diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aaee75c..914fbe2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -66,19 +66,78 @@ jobs:
           echo "OK: $bundle is a single bundle with no dynamic import()"
 
       # `@openvtc/pnm-core/admin` is operator surface — granting authority at an
-      # agent, revoking it, destroying contexts. A wallet has no business
-      # shipping any of it, and the way it would arrive is someone importing it
-      # from the package root instead of the subpath. The task URIs are the
-      # tell: they only appear in a bundle that pulled the module in.
-      - name: Assert the wallet ships no agent-administration surface
+      # agent, revoking it, destroying contexts. The task URIs are the tell:
+      # they only appear in a bundle that pulled the module in.
+      #
+      # The management console (`manager.html`) administers the agent, so it
+      # imports the module deliberately. Every *wallet* surface — the service
+      # worker, the content and page-world scripts, the popup, the confirm
+      # window, the offscreen document, the options page — still must not, and
+      # the way it would arrive is someone importing from the package root
+      # instead of the subpath, or Rollup hoisting a shared chunk.
+      #
+      # Hence: banned everywhere in dist/ **except** `manager.js`. Phrased as an
+      # exclusion rather than a list of permitted files so it keeps holding as
+      # entries are added. `vite.config.manager.ts` builds the console alone
+      # with `codeSplitting: false`, which is what makes "exactly one file may
+      # contain this" a structural property rather than a convention.
+      - name: Assert agent-administration surface is confined to the console
         run: |
           for task in 'acl/grant/0.1' 'acl/revoke/0.1' 'acl/update/0.1' 'contexts/delete/1.0' 'keys/create/0.1' 'keys/sign/0.1' 'policy/upsert/0.2' 'device/wipe/0.1' 'config/patch/0.1' 'vta/did-templates/create/2.0' 'consent/approver-set/1.0' 'keys/import/0.1' 'did-management/did/delete/0.1' 'vta/services/enable/1.0' 'vta/services/disable/1.0' 'vta/credentials/issue/0.1' 'vta/credentials/revoke/0.1'; do
-            if grep -rlF "$task" packages/extension/dist/; then
-              echo "::error::the extension bundle contains $task — @openvtc/pnm-core/admin must not be reachable from the wallet (check for a root-barrel import)"
+            leaked=$(grep -rlF "$task" packages/extension/dist/ | grep -v '^packages/extension/dist/manager\.js$' || true)
+            if [ -n "$leaked" ]; then
+              echo "::error::$leaked contains $task — @openvtc/pnm-core/admin must not be reachable from any wallet surface (check for a root-barrel import, or a shared chunk)"
               exit 1
             fi
           done
-          echo "OK: no admin task URIs in the extension bundle"
+          echo "OK: admin task URIs appear only in manager.js"
+
+      # A second, stricter guard — and the difference from the one above is the
+      # point.
+      #
+      # That guard is about *authority*: `admin/*` grants and revokes it, and
+      # the console is deliberately the one surface that holds it, so it names
+      # `manager.js` as an exception.
+      #
+      # These tasks are about *material*. `vta/seeds/export-mnemonic/1.0`
+      # returns a BIP-39 mnemonic — the seed every derived key in the agent
+      # comes from — and `list`/`rotate` are the rest of that family's surface.
+      # There is no browser context that should be able to ask for them, so this
+      # guard has **no exception**: not the console, not the wallet, nowhere in
+      # `dist/`.
+      #
+      # It exists because the alternative is an omission, and an omission is
+      # indistinguishable from not having got to it yet. Someone reasonable
+      # could add a seeds pane next year and no one would know it was refused on
+      # purpose. This is what says so.
+      #
+      # `vault/release/0.1` is deliberately NOT here: it releases a secret to a
+      # site the human just approved, which is the wallet's whole job.
+      - name: Assert no key-material surface ships at all
+        run: |
+          for task in 'vta/seeds/list/1.0' 'vta/seeds/rotate/1.0' 'vta/seeds/export-mnemonic/1.0'; do
+            found=$(grep -rlF "$task" packages/extension/dist/ || true)
+            if [ -n "$found" ]; then
+              echo "::error::$found contains $task — this family returns key material and must not ship in any extension bundle, the console included. See CLAUDE.md."
+              exit 1
+            fi
+          done
+          echo "OK: no key-material task URIs anywhere in dist/"
+
+      # The console's isolation rests on it being one self-contained file: the
+      # guard above names exactly one exception, so a second chunk would be a
+      # file nothing checks. Losing `codeSplitting: false` in a future upgrade
+      # is silent otherwise.
+      - name: Assert the console is a single self-contained bundle
+        run: |
+          bundle=packages/extension/dist/manager.js
+          test -f "$bundle" || { echo "::error::$bundle was not emitted — did the manager build run?"; exit 1; }
+          extra=$(ls packages/extension/dist/manager-split-*.js 2>/dev/null || true)
+          if [ -n "$extra" ]; then
+            echo "::error::the console emitted extra chunks ($extra); codeSplitting: false was lost and the admin guard now has unchecked files"
+            exit 1
+          fi
+          echo "OK: manager.js is a single bundle"
 
       # Build the Chrome Web Store upload artefact from the dist/ that the
       # Build step just produced (scripts/package.mjs re-stages it; it does
diff --git a/CLAUDE.md b/CLAUDE.md
index 2f1bb1f..3f20fb1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -15,7 +15,8 @@ interaction code:
 - **`vti-stack-development-guide.md`** — binding rules (R-numbers below);
   paste its pre-merge checklist into PRs.
 - **`vti-networking-remediation-plan.md`** — deliverable **D8** covers this
-  repo (with vti-didcomm-js and pnm-relay).
+  repo (with vti-didcomm-js; `pnm-relay` was the third and no longer exists —
+  see R4.1).
 - **`vti-architectural-direction.md`** — design-level rationale.
 
 Rules that bite hardest here:
@@ -54,9 +55,22 @@ Rules that bite hardest here:
   network helper here takes an optional `fetch` for testability, so a literal
   `grep "fetch("` finds almost nothing — the real calls are spelled `f(...)`,
   `fetchFn(...)`, `this.fetchImpl(...)`.
-- **R4.1 — shared code with pnm-relay and vti-didcomm-js is a liability until
-  extracted**: the relay never received this repo's body-first error-parsing
-  fix. Land contract/transport fixes in all three or extract the shared core.
+- **R4.1 — the shared core is extracted; keep it that way.** This rule used to
+  read "shared code with pnm-relay and vti-didcomm-js is a liability until
+  extracted: the relay never received this repo's body-first error-parsing
+  fix". That is done and the note had gone stale: **`pnm-relay` no longer
+  exists.** Its `rest-channel.ts` / `request-task.ts` were consolidated into
+  `@openvtc/pnm-core` — the copy `pnm-extension` and `pnm-pwa` both consume,
+  which carries the body-first parse (`decodeTrustTaskHttpAck` reads the body,
+  then builds with `errorFromBody`; `errorFromResponse` appears nowhere) and the
+  `ConsentRequired` union. Nothing depends on `@openvtc/pnm-relay`, and
+  `rp-sdk-js` is a separate server-side SIOPv2 verifier, not its successor.
+  (`vti-networking-remediation-plan.md` F5, resolved by consolidation.)
+
+  What survives is the *rule*, not the defect: `vti-didcomm-js` is still a
+  separate implementation of the same wire contract, so a transport or
+  error-shape fix has to land in both. A third copy is what R4.1 exists to
+  prevent — do not reintroduce one.
 
 ## How persist-before-ack is held (R1.6)
 
@@ -128,6 +142,108 @@ routing either through a channel would overwrite or duplicate a proof.
 document as the counterparty receives it — a signature copied from another
 document satisfies an "is there a `proof` member" check and fails this one.
 
+## The wallet ships no operator authority — the console does
+
+`@openvtc/pnm-core/admin` is operator surface: granting authority at an agent,
+revoking it, destroying contexts. It is deliberately absent from the package
+root barrel, and CI greps the built output for 17 of its task URIs.
+
+That guard used to read "banned anywhere in `dist/`", on the grounds that a
+wallet has no business shipping any of it. The **management console**
+(`manager.html`) makes that statement false on purpose — administering the agent
+is its whole job — so the guard was **narrowed, not deleted**: banned everywhere
+in `dist/` *except* `manager.js`. Every wallet surface (service worker, content
+and page-world scripts, popup, confirm, offscreen, options) keeps the property
+the guard was protecting.
+
+**The console is its own vite build** (`vite.config.manager.ts`,
+`codeSplitting: false`). That is what makes "exactly one file may contain admin"
+structural rather than a convention: the main build emits popup, options,
+confirm and offscreen *together*, and Rollup is free to hoist shared code into a
+common `assets/*.js` chunk that wallet surfaces load. Building the console alone
+means there is no other entry to share with. A second CI assertion fails if it
+ever emits more than one chunk, because the first guard names exactly one
+exception and an extra chunk is a file nothing checks.
+
+**The console holds no key material.** It composes typed documents with the
+`admin/*` helpers and the offscreen document signs them, so an XSS there cannot
+exfiltrate a key. This is why `admin/*` and `vta/contexts.ts` type their
+envelope parties as `TaskParty` (`vta/channel.ts`) — just a DID — rather than
+`Identity` and `RemoteDidcommEndpoint`: only `.did` was ever read, and a
+surface typed on `Identity` can only be called from somewhere holding a private
+key. The REST convenience wrappers (`vtaListContexts`, `vtaCreateContext`) still
+take the stricter pair, because they *build a channel*, and a channel signs.
+
+**Only `type` and `payload` cross the bridge.** `RUNTIME_MANAGER_TASK` carries
+those two members and nothing else; `carrier.ts` strips the envelope the admin
+helper built, and `offscreen.ts`'s existing `OFFSCREEN_REQUEST_TASK` mints the
+real one and signs it. `core/src/vta/request-task.ts` explains why the device
+must mint it, and that reasoning does not soften because the composer is an
+extension page: a wallet that counter-signs a document composed elsewhere
+attests to fields it never checked. Reusing that path also inherits transport
+selection, `TransportHealth`, and the same-browser approver ceremony for free —
+`offscreen.ts` needed no change at all.
+
+**The relay is gated on `sender.url`, not `sender.id`.** Every content script
+carries this extension's id, so `sender.id` cannot separate a page from an
+extension surface. `isExtensionPageSender` compares against
+`chrome.runtime.getURL("")`. Unlike the page-facing `RUNTIME_REQUEST_TASK`, this
+one does **not** prompt per call — the caller is the operator driving their own
+console, and twelve identical dialogs to render one screen is dismissal, not
+consent. What stands in its place: the agent's ACL, its policy engine (a
+`requireConsent` comes back as `ConsentRequiredError` and renders as a match-code
+ceremony, never as a red string), and preview-then-confirm on every irreversible
+action, showing the agent's own account of what would be destroyed.
+
+**What breaks it:** importing `admin` from the package root instead of the
+subpath; folding `manager.html` into `vite.config.ts` (a shared chunk then
+carries admin into wallet surfaces); losing `codeSplitting: false`; adding
+`RUNTIME_MANAGER_TASK` to `PAGE_FACING_RUNTIME_TYPES` or to `content.ts`'s
+dispatch table; gating on `sender.id`; or widening the carrier to pass the
+envelope through. `tests/manager-sender.test.mts`,
+`tests/manager-surface.test.mts` and the two CI assertions pin each of these.
+
+## Key material never reaches a browser, and that is enforced
+
+`vta/seeds/*` — `list`, `rotate`, `export-mnemonic` — is the one task family
+this extension refuses outright. `export-mnemonic` returns a BIP-39 mnemonic:
+the seed every derived key in the agent comes from, and the one secret whose
+disclosure loses everything at once. `list` and `rotate` are the rest of that
+family's surface.
+
+**A second CI guard bans all three from anywhere in `dist/`, with no
+exception.** That is the difference from the admin guard above, and the
+difference is the point: `admin/*` is *authority*, which the console is meant to
+hold, so that guard names `manager.js` as its one permitted file. These return
+*material*, and no browser context should be able to ask for them — not the
+console, not the wallet, nowhere.
+
+**Why a guard rather than simply not building it.** Not building a seeds pane is
+indistinguishable from not having got round to one. Someone reasonable adds it
+next year, nothing objects, and the refusal was never recorded anywhere a person
+would look. The guard is what makes the decision legible.
+
+**Verified non-vacuous — and the way it is verified matters.** A seeds URI
+merely *present* in console source is not enough: Rollup tree-shakes an
+unreferenced export, the string never reaches `dist/`, and the guard correctly
+stays silent. That is the guard being right, not weak — it asserts what
+*ships* — but it means a probe that adds an unused `export const` proves
+nothing and reads like a hole. To re-verify, put the URI somewhere the console
+actually renders (a nav `label`, say), rebuild, and watch `manager.js` trip it.
+
+`packages/core` has no seeds module and must not gain one. The guard catches
+that too — a core function would be bundled into `manager.js` and grep would
+find it there.
+
+**`vault/release/0.1` is deliberately not on the list.** It releases a secret to
+a site the human has just approved, which is the wallet's entire job. The line
+is not "touches a secret"; it is "hands over material the holder cannot revoke,
+to a surface that cannot contain it".
+
+**What breaks it:** adding a seeds client to `packages/core`; relaxing the guard
+to allow `manager.js` "for symmetry" with the admin one; or reading this as
+advice rather than a refusal.
+
 ## Advertisement is not availability
 
