A window is
a capability
The agentic userlayer. Everything a human or AI agent touches is a cap-confined surface over verified state. Progressive enhancement becomes progressive attenuation.
A surface is authority, not a session
In a normal desktop, what an app may do is decided by ambient grants — a cookie, a logged-in session, trust-the-process. On the surface the window is the authority: a typed bundle of cap-gated affordances. An agent sees exactly the affordances its held capabilities authorize; an unauthorized action is refused in-band by the required ⊆ held gate.
A window is a Cap{ Surface(cell), rights }. Hand it to an agent and you've handed it a budget it cannot exceed. Revoke the capability and the window goes dark — no callback, no cleanup race.
Surfaces are hypertext-driven. Each affordance names the turn it invokes and the capability it needs. The renderer shows only what your token authorizes — the cheat is unrepresentable, not merely blocked.
A screenshot embeds a sturdyref behind a membrane. Reopen it and it re-attaches a per-viewer, attenuated live surface. Two people open "the same" image and rehydrate two different, confined views.
Fog of war: you provably cannot peek
The sharpest exemplar makes a game mechanic into a security property. Fog of war is the membrane's per-viewer projection. To see a side's tiles you must hold the capability; a player holding only its own secret cannot construct the enemy's vision.
The desktop adds no trust
Everything above reduces to cells, turns and receipts. The surface is a rendering of capability-gated affordances over the kernel — it introduces no new privileged path. If the kernel refuses a turn, the surface cannot smuggle it through, because the surface has no authority the kernel does not grant it.