diff --git a/src/components/agents/config/ConfigFlagsSummary.vue b/src/components/agents/config/ConfigFlagsSummary.vue
new file mode 100644
index 00000000..c3d3773e
--- /dev/null
+++ b/src/components/agents/config/ConfigFlagsSummary.vue
@@ -0,0 +1,83 @@
+<template>
+  <section
+    class="rounded-md border border-ccf-300 p-4 dark:border-slate-700"
+    data-test="flags-summary"
+  >
+    <h4 class="mb-3 text-sm font-semibold text-gray-900 dark:text-slate-200">
+      Flags
+    </h4>
+    <div class="grid grid-cols-1 gap-2 text-sm md:grid-cols-2">
+      <EditableField
+        v-for="row in rows"
+        :key="row.ptr"
+        :ptr="row.ptr"
+        :label="row.label"
+        :kind="row.kind"
+      >
+        <template #label
+          ><span class="text-gray-500 dark:text-slate-400">{{
+            row.label
+          }}</span></template
+        >
+        <span class="text-gray-900 dark:text-slate-200">{{ row.value }}</span>
+        <ProvenanceBadge
+          v-if="row.provenance !== 'file'"
+          :provenance="row.provenance"
+        />
+      </EditableField>
+    </div>
+  </section>
+</template>
+
+<script setup lang="ts">
+// Agent-wide flags on the Effective view; each is editable inline (R69).
+import { computed } from 'vue';
+import type { ConfigDoc, OverlayDoc } from '@/types/agent-config';
+import { provenanceOf } from '@/utils/agent-config/provenance';
+import { getAt } from '@/utils/agent-config/json-pointer';
+import ProvenanceBadge from './ProvenanceBadge.vue';
+import EditableField from './effective/EditableField.vue';
+import type { ScalarKind } from './effective/scalar';
+import { verbosityLabel } from './constants';
+
+const props = defineProps<{
+  effective: ConfigDoc | null;
+  base: ConfigDoc | null;
+  overlay: OverlayDoc | null;
+}>();
+
+const rows = computed(() => {
+  const eff = props.effective ?? {};
+  const show = (v: unknown) =>
+    v === undefined || v === null ? '—' : String(v);
+  const defs: {
+    ptr: string;
+    label: string;
+    kind: ScalarKind;
+    format?: (v: unknown) => string;
+  }[] = [
+    {
+      ptr: '/verbosity',
+      label: 'Verbosity',
+      kind: 'verbosity',
+      format: verbosityLabel,
+    },
+    { ptr: '/agent_evidence/enabled', label: 'Agent evidence', kind: 'bool' },
+    {
+      ptr: '/agent_evidence/emit_on_run_completion',
+      label: 'Emit on run completion',
+      kind: 'bool',
+    },
+    {
+      ptr: '/agent_evidence/interval',
+      label: 'Evidence interval',
+      kind: 'duration',
+    },
+  ];
+  return defs.map((d) => ({
+    ...d,
+    value: (d.format ?? show)(getAt(eff, d.ptr)),
+    provenance: provenanceOf(d.ptr, props.base ?? {}, props.overlay ?? {}),
+  }));
+});
+</script>
diff --git a/src/components/agents/config/effective/AccessIcon.vue b/src/components/agents/config/effective/AccessIcon.vue
new file mode 100644
index 00000000..065347fb
--- /dev/null
+++ b/src/components/agents/config/effective/AccessIcon.vue
@@ -0,0 +1,44 @@
+<template>
+  <i
+    v-if="icon"
+    v-tooltip.top="text"
+    role="img"
+    tabindex="0"
+    class="pi text-xs"
+    :class="icon"
+    :aria-label="text"
+    :data-test="testId ?? `field-${state}`"
+  />
+</template>
+
+<script setup lang="ts">
+// The R71 access hint next to a field (utils/agent-config/field-access.ts): a shield where only
+// some reporting instances would apply a change, an info icon where none would, a lock for a
+// locked key. With `blocked`, "none would" is a red ban instead (a plugin no instance would
+// install). Nothing is shown for an editable field.