 A VTA's DID document says what it *offers*. `buildVtaSession` skips a channel
diff --git a/package-lock.json b/package-lock.json
index 880320f..ec110d5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15,6 +15,9 @@
         "packages/demo-rp",
         "packages/reviewer-demo"
       ],
+      "dependencies": {
+        "@openvtc/trust-tasks": "^0.16.8"
+      },
       "engines": {
         "node": ">=24"
       }
@@ -2301,9 +2304,9 @@
       "link": true
     },
     "node_modules/@openvtc/trust-tasks": {
-      "version": "0.16.3",
-      "resolved": "https://registry.npmjs.org/@openvtc/trust-tasks/-/trust-tasks-0.16.3.tgz",
-      "integrity": "sha512-dEWebVgAEvjc7rqfAkAT96sDiVSvTSxv1HGfrCI5XxYk7DfNNHToNGZeppAseMJM2/nuvLinDyhXoQis6XgbTA==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@openvtc/trust-tasks/-/trust-tasks-0.16.8.tgz",
+      "integrity": "sha512-wzwfEcylO91Tr5Cb9UCMqrMOpw1IVuspKHXAGYeOkPQi4LVurv7XH9/NHfRIK9dl7cqpucZ5kmjJRKCI8bD+Gw==",
       "license": "Apache-2.0"
     },
     "node_modules/@openvtc/vti-didcomm-js": {
@@ -4688,9 +4691,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
-      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
+      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
       "dev": true,
       "funding": [
         {
@@ -7806,7 +7809,7 @@
       "dependencies": {
         "@cfworker/json-schema": "^4.1.1",
         "@noble/curves": "^2.4.0",
-        "@openvtc/trust-tasks": "^0.16.3",
+        "@openvtc/trust-tasks": "^0.16.8",
         "@openvtc/vti-didcomm-js": "^0.7.0",
         "@openvtc/vti-tsp-js": "^0.2.0",
         "@scure/base": "^2.2.0",
diff --git a/package.json b/package.json
index a5819ce..3801843 100644
--- a/package.json
+++ b/package.json
@@ -26,5 +26,8 @@
   "overrides": {
     "uuid": "^11.1.1",
     "esbuild": "^0.28.1"
+  },
+  "dependencies": {
+    "@openvtc/trust-tasks": "^0.16.8"
   }
 }
diff --git a/packages/core/package.json b/packages/core/package.json
index a087975..3c6f2a8 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -120,7 +120,7 @@
   "dependencies": {
     "@cfworker/json-schema": "^4.1.1",
     "@noble/curves": "^2.4.0",
-    "@openvtc/trust-tasks": "^0.16.3",
+    "@openvtc/trust-tasks": "^0.16.8",
     "@openvtc/vti-didcomm-js": "^0.7.0",
     "@openvtc/vti-tsp-js": "^0.2.0",
     "@scure/base": "^2.2.0",
diff --git a/packages/core/src/admin/acl.ts b/packages/core/src/admin/acl.ts
index daa78e4..55a4550 100644
--- a/packages/core/src/admin/acl.ts
+++ b/packages/core/src/admin/acl.ts
@@ -12,9 +12,7 @@
 // from the Rust structs, which is a copy that drifts, and got the nullability of
 // `acl/show`'s response wrong in the process.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -73,9 +71,9 @@ export type { AclEntry };
 export interface AclCallerParams {
   /** Envelope `issuer` — the caller's DIDComm identity. Its DID needs a role
    *  the agent accepts for this task; the whole family is manage-gated. */
-  holder: Identity;
+  holder: TaskParty;
   /** The agent — envelope `recipient`. */
-  service: RemoteDidcommEndpoint;
+  service: TaskParty;
 }
 
 export interface AclGrantParams extends AclCallerParams {
diff --git a/packages/core/src/admin/backup.ts b/packages/core/src/admin/backup.ts
new file mode 100644
index 0000000..a17c3bd
--- /dev/null
+++ b/packages/core/src/admin/backup.ts
@@ -0,0 +1,104 @@
+// `vta/backup/*` — and the deliberate absence of most of it.
+//
+// The agent dispatches five verbs: initiate-export, complete-export,
+// initiate-import, finalize-import, abort. **This module exposes one.**
+//
+// ## Why export and import are not here
+//
+// `initiate-export` and `finalize-import` both carry a `password` member: the
+// key-derivation input that protects, or unlocks, a complete copy of the agent
+// — every key, ACL and trust context it holds. It travels *inbound*, chosen by
+// the caller at the moment of asking.
+//
+// The specification classifies it `ingests: secret` and annotates it
+// `writeOnly`, and it says the part that decides this module's shape: the
+// password's exposure is settled by **where it is typed**. A browser form is
+// reachable by autofill, by a password manager, by any other extension with
+// host access, and by screen capture — none of which this wallet controls, and
+// none of which a step-up ceremony reaches. A passkey prompt proves a human is
+// present for the action; it proves nothing about the field, which was filled
+// in before the prompt appeared.
+//
+// So this is not a "not yet". Adding an export pane would be a decision to
+// collect the agent's master password in the least defensible place available,
+// and the CLI already collects it in a better one. Operators export and import
+// there.
+//
+// ## Why `abort` is
+//
+// It carries no secret — one opaque handle in, a boolean out — and it is the
+// only way to close a window that is otherwise open until it expires. An
+// operator who realises mid-export that the download went somewhere it should
+// not have wants the bundle dead now, and the alternative is waiting out the
+// slot with a fetchable copy of the agent live at a known address.
+//
+// It also unwedges: an agent caps how many bundles one operator may hold open,
+// so an abandoned bundle costs a slot until expiry.
+//
+// ## Why there is no bundle list to abort *from*
+//
+// There is no enumerate verb in the family — the agent offers no way to ask
+// what is in flight. So the caller supplies the id the CLI printed. A picker
+// would be nicer and cannot be built without a task that does not exist; the
+// UI says so rather than implying the console lost it.
+
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
+import { buildTrustTask } from "../vta/trust-task.js";
+
+import {
+  TYPE_URI as BACKUP_ABORT,
+  RESPONSE_TYPE_URI as BACKUP_ABORT_RESPONSE,
+  type VTABackupAbortPayload,
+  type VTABackupAbortResponsePayload,
+} from "@openvtc/trust-tasks/vta/backup/abort/1.0/payload";
+
+/** Issued by an operator identity, to the agent holding the bundle. */
+export interface BackupCallerParams {
+  /** Envelope `issuer`. Must be the identity that initiated the bundle —
+   *  the agent checks, and answers a mismatch as not-found rather than as a
+   *  refusal, so that a stranger cannot learn a bundle exists by guessing. */
+  holder: TaskParty;
+  /** The agent — envelope `recipient`. */
+  service: TaskParty;
+}
+
+export interface BackupAbortParams extends BackupCallerParams {
+  /** Handle from an initiate-export or initiate-import descriptor. Either kind
+   *  is accepted; the agent already knows which it holds. */
+  bundleId: string;
+}
+
+/** What the agent did, which is not always what was asked. */
+export interface BackupAbortResult {
+  bundleId: string;
+  /** `false` means the bundle was already terminal — completed, expired, or
+   *  aborted by an earlier attempt. A success, not a failure: abort is
+   *  idempotent precisely because the situation it exists for (a dropped
+   *  connection, an operator unsure whether the cancel landed) is the one that
+   *  produces duplicates. Callers should render it as "already closed" rather
+   *  than as an error. */
+  aborted: boolean;
+}
+
+/**
+ * Cancel an in-flight export or import bundle and discard its staged bytes.
+ *
+ * Destructive and irreversible for the bundle: on the export side the
+ * encrypted copy is deleted and cannot be re-minted — a new export re-serialises
+ * the agent and produces different bytes.
+ */
+export async function backupAbort(
+  sender: TrustTaskSender,
+  params: BackupAbortParams,
+): Promise<BackupAbortResult> {
+  const payload: VTABackupAbortPayload = { bundleId: params.bundleId };
+  const envelope = buildTrustTask(BACKUP_ABORT, payload, {
+    issuer: params.holder.did,
+    recipient: params.service.did,
+  });
+  const res = await sender.send<VTABackupAbortResponsePayload>(envelope, {
+    expectedResponseType: BACKUP_ABORT_RESPONSE,
+    operationLabel: "vta/backup/abort/1.0",
+  });
+  return { bundleId: res.bundleId, aborted: res.aborted };
+}
diff --git a/packages/core/src/admin/consent.ts b/packages/core/src/admin/consent.ts
index 742a758..bf219da 100644
--- a/packages/core/src/admin/consent.ts
+++ b/packages/core/src/admin/consent.ts
@@ -15,9 +15,7 @@
 // consent and carries a challenge the approver's decision is bound to. Most
 // consoles will use `consentList`, `consentDecision` and `consentRevoke`.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -63,8 +61,8 @@ import {
 export type { ConsentGrant, ConsentSubject, ApproverBinding };
 
 export interface ConsentCallerParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
 }
 
 export interface ConsentListParams extends ConsentCallerParams {
diff --git a/packages/core/src/admin/contexts.ts b/packages/core/src/admin/contexts.ts
index 673f139..be537f4 100644
--- a/packages/core/src/admin/contexts.ts
+++ b/packages/core/src/admin/contexts.ts
@@ -10,28 +10,27 @@
 // snake_case. Both fields happen to be single words, which is exactly the kind
 // of coincidence that hides a casing bug until someone adds `dry_run`.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
-const TASK_CONTEXTS_DELETE = "https://trusttasks.org/spec/vta/contexts/delete/1.0";
-const TASK_CONTEXTS_PREVIEW_DELETE =
-  "https://trusttasks.org/spec/vta/contexts/preview-delete/1.0";
+import {
+  TYPE_URI as TASK_CONTEXTS_DELETE,
+  type VTAContextsDeleteResponsePayload,
+} from "@openvtc/trust-tasks/vta/contexts/delete/1.0/payload";
+import { TYPE_URI as TASK_CONTEXTS_PREVIEW_DELETE } from "@openvtc/trust-tasks/vta/contexts/preview-delete/1.0/payload";
 
 export interface ContextDeleteParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
   /** Context id (full path for a nested context). */
   id: string;
   /** Delete even when the context still holds keys or DIDs. Default false. */
   force?: boolean;
 }
 
-export interface ContextDeleteResult {
-  id: string;
-  deleted: boolean;
-}
+/** The delete response, from the binding. The hand-written copy omitted
+ *  `ext`, which SPEC §4.5.1 lets any agent send. */
+export type ContextDeleteResult = VTAContextsDeleteResponsePayload;
 
 /**
  * What deleting this context would destroy.
diff --git a/packages/core/src/admin/credentials.ts b/packages/core/src/admin/credentials.ts
index 62b9286..d43b576 100644
--- a/packages/core/src/admin/credentials.ts
+++ b/packages/core/src/admin/credentials.ts
@@ -11,11 +11,17 @@
 // two families version independently; a matching pair is a coincidence, not a
 // rule, so read the import paths rather than assuming.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
+import {
+  TYPE_URI as CREDENTIALS_LIST,
+  RESPONSE_TYPE_URI as CREDENTIALS_LIST_RESPONSE,
+  type VTACredentialsListResponsePayload,
+  type IssuedCredentialSummary,
+  type IssuedCredentialStatus,
+} from "@openvtc/trust-tasks/vta/credentials/list/0.1/payload";
+
 import {
   TYPE_URI as CREDENTIALS_ISSUE,
   RESPONSE_TYPE_URI as CREDENTIALS_ISSUE_RESPONSE,
@@ -32,9 +38,9 @@ import {
 /** Both calls are issued by an operator identity, to an agent. */
 export interface CredentialIssuerCallerParams {
   /** Envelope `issuer` — needs an agent role that carries issuing authority. */
-  holder: Identity;
+  holder: TaskParty;
   /** The issuing agent — envelope `recipient`. */
-  service: RemoteDidcommEndpoint;
+  service: TaskParty;
 }
 
 export interface IssueCredentialParams extends CredentialIssuerCallerParams {
@@ -128,3 +134,82 @@ export async function revokeCredential(
     operationLabel: "vta/credentials/revoke/0.1",
   });
 }
+
+export type { IssuedCredentialSummary, IssuedCredentialStatus };
+
+export interface ListCredentialsParams extends CredentialIssuerCallerParams {
+  /**
+   * Only credentials issued to this DID.
+   *
+   * Named `holderDid` rather than `holder` — matching {@link issueCredential} —
+   * because `holder` on the caller params is the envelope's *issuer*, this
+   * library's own identity. Two different parties would otherwise share one
+   * member name on the same object.
+   */
+  holderDid?: string;
+  /** Only credentials carrying this type tag beyond `VerifiableCredential`. */
+  credentialType?: string;
+  /** Only credentials in this state. */
+  status?: IssuedCredentialStatus;
+  /** Maximum records to return. The agent caps this. */
+  pageSize?: number;
+  /** Continue a previous page. Opaque — never construct or parse one. */
+  cursor?: string;
+}
+
+export interface ListCredentialsResult {
+  credentials: IssuedCredentialSummary[];
+  /** The agent stopped early. **Check this before drawing conclusions** — a
+   *  truncated page is not a complete account of what was issued, and reading
+   *  "nothing else was issued" off one is the mistake the member exists to
+   *  prevent. */
+  truncated: boolean;
+  /** Pass as `cursor` to continue. Absent on the last page, so a caller stops
+   *  on its absence rather than needing an empty page to learn it is done. */
+  cursor?: string;
+}
+
+/**
+ * What this agent has issued, as metadata.
+ *
+ * **No credential bodies.** `vault/list/0.1` states the rule this family
+ * follows — list enumerates, release uses — and an issuer that needs a body
+ * minted it and got it back from {@link issueCredential}. A caller reaching for
+ * this to populate claim data has mistaken it for a read of the credentials
+ * themselves; there is no such task.
+ *
+ * `status` is derived by the agent when it answers, never stored, and
+ * `revoked` takes precedence over `expired` — a credential revoked before its
+ * window closed is revoked, and reading it as merely expired hides that
+ * somebody acted. Do not cache the result: a cached page reports a credential
+ * as active after it has been revoked.
+ *
+ * Unlike the holder-side `credVaultQuery`, an unfiltered call is answered. The
+ * caller here is the issuer reading a record of its own past actions rather
+ * than a delegate reading someone's private store.
+ */
+export async function listCredentials(
+  sender: TrustTaskSender,
+  params: ListCredentialsParams,
+): Promise<ListCredentialsResult> {
+  const envelope = buildTrustTask(
+    CREDENTIALS_LIST,
+    {
+      ...(params.holderDid ? { holder: params.holderDid } : {}),
+      ...(params.credentialType ? { credentialType: params.credentialType } : {}),
+      ...(params.status ? { status: params.status } : {}),
+      ...(params.pageSize !== undefined ? { pageSize: params.pageSize } : {}),
+      ...(params.cursor ? { cursor: params.cursor } : {}),
+    },
+    { issuer: params.holder.did, recipient: params.service.did },
+  );
+  const res = await sender.send<VTACredentialsListResponsePayload>(envelope, {
+    expectedResponseType: CREDENTIALS_LIST_RESPONSE,
+    operationLabel: "vta/credentials/list/0.1",
+  });
+  return {
+    credentials: res.credentials ?? [],
+    truncated: res.truncated ?? false,
+    ...(res.cursor ? { cursor: res.cursor } : {}),
+  };
+}
diff --git a/packages/core/src/admin/devices.ts b/packages/core/src/admin/devices.ts
index a018fdb..b545ec0 100644
--- a/packages/core/src/admin/devices.ts
+++ b/packages/core/src/admin/devices.ts
@@ -10,9 +10,7 @@
 // request missing either: a wipe with no recorded reason is an audit gap. That
 // is a deliberate obstacle, so this wrapper adds no default for either.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -41,8 +39,8 @@ export type { DeviceBinding };
 export type WipeScope = DeviceWipePayload["scope"];
 
 export interface DeviceCallerParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
 }
 
 export interface DeviceListParams extends DeviceCallerParams {
diff --git a/packages/core/src/admin/did-templates.ts b/packages/core/src/admin/did-templates.ts
index a90f767..66be7f9 100644
--- a/packages/core/src/admin/did-templates.ts
+++ b/packages/core/src/admin/did-templates.ts
@@ -16,9 +16,7 @@
 // the operation to that context's templates; omitting it addresses the global
 // set. The two are different namespaces, and a name can exist in both.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -60,8 +58,8 @@ import {
 export type { DidTemplate, DidTemplateRecord };
 
