Talks only to the control API. Values are never displayed here — only token IDs and masks (ADR-0001).