+import { computed } from 'vue';
+import type { FieldState } from '@/utils/agent-config/field-access';
+
+const props = defineProps<{
+  state: FieldState | null | undefined;
+  /** Tooltip and accessible name. */
+  text: string;
+  /** Defaults to `field-<state>`. */
+  testId?: string;
+  blocked?: boolean;
+}>();
+
+const ICONS: Partial<Record<FieldState, string>> = {
+  restricted: 'pi-shield text-amber-600 dark:text-amber-400',
+  readonly: 'pi-info-circle text-gray-400 dark:text-slate-500',
+  forbidden: 'pi-lock text-gray-400 dark:text-slate-500',
+};
+
+const icon = computed(() => {
+  if (!props.state) return '';
+  if (props.state === 'readonly' && props.blocked) {
+    return 'pi-ban text-red-600 dark:text-red-400';
+  }
+  return ICONS[props.state] ?? '';
+});
+</script>
diff --git a/src/components/agents/config/effective/EditableField.vue b/src/components/agents/config/effective/EditableField.vue
new file mode 100644
index 00000000..c3179cd9
--- /dev/null
+++ b/src/components/agents/config/effective/EditableField.vue
@@ -0,0 +1,135 @@
+<template>
+  <div
+    class="min-w-0"
+    :data-test="`field-${ptr}`"
+    :data-state="access.state"
+    :data-pending="pending ? 'true' : undefined"
+  >
+    <div class="flex flex-wrap items-center gap-2">
+      <slot name="label" />
+      <span
+        class="min-w-0"
+        :class="{
+          'text-gray-400 dark:text-slate-500': access.state === 'forbidden',
+        }"
+      >
+        <slot />
+      </span>
+      <AccessIcon
+        v-if="access.state === 'forbidden' || showAccess"
+        :state="access.state"
+        :text="access.state === 'forbidden' ? FORBIDDEN_TOOLTIP : accessText"
+      />
+      <button
+        v-if="editable"
+        type="button"
+        class="rounded p-0.5 text-gray-500 hover:bg-slate-200 hover:text-sky-700 dark:text-slate-400 dark:hover:bg-slate-700 dark:hover:text-sky-300"
+        :aria-label="`Edit ${label}`"
+        :aria-expanded="open"
+        :data-test="`edit-${ptr}`"
+        @click="open = !open"
+      >
+        <i class="pi pi-pencil text-xs" />
+      </button>
+      <PendingPill
+        v-if="pending"
+        :text="pendingText"
+        :undo-label="`Undo the pending change to ${label}`"
+        :test-id="`pending-${ptr}`"
+        :undo-test-id="`undo-${ptr}`"
+        @undo="ws!.draft.revertPointer(ptr)"
+      />
+    </div>
+    <div
+      v-if="open && editable"
+      class="mt-2 rounded-md border border-sky-200 bg-white p-3 dark:border-sky-800 dark:bg-slate-900"
+      :data-test="`editor-${ptr}`"
+    >
+      <InlineScalarEditor
+        v-if="kind !== 'custom'"
+        :ptr="ptr"
+        :kind="kind"
+        :label="label"
+        :removable="removable"
+        @done="open = false"
+      />
+      <template v-else>
+        <slot name="editor" :done="() => (open = false)" />
+        <div class="mt-2 flex justify-end">
+          <SecondaryButton
+            size="small"
+            :data-test="`done-${ptr}`"
+            @click="open = false"
+            >Done</SecondaryButton
+          >
+        </div>
+      </template>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+// One field of the Effective view with its R71 state and, when the workspace is provided and
+// the user may edit it, an inline editor that writes to the shared pending-changes draft
+// (R69). States (utils/agent-config/field-access.ts), over the reporting instances:
+//   editable   — every instance would apply a change: pencil only;
+//   restricted — some would not: pencil + shield naming them and why;
+//   readonly   — none would: no pencil, an info icon explains why;
+//   forbidden  — locked keys: lock icon, never editable.
+// Without agent:configure every field is read-only and the access hints are hidden (they
+// describe what an edit would do).