 export interface DidTemplateCallerParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
   /** Scope the call to one context's templates. Omit for the global set —
    *  a different namespace, in which the same name may also exist. */
   contextId?: string;
diff --git a/packages/core/src/admin/index.ts b/packages/core/src/admin/index.ts
index 654ce94..786e5bd 100644
--- a/packages/core/src/admin/index.ts
+++ b/packages/core/src/admin/index.ts
@@ -22,3 +22,4 @@ export * from "./consent.js";
 export * from "./contexts.js";
 export * from "./services.js";
 export * from "./credentials.js";
+export * from "./backup.js";
diff --git a/packages/core/src/admin/keys.ts b/packages/core/src/admin/keys.ts
index 2eaa2a7..1d1758b 100644
--- a/packages/core/src/admin/keys.ts
+++ b/packages/core/src/admin/keys.ts
@@ -23,9 +23,7 @@
 // the parameter type enforces it here; the cleartext warning cannot be
 // enforced by any type and is stated where a caller will read it.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -103,9 +101,9 @@ export type KeyRecord = SpecKeyRecord;
 
 export interface KeysCallerParams {
   /** Envelope `issuer` — the caller's DIDComm identity. */
-  holder: Identity;
+  holder: TaskParty;
   /** The agent — envelope `recipient`. */
-  service: RemoteDidcommEndpoint;
+  service: TaskParty;
 }
 
 export interface KeysCreateParams extends KeysCallerParams {
diff --git a/packages/core/src/admin/memory.ts b/packages/core/src/admin/memory.ts
index 37a4283..ead8435 100644
--- a/packages/core/src/admin/memory.ts
+++ b/packages/core/src/admin/memory.ts
@@ -9,9 +9,7 @@
 // counterpart only in the sense that both name a key — the list is deliberately
 // a directory, so enumerating memory does not spill its contents.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -34,8 +32,8 @@ import {
 } from "@openvtc/trust-tasks/vta/memory/delete/0.1/payload";
 
 export interface MemoryCallerParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
   /** Required — memory has no global namespace. */
   contextId: string;
 }
diff --git a/packages/core/src/admin/observability.ts b/packages/core/src/admin/observability.ts
index c8f1cb2..2480d0d 100644
--- a/packages/core/src/admin/observability.ts
+++ b/packages/core/src/admin/observability.ts
@@ -5,9 +5,7 @@
 // "under what settings", and `config/patch` is the one write, kept in the same
 // file because you should never be looking at the second without the first.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -40,8 +38,8 @@ import {
 export type { AuditEnvelope, ConfigField };
 
 export interface ObservabilityCallerParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
 }
 
 export interface AuditListParams extends ObservabilityCallerParams {
diff --git a/packages/core/src/admin/policy.ts b/packages/core/src/admin/policy.ts
index 635fc95..2b1ba35 100644
--- a/packages/core/src/admin/policy.ts
+++ b/packages/core/src/admin/policy.ts
@@ -13,9 +13,7 @@
 //
 // Payload and response types come from `@openvtc/trust-tasks`.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -46,8 +44,8 @@ import {
 export type { PolicyModule };
 
 export interface PolicyCallerParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
 }
 
 export interface PolicyListParams extends PolicyCallerParams {
diff --git a/packages/core/src/admin/services.ts b/packages/core/src/admin/services.ts
index 19cd30e..f391845 100644
--- a/packages/core/src/admin/services.ts
+++ b/packages/core/src/admin/services.ts
@@ -11,9 +11,7 @@
 // calls it off. A caller that treats `disable` as instantaneous will report an
 // agent as off while it is still answering.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -64,15 +62,21 @@ import {
   type VTAServicesDrainCancelPayload,
   type VTAServicesDrainCancelResponsePayload,
 } from "@openvtc/trust-tasks/vta/services/drain/cancel/1.0/payload";
+import {
+  TYPE_URI as MANAGEMENT_RELOAD,
+  RESPONSE_TYPE_URI as MANAGEMENT_RELOAD_RESPONSE,
+  type VTAManagementReloadServicesPayload,
+  type VTAManagementReloadServicesResponsePayload,
+} from "@openvtc/trust-tasks/vta/management/reload-services/1.0/payload";
 
 export type { ServiceState, ServiceKind };
 
 /** Every `vta/services/*` call is issued by an operator identity, to an agent. */
 export interface ServicesCallerParams {
   /** Envelope `issuer`. Needs an admin role — the whole family is manage-gated. */
-  holder: Identity;
+  holder: TaskParty;
   /** The agent — envelope `recipient`. */
-  service: RemoteDidcommEndpoint;
+  service: TaskParty;
 }
 
 /** Transport configuration. Which members apply depends on the `ServiceKind`. */
@@ -263,3 +267,57 @@ export async function serviceDrainCancel(
   return call(sender, params, SERVICES_DRAIN_CANCEL, SERVICES_DRAIN_CANCEL_RESPONSE,
     "vta/services/drain/cancel/1.0", payload);
 }
+
+/**
+ * Re-read the agent's service configuration and restart its transports.
+ *
+ * Takes no parameters, and the specification argues for the emptiness rather
+ * than leaving it to look unfinished: every member this could carry — a list of
+ * services to reload selectively, inline configuration, a flag to skip
+ * validation — turns "apply what is written down" into "apply what this
+ * document says", which would let a caller put an agent into a state its own
+ * configuration does not describe. So a reload is all-or-nothing, and the
+ * agent's config stays the single account of how the agent runs.
+ *
+ * ## Two outcomes that are not failures
+ *
+ * **No response.** A successful reload drops the very transport the response
+ * would travel on, so the connection may simply close. That is not an error and
+ * **must not be retried as one** — the reload has very likely succeeded. The
+ * reliable check is external to the call: reconnect and see whether the agent
+ * answers.
+ *
+ * **`reloadFailed`.** The agent read its configuration and could not bring
+ * services up on it. What state it is left in is implementation-specific, and
+ * the code deliberately does not assert one: it may hold the previous config
+ * and stay up, come up partially, or not come up at all. Do not report to an
+ * operator that the agent is still serving.
+ *
+ * ## What it costs
+ *
+ * Every open session drops, including this wallet's own inbound sessions. The
+ * cost falls on every counterparty of the agent, none of whom asked — which is
+ * why the console puts it behind a step-up even though the task creates,
+ * deletes and discloses nothing.
+ */
+export async function reloadServices(
+  sender: TrustTaskSender,
+  params: ServicesCallerParams,
+): Promise<{ status: string }> {
+  const payload: VTAManagementReloadServicesPayload = {};
+  const res = await call<
+    VTAManagementReloadServicesPayload,
+    VTAManagementReloadServicesResponsePayload
+  >(
+    sender,
+    params,
+    MANAGEMENT_RELOAD,
+    MANAGEMENT_RELOAD_RESPONSE,
+    "vta/management/reload-services/1.0",
+    payload,
+  );
+  // Advisory free text — shown to a human, never branched on. The reliable
+  // signal is whether the agent answers afterwards, not what it said before
+  // restarting.
+  return { status: res.status };
+}
diff --git a/packages/core/src/admin/sessions.ts b/packages/core/src/admin/sessions.ts
index c03926c..b8f72b1 100644
--- a/packages/core/src/admin/sessions.ts
+++ b/packages/core/src/admin/sessions.ts
@@ -15,9 +15,7 @@
 //
 // Payload and response types come from `@openvtc/trust-tasks`.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -40,8 +38,8 @@ import {
 export type { Session };
 
 export interface SessionCallerParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
 }
 
 /**
diff --git a/packages/core/src/app-state/records.ts b/packages/core/src/app-state/records.ts
index 87bd273..beb9f7b 100644
--- a/packages/core/src/app-state/records.ts
+++ b/packages/core/src/app-state/records.ts
@@ -15,9 +15,7 @@
 // is the isolation boundary** — not a filter, and not a convenience. Two
 // contexts holding the same namespace and key hold two unrelated records.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -63,9 +61,9 @@ export type { AppStateRecord };
 /** Every `vta/app-state/*` call is issued by an identity, to an agent. */
 export interface AppStateCallerParams {
   /** Envelope `issuer` — the caller's DIDComm identity. */
-  holder: Identity;
+  holder: TaskParty;
   /** The agent — envelope `recipient`. */
-  service: RemoteDidcommEndpoint;
+  service: TaskParty;
   /** The VTA context the record is scoped to. The isolation boundary: the same
    *  `(namespace, key)` in another context is a different record. */
   contextId: string;
diff --git a/packages/core/src/device/register-gateway.ts b/packages/core/src/device/register-gateway.ts
index b768d06..63751b7 100644
--- a/packages/core/src/device/register-gateway.ts
+++ b/packages/core/src/device/register-gateway.ts
@@ -19,19 +19,24 @@ import { withFetchTimeout } from "../http/timeout-fetch.js";
 // push/register/0.2 — the payload is field-identical to 0.1 (no enum values),
 // so this is a pure version-string bump. The gateway accepts both 0.1 and 0.2
 // and mirrors the request version into the `#response`.
-const TASK_PUSH_REGISTER = "https://trusttasks.org/spec/push/register/0.2";
-const TASK_PUSH_REGISTER_RESPONSE =
-  "https://trusttasks.org/spec/push/register/0.2#response";
+import {
+  TYPE_URI as TASK_PUSH_REGISTER,
+  RESPONSE_TYPE_URI as TASK_PUSH_REGISTER_RESPONSE,
+  type WebPush,
+} from "@openvtc/trust-tasks/push/register/0.2/payload";
 
 /** A device's platform push channel — tagged union over `platform`. Only the
  *  Web Push variant is wired today (self-hostable, no Apple/Google account). */
-export type PushRegistration = {
-  platform: "webpush";
-  /** RFC 8030 Web Push subscription endpoint. */
-  endpoint: string;
-  /** RFC 8291 encryption keys. */
-  keys: { p256dh: string; auth: string };
-};
+/** What this wallet registers: a Web Push subscription.
+ *
+ *  A deliberate NARROWING of the schema's `PushRegistration`, which is
+ *  `Apns | Fcm | WebPush` — a browser extension cannot produce the other two.
+ *  Taken as the generated `WebPush` variant rather than restated, so the
+ *  narrowing is the only thing this line says: the members still come from the
+ *  schema, and widening the union later does not silently leave this behind.
+ */
+export type PushRegistration = WebPush;
+
 
 export interface RegisterPushChannelOptions {
   /** Push gateway base URL (the HTTPS transport — `POST {gatewayUrl}/trust-tasks`). */
diff --git a/packages/core/src/device/set-wake.ts b/packages/core/src/device/set-wake.ts
index a61ddde..89c09c6 100644
--- a/packages/core/src/device/set-wake.ts
+++ b/packages/core/src/device/set-wake.ts
@@ -18,29 +18,23 @@ import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
 import { RestChannel, type RestChannelOptions } from "../vta/rest-channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
-const TASK_DEVICE_SET_WAKE = "https://trusttasks.org/spec/device/set-wake/0.2";
-const TASK_DEVICE_SET_WAKE_RESPONSE =
-  "https://trusttasks.org/spec/device/set-wake/0.2#response";
+import {
+  TYPE_URI as TASK_DEVICE_SET_WAKE,
+  RESPONSE_TYPE_URI as TASK_DEVICE_SET_WAKE_RESPONSE,
+  type WakeHandle,
+  type WakeTriggerPolicy,
+  type DeviceSetWakeResponsePayload,
+} from "@openvtc/trust-tasks/device/set-wake/0.2/payload";
 
-/** The opaque gateway-issued handle — gateway address + handle, no token. */
-export interface WakeHandle {
-  /** Gateway that issued + acts on this handle (DID or https URL). */
-  gateway: string;
-  /** Opaque gateway-issued channel identifier (reveals no token). */
-  handle: string;
-}
+/** Re-exported from the binding rather than restated here: both were declared
+ *  by hand and were byte-identical to the schema's, which is the state just
+ *  before a divergence nobody notices. */
+export type { WakeHandle, WakeTriggerPolicy };
 
-/** The VTA's effective allowlist, as provisioned to the gateway. */
-export interface WakeTriggerPolicy {
-  allowedTriggers: string[];
-}
+/** The set-wake response, from the binding. The hand-written copy omitted
+ *  `ext`, which SPEC §4.5.1 lets any agent send. */
+export type DeviceSetWakeResponse = DeviceSetWakeResponsePayload;
 
-export interface DeviceSetWakeResponse {
-  /** Whether the device now has a usable wake channel. */
-  pushCapable: boolean;
-  /** The effective allowlist the VTA computed + provisioned (absent on clear). */
-  triggerPolicy?: WakeTriggerPolicy;
-}
 
 export interface DeviceSetWakeParams {
   /** The wallet's holder DIDComm identity (envelope `issuer`). */
diff --git a/packages/core/src/inbound/task-consent.ts b/packages/core/src/inbound/task-consent.ts
index 8f443da..076b75b 100644
--- a/packages/core/src/inbound/task-consent.ts
+++ b/packages/core/src/inbound/task-consent.ts
@@ -53,17 +53,23 @@ import {
   type PayloadValidator,
 } from "../trust-tasks/validate.js";
 
-import { PAYLOAD_SCHEMA } from "@openvtc/trust-tasks/task-consent/request/0.1/payload";
-import { RESPONSE_PAYLOAD_SCHEMA as DECISION_RESPONSE_SCHEMA } from "@openvtc/trust-tasks/task-consent/decision/0.1/payload";
+import {
+  PAYLOAD_SCHEMA,
+  TYPE_URI as TASK_CONSENT_REQUEST_TYPE_URI,
+  type Exposure,
+  type StatePin,
+} from "@openvtc/trust-tasks/task-consent/request/0.1/payload";
+import {
+  RESPONSE_PAYLOAD_SCHEMA as DECISION_RESPONSE_SCHEMA,
+  TYPE_URI as TASK_CONSENT_DECISION_TYPE_URI,
+} from "@openvtc/trust-tasks/task-consent/decision/0.1/payload";
+import { TYPE_URI as TASK_CONSENT_GRANTED_TYPE_URI } from "@openvtc/trust-tasks/task-consent/granted/0.1/payload";
 import type { SigningIdentity } from "../siop/self-issued.js";
 
-export const TASK_CONSENT_REQUEST_TYPE =
-  "https://trusttasks.org/spec/task-consent/request/0.1";
-export const TASK_CONSENT_DECISION_TYPE =
-  "https://trusttasks.org/spec/task-consent/decision/0.1";
+export const TASK_CONSENT_REQUEST_TYPE = TASK_CONSENT_REQUEST_TYPE_URI;
+export const TASK_CONSENT_DECISION_TYPE = TASK_CONSENT_DECISION_TYPE_URI;
 /** VTA → requester: an approval landed and a grant is ready — re-submit now. */
-export const TASK_CONSENT_GRANTED_TYPE =
-  "https://trusttasks.org/spec/task-consent/granted/0.1";
+export const TASK_CONSENT_GRANTED_TYPE = TASK_CONSENT_GRANTED_TYPE_URI;
 /** The executor's acknowledgement of a decision this device sent. */
 export const TASK_CONSENT_DECISION_RESPONSE_TYPE = `${TASK_CONSENT_DECISION_TYPE}#response`;
 
@@ -264,16 +270,13 @@ export function parseTaskConsentGranted(
 /** SPEC §7.3 item 13 — the integrity effect of executing the task. */
 export type SideEffectLevel = "none" | "mutating" | "destructive";
 
-/** SPEC §7.3 item 14 — what leaves the executor, and whose authority is used. */
-export interface Exposure {
-  discloses: "none" | "metadata" | "secret";
-  actsAsSubject: boolean;
-}
 
