Deep Dive rewrite: align every page to the current architecture

STYLE.md

@@ -63,8 +63,7 @@ One name per thing, used consistently. Canonical names:
 |---|---|
 | CoFHE | The coprocessor as a whole. Not COFHE, not Cofhe. |
 | Teecryptor | The TEE decryption service. Capitalized as a product name. |
-| FHE Engine | The service that executes FHE operations. |
-| FheOS Server | The service that verifies and queues incoming work. It does not execute FHE operations. |
+| FHE Engine | The offchain pipeline that subscribes to task events, executes FHE operations, and posts commitments. One name for the whole pipeline; its internal stages are not named in public docs. |
 | ZK Verifier | The input proof verification service. |
 | TaskManager, CommitmentRegistry, ACL | Contract names, written as in the source. |
 | ACP | Access Control Permission. Replaces "Permit" from `0.7` onward, so that it is not confused with an ERC-2612 permit. Spell it out before the acronym: a page whose subject is ACPs carries the full term in its `title`, and every other page expands it on first use. Never write "ACP permission". |
@@ -100,6 +99,7 @@ Do not use internal names in public docs: no hostnames, no GCP project names, no
 
 - Internal links use root-relative paths: `/fhe-library/core-concepts/access-control`, not `../core-concepts/access-control` and not the full `https://cofhe-docs.fhenix.zone/...` URL. Relative paths break when a page moves; absolute URLs break preview deployments.
 - Link text describes the destination. "See [access control](/fhe-library/core-concepts/access-control)", never `"click [here](/...)"` or a bare URL.
+- Never link to a private repository; readers get a 404. Of the FhenixProtocol repos, only `cofhe-contracts` and `cofhesdk` are public. Name a component or path in prose instead, and add the link when the repo goes public.
 - Every image is wrapped in `<Frame>` and carries alt text that says what the image shows, not what it is called. "Sealed output flowing from the FHE Engine to the client", not "diagram".
 - Pick the component that matches the content, and use each one for one job:
 
@@ -119,6 +119,8 @@ Do not use internal names in public docs: no hostnames, no GCP project names, no
 
 A page full of callouts has none.
 
+- Long code identifiers in narrow table columns get chopped mid-word by the table layout. Keep the first column to bare names (no argument lists) and guard each one with `<code style={{ whiteSpace: "nowrap" }}>name</code>`. Full signatures belong in prose above the table or in the description column.
+
 ## Code samples
 
 - Every sample must compile or run against the currently published versions. If it would not run when pasted, it does not ship.

deep-dive/cofhe-components/acl.mdx

@@ -1,11 +1,48 @@
 ---
 title: ACL (Access Control Layer)
-description: "On-chain contract that manages and enforces access control for ciphertexts, ensuring only authorized contracts can reference or decrypt them"
+description: "Onchain contract that manages and enforces access control for ciphertexts, ensuring only authorized contracts and accounts can reference or decrypt them"
 ---
 
 | Aspect | Description |
 |--------|-------------|
-| **Type** | Contract deployed on the destination blockchain |
-| **Function** | Manages and enforces access control for ciphertexts, ensuring only authorized contracts can reference or decrypt them. |
-| **Responsibilities** | An internal contract that is responsible for managing and verifying access for each and every ciphertext. |
+| **Type** | Contract deployed on the host chain, UUPS-upgradeable behind a proxy. |
+| **Function** | Manages and enforces access control for ciphertexts, for both contracts and user accounts. |
+| **Responsibilities** | • Records who may use each handle in FHE operations. <br/>• Records which handles may be decrypted, and by whom. <br/>• Answers the access queries of the [TaskManager](/deep-dive/cofhe-components/task-manager) and the decryption service. |
 
+Every encrypted value in CoFHE is guarded by this contract. A handle is useless to anyone the ACL does not list. The TaskManager rejects operations on inputs the caller cannot access, and [Teecryptor](/deep-dive/cofhe-components/teecryptor) refuses to decrypt handles without a matching grant.
+
+## Grant tiers
+
+| Tier | Granted by | Scope |
+|------|------------|-------|
+| **Transient** | `FHE.allowTransient` | Current transaction only. Stored with EIP-1153 transient storage, so it costs no persistent state. |
+| **Persistent** | `FHE.allow(handle, account)` | A specific account (contract or EOA), permanently. |
+| **Global** | `FHE.allowGlobal` (alias `FHE.allowPublic`) | Every account. Also marks the handle publicly decryptable. |
+| **Decryption** | `TaskManager.allowForDecryption` | Adds the handle to the decryption allowlist and emits `AllowedForDecryption`. |
+
+## Writes go through the TaskManager
+
+All state-mutating entry points require `msg.sender` to be the TaskManager; direct calls revert with `DirectAllowForbidden`. Contracts grant access through the `FHE.sol` helpers (`allow`, `allowThis`, `allowSender`, `allowGlobal`, `allowTransient`), which route through the TaskManager.
+
+## Permits
+
+Offchain reads are authorized by a [permit](/client-sdk/guides/permits), which onchain is an `ACP` (Access Control Permission): an EIP-712 body signed by its issuer. Beyond the issuer, expiration, and the sealing key used for sealed outputs, an ACP carries a **scope**: global, limited to specific contracts, or limited to specific handles. A scope only narrows what the issuer could already access; it never grants more.
+
+An ACP can be shared with a recipient, revoked through a revoker contract, and handed over onchain through the ACP share registry.
+
+## Read surface
+
+| Function | Answers |
+|----------|---------|
+| `isAllowed(handle, account)` | May this account use the handle? (any tier) |
+| `allowedTransient(handle, account)` | Is there a transient grant in this transaction? |
+| `persistAllowed(handle, account)` | Is there a persistent grant? |
+| `globalAllowed(handle)` | Is the handle globally allowed? |
+| `isAllowedForDecryption(handle)` | Is the handle on the decryption allowlist? |
+| <code style={{ whiteSpace: "nowrap" }}>isAllowedWithPermission</code> | Does this permit (ACP) authorize its issuer for the given handle? |
+
+The last two are what the decryption path runs on. For every `decrypt` or `sealoutput` request, Teecryptor queries the ACL through the TaskManager: `isAllowedWithPermission` when a permit is attached, or `isPubliclyAllowed` (the TaskManager's wrapper over `globalAllowed`) when none is. A future [Threshold Network](/deep-dive/research/future-plans) will consume the same interface.
+
+## Upgrades
+
+The contract is UUPS-upgradeable behind a proxy, and storage uses ERC-7201 namespaced slots for upgrade safety.