+import { computed, ref } from 'vue';
+import SecondaryButton from '@/volt/SecondaryButton.vue';
+import { useWorkspace } from '@/composables/agent-config/useConfigWorkspace';
+import {
+  FORBIDDEN_TOOLTIP,
+  accessTooltip,
+  fieldAccess,
+} from '@/utils/agent-config/field-access';
+import { getAt } from '@/utils/agent-config/json-pointer';
+import AccessIcon from './AccessIcon.vue';
+import InlineScalarEditor from './InlineScalarEditor.vue';
+import PendingPill from './PendingPill.vue';
+import type { ScalarKind } from './scalar';
+
+const props = withDefaults(
+  defineProps<{
+    ptr: string;
+    label: string;
+    kind?: ScalarKind | 'custom';
+    /** Offer "Remove" (config keys): makeAbsent instead of only "file value". */
+    removable?: boolean;
+    /** Show the pending value next to the pill (scalars). */
+    showPendingValue?: boolean;
+  }>(),
+  { kind: 'text', removable: false, showPendingValue: true },
+);
+
+const ws = useWorkspace();
+const open = ref(false);
+
+// Read-only contexts (no workspace) only know the locked keys.
+const access = computed(() =>
+  ws ? ws.accessAt(props.ptr) : fieldAccess(props.ptr, []),
+);
+const accessText = computed(() => accessTooltip(access.value));
+/** Shields / read-only hints are for users who may edit (agent:configure). */
+const showAccess = computed(
+  () => !!ws && ws.ready.value && ws.canConfigure.value,
+);
+const editable = computed(
+  () => !!ws && ws.ready.value && ws.canEditPointer(props.ptr),
+);
+const pending = computed(() => !!ws && ws.draft.pendingAt(props.ptr));
+
+const pendingText = computed(() => {
+  if (!ws || !pending.value || !props.showPendingValue) return '';
+  const v = getAt(ws.draft.effectiveDraft.value, props.ptr);
+  if (v === undefined || v === null) return 'removed / default';
+  if (typeof v === 'string') return v.length > 40 ? `${v.slice(0, 40)}…` : v;
+  if (typeof v === 'object') return '';
+  return String(v);
+});
+
+defineExpose({ open });
+</script>
diff --git a/src/components/agents/config/effective/InlineScalarEditor.vue b/src/components/agents/config/effective/InlineScalarEditor.vue
new file mode 100644
index 00000000..63a85bd8
--- /dev/null
+++ b/src/components/agents/config/effective/InlineScalarEditor.vue
@@ -0,0 +1,250 @@
+<template>
+  <form
+    class="flex flex-wrap items-start gap-2"
+    :data-test="`scalar-editor-${ptr}`"
+    @submit.prevent="apply"
+    @keydown.esc.prevent="$emit('done')"
+  >
+    <div class="min-w-48 flex-1">
+      <Select
+        v-if="isSelect"
+        v-model="choice"
+        :options="options"
+        option-label="label"
+        option-value="value"
+        size="small"
+        class="w-full"
+        :aria-label="label"
+        data-test="scalar-select"
+      />
+      <InputText
+        v-else
+        v-model="text"
+        size="small"
+        class="w-full font-mono"
+        :placeholder="placeholder"
+        :aria-label="label"
+        data-test="scalar-input"
+      />
+      <p
+        v-if="hint && !error"
+        class="mt-1 text-xs text-gray-500 dark:text-slate-400"
+        data-test="scalar-hint"
+      >
+        {{ hint }}
+      </p>
+      <p
+        v-if="error"
+        class="mt-1 text-xs text-red-600 dark:text-red-400"
+        data-test="scalar-error"
+      >
+        {{ error }}
+      </p>
+    </div>
+    <div class="flex flex-wrap gap-2">
+      <PrimaryButton
+        size="small"
+        type="submit"
+        :disabled="!!error"
+        data-test="scalar-apply"
+        >Apply</PrimaryButton
+      >
+      <SecondaryButton
+        v-if="!isSelect && inOverlay"
+        size="small"
+        type="button"
+        data-test="scalar-file-value"
+        @click="fileValue"
+        >Use file value</SecondaryButton
+      >
+      <SecondaryButton
+        v-if="kind === 'cron'"
+        size="small"
+        type="button"
+        data-test="scalar-agent-default"
+        @click="agentDefault"
+        >Agent default (every minute)</SecondaryButton
+      >
+      <SecondaryButton
+        v-if="removable"
+        size="small"
+        type="button"
+        data-test="scalar-remove"
+        @click="removeKey"
+        >Remove</SecondaryButton
+      >
+      <TertiaryButton
+        size="small"
+        type="button"
+        data-test="scalar-cancel"
+        @click="$emit('done')"
+        >Cancel</TertiaryButton
+      >
+    </div>
+  </form>
+</template>
+
+<script setup lang="ts">
+// Small inline editor for one scalar field (R69). It edits a local value; Apply writes it to
+// the pending-changes draft. R56 everywhere: "file value" omits the key, "agent default"
+// (schedule) and protocol "Auto" write null.