 /**
  * One consequence of executing the task, authored by the VTA by dry-running the
  * handler it is about to invoke.
  */
+export type { Exposure, StatePin };
+
 export interface ConsentEffect {
   /** Machine discriminator. The set is OPEN — handlers evolve faster than this
    *  type, so a surface MUST tolerate a kind it does not recognise. */
@@ -287,11 +290,6 @@ export interface ConsentEffect {
   detail?: Record<string, unknown>;
 }
 
-/** The prior state the effects were computed against. */
-export interface StatePin {
-  resource: string;
-  version: string;
-}
 
 /** Payload of an inbound `task-consent/request/0.1` (VTA → approver). */
 export interface TaskConsentRequestPayload {
diff --git a/packages/core/src/onboarding/swap.ts b/packages/core/src/onboarding/swap.ts
index 6fe134a..d46e091 100644
--- a/packages/core/src/onboarding/swap.ts
+++ b/packages/core/src/onboarding/swap.ts
@@ -24,19 +24,29 @@ import { RestChannel } from "../vta/rest-channel.js";
 import type { DidcommMessageBridge } from "../vta/transport.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
-const ACL_SWAP_KEY = "https://trusttasks.org/spec/acl/swap-key/0.1";
-const ACL_SWAP_KEY_RESPONSE = "https://trusttasks.org/spec/acl/swap-key/0.1#response";
+import {
+  TYPE_URI as ACL_SWAP_KEY,
+  RESPONSE_TYPE_URI as ACL_SWAP_KEY_RESPONSE,
+  type ACLSwapKeyResponsePayload,
+  type AclEntry,
+} from "@openvtc/trust-tasks/acl/swap-key/0.1/payload";
+
+/** The swap-key response, as the registry declares it: the realized ACL entry
+ *  plus the DID that was swapped out.
+ *
+ *  This was declared by hand as a FLAT entry — `did`, `role`, `allowedContexts`,
+ *  `createdAt: number` — and was wrong in three ways at once. The agent wraps
+ *  the entry (`{ entry, previousSubject }`, VTI #857), and the entry itself
+ *  names `subject` not `did`, `scopes` not `allowedContexts`, and dates as
+ *  RFC 3339 strings not numbers. Every field a caller read came back
+ *  `undefined`.
+ *
+ *  Nothing caught it because `sender.send<T>()` is an unchecked cast and the
+ *  only test built its fixture from this type rather than from the schema — so
+ *  the test asserted the drift and would have gone on doing so. */
+export type AclSwapResult = ACLSwapKeyResponsePayload;
+export type { AclEntry };
 
-/** The ACL entry created for the new DID (the swap-key result body). */
-export interface AclSwapResult {
-  did: string;
-  role: string;
-  label?: string | null;
-  allowedContexts: string[];
-  createdAt: number;
-  createdBy: string;
-  expiresAt?: number | null;
-}
 
 export interface SwapAclParams {
   /** The OLD DID (operator-granted ephemeral). Its DID is `currentSubject` and
diff --git a/packages/core/src/rp-login/didcomm.ts b/packages/core/src/rp-login/didcomm.ts
index 2750d36..3156d10 100644
--- a/packages/core/src/rp-login/didcomm.ts
+++ b/packages/core/src/rp-login/didcomm.ts
@@ -27,8 +27,10 @@ import type { DidcommMessageBridge } from "../vta/transport.js";
 //
 // Matched with `===` against the spelling the RP declares today; no
 // both-spellings fold, per this repo's rule on compatibility arms.
-const MSG_AUTHENTICATE = "https://trusttasks.org/spec/auth/authenticate/0.1";
-const MSG_AUTH_RESPONSE = "https://trusttasks.org/spec/auth/authenticate/0.1#response";
+import {
+  TYPE_URI as MSG_AUTHENTICATE,
+  RESPONSE_TYPE_URI as MSG_AUTH_RESPONSE,
+} from "@openvtc/trust-tasks/auth/authenticate/0.1/payload";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
 
diff --git a/packages/core/src/rp-login/step-up.ts b/packages/core/src/rp-login/step-up.ts
index 72527c4..1789e37 100644
--- a/packages/core/src/rp-login/step-up.ts
+++ b/packages/core/src/rp-login/step-up.ts
@@ -25,13 +25,15 @@ import { withFetchTimeout } from "../http/timeout-fetch.js";
 
 // Canonical step-up approval spec from trusttasks-tf. The proof on the
 // approve-response is what the RP verifies to elevate the session's acr.
-const MSG_APPROVE_RESPONSE = "https://trusttasks.org/spec/auth/step-up/approve-response/0.2";
+import { TYPE_URI as MSG_APPROVE_RESPONSE } from "@openvtc/trust-tasks/auth/step-up/approve-response/0.2/payload";
+import { TYPE_URI as APPROVE_REQUEST_0_2 } from "@openvtc/trust-tasks/auth/step-up/approve-request/0.2/payload";
+import { TYPE_URI as APPROVE_REQUEST_0_1 } from "@openvtc/trust-tasks/auth/step-up/approve-request/0.1/payload";
 /** The RP→approver request halves this wallet accepts. 0.2 is what the
  *  did-hosting control plane mints on `start`; 0.1 is the VTA-pushed flavor
  *  (same required payload members) — both are gated identically. */
 export const STEP_UP_APPROVE_REQUEST_TYPES = [
-  "https://trusttasks.org/spec/auth/step-up/approve-request/0.2",
-  "https://trusttasks.org/spec/auth/step-up/approve-request/0.1",
+  APPROVE_REQUEST_0_2,
+  APPROVE_REQUEST_0_1,
 ] as const;
 
 /** The RP's `approve-request/0.2` payload, verified out of the signed
diff --git a/packages/core/src/siop/login-client.ts b/packages/core/src/siop/login-client.ts
index 7a21a02..7bb039a 100644
--- a/packages/core/src/siop/login-client.ts
+++ b/packages/core/src/siop/login-client.ts
@@ -11,7 +11,7 @@ import { withFetchTimeout } from "../http/timeout-fetch.js";
 
 /** The canonical authenticate Trust-Task type from trusttasks-tf.
  *  did-hosting + VTA + VTC all dispatch on this same URI. */
-const TASK_AUTH_AUTHENTICATE = "https://trusttasks.org/spec/auth/authenticate/0.1";
+import { TYPE_URI as TASK_AUTH_AUTHENTICATE } from "@openvtc/trust-tasks/auth/authenticate/0.1/payload";
 
 export interface SiopLoginResult {
   accessToken: string;
diff --git a/packages/core/src/vault/credentials.ts b/packages/core/src/vault/credentials.ts
new file mode 100644
index 0000000..4953b9a
--- /dev/null
+++ b/packages/core/src/vault/credentials.ts
@@ -0,0 +1,340 @@
+// The credential vault — the W3C credentials a holder **holds**.
+//
+// `vault/credentials/*`: invitations, memberships, roles. It shares the `vault`
+// slug and the agent's `vault` keyspace with the password-manager surface in
+// this directory, and is otherwise a different thing — the two use disjoint key
+// namespaces, and a credential body is a presentable VC rather than a raw
+// secret, so nothing here builds or opens a sealed envelope.
+//
+// Distinct again from `../credentials/`, which is the *exchange* protocol
+// (offer, request, present), and from `../admin/credentials.ts`, which is the
+// agent as an **issuer**. This module is the holder's own store.
+//
+// ## Query enumerates; get discloses
+//
+// `credVaultQuery` returns body-free descriptors and `credVaultGet` returns the
+// credential itself, and they are separate calls on purpose: a consumer can
+// browse its own vault continuously while the far narrower act of reading a
+// credential's contents stays a separate, separately-recorded request. A caller
+// that finds itself calling `credVaultGet` in a loop to populate a list has
+// mistaken the two.
+//
+// **`credVaultQuery` refuses an unconstrained filter**, and so must callers.
+// An empty filter returns the shape of the holder's whole life — every
+// community, every role, every issuer — so the agent rejects it rather than
+// answering. `includeArchived` and `includeDeleted` are modifiers and do not
+// satisfy the requirement; `{ includeDeleted: true }` alone is an enumeration
+// wearing a flag. {@link isRunnableCredentialQuery} is the local check, so a
+// caller can disable a control rather than discover this from a rejection.
+//
+// Wire types come from `@openvtc/trust-tasks`, generated from the same JSON
+// Schemas the agent is generated from. Specified in
+// `dtgwg-trust-tasks-tf#338`, which wrote the family down from the
+// implementation that had been dispatching it unspecified.
+
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
+import { buildTrustTask } from "../vta/trust-task.js";
+
+import {
+  TYPE_URI as CRED_QUERY,
+  RESPONSE_TYPE_URI as CRED_QUERY_RESPONSE,
+  type VaultCredentialsQueryResponsePayload,
+  type CredentialDescriptor,
+  type CredentialStatus,
+} from "@openvtc/trust-tasks/vault/credentials/query/0.1/payload";
+import {
+  TYPE_URI as CRED_GET,
+  RESPONSE_TYPE_URI as CRED_GET_RESPONSE,
+  type VaultCredentialsGetResponsePayload,
+} from "@openvtc/trust-tasks/vault/credentials/get/0.1/payload";
+import {
+  TYPE_URI as CRED_RECEIVE,
+  RESPONSE_TYPE_URI as CRED_RECEIVE_RESPONSE,
+  type VaultCredentialsReceiveResponsePayload,
+} from "@openvtc/trust-tasks/vault/credentials/receive/0.1/payload";
+import {
+  TYPE_URI as CRED_ARCHIVE,
+  RESPONSE_TYPE_URI as CRED_ARCHIVE_RESPONSE,
+} from "@openvtc/trust-tasks/vault/credentials/archive/0.1/payload";
+import {
+  TYPE_URI as CRED_UNARCHIVE,
+  RESPONSE_TYPE_URI as CRED_UNARCHIVE_RESPONSE,
+} from "@openvtc/trust-tasks/vault/credentials/unarchive/0.1/payload";
+import {
+  TYPE_URI as CRED_DELETE,
+  RESPONSE_TYPE_URI as CRED_DELETE_RESPONSE,
+} from "@openvtc/trust-tasks/vault/credentials/delete/0.1/payload";
+import {
+  TYPE_URI as CRED_RESTORE,
+  RESPONSE_TYPE_URI as CRED_RESTORE_RESPONSE,
+} from "@openvtc/trust-tasks/vault/credentials/restore/0.1/payload";
+import {
+  TYPE_URI as CRED_PURGE,
+  RESPONSE_TYPE_URI as CRED_PURGE_RESPONSE,
+} from "@openvtc/trust-tasks/vault/credentials/purge/0.1/payload";
+
+export type { CredentialDescriptor, CredentialStatus };
+
+/** Archival state. **Orthogonal to validity** — a credential can be `valid`
+ *  and `archived`, or `revoked` and `active`. A caller that collapses the two
+ *  axes mis-renders its own vault: "can I present this?" needs both, and only
+ *  an `active` one may be presented. */
+export type CredentialLifecycle = "active" | "archived" | "deleted";
+
+export interface CredVaultCallerParams {
+  /** Envelope `issuer`. */
+  holder: TaskParty;
+  /** The agent — envelope `recipient`. */
+  service: TaskParty;
+}
+
+/** The indexed fields a query may constrain on. At least one is REQUIRED. */
+export interface CredentialFilter {
+  /** Match credentials carrying this VC `type` tag. */
+  type?: string;
+  /** Match credentials held for this community or context DID. */
+  communityDid?: string;
+  /** Match credentials from this issuer DID. */
+  issuerDid?: string;
+  /** Match the agent's semantic classification — `invite`, `membership`,
+   *  `role`, `endorsement`, `personhood`, or an agent-defined token. */
+  purpose?: string;
+  /** Match the validity dimension. */
+  status?: CredentialStatus;
+}
+
+export interface CredVaultQueryParams extends CredVaultCallerParams, CredentialFilter {
+  /** Also return archived credentials. A **modifier, not a filter** — it does
+   *  not satisfy the at-least-one-filter requirement. */
+  includeArchived?: boolean;
+  /** Also return soft-deleted tombstones, so a trash view can offer restore or
+   *  purge. Same modifier semantics. */
+  includeDeleted?: boolean;
+}
+
+/**
+ * Whether this filter is one the agent will run.
+ *
+ * Exported so a caller can decide *before* sending — a search box that knows
+ * an empty query is refused can stay disabled and say why, rather than firing a
+ * request that comes back as an error the user has to interpret.
+ *
+ * The modifiers are deliberately not counted. They widen what a filter matches;
+ * they do not constrain anything.
+ */
+export function isRunnableCredentialQuery(filter: CredentialFilter): boolean {
+  return Boolean(
+    filter.type || filter.communityDid || filter.issuerDid || filter.purpose || filter.status,
+  );
+}
+
+/**
+ * Search stored credentials. Returns **body-free** descriptors.
+ *
+ * Throws before sending when the filter constrains nothing — the agent would
+ * refuse it as an enumeration, and failing here names the reason at the call
+ * site instead of surfacing a `filterRequired` from three layers down.
+ */
+export async function credVaultQuery(
+  sender: TrustTaskSender,
+  params: CredVaultQueryParams,
+): Promise<CredentialDescriptor[]> {
+  if (!isRunnableCredentialQuery(params)) {
+    throw new Error(
+      "vault/credentials/query needs at least one of type, communityDid, issuerDid, purpose " +
+        "or status. An unconstrained query enumerates the whole vault and the agent refuses " +
+        "it; includeArchived and includeDeleted are modifiers and do not count.",
+    );
+  }
+  const envelope = buildTrustTask(
+    CRED_QUERY,
+    {
+      ...(params.type ? { type: params.type } : {}),
+      ...(params.communityDid ? { communityDid: params.communityDid } : {}),
+      ...(params.issuerDid ? { issuerDid: params.issuerDid } : {}),
+      ...(params.purpose ? { purpose: params.purpose } : {}),
+      ...(params.status ? { status: params.status } : {}),
+      ...(params.includeArchived ? { includeArchived: true } : {}),
+      ...(params.includeDeleted ? { includeDeleted: true } : {}),
+    },
+    { issuer: params.holder.did, recipient: params.service.did },
+  );
+  const res = await sender.send<VaultCredentialsQueryResponsePayload>(envelope, {
+    expectedResponseType: CRED_QUERY_RESPONSE,
+    operationLabel: "vault/credentials/query/0.1",
+  });
+  return res.credentials ?? [];
+}
+
+export interface CredVaultGetParams extends CredVaultCallerParams {
+  /** Handle from a {@link CredentialDescriptor}. Opaque — never derive one. */
+  id: string;
+}
+
+/**
+ * Fetch one credential's full body, for presentation.
+ *
+ * The only call in this module that returns credential contents. An archived or
+ * soft-deleted credential is not returned: those states mean "not for use", and
+ * a body handed back is a body that can be presented.
+ *
+ * Hold the result no longer than the presentation it was fetched for. The agent
+ * remains the record — only it sees a later revocation or lifecycle change, and
+ * a cached body outlives both.
+ */
+export async function credVaultGet(
+  sender: TrustTaskSender,
+  params: CredVaultGetParams,
+): Promise<Record<string, unknown>> {
+  const envelope = buildTrustTask(
+    CRED_GET,
+    { id: params.id },
+    { issuer: params.holder.did, recipient: params.service.did },
+  );
+  const res = await sender.send<VaultCredentialsGetResponsePayload>(envelope, {
+    expectedResponseType: CRED_GET_RESPONSE,
+    operationLabel: "vault/credentials/get/0.1",
+  });
+  return res.credential as Record<string, unknown>;
+}
+
+export interface CredVaultReceiveParams extends CredVaultCallerParams {
+  /** The verifiable credential. */
+  credential: Record<string, unknown>;
+  /** Handle to store under. Absent, the agent derives one from the
+   *  credential's own `id`. Supplying it makes a retry after an ambiguous
+   *  failure replace rather than duplicate. */
+  id?: string;
+  /** Context to hold it in. Absent, the caller's own. */
+  contextId?: string;
+  /** Credential format, where the body does not make it evident. */
+  format?: string;
+}
+
+/**
+ * Verify and store a received credential.
+ *
+ * The agent verifies the proof against the issuer key resolved from its DID
+ * **before** storing, and stores nothing that fails. There is no `purpose`
+ * parameter on purpose: the agent derives the classification from the
+ * credential's type tags, so a caller cannot file a credential under a
+ * classification its contents do not support.
+ */
+export async function credVaultReceive(
+  sender: TrustTaskSender,
+  params: CredVaultReceiveParams,
+): Promise<VaultCredentialsReceiveResponsePayload> {
+  const envelope = buildTrustTask(
+    CRED_RECEIVE,
+    {
+      credential: params.credential,
+      ...(params.id ? { id: params.id } : {}),
+      ...(params.contextId ? { contextId: params.contextId } : {}),
+      ...(params.format ? { format: params.format } : {}),
+    },
+    { issuer: params.holder.did, recipient: params.service.did },
+  );
+  return sender.send<VaultCredentialsReceiveResponsePayload>(envelope, {
+    expectedResponseType: CRED_RECEIVE_RESPONSE,
+    operationLabel: "vault/credentials/receive/0.1",
+  });
+}
+
+/** What a lifecycle transition reports back. `lifecycle` is the state *after*
+ *  it — echoed rather than inferred from the verb that was called. */
+export interface CredVaultLifecycleResult {
+  id: string;
+  lifecycle: CredentialLifecycle;
+  /** Restore deadline. Present after a default `delete`; **absent after a
+   *  forced one**, and that absence is how a caller knows nothing can be
+   *  restored. */
+  graceUntil?: string;
+}
+
+export interface CredVaultLifecycleParams extends CredVaultCallerParams {
+  id: string;
+  /** Recorded with the transition. Must not carry credential contents — it
+   *  lands in a trail read by people entitled to know a credential changed
+   *  state without being entitled to know what it said. */
+  reason?: string;
+}
+
+function lifecycleCall(
+  sender: TrustTaskSender,
+  params: CredVaultLifecycleParams,
+  type: string,
+  responseType: string,
+  label: string,
+  extra: Record<string, unknown> = {},
+): Promise<CredVaultLifecycleResult> {
+  const envelope = buildTrustTask(
+    type,
+    { id: params.id, ...(params.reason ? { reason: params.reason } : {}), ...extra },
+    { issuer: params.holder.did, recipient: params.service.did },
+  );
+  return sender.send<CredVaultLifecycleResult>(envelope, {
+    expectedResponseType: responseType,
+    operationLabel: label,
+  });
+}
+
+/** Hide from default query results and refuse for presentation. Reversible
+ *  with {@link credVaultUnarchive}; the credential is untouched. */
+export function credVaultArchive(
+  sender: TrustTaskSender,
+  params: CredVaultLifecycleParams,
+): Promise<CredVaultLifecycleResult> {
+  return lifecycleCall(
+    sender, params, CRED_ARCHIVE, CRED_ARCHIVE_RESPONSE, "vault/credentials/archive/0.1");
+}
+
+/** Return an archived credential to active. Refuses a soft-deleted one — that
+ *  comes back through {@link credVaultRestore}, which has a deadline. */
+export function credVaultUnarchive(
+  sender: TrustTaskSender,
+  params: CredVaultLifecycleParams,
+): Promise<CredVaultLifecycleResult> {
+  return lifecycleCall(
+    sender, params, CRED_UNARCHIVE, CRED_UNARCHIVE_RESPONSE, "vault/credentials/unarchive/0.1");
+}
+
+export interface CredVaultDeleteParams extends CredVaultLifecycleParams {
+  /**
+   * Erase immediately instead of tombstoning. **Irrecoverable** — no grace
+   * window, no restore, and the result carries no `graceUntil`.
+   *
+   * The default path exists because a credential cannot be re-obtained by
+   * asking nicely: re-issuance means going back to the issuer, and for an
+   * invitation or a one-time membership that may not be possible at all.
+   */
+  force?: boolean;
+}
+
+/** Move to a recoverable tombstone, or erase outright with `force`. */
+export function credVaultDelete(
+  sender: TrustTaskSender,
+  params: CredVaultDeleteParams,
+): Promise<CredVaultLifecycleResult> {
+  return lifecycleCall(
+    sender, params, CRED_DELETE, CRED_DELETE_RESPONSE, "vault/credentials/delete/0.1",
+    params.force ? { force: true } : {});
+}
+
+/** Return a soft-deleted credential to active, while its grace window lasts.
+ *  After `graceUntil` the agent has erased it and there is nothing to restore. */
+export function credVaultRestore(
+  sender: TrustTaskSender,
+  params: CredVaultLifecycleParams,
+): Promise<CredVaultLifecycleResult> {
+  return lifecycleCall(
+    sender, params, CRED_RESTORE, CRED_RESTORE_RESPONSE, "vault/credentials/restore/0.1");
+}
+
+/** Erase immediately and irrecoverably. No tombstone, no grace window. */
+export function credVaultPurge(
+  sender: TrustTaskSender,
+  params: CredVaultLifecycleParams,
+): Promise<CredVaultLifecycleResult> {
+  return lifecycleCall(
+    sender, params, CRED_PURGE, CRED_PURGE_RESPONSE, "vault/credentials/purge/0.1");
+}
diff --git a/packages/core/src/vault/index.ts b/packages/core/src/vault/index.ts
index 74bc0cf..ca449fc 100644
--- a/packages/core/src/vault/index.ts
+++ b/packages/core/src/vault/index.ts
@@ -5,5 +5,9 @@ export * from "./delete.js";
 export * from "./release.js";
 export * from "./proxy-login.js";
 export * from "./sign-trust-task.js";
+// The credential vault — the credentials a holder *holds*. Shares this slug
+// and the agent's keyspace with the secrets surface above, and is otherwise a
+// different store; see the module header.
+export * from "./credentials.js";
 export * from "./task-signer.js";
 export type { VtaAuthInputs } from "../vta/auth.js";
diff --git a/packages/core/src/vta/auth.ts b/packages/core/src/vta/auth.ts
index d24581f..d745ac2 100644
--- a/packages/core/src/vta/auth.ts
+++ b/packages/core/src/vta/auth.ts
@@ -30,7 +30,7 @@ import { packAuthcrypt, type Identity } from "../didcomm/index.js";
 import type { RemoteDidcommEndpoint } from "./didcomm.js";
 import { withFetchTimeout } from "../http/timeout-fetch.js";
 
