Label has been fixed for a while now, but perhaps categories should default to "Defaults (all gray)".

Think of it as a tree. Catalogues default to permissions based on set privileges, which is fine. But categories are branches of the catalogue. Therefore, categories should default to "Defaults" / inherit from the catalogue, but currently they also take from submission privileges by default.

We should also check to make sure that, should a catalogue's permissions get changed later, that the categories set to Defaults match the new permissions.

That's not how it works under-the-hood in Composr. Categories don't inherit permissions from Catalogues. Instead, it's a series of successive checks that need to pass. I think of it like barriers. It's a subtle distinction, and you could even argue a distinction without a difference in this case, but to try and make the UI hide how the system is actually working could be a big can of worms. I'd also advise not trying to mask over the subtle distinction as it becomes important to understand in other cases, like view permissions of pages vs zones. Composr isn't really a hierarchical system outside of category trees, it's a modular system.

So if I'm understanding correctly, a permission / privilege is checked for itself (the category) and its parent (the catalogue), and if either is denied (even if the other is accepted) then the whole thing is denied. E.g. all of the checks must pass to have that permission or privilege.

Is this correct?

Yes

Got it. Then I'm guessing there's no benefit to matching a category's permission with the catalogue's then. E.g. it is redundant.

Our current implementation us not intuitive to many people, so I wouldn't say there's no way to improve it. But it'd have to be explained in the UI rather than just shown as inherited. Or we'd have to gut the system and change it to pure inheritance, which probably would lose something in the process. Either way, lots more work than just tweaking an interface.