+import { computed, ref } from 'vue';
+import InputText from '@/volt/InputText.vue';
+import PrimaryButton from '@/volt/PrimaryButton.vue';
+import SecondaryButton from '@/volt/SecondaryButton.vue';
+import Select from '@/volt/Select.vue';
+import TertiaryButton from '@/volt/TertiaryButton.vue';
+import { REDACTED_MASK } from '@/types/agent-config';
+import { useWorkspace } from '@/composables/agent-config/useConfigWorkspace';
+import { getAt, hasAt } from '@/utils/agent-config/json-pointer';
+import {
+  describeCron5,
+  GO_DURATION_RE,
+  validateCron5,
+} from '@/utils/agent-config/cron5';
+import { VERBOSITY_OPTIONS } from '../constants';
+import { definedInAnyBase, setStringKey } from './emptyValue';
+import type { ScalarKind } from './scalar';
+
+const props = defineProps<{
+  ptr: string;
+  kind: ScalarKind;
+  label: string;
+  removable?: boolean;
+}>();
+const emit = defineEmits<{ done: [] }>();
+
+const ws = useWorkspace()!;
+const draft = ws.draft;
+
+const inOverlay = computed(() => hasAt(draft.overlay.value, props.ptr));
+const overlayValue = getAt(draft.overlay.value, props.ptr);
+const effectiveValue = getAt(draft.effectiveDraft.value, props.ptr);
+const baseValue = getAt(ws.placeholderBase.value ?? {}, props.ptr);
+const bases = [ws.placeholderBase.value, ...ws.bases.value];
+/** Some instance's file defines this key: emptying it inherits the file value. */
+const inAnyBase = definedInAnyBase(bases, props.ptr);
+
+// ---- text kinds ----
+function initialText(): string {
+  const v = typeof overlayValue === 'string' ? overlayValue : effectiveValue;
+  // Never start from a masked report value (R25): the user types a new one.
+  return typeof v === 'string' && v !== REDACTED_MASK ? v : '';
+}
+const text = ref(initialText());
+const placeholder = computed(() => {
+  if (effectiveValue === REDACTED_MASK) return 'masked; type a new value';
+  if (props.kind === 'cron') return '* * * * *';
+  if (props.kind === 'duration') return 'e.g. 5m';
+  return typeof baseValue === 'string' ? baseValue : '';
+});
+
+// ---- select kinds ----
+type Choice = string | number | boolean;
+const FILE = '__file__';
+const AUTO = '__auto__';
+const options = computed<{ label: string; value: Choice }[]>(() => {
+  switch (props.kind) {
+    case 'bool':
+      return [
+        { label: 'Yes', value: true },
+        { label: 'No', value: false },
+        { label: 'File value', value: FILE },
+      ];
+    case 'verbosity':
+      return [
+        ...VERBOSITY_OPTIONS.map((o) => ({ label: o.label, value: o.value })),
+        { label: 'File value', value: FILE },
+      ];
+    case 'protocol':
+      return [
+        { label: 'File value', value: FILE },
+        { label: 'Auto', value: AUTO },
+        { label: '1', value: 1 },
+        { label: '2', value: 2 },
+      ];
+    default:
+      return [];
+  }
+});
+const isSelect = computed(() => options.value.length > 0);
+function initialChoice(): Choice {
+  if (!hasAt(draft.overlay.value, props.ptr)) {
+    // A boolean shows its effective value so a click on Apply is meaningful.