-const VTA_AUTHENTICATE = "https://trusttasks.org/spec/auth/authenticate/0.1";
+import { TYPE_URI as VTA_AUTHENTICATE } from "@openvtc/trust-tasks/auth/authenticate/0.1/payload";
 
 /** Reuse window — kept well under the server's ~15-minute token TTL so a
  *  cached token can't be served past expiry (clock-skew safety margin). */
diff --git a/packages/core/src/vta/channel.ts b/packages/core/src/vta/channel.ts
index e76c7a2..4785d5b 100644
--- a/packages/core/src/vta/channel.ts
+++ b/packages/core/src/vta/channel.ts
@@ -25,6 +25,26 @@ export interface TrustTaskSender {
   send<Res>(envelope: TrustTask<unknown>, opts?: SendOpts): Promise<Res>;
 }
 
+/**
+ * A party named on a Trust-Task envelope — the `issuer` or the `recipient`.
+ *
+ * Deliberately just the DID. Building an envelope needs nothing else: an
+ * `Identity` carries key material and a `RemoteDidcommEndpoint` carries a
+ * key-agreement JWK, and neither is read when the only question is "whose DID
+ * goes in this field". Both structurally satisfy this, so a caller that holds
+ * one passes it unchanged.
+ *
+ * Asking for more than this is not free. A surface typed on `Identity` can only
+ * be called from somewhere holding a private key, which forces key material
+ * into callers that compose documents without ever signing them — the
+ * management console being the case in point: it builds admin tasks and hands
+ * them to the device to mint and sign, and holds no key of its own. Typing the
+ * envelope's parties by what they actually are keeps that possible.
+ */
+export interface TaskParty {
+  did: string;
+}
+
 export interface SendOpts {
   /** Expected response document `type` (the `<request>#response` URI). When
    *  set, a reply whose `type` is neither this nor a trust-task-error is a
diff --git a/packages/core/src/vta/contexts.ts b/packages/core/src/vta/contexts.ts
index 9d1c6d4..918c6f7 100644
--- a/packages/core/src/vta/contexts.ts
+++ b/packages/core/src/vta/contexts.ts
@@ -1,103 +1,79 @@
-// Contexts — list + create, as dispatcher trust-tasks.
+// Contexts — the `vta/contexts/*` family, as dispatcher trust-tasks.
 //
 // The popup's AddEntryForm fetches the operator's accessible contexts (to
 // populate the context picker) and can create a new context inline. Both run
 // as canonical trust-tasks over a TrustTaskChannel/VtaSession, so they work on
 // a DIDComm-only VTA as well as REST.
 //
-//   list   → https://trusttasks.org/spec/vta/contexts/list/1.0    (payload {})
-//   create → https://trusttasks.org/spec/vta/contexts/create/1.0  (super-admin)
-//
-// Wire shapes mirror `vta-sdk::protocols::context_management::{list,create}`:
-// snake_case fields, `CreateContextResultBody` as the record. The VTA also
-// exposes a bespoke `GET/POST /contexts` REST route (now deprecated) — the
-// trust-task dispatcher form is the canonical one.
+// **Every URI and the record shape come from `@openvtc/trust-tasks`.** They
+// used to be hand-written here, alongside a hand-declared `ContextRecord` and a
+// header claiming the wire was snake_case. None of that was true any more, and
+// two of them were wrong in a way nothing would have caught: the hand-written
+// record typed `did` and `description` as `string | null`, where the published
+// schema makes them OPTIONAL — an agent omits them, so a caller testing
+// `=== null` never matches, and TypeScript agrees with the caller. Taking the
+// type from the binding means the schema is the only place that shape is
+// stated.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "./channel.js";
-import type { RemoteDidcommEndpoint } from "./didcomm.js";
+import type { TaskParty, TrustTaskSender } from "./channel.js";
 import { RestChannel, type RestChannelOptions } from "./rest-channel.js";
 import { buildTrustTask } from "./trust-task.js";
 
-const TASK_CONTEXTS_LIST = "https://trusttasks.org/spec/vta/contexts/list/1.0";
-const TASK_CONTEXTS_LIST_RESPONSE = `${TASK_CONTEXTS_LIST}#response`;
-const TASK_CONTEXTS_CREATE = "https://trusttasks.org/spec/vta/contexts/create/1.0";
-const TASK_CONTEXTS_GET = "https://trusttasks.org/spec/vta/contexts/get/1.0";
-const TASK_CONTEXTS_GET_RESPONSE = `${TASK_CONTEXTS_GET}#response`;
-const TASK_CONTEXTS_UPDATE = "https://trusttasks.org/spec/vta/contexts/update/1.0";
-const TASK_CONTEXTS_UPDATE_RESPONSE = `${TASK_CONTEXTS_UPDATE}#response`;
-const TASK_CONTEXTS_UPDATE_DID = "https://trusttasks.org/spec/vta/contexts/update-did/1.0";
-const TASK_CONTEXTS_UPDATE_DID_RESPONSE = `${TASK_CONTEXTS_UPDATE_DID}#response`;
-const TASK_CONTEXTS_CREATE_RESPONSE = `${TASK_CONTEXTS_CREATE}#response`;
+import {
+  TYPE_URI as TASK_CONTEXTS_LIST,
+  RESPONSE_TYPE_URI as TASK_CONTEXTS_LIST_RESPONSE,
+  type ContextRecord,
+} from "@openvtc/trust-tasks/vta/contexts/list/1.0/payload";
+import {
+  TYPE_URI as TASK_CONTEXTS_CREATE,
+  RESPONSE_TYPE_URI as TASK_CONTEXTS_CREATE_RESPONSE,
+} from "@openvtc/trust-tasks/vta/contexts/create/1.0/payload";
+import {
+  TYPE_URI as TASK_CONTEXTS_GET,
+  RESPONSE_TYPE_URI as TASK_CONTEXTS_GET_RESPONSE,
+} from "@openvtc/trust-tasks/vta/contexts/get/1.0/payload";
+import {
+  TYPE_URI as TASK_CONTEXTS_UPDATE,
+  RESPONSE_TYPE_URI as TASK_CONTEXTS_UPDATE_RESPONSE,
+} from "@openvtc/trust-tasks/vta/contexts/update/1.0/payload";
+import {
+  TYPE_URI as TASK_CONTEXTS_UPDATE_DID,
+  RESPONSE_TYPE_URI as TASK_CONTEXTS_UPDATE_DID_RESPONSE,
+} from "@openvtc/trust-tasks/vta/contexts/update-did/1.0/payload";
 
-/** One context record — mirrors `CreateContextResultBody` (the shape returned
- *  by both list and create). snake_case on the wire. */
-export interface ContextRecord {
-  id: string;
-  name: string;
-  did: string | null;
-  description: string | null;
-  /** Parent context id, or absent for a top-level context. */
-  parent?: string;
-  /** Resolved path from the root context — derived by the VTA, not settable. */
-  basePath: string;
-  createdAt: string;
-  updatedAt: string;
-}
+/** One context record, as the registry declares it. Re-exported so callers
+ *  need not know which task's binding it happens to live under. */
+export type { ContextRecord };
 
 
-/**
- * Read a member that the agent may still spell in snake_case.
- *
- * SPEC §4.10 makes lowerCamelCase the wire contract, and the VTA now emits it —
- * but an agent that has not taken that change yet still sends the old spelling,
- * and this library talks to agents it does not control. Accepting both on read
- * is Postel's other half; this library emits only the canonical form.
- *
- * Delete once no supported agent predates the fold.
- */
-export function fold(
-  raw: Record<string, unknown>,
-  pairs: readonly (readonly [string, string])[],
-): Record<string, unknown> {
-  const out: Record<string, unknown> = { ...raw };
-  for (const [camel, snake] of pairs) {
-    if (snake in out) {
-      if (!(camel in out)) out[camel] = out[snake];
-      delete out[snake];
-    }
-  }
-  return out;
-}
 
 /**
- * Accept either spelling of the record's members; hand back the canonical one.
+ * A context record as the agent sends it.
  *
- * Only rewrites what is present: a record that carries neither spelling of a
- * member keeps not carrying it, rather than gaining the key with `undefined`.
+ * This used to fold `base_path`/`created_at`/`updated_at` into the canonical
+ * spelling, on the reasoning that the library "talks to agents it does not
+ * control". That reasoning does not hold here and the fold was dead code:
+ * nothing is deployed, the wallet has never been published, and `ContextRecord`
+ * in `vta-sdk` carries `#[serde(rename_all = "camelCase")]` — so the agent
+ * *emits* camelCase and has done since the casing change. Its `alias`
+ * attributes are deserialize-only; they let it keep *accepting* the old
+ * spelling, which says nothing about what it sends.
+ *
+ * A fold kept past its cause is worse than none: it reads as a live constraint,
+ * and the next person maintaining this file has to work out whether some peer
+ * still needs it. SPEC §4.10 names one spelling — match it with `===`.
  */
-function normalizeContext(raw: Record<string, unknown>): ContextRecord {
-  const out: Record<string, unknown> = { ...raw };
-  for (const [camel, snake] of [
-    ["basePath", "base_path"],
-    ["createdAt", "created_at"],
-    ["updatedAt", "updated_at"],
-  ] as const) {
-    if (snake in out) {
-      if (!(camel in out)) out[camel] = out[snake];
-      delete out[snake];
-    }
-  }
-  return out as unknown as ContextRecord;
+function asContextRecord(raw: Record<string, unknown>): ContextRecord {
+  return raw as unknown as ContextRecord;
 }
 
 export interface ContextsListParams {
   /** Envelope `issuer` — the holder's DIDComm identity. Its DID must be in
    *  the VTA's ACL with any role (`contexts/list` is auth-gated, not
    *  admin-only; the VTA filters by `has_context_access`). */
-  holder: Identity;
+  holder: TaskParty;
   /** The VTA — envelope `recipient`. */
-  service: RemoteDidcommEndpoint;
+  service: TaskParty;
 }
 
 /** List the contexts the holder can access.
@@ -117,12 +93,12 @@ export async function contextsList(
     expectedResponseType: TASK_CONTEXTS_LIST_RESPONSE,
     operationLabel: "contexts/list/1.0",
   });
-  return (payload.contexts ?? []).map(normalizeContext);
+  return (payload.contexts ?? []).map(asContextRecord);
 }
 
 export interface ContextsCreateParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
   /** Leaf segment when `parent` is set (full path = `<parent>/<id>`), else a
    *  top-level id. Must be unique; a conflict rejects. */
   id: string;
@@ -155,19 +131,26 @@ export async function contextsCreate(
     expectedResponseType: TASK_CONTEXTS_CREATE_RESPONSE,
     operationLabel: "contexts/create/1.0",
   });
-  return normalizeContext(created);
+  return asContextRecord(created);
 }
 
 /** @deprecated REST-transport options. Kept for existing call sites; prefer
- *  {@link contextsList} with a channel from a `VtaSession`. */
-export interface VtaListContextsOptions extends ContextsListParams, RestChannelOptions {}
+ *  {@link contextsList} with a channel from a `VtaSession`.
+ *
+ *  `holder` and `service` come from {@link RestChannelOptions}, not from
+ *  {@link ContextsListParams}: composing the envelope needs only the two DIDs, but this
+ *  wrapper also *builds the channel*, and a channel signs and encrypts. The
+ *  narrower pair is what the wire actually requires here. */
+export interface VtaListContextsOptions
+  extends Omit<ContextsListParams, "holder" | "service">,
+    RestChannelOptions {}
 
 /** @deprecated Use {@link contextsList} with a channel from a `VtaSession`.
  *  List over REST — builds a one-shot {@link RestChannel} (dispatches
  *  `contexts/list/1.0` over `/trust-tasks`, NOT the bespoke `/contexts`). */
 export interface ContextsGetParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
   /** Context id — the full path for a nested context. */
   id: string;
 }
@@ -194,12 +177,12 @@ export async function contextsGet(
     expectedResponseType: TASK_CONTEXTS_GET_RESPONSE,
     operationLabel: "vta/contexts/get/1.0",
   });
-  return normalizeContext(payload);
+  return asContextRecord(payload);
 }
 
 export interface ContextsUpdateParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
   /** Context to update. The id itself cannot be changed. */
   id: string;
   /** New human-readable name. Omit to leave unchanged. */
@@ -235,12 +218,12 @@ export async function contextsUpdate(
     expectedResponseType: TASK_CONTEXTS_UPDATE_RESPONSE,
     operationLabel: "vta/contexts/update/1.0",
   });
-  return normalizeContext(payload);
+  return asContextRecord(payload);
 }
 
 export interface ContextsUpdateDidParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
   /** Context whose DID is being set. */
   id: string;
   /** The DID to associate with this context. */
@@ -261,7 +244,7 @@ export async function contextsUpdateDid(
     expectedResponseType: TASK_CONTEXTS_UPDATE_DID_RESPONSE,
     operationLabel: "vta/contexts/update-did/1.0",
   });
-  return normalizeContext(payload);
+  return asContextRecord(payload);
 }
 
 export function vtaListContexts(opts: VtaListContextsOptions): Promise<ContextRecord[]> {
@@ -269,8 +252,15 @@ export function vtaListContexts(opts: VtaListContextsOptions): Promise<ContextRe
 }
 
 /** @deprecated REST-transport options. Kept for existing call sites; prefer
- *  {@link contextsCreate} with a channel from a `VtaSession`. */
-export interface VtaCreateContextOptions extends ContextsCreateParams, RestChannelOptions {}
+ *  {@link contextsCreate} with a channel from a `VtaSession`.
+ *
+ *  `holder` and `service` come from {@link RestChannelOptions}, not from
+ *  {@link ContextsCreateParams}: composing the envelope needs only the two DIDs, but this
+ *  wrapper also *builds the channel*, and a channel signs and encrypts. The
+ *  narrower pair is what the wire actually requires here. */
+export interface VtaCreateContextOptions
+  extends Omit<ContextsCreateParams, "holder" | "service">,
+    RestChannelOptions {}
 
 /** @deprecated Use {@link contextsCreate} with a channel from a `VtaSession`.
  *  Create over REST — builds a one-shot {@link RestChannel}. */
diff --git a/packages/core/src/vta/list-dids.ts b/packages/core/src/vta/list-dids.ts
index 7a1837b..b753ca4 100644
--- a/packages/core/src/vta/list-dids.ts
+++ b/packages/core/src/vta/list-dids.ts
@@ -20,27 +20,23 @@ import type { TrustTaskSender } from "./channel.js";
 import type { RemoteDidcommEndpoint } from "./didcomm.js";
 import { RestChannel, type RestChannelOptions } from "./rest-channel.js";
 import { buildTrustTask } from "./trust-task.js";
-import { fold } from "./contexts.js";
 
-const TASK_WEBVH_DIDS_LIST_1_0 = "https://trusttasks.org/spec/vta/webvh/dids/list/1.0";
+import {
+  TYPE_URI as TASK_WEBVH_DIDS_LIST_1_0,
+  type WebvhDidRecord,
+} from "@openvtc/trust-tasks/vta/webvh/dids/list/1.0/payload";
 const TASK_WEBVH_DIDS_LIST_1_0_RESPONSE = `${TASK_WEBVH_DIDS_LIST_1_0}#response`;
 
-/** One webvh DID record as returned by `vta/webvh/dids/list/1.0`.
- *  Mirrors `vta-sdk::webvh::WebvhDidRecord` — **snake_case** on the
- *  wire. Only the fields the wallet consumes are typed; the VTA also
- *  sends `mnemonic`, `scid`, `log_entry_count`, timestamps, etc. which
- *  we ignore here. */
-export interface WebvhDidRecord {
-  /** The hosted DID (`did:webvh:…`). The persona a did-self-issued
-   *  entry acts AS — becomes the SIOP `iss`/`sub`. */
-  did: string;
-  /** Context this DID belongs to (matches a `ContextRecord.id`). */
-  contextId: string;
-  /** Hosting server the DID is registered with. */
-  serverId?: string;
-  /** Whether the DID is portable across hosting servers. */
-  portable?: boolean;
-}
+/** A hosted DID as the registry declares it.
+ *
+ *  Taken from the binding rather than declared here. The hand-written version
+ *  this replaces had drifted in both directions at once: it marked `serverId`
+ *  and `portable` OPTIONAL where the schema makes them required, and it omitted
+ *  seven members the agent actually sends (`mnemonic`, `scid`, `logEntryCount`,
+ *  `preRotationCount`, `nextFragmentId`, `createdAt`, `updatedAt`). Neither
+ *  kind of drift announces itself: the first invites guards that can never
+ *  fire, the second hides data a caller would have used. */
+export type { WebvhDidRecord };
 
 interface ListDidsResultBody {
   dids?: WebvhDidRecord[];
@@ -84,16 +80,13 @@ export async function vtaListDids(
     expectedResponseType: TASK_WEBVH_DIDS_LIST_1_0_RESPONSE,
     operationLabel: "webvh/dids/list",
   });
-  // Accept either spelling while agents migrate to the canonical casing
-  // (SPEC §4.10). Changing the type alone would leave `contextId` undefined
-  // against an agent that has not taken the fold.
-  return (result.dids ?? []).map(
-    (d) =>
-      fold(d as unknown as Record<string, unknown>, [
-        ["contextId", "context_id"],
-        ["serverId", "server_id"],
-      ]) as unknown as WebvhDidRecord,
-  );
+  // No casing fold. `WebvhDidRecord` in `vta-sdk` carries
+  // `#[serde(rename_all = "camelCase")]`, so the agent emits `contextId` and
+  // `serverId`; its `alias` attributes are deserialize-only and say nothing
+  // about what it sends. Nothing is deployed, so "an agent that has not taken
+  // the fold" names no peer that exists — and a fold kept past its cause reads
+  // as a live constraint to whoever maintains this next.
+  return (result.dids ?? []) as unknown as WebvhDidRecord[];
 }
 
 /** @deprecated Use {@link vtaListDids} with a channel from a `VtaSession`.
diff --git a/packages/core/src/webvh/dids.ts b/packages/core/src/webvh/dids.ts
index 1040805..e595938 100644
--- a/packages/core/src/webvh/dids.ts
+++ b/packages/core/src/webvh/dids.ts
@@ -58,17 +58,18 @@ import {
   type Response as DidsRegisterWithServerResponse,
 } from "@openvtc/trust-tasks/vta/webvh/dids/register-with-server/1.0/payload";
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 export type { WebvhDidRecord, WebvhPathMode };
 
 /** Who is asking, and which agent is being asked. */
 export interface WebvhCall {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  /** Envelope `issuer`. Only the DID is read — see `TaskParty` in
+   *  `vta/channel.ts` for why this is not typed on `Identity`. */
+  holder: TaskParty;
+  /** Envelope `recipient`. */
+  service: TaskParty;
 }
 
 const send = <T>(
diff --git a/packages/core/task-surface.json b/packages/core/task-surface.json
index 9deb470..535ab34 100644
--- a/packages/core/task-surface.json
+++ b/packages/core/task-surface.json
@@ -2,7 +2,7 @@
   "$comment": "Generated by scripts/sync-task-surface.mjs from a vta-sdk checkout. Do not hand-edit: re-run the script. Checked by tests/task-surface.mjs.",
   "source": {
     "crate": "vta-sdk",
-    "version": "0.30.0",
+    "version": "0.32.3",
     "scanned": "vta-sdk/src/**/*.rs"
   },
   "tasks": [
@@ -416,10 +416,16 @@
       "uri": "https://trusttasks.org/spec/provision/integration/0.1"
     },
     {
-      "uri": "https://trusttasks.org/spec/provision/integration/0.2"
+      "uri": "https://trusttasks.org/spec/provision/integration/0.2",
+      "consts": [
+        "V0_2"
+      ]
     },
     {
-      "uri": "https://trusttasks.org/spec/provision/integration/0.3"
+      "uri": "https://trusttasks.org/spec/provision/integration/0.3",
+      "consts": [
+        "V0_3"
+      ]
     },
     {
       "uri": "https://trusttasks.org/spec/push/wake/0.2"
@@ -672,6 +678,9 @@
     {
       "uri": "https://trusttasks.org/spec/vta/credentials/issue/0.2"
     },
+    {
+      "uri": "https://trusttasks.org/spec/vta/credentials/list/0.1"
+    },
     {
       "uri": "https://trusttasks.org/spec/vta/credentials/revoke/0.1"
     },
diff --git a/packages/core/tests/schema-types-are-not-restated.mjs b/packages/core/tests/schema-types-are-not-restated.mjs
new file mode 100644
index 0000000..24c0aab
--- /dev/null
+++ b/packages/core/tests/schema-types-are-not-restated.mjs
@@ -0,0 +1,135 @@
+// A type the registry declares must not be declared here as well.
+//
+// ## What went wrong
+//
+// `ContextRecord` and `WebvhDidRecord` were written out by hand in this
+// library, alongside the generated ones in `@openvtc/trust-tasks`. Both had
+// drifted, in opposite directions, and neither drift could fail anything:
+//
+//   * `ContextRecord.did` was typed `string | null`. The schema makes it
+//     OPTIONAL — a conforming agent omits the member — so a caller guarding
+//     with `=== null` never matches, and TypeScript agrees with the caller.
+//   * `WebvhDidRecord` marked `serverId` and `portable` optional where the
+//     schema makes them required, and omitted seven members the agent sends
+//     (`mnemonic`, `scid`, `logEntryCount`, `createdAt`, …). Data the caller
+//     could have used simply was not visible.
+//
+// Nothing else in this repo would have caught either. `task-surface.mjs` checks
+// that the URIs this library names exist and are current; it says nothing about
+// payload SHAPES. The type is the one part of a Trust Task that is checked
+// against a copy rather than against the schema.
+//
+// ## The rule
+//
+// If `@openvtc/trust-tasks` exports a shared component type, this library uses
+// it — it does not restate it. Four more (`WakeHandle`, `WakeTriggerPolicy`,
+// `Exposure`, `StatePin`) were byte-identical to the generated ones when this
+// test was written, which is not reassuring: identical is the state a type is
+// in immediately before it diverges, and a duplicate that has not drifted yet
+// is a duplicate that will.
+//
+// ## The exception, and why it is narrow
+//
+// A local type MAY narrow a generated one where the browser knows more than the
+// schema can say — see `NARROWING`. It must say so, and it must be a
+// restriction, never an addition: the schema is the wider contract and a local
+// type that ADDS a member is asserting something the agent never promised.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, readdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const SRC = fileURLToPath(new URL("../src", import.meta.url));
+// Located from a real subpath, resolved through ESM.
+//
+// Two traps here, both worth naming. The package's `exports` map does not
+// expose its own `package.json`, so the usual `require.resolve(pkg +
+// "/package.json")` fails; and its subpaths are a bare `./*` pattern, which
+// CJS `require.resolve` will not match even though `import` does. So this uses
+// `import.meta.resolve` — the same resolver the source files use.
+const COMPONENTS = join(
+  dirname(fileURLToPath(import.meta.resolve("@openvtc/trust-tasks/vta/contexts/list/1.0/payload"))),
+  "../../../../_shared/components.d.ts",
+);
+
+/**
+ * Types this library deliberately restates, each with the reason.
+ *
+ * An entry is a claim that the local declaration says something TRUER for a
+ * browser than the schema can — not that importing it would be inconvenient.
+ */
+const NARROWING = {
+  PasskeyVerificationMethod:
+    "narrows `webauthnTransports` from the schema's `string[]` to the DOM's " +
+    "`AuthenticatorTransport` union. The schema cannot name a browser type, and " +
+    "a caller passing these to `navigator.credentials` wants the narrow one.",
+};
+
+const files = (dir) =>
+  readdirSync(dir, { withFileTypes: true }).flatMap((e) =>
+    e.isDirectory() ? files(join(dir, e.name)) : e.name.endsWith(".ts") ? [join(dir, e.name)] : [],
+  );
+
+const generated = new Set(
+  [...readFileSync(COMPONENTS, "utf8").matchAll(/export (?:interface|type) ([A-Za-z0-9_]+)/g)].map(
+    (m) => m[1],
+  ),
+);
+
+test("the generated component list is real, so none of this passes vacuously", () => {
+  assert.ok(
+    generated.size > 100,
+    `found only ${generated.size} generated component types — the path to ` +
+      `components.d.ts is stale and this test now checks nothing`,
+  );
+  assert.ok(generated.has("ContextRecord"), "components.d.ts does not look like the right file");
+});
+
+// `export type X = SomeIdentifier;` is the *fix* pattern, not the defect: it
+// aliases the generated type, so the shape still has one source. Only an inline
+// body — `= {`, `= "a" | "b"`, `= Foo[]` — restates it. This distinction was
+// missing when the test was first written, and it hid two: `KeyRecord` (a
+// correct alias) and `PushRegistration` (an inline restatement of a union the
+// schema declares as `Apns | Fcm | WebPush`).
+const ALIAS_TO_IDENTIFIER = /^\s*[A-Za-z0-9_.]+(<[^;]*>)?\s*;/;
+
+test("no schema component type is restated by hand", () => {
+  const restated = [];
+  for (const file of files(SRC)) {
+    const rel = file.slice(SRC.length + 1);
+    const src = readFileSync(file, "utf8");
+
+    for (const m of src.matchAll(/export interface ([A-Za-z0-9_]+)/g)) {
+      if (generated.has(m[1]) && !(m[1] in NARROWING)) restated.push(`${m[1]}  (${rel})`);
+    }
+    for (const m of src.matchAll(/export type ([A-Za-z0-9_]+)\s*=/g)) {
+      if (!generated.has(m[1]) || m[1] in NARROWING) continue;
+      const rhs = src.slice(m.index + m[0].length);
+      if (!ALIAS_TO_IDENTIFIER.test(rhs)) restated.push(`${m[1]}  (${rel})`);
+    }
+  }
+
+  assert.deepEqual(
+    restated.sort(),
+    [],
+    `these types are declared here and also generated from a published schema:\n  ` +
+      `${restated.join("\n  ")}\n\n` +
+      `Import the generated one instead — a hand-written copy drifts silently, ` +
+      `because nothing compares the two. Aliasing it (\`export type X = Generated;\`) ` +
+      `is fine and is how the narrowing cases are written. If the local type ` +
+      `deliberately NARROWS the generated one for a browser caller, add it to ` +
+      `NARROWING with the reason.`,
+  );
+});
+
+test("every NARROWING entry still names a generated type", () => {
+  const stale = Object.keys(NARROWING).filter((n) => !generated.has(n));
+  assert.deepEqual(
+    stale,
+    [],
+    `these NARROWING entries no longer name a generated component type — the ` +
+      `schema moved, so the exception is either unnecessary or now wrong: ${stale.join(", ")}`,
+  );
+});
diff --git a/packages/core/tests/task-surface.mjs b/packages/core/tests/task-surface.mjs
index f7aa593..ef70526 100644
--- a/packages/core/tests/task-surface.mjs
+++ b/packages/core/tests/task-surface.mjs
@@ -178,21 +178,52 @@ test("coverage against the agent's surface is recorded, not discovered", () => {
     [...REFERENCED.keys()].map(family).filter((f) => canonicalFamilies.has(f)),
   );
 