+    if (props.kind === 'bool' && typeof effectiveValue === 'boolean')
+      return effectiveValue;
+    return FILE;
+  }
+  if (overlayValue === null) return props.kind === 'protocol' ? AUTO : FILE;
+  return overlayValue as Choice;
+}
+const startChoice = initialChoice();
+const choice = ref<Choice>(startChoice);
+const startText = text.value;
+
+const error = computed(() => {
+  if (isSelect.value) return '';
+  const v = text.value.trim();
+  if (v === REDACTED_MASK)
+    return 'This is the masked report value; type the real value or use ${env:NAME}';
+  if (!v) return '';
+  if (props.kind === 'cron') {
+    const e = validateCron5(v);
+    return e ? `Invalid schedule: ${e}` : '';
+  }
+  if (props.kind === 'duration') {
+    if (!GO_DURATION_RE.test(v))
+      return 'Use a Go duration such as 30s, 5m or 1h';
+    if (v.startsWith('-')) return 'The interval must not be negative';
+  }
+  return '';
+});
+const hint = computed(() => {
+  if (props.kind === 'cron' && text.value.trim())
+    return describeCron5(text.value.trim());
+  if (!isSelect.value && !text.value.trim())
+    return props.kind === 'text' && props.removable && !inAnyBase
+      ? 'Empty: an empty string. Use "Remove" to delete the key.'
+      : 'Empty: the file value applies.';
+  return '';
+});
+
+function apply() {
+  if (error.value) return;
+  // An untouched field the overlay does not set: nothing to change (do not pin the file
+  // value into the overlay).
+  const untouched = isSelect.value
+    ? choice.value === startChoice
+    : text.value === startText;
+  if (untouched && !inOverlay.value) {
+    emit('done');
+    return;
+  }
+  if (isSelect.value) {
+    if (choice.value === FILE) draft.unset(props.ptr);
+    else if (choice.value === AUTO) draft.remove(props.ptr);
+    else draft.set(props.ptr, choice.value);
+  } else {
+    const v = props.kind === 'text' ? text.value : text.value.trim();
+    // A config / label key (removable) follows the map editor's rule (emptyValue.ts): empty
+    // unsets a key a file defines and keeps "" for an overlay-only key. Other fields: empty
+    // always means the file value.
+    if (props.removable) setStringKey(draft, bases, props.ptr, v);
+    else if (!v) draft.unset(props.ptr);
+    else draft.set(props.ptr, v);
+  }
+  emit('done');
+}
+function fileValue() {
+  draft.unset(props.ptr);
+  emit('done');
+}
+function agentDefault() {
+  draft.remove(props.ptr);
+  emit('done');
+}
+function removeKey() {
+  draft.makeAbsent(props.ptr);
+  emit('done');
+}
+</script>
diff --git a/src/components/agents/config/effective/MapFieldEditor.vue b/src/components/agents/config/effective/MapFieldEditor.vue
new file mode 100644
index 00000000..482c5480
--- /dev/null
+++ b/src/components/agents/config/effective/MapFieldEditor.vue
@@ -0,0 +1,83 @@
+<template>
+  <KeyValueEditor
+    :label="field"
+    :rows="rows"
+    :warn-keys="field === 'config'"
+    :test-id="`${field}-${plugin}`"
+    @set="setValue"
+    @add="(k, v) => draft.set(p(k), v)"
+    @reset="(k) => draft.unset(p(k))"
+    @delete="(k) => draft.makeAbsent(p(k))"
+  />
+  <FieldIssues v-for="r in rows" :key="r.key" :ptr="p(r.key)" />
+</template>
+
+<script setup lang="ts">
+// Inline editor of a plugin's `config` or `labels` map (R69): add, change, reset to the file
+// value or remove keys. Values are strings (R27). Each row carries its R71 access: a key no
+// reporting instance would apply (e.g. no overridable_config_flags entry anywhere) is
+// read-only with a lock, one only some would apply gets a shield.