-  // 152 of 177 as of vta-sdk 0.29.0. It was 130 until the specced-but-
+  // 161 of 178 as of vta-sdk 0.32.3. It was 130 until the specced-but-
   // unimplemented gap was closed in one pass: `trust-task-discovery/0.1`,
   // `acl/update/0.1`, `vta/webvh/servers/retire-orphan/0.1`,
   // `vtc/members/removal-notice/0.1`, `vta/app-state/*` (6), `vta/services/*`
   // (8), `vta/credentials/{issue,revoke}/0.1`, and
   // `auth/passkey/login/{start,finish}/0.2`.
   //
-  // **All 25 still outstanding are unspecced** — no schema in the registry, so
-  // no binding in @openvtc/trust-tasks to implement against: `vault/*`'s
-  // archive/restore/purge/unarchive and its whole `credentials` sub-family,
-  // `vta/backup/*`, `vta/attestation/*`, `vta/seeds/*`,
-  // `vta/audit/*-retention`, and `vta/management/reload-services`. That makes
-  // this number, for the first time, a statement about upstream rather than
-  // about this repo: it moves when a spec lands, not when someone here finds
-  // time.
+  // 160 -> 161 is `vta/credentials/list/0.1`, and the canonical total moved
+  // with it (177 -> 178) because the task did not exist on either side before.
+  // Specified at trustoverip/dtgwg-trust-tasks-tf#342 and implemented at
+  // OpenVTC/verifiable-trust-infrastructure#1235, in response to a gap this
+  // console surfaced: `revoke` is keyed on a `credentialId` that `issue`
+  // returns exactly once, so an issuer that had not recorded it could not ask.
+  // Unlike the eight below, this is not a family that moved off the unspecced
+  // list — it is new.
+  //
+  // 152 -> 160 is the whole `vault/credentials/*` sub-family — receive, query,
+  // get, archive, unarchive, delete, restore, purge — which moved here from
+  // the unspecced list rather than from a backlog. The agent had been
+  // dispatching all eight with no schema in the registry; specifying them
+  // (trustoverip/dtgwg-trust-tasks-tf#338, shipped in @openvtc/trust-tasks
+  // 0.16.4) is what produced bindings to implement against.
+  //
+  // 161 -> 163 is `vta/backup/abort` and `vta/management/reload-services`,
+  // specced at trustoverip/dtgwg-trust-tasks-tf#347 and shipped in
+  // @openvtc/trust-tasks 0.16.8. Same shape as the eight before them: the
+  // agent was already dispatching both with no schema in the registry.
+  //
+  // **`vta/backup/*` is now specced in full and deliberately implemented in
+  // part**, which makes it the first family whose absence is a decision rather
+  // than a gap upstream. All five verbs have bindings; this library exposes
+  // `abort` alone. `initiate-export` and `finalize-import` carry a `password`
+  // — the key to a complete copy of the agent, travelling inbound — and a
+  // browser is the wrong place to collect it, for reasons `admin/backup.ts`
+  // sets out at length. Do not "finish" the family to make this number
+  // rounder; the four that are missing are missing on purpose.
+  //
+  // **The other 15 outstanding are unspecced** — no schema in the registry, so
+  // no binding in @openvtc/trust-tasks to implement against: `vault/*`'s own
+  // archive/restore/purge/unarchive (the *secrets* lifecycle, distinct from
+  // the credential one above), `vta/attestation/*`, `vta/seeds/*` and
+  // `vta/audit/*-retention`.
+  //
+  // `vta/seeds/*` is a third category again, and will never move: it returns
+  // key material, and CI bans its URIs from every extension bundle including
+  // the console. A spec landing upstream would not change that.
   //
   // **Nothing is behind any more.** Every implemented family names the newest
   // version `vta-sdk` publishes: `vault/{list,get,upsert}` and
@@ -203,7 +234,7 @@ test("coverage against the agent's surface is recorded, not discovered", () => {
   // the agent does not name, rather than as a deprecation warning. That is the
   // expected shape of a cutover here: nothing is deployed, so neither side
   // keeps an old version alive.
-  const expected = 152;
+  const expected = 163;
   assert.equal(
     implemented.size,
     expected,
diff --git a/packages/core/tests/vault.ops.mjs b/packages/core/tests/vault.ops.mjs
index dc87a5e..9e79572 100644
--- a/packages/core/tests/vault.ops.mjs
+++ b/packages/core/tests/vault.ops.mjs
@@ -76,13 +76,13 @@ test("vaultSignTrustTask forwards the unsigned envelope and returns signedEnvelo
 });
 
 test("vtaListDids scopes by context and unwraps dids[]", async () => {
-  const ch = captureChannel({ dids: [{ did: "did:webvh:a", context_id: "work" }] });
+  const ch = captureChannel({ dids: [{ did: "did:webvh:a", contextId: "work" }] });
   const res = await vtaListDids(ch, { holder, service, contextId: "work" });
   assert.equal(ch.sent[0].envelope.type, "https://trusttasks.org/spec/vta/webvh/dids/list/1.0");
-  // camelCase: the schema names `contextId` and sets additionalProperties:false,
-  // so `context_id` was malformed rather than an accepted synonym. This
-  // assertion pinned the drift in place — the reply is still snake_case above,
-  // because the READ path deliberately folds both while agents migrate.
+  // camelCase both ways: the schema names `contextId` and sets
+  // additionalProperties:false, so `context_id` was malformed rather than an
+  // accepted synonym — and the agent emits the canonical spelling too, so the
+  // read path no longer folds.
   assert.deepEqual(ch.sent[0].envelope.payload, { contextId: "work" });
   assert.deepEqual(res, [{ did: "did:webvh:a", contextId: "work" }]);
 });
@@ -108,12 +108,21 @@ test("contextsCreate defaults name to id and forwards description/parent", async
 
 test("swapAcl sends acl/swap-key with currentSubject/newSubject/linkProof (ephemeral issuer)", async () => {
   const holderSigning = generateSigningIdentity();
+  // The response shape the AGENT sends (VTI #857): the realized entry wrapped,
+  // plus the DID swapped out. This fixture used to be a flat entry with `did`,
+  // `allowedContexts` and a numeric `createdAt` — built from the client's own
+  // hand-written type rather than from the schema, so it agreed with the drift
+  // instead of catching it. Nothing read it either, which is how a response
+  // type can be wrong in three ways and stay green.
   const ch = captureChannel({
-    did: holderSigning.did,
-    role: "admin",
-    allowedContexts: [],
-    createdAt: 1,
-    createdBy: "did:web:vta.example",
+    entry: {
+      subject: holderSigning.did,
+      role: "admin",
+      scopes: [],
+      createdAt: "2026-01-01T00:00:00Z",
+      createdBy: "did:web:vta.example",
+    },
+    previousSubject: "did:key:zEphemeral",
   });
   const res = await swapAcl(ch, {
     ephemeralDid: "did:key:zEphemeral",
@@ -126,12 +135,18 @@ test("swapAcl sends acl/swap-key with currentSubject/newSubject/linkProof (ephem
   assert.equal(envelope.recipient, "did:web:vta.example");
   assert.equal(envelope.payload.currentSubject, "did:key:zEphemeral");
   assert.equal(envelope.payload.newSubject, holderSigning.did);
+
+  // Assert the RESPONSE too. The absence of this is what let the return type
+  // drift: `sender.send<T>()` is an unchecked cast, so a wrong `T` costs
+  // nothing until a caller reads a field and gets `undefined`.
+  assert.equal(res.entry.subject, holderSigning.did);
+  assert.equal(res.entry.role, "admin");
+  assert.equal(res.previousSubject, "did:key:zEphemeral");
   assert.ok(
     typeof envelope.payload.linkProof === "string" && envelope.payload.linkProof.length > 0,
     "linkProof VP-JWT is present",
   );
   assert.equal(opts.expectedResponseType, "https://trusttasks.org/spec/acl/swap-key/0.1#response");
-  assert.equal(res.did, holderSigning.did);
 });
 
 test("ops accept a VtaSession (not just a raw channel) and route through it", async () => {
@@ -154,30 +169,6 @@ test("setDeviceWake sets the handle; omitting it clears", async () => {
   assert.deepEqual(ch2.sent[0].envelope.payload, {}); // clear
 });
 
-test("a context record still arrives from an agent that predates the casing fold", async () => {
-  // SPEC §4.10 makes lowerCamelCase the wire contract and the VTA now emits it,
-  // but this library talks to agents it does not control. The old spelling is
-  // accepted on read and normalised away — a caller never sees both.
-  const ch = captureChannel({
-    contexts: [
-      { id: "work", name: "Work", base_path: "/work", created_at: "t1", updated_at: "t2" },
-    ],
-  });
-  const [ctx] = await contextsList(ch, { holder, service });
-  assert.equal(ctx.basePath, "/work");
-  assert.equal(ctx.createdAt, "t1");
-  assert.equal(ctx.updatedAt, "t2");
-  assert.ok(!("base_path" in ctx), "the pre-fold spelling must not survive into the result");
-});
-
-test("a webvh DID record likewise", async () => {
-  const ch = captureChannel({ dids: [{ did: "did:webvh:a", context_id: "work", server_id: "prod" }] });
-  const [d] = await vtaListDids(ch, { holder, service });
-  assert.equal(d.contextId, "work");
-  assert.equal(d.serverId, "prod");
-  assert.ok(!("context_id" in d));
-});
-
 test("the canonical spelling is passed through untouched", async () => {
   const ch = captureChannel({ contexts: [{ id: "work", name: "Work", basePath: "/work" }] });
   const [ctx] = await contextsList(ch, { holder, service });
diff --git a/packages/core/tests/vta.list-dids-casing.mjs b/packages/core/tests/vta.list-dids-casing.mjs
index 5073dbe..2c29781 100644
--- a/packages/core/tests/vta.list-dids-casing.mjs
+++ b/packages/core/tests/vta.list-dids-casing.mjs
@@ -47,12 +47,14 @@ test("no filter sends an empty payload rather than an absent key set to undefine
   assert.deepEqual(ch.sent[0].envelope.payload, {});
 });
 
-test("the read path still folds a legacy record, because agents migrate later", async () => {
-  // Emitting the canonical spelling and accepting both are separate moves. An
-  // agent that has not taken the fold still answers `context_id`, and dropping
-  // the fold here would leave `contextId` undefined against it.
+test("the read path passes the canonical spelling straight through", async () => {
+  // The fold this replaced accepted `context_id`/`server_id` too, justified by
+  // "an agent that has not taken the fold". No such agent exists: nothing is
+  // deployed, and `WebvhDidRecord` in `vta-sdk` is `rename_all = "camelCase"`,
+  // so the agent emits the canonical spelling. Its `alias` attributes are
+  // deserialize-only — they govern what it accepts, not what it sends.
   const ch = recorder({
-    dids: [{ did: "did:webvh:QmA:h.example", context_id: "personal", server_id: "prod" }],
+    dids: [{ did: "did:webvh:QmA:h.example", contextId: "personal", serverId: "prod" }],
   });
   const [rec] = await vtaListDids(ch, { holder: HOLDER, service: SERVICE });
   assert.equal(rec.contextId, "personal");
diff --git a/packages/extension/manager.html b/packages/extension/manager.html
new file mode 100644
index 0000000..a5514c6
--- /dev/null
+++ b/packages/extension/manager.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>VTA Console</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/manager.tsx"></script>
+  </body>
+</html>
diff --git a/packages/extension/package.json b/packages/extension/package.json
index 23e296a..57d4bfd 100644
--- a/packages/extension/package.json
+++ b/packages/extension/package.json
@@ -6,7 +6,7 @@
   "type": "module",
   "scripts": {
     "dev": "vite build --watch --mode development",
-    "build": "tsc -b && vite build && vite build -c vite.config.background.ts",
+    "build": "tsc -b && vite build && vite build -c vite.config.background.ts && vite build -c vite.config.manager.ts",
     "lint": "tsc -b",
     "test": "node --test tests/*.test.mts",
     "package": "npm run build && node scripts/package.mjs",
diff --git a/packages/extension/src/active-vta.ts b/packages/extension/src/active-vta.ts
index 7c73e12..6d07f86 100644
--- a/packages/extension/src/active-vta.ts
+++ b/packages/extension/src/active-vta.ts
@@ -32,6 +32,44 @@ export function parseActiveVtaDid(raw: unknown): string | null {
   }
 }
 