+import { computed } from 'vue';
+import { pointer } from '@/utils/agent-config/json-pointer';
+import { isPlainObject } from '@/utils/agent-config/merge-patch';
+import { provenanceOf } from '@/utils/agent-config/provenance';
+import { REDACTED_MASK } from '@/types/agent-config';
+import { accessTooltip } from '@/utils/agent-config/field-access';
+import KeyValueEditor, { type KeyValueRow } from '../editor/KeyValueEditor.vue';
+import FieldIssues from '../editor/FieldIssues.vue';
+import { useEditor } from '../editor/useEditor';
+import { setStringKey } from './emptyValue';
+
+const props = defineProps<{ plugin: string; field: 'config' | 'labels' }>();
+
+const { draft, ctx, baseValue, overlayValue, access, shield } = useEditor();
+
+function p(key?: string): string {
+  return key === undefined
+    ? pointer('plugins', props.plugin, props.field)
+    : pointer('plugins', props.plugin, props.field, key);
+}
+
+const rows = computed<KeyValueRow[]>(() => {
+  const base = baseValue(p());
+  const ov = overlayValue(p());
+  const keys = new Set<string>([
+    ...Object.keys(isPlainObject(base) ? base : {}),
+    ...Object.keys(isPlainObject(ov) ? ov : {}),
+  ]);
+  return Array.from(keys)
+    .sort()
+    .map((k) => {
+      const ptr = p(k);
+      const bv = isPlainObject(base) ? base[k] : undefined;
+      const oVal = isPlainObject(ov) ? ov[k] : undefined;
+      const acc = access(ptr);
+      const locked = acc.state === 'readonly';
+      return {
+        key: k,
+        value: typeof oVal === 'string' ? oVal : '',
+        placeholder:
+          bv === REDACTED_MASK
+            ? 'masked; type a new value'
+            : typeof bv === 'string'
+              ? bv
+              : '',
+        provenance: provenanceOf(
+          ptr,
+          ctx.placeholderBase.value ?? {},
+          draft.overlay.value,
+        ),
+        removed: isPlainObject(ov) && oVal === null,
+        locked,
+        lockTooltip: locked ? accessTooltip(acc) : undefined,
+        restricted: acc.state === 'restricted' ? accessTooltip(acc) : undefined,
+        shield: shield(ptr),
+      };
+    });
+});
+
+/** An emptied value: the file value again when a file defines the key (emptyValue.ts). */
+function setValue(k: string, v: string) {
+  setStringKey(draft, [ctx.placeholderBase.value, ...ctx.bases.value], p(k), v);
+}
+</script>
diff --git a/src/components/agents/config/effective/PendingPill.vue b/src/components/agents/config/effective/PendingPill.vue
new file mode 100644
index 00000000..16d16d47
--- /dev/null
+++ b/src/components/agents/config/effective/PendingPill.vue
@@ -0,0 +1,33 @@
+<template>
+  <span
+    class="inline-flex items-center gap-1 rounded-full bg-sky-100 px-2 text-sky-800 dark:bg-sky-500/15 dark:text-sky-200"
+    :class="compact ? 'text-[0.7rem]' : 'py-0.5 text-xs'"
+    :data-test="testId"
+  >
+    pending<template v-if="text">: {{ text }}</template>
+    <button
+      type="button"
+      class="ml-0.5"
+      :aria-label="undoLabel"
+      :data-test="undoTestId"
+      @click="$emit('undo')"
+    >
+      ↺
+    </button>
+  </span>
+</template>
+
+<script setup lang="ts">
+// The "pending" pill of a field with a pending change in the draft, and its ↺ undo button.
+defineProps<{
+  /** Accessible name of the undo button, e.g. "Undo the pending change to schedule". */
+  undoLabel: string;
+  /** The pending value, shown after "pending:". */
+  text?: string;
+  testId: string;
+  undoTestId: string;
+  /** Smaller, for policy_data tree rows. */
+  compact?: boolean;
+}>();
+defineEmits<{ undo: [] }>();
+</script>
diff --git a/src/components/agents/config/effective/__tests__/emptyValue.spec.ts b/src/components/agents/config/effective/__tests__/emptyValue.spec.ts
new file mode 100644
index 00000000..49a440f9
--- /dev/null
+++ b/src/components/agents/config/effective/__tests__/emptyValue.spec.ts
@@ -0,0 +1,34 @@
+import { describe, expect, it, vi } from 'vitest';
+import type { ConfigDoc } from '@/types/agent-config';
+import { definedInAnyBase, setStringKey } from '../emptyValue';
+
+const PTR = '/plugins/p/config/k';
+const withKey = { plugins: { p: { config: { k: 'file' } } } } as ConfigDoc;
+const without = { plugins: { p: { config: {} } } } as ConfigDoc;
+
+function fakeDraft() {
+  return { set: vi.fn(), unset: vi.fn() };
+}
+
+describe('emptied string keys', () => {
+  it('knows whether any base defines the key', () => {
+    expect(definedInAnyBase([null, without, withKey], PTR)).toBe(true);
+    expect(definedInAnyBase([null, without], PTR)).toBe(false);
+  });
+
+  it('empty unsets a key some file defines', () => {
+    const d = fakeDraft();
+    setStringKey(d, [without, withKey], PTR, '');
+    expect(d.unset).toHaveBeenCalledWith(PTR);
+    expect(d.set).not.toHaveBeenCalled();
+  });
+
+  it('empty keeps "" for an overlay-only key; a value is always set', () => {
+    const d = fakeDraft();
+    setStringKey(d, [without], PTR, '');
+    expect(d.set).toHaveBeenCalledWith(PTR, '');
+    setStringKey(d, [withKey], PTR, 'v');
+    expect(d.set).toHaveBeenCalledWith(PTR, 'v');
+    expect(d.unset).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/components/agents/config/effective/emptyValue.ts b/src/components/agents/config/effective/emptyValue.ts
new file mode 100644
index 00000000..90942d4c
--- /dev/null
+++ b/src/components/agents/config/effective/emptyValue.ts
@@ -0,0 +1,26 @@
+// The "emptied value" rule shared by the inline editors of string map keys (plugin config
+// and labels): emptying a key that any instance's file defines inherits the file value again
+// (the overlay drops the key); a key only the overlay adds keeps an empty string (its Remove /
+// delete action removes it).
+import type { OverlayDraft } from '@/composables/agent-config/useOverlayDraft';
+import type { ConfigDoc } from '@/types/agent-config';
+import { hasAt } from '@/utils/agent-config/json-pointer';
+
+/** Whether any of `bases` (the instances' files) defines a value at `ptr`. */
+export function definedInAnyBase(
+  bases: readonly (ConfigDoc | null | undefined)[],
+  ptr: string,
+): boolean {
+  return bases.some((b) => !!b && hasAt(b, ptr));
+}
+
+/** Writes `value` at `ptr`, applying the empty-value rule above. */
+export function setStringKey(
+  draft: Pick<OverlayDraft, 'set' | 'unset'>,
+  bases: readonly (ConfigDoc | null | undefined)[],
+  ptr: string,
+  value: string,
+): void {
+  if (!value && definedInAnyBase(bases, ptr)) draft.unset(ptr);
+  else draft.set(ptr, value);
+}
diff --git a/src/components/agents/config/effective/nullKeys.ts b/src/components/agents/config/effective/nullKeys.ts
new file mode 100644
index 00000000..42b9a8b0
--- /dev/null
+++ b/src/components/agents/config/effective/nullKeys.ts
@@ -0,0 +1,27 @@
+// policy_data is stored as an RFC 7396 merge patch, where `null` at an object key means
+// "delete the key": a null value can't be stored for a key. Items of an array may be null (an
+// array is written whole).
+import { isPlainObject } from '@/utils/agent-config/merge-patch';
+import type { PatchOp } from '@/utils/agent-config/policy-data-patch';
+
+export const NULL_KEY_ERROR =
+  "null can't be stored for a key (it means delete in an overlay)";
+
+/** The dotted path of the first object key holding null in `v` (outside arrays), or null. */
+export function nullKeyPath(v: unknown, path: string[] = []): string | null {
+  if (!isPlainObject(v)) return null;
+  for (const [k, child] of Object.entries(v)) {
+    if (child === null) return [...path, k].join('.');
+    const found = nullKeyPath(child, [...path, k]);
+    if (found !== null) return found;
+  }
+  return null;
+}
+
+/** Whether `ops` (key-level edits) would write null for some key. */
+export function opsSetNullKey(ops: readonly PatchOp[]): boolean {
+  return ops.some(
+    (o) =>
+      o.op === 'set' && (o.value === null || nullKeyPath(o.value) !== null),
+  );
+}
diff --git a/src/components/agents/config/effective/scalar.ts b/src/components/agents/config/effective/scalar.ts
new file mode 100644
index 00000000..03a3fd1d
--- /dev/null
+++ b/src/components/agents/config/effective/scalar.ts
@@ -0,0 +1,8 @@
+// Kinds of inline scalar editors on the Effective view (R69).
+export type ScalarKind =
+  | 'text'
+  | 'cron'
+  | 'duration'
+  | 'bool'
+  | 'verbosity'
+  | 'protocol';