+/**
+ * Make `vtaDid` the active agent, if the wallet has onboarded it.
+ *
+ * Writes the same `pnm-connection/v3` envelope the readers above parse, which
+ * is zustand's persisted blob. Read-modify-write rather than a blind set: the
+ * envelope carries the whole connection map, and replacing it wholesale from a
+ * partial view would forget every other VTA — the same class of bug the
+ * per-agent inbox map exists to prevent (see CLAUDE.md).
+ *
+ * Refuses a DID the wallet does not hold, matching `activateVta` in the store:
+ * activating an agent that was never onboarded would leave the console pointed
+ * at something it has no holder identity for.
+ *
+ * Returns whether the switch happened, so a caller can tell "done" from "that
+ * agent is not on this device" without inspecting storage itself.
+ */
+export async function setActiveVtaDid(vtaDid: string): Promise<boolean> {
+  const KEY = "pnm-connection/v3";
+  const stored = await chrome.storage.local.get(KEY);
+  const raw = stored[KEY];
+  if (typeof raw !== "string") return false;
+
+  let parsed: { state?: { connections?: { activeVtaDid?: string | null; vtas?: Record<string, unknown> } } };
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return false;
+  }
+
+  const connections = parsed.state?.connections;
+  if (!connections?.vtas || !(vtaDid in connections.vtas)) return false;
+  if (connections.activeVtaDid === vtaDid) return true;
+
+  connections.activeVtaDid = vtaDid;
+  await chrome.storage.local.set({ [KEY]: JSON.stringify(parsed) });
+  return true;
+}
+
 /** Enumerate every VTA the wallet has onboarded — keys of the
  *  persisted `vtas` map regardless of which one is active. Background
  *  uses this to drive the multi-listener inbound reconcile. Returns
diff --git a/packages/extension/src/app-shell.tsx b/packages/extension/src/app-shell.tsx
index 5f0e9ef..6c107da 100644
--- a/packages/extension/src/app-shell.tsx
+++ b/packages/extension/src/app-shell.tsx
@@ -265,6 +265,33 @@ export function AppShell({ advanced, vault }: { advanced: React.ReactNode; vault
           );
         })}
 
+        {/* The management console — a separate surface, and a separate tab.
+            Not a pane here: these four are the *wallet's* settings, and
+            administering the agent (granting authority, destroying contexts) is
+            a different job with a different blast radius. It also ships as its
+            own bundle, which is what keeps `@openvtc/pnm-core/admin` out of
+            every wallet surface — see `vite.config.manager.ts`. */}
+        <button
+          onClick={() => void chrome.tabs.create({ url: chrome.runtime.getURL("manager.html") })}
+          style={{
+            display: "flex",
+            alignItems: "center",
+            gap: 10,
+            marginTop: 10,
+            padding: "7px 9px",
+            borderRadius: "var(--w-r-sm)",
+            border: `1px solid ${c.line}`,
+            background: "transparent",
+            color: c.muted,
+            fontSize: t.base,
+            textAlign: "left",
+            cursor: "pointer",
+            width: "100%",
+          }}
+        >
+          Manage agent&nbsp;↗
+        </button>
+
         {/* Both roles, always visible. The wallet's whole authority model is
             that these are two identities with different powers; showing only
             one of them made the split something you had to go and look for.
diff --git a/packages/extension/src/background.ts b/packages/extension/src/background.ts
index 8e3bea8..43675fd 100644
--- a/packages/extension/src/background.ts
+++ b/packages/extension/src/background.ts
@@ -106,6 +106,7 @@ import {
   RUNTIME_ONBOARD_PREPARE,
   PAGE_FACING_RUNTIME_TYPES,
   RUNTIME_REQUEST_TASK,
+  RUNTIME_MANAGER_TASK,
   RUNTIME_SIGN_TRUST_TASK,
   RUNTIME_TASK_CONSENT,
   CONSENT_KEEPALIVE_PORT,
@@ -153,6 +154,8 @@ import {
   OFFSCREEN_REQUEST_TASK,
   type RuntimeRequestTaskRequest,
   type RuntimeRequestTaskResponse,
+  type RuntimeManagerTaskRequest,
+  type RuntimeManagerTaskResponse,
   type RuntimeSignTrustTaskRequest,
   type RuntimeSignTrustTaskResponse,
   type RuntimeStepUpConsentRequest,
@@ -1676,6 +1679,72 @@ async function handleRequestTask(
   return res;
 }
 
+/**
+ * True when this message came from one of the extension's own pages.
+ *
+ * `sender.id === chrome.runtime.id` — already checked for every message — does
+ * NOT answer this: a content script is our script, injected into someone else's
+ * page, and passes it. `sender.url` is set by the browser from the context the
+ * message actually left, so an extension page reads
+ * `chrome-extension://<id>/manager.html` while a content script reads the page
+ * it is running in. That is the whole distinction, and it is not forgeable from
+ * page content.
+ *
+ * Used to gate the management console's relay, which — unlike the page-facing
+ * one — does not stop to ask a human before each task.
+ */
+function isExtensionPageSender(sender: chrome.runtime.MessageSender): boolean {
+  const base = chrome.runtime.getURL("");
+  return typeof sender.url === "string" && sender.url.startsWith(base);
+}
+
+/**
+ * Run one administration task proposed by the management console.
+ *
+ * ## Why this does not prompt, when `handleRequestTask` always does
+ *
+ * That prompt exists because an arbitrary web page is proposing an arbitrary
+ * task, and under a generic relay a remembered grant would mean "this site may
+ * ask my agent to do anything at all". Neither half is true here: the caller is
+ * an extension page the operator opened themselves, and there is no origin to
+ * remember or to be wrong about. Prompting per call would also make the surface
+ * unusable — a console reads a dozen lists to draw one screen, and a human who
+ * clicks through twelve identical dialogs to see a page is not consenting to
+ * anything, they are dismissing an obstacle.
+ *
+ * What still stands between the console and a destructive change: the agent's
+ * own policy engine, which answers `requireConsent` as a `consentRequired`
+ * outcome that the console renders as an approval ceremony rather than an
+ * error; the agent's ACL, which is the only authority that decides whether this
+ * caller may act at all; and the console's own preview-then-confirm on every
+ * irreversible action, which shows the agent's account of what would be
+ * destroyed rather than a generic "are you sure".
+ *
+ * The origin stamped into the task is this extension's own. That is the honest
+ * answer — the console really is the caller — and it is what the agent's audit
+ * trail will record.
+ */
+async function handleManagerTask(
+  req: RuntimeManagerTaskRequest,
+): Promise<RuntimeManagerTaskResponse> {
+  const active = await readActiveConnection();
+  if (!active.ok) return { ok: false, error: active.error };
+
+  await ensureOffscreenDocument();
+  // No `origin`. There is no proposing page — the operator is acting directly,
+  // the same position a CLI is in — and `requestTask` is explicit that a caller
+  // with no attested origin should omit it rather than invent one. Inventing
+  // this extension's own put an `ext` member on every payload, which some agent
+  // payload structs reject outright.
+  return (await chrome.runtime.sendMessage({
+    target: OFFSCREEN_TARGET,
+    type: OFFSCREEN_REQUEST_TASK,
+    vtaDid: active.conn.vtaDid,
+    restBaseUrl: active.conn.restBaseUrl,
+    params: req.params,
+  })) as RuntimeManagerTaskResponse;
+}
+
 // Sign a Trust-Task envelope with the wallet's holder did:peer #key-2.
 // Forward to the offscreen which loads the holder identity + calls the core
 // `signTrustTask` helper.
@@ -2663,6 +2732,26 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
     return true; // async sendResponse
   }
 
+  if ((message as { type?: string })?.type === RUNTIME_MANAGER_TASK) {
+    // Extension pages only. A content script carries our extension id but not
+    // our URL, and this relay does not stop to ask a human — so the gate is the
+    // whole security boundary for the console's authority.
+    if (!isExtensionPageSender(sender)) {
+      // eslint-disable-next-line no-console
+      console.warn(
+        `[background] rejecting ${RUNTIME_MANAGER_TASK} from non-extension sender url=${sender.url}`,
+      );
+      sendResponse({ ok: false, error: "manager surface is not page-reachable" });
+      return false;
+    }
+    handleManagerTask(message as RuntimeManagerTaskRequest)
+      .then(sendResponse)
+      .catch((e: unknown) =>
+        sendResponse({ ok: false, error: e instanceof Error ? e.message : String(e) }),
+      );
+    return true; // async sendResponse
+  }
+
   if ((message as { type?: string })?.type === RUNTIME_REQUEST_TASK) {
     handleRequestTask(message as RuntimeRequestTaskRequest)
       .then(sendResponse)
diff --git a/packages/extension/src/bridge-protocol.ts b/packages/extension/src/bridge-protocol.ts
index 3d0a7d8..be512a6 100644
--- a/packages/extension/src/bridge-protocol.ts
+++ b/packages/extension/src/bridge-protocol.ts
@@ -1743,10 +1743,57 @@ export interface OffscreenRequestTaskRequest {
   type: typeof OFFSCREEN_REQUEST_TASK;
   vtaDid: string;
   restBaseUrl: string;
-  origin: string;
+  /**
+   * The origin the browser attributed to the proposing page, when there is one.
+   *
+   * **Absent for the management console, deliberately.** `requestTask` stamps
+   * this into `payload.ext["openvtc.origin"]` so the origin a human approves is
+   * bound to the payload that executes — which is essential when a *page*
+   * proposed the task and meaningless when the operator is driving their own
+   * console. `requestTask`'s own contract says a caller with no attested origin
+   * should omit it rather than invent one, and inventing one here was not free:
+   * it put an `ext` member on every payload, and an agent whose struct has
+   * drifted from its schema rejects the whole request as malformed.
+   *
+   * The page path is unaffected — `background.ts` still refuses a page-facing
+   * message that carries no browser-attested origin, which is where that
+   * requirement is enforced.
+   */
+  origin?: string;
+  params: RequestTaskParams;
+}
+
+/** manager console → background: run one administration task at the agent.
+ *
+ *  **Deliberately NOT in {@link PAGE_FACING_RUNTIME_TYPES}, and deliberately
+ *  absent from `content.ts`'s dispatch table.** Granting authority at an agent,
+ *  revoking it and destroying contexts is operator surface; a web page has no
+ *  business proposing any of it, and the relay it *is* allowed to use
+ *  ({@link RUNTIME_REQUEST_TASK}) prompts a human for every single call.
+ *
+ *  `sender.id === chrome.runtime.id` does not separate the two — a content
+ *  script passes it. The discriminator is `sender.url`, which the browser sets
+ *  and a page cannot influence: an extension page's is under
+ *  `chrome.runtime.getURL("")`, a content script's is the page it was injected
+ *  into. `background.ts` gates on exactly that.
+ *
+ *  Carries `params` and nothing else. The console composes a typed envelope
+ *  with the `@openvtc/pnm-core/admin` helpers, but only its `type` and
+ *  `payload` cross this boundary — the device mints `id`, `issuedAt`, `issuer`
+ *  and `recipient` inside its own trust boundary and the channel signs the
+ *  result, exactly as it does for a page-proposed task. See
+ *  `core/src/vta/request-task.ts` for why that division is not negotiable. */
+export const RUNTIME_MANAGER_TASK = "vta-wallet/manager-task" as const;
+
+export interface RuntimeManagerTaskRequest {
+  type: typeof RUNTIME_MANAGER_TASK;
   params: RequestTaskParams;
 }
 
+export type RuntimeManagerTaskResponse =
+  | { ok: true; result: RequestTaskResult }
+  | { ok: false; error: string };
+
 /**
  * Every runtime message type a *web page* can originate through the content
  * script — the exact set whose origin must be the browser's, not the message
diff --git a/packages/extension/src/manager-theme.css b/packages/extension/src/manager-theme.css
new file mode 100644
index 0000000..41dcc5b
--- /dev/null
+++ b/packages/extension/src/manager-theme.css
@@ -0,0 +1,73 @@
+/* Act colours — the console's only addition to the wallet's design tokens.
+ *
+ * `theme.css` stays the base: ground, surface, line, text, and the semantic
+ * ok/warn/danger triple are shared with the popup, options and confirm
+ * surfaces, so the console reads as the same product and there is exactly one
+ * palette to keep correct across light and dark.
+ *
+ * What the console needs *on top* is a way to say which act of the stack a
+ * section belongs to. The workshop deck does this with a left rail that changes
+ * colour by act, and it works because the grouping is real — the three groups
+ * answer three different questions:
+ *
+ *   identity  (purple)  who you are
+ *   data      (teal)    what is stored here, and who put it there
+ *   wire      (lime)    how bytes get there, and whether they did
+ *   graph     (gold)    who may act, and who has to agree
+ *
+ * These are navigation colours and nothing else. They never encode state: a
+ * section is not "more purple" when something is wrong. `--w-ok` / `--w-warn` /
+ * `--w-danger` remain the only colours that mean anything, which is the reason
+ * the accent was kept separate from the semantics in the first place — "this is
+ * actionable" and "this verified" must stay visually separable in a security
+ * UI, and adding three more meaningful colours would undo that.
+ *
+ * Light values are darkened well past their names (a literal lime is unreadable
+ * on a near-white ground); dark values are lifted. Both are checked against
+ * `--w-surface`, not against white.
+ */
+
+:root {
+  --m-act-identity: #6b3fd4;
+  --m-act-identity-soft: #f0ebfd;
+  --m-act-wire: #4b7d16;
+  --m-act-wire-soft: #eef6e2;
+  --m-act-graph: #8f6410;
+  --m-act-graph-soft: #fbf2dc;
+  --m-act-data: #0e6f78;
+  --m-act-data-soft: #e2f2f4;
+
+  /* The rail's own ground — a half-step off `--w-ground` so the three columns
+   * read as three columns without a hard border doing the work. */
+  --m-rail: #f2f4f8;
+  --m-tree: #fafbfd;
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --m-act-identity: #a98bff;
+    --m-act-identity-soft: #1d1733;
+    --m-act-wire: #a4d552;
+    --m-act-wire-soft: #182310;
+    --m-act-graph: #e0b355;
+    --m-act-graph-soft: #292010;
+    --m-act-data: #4dc4d0;
+    --m-act-data-soft: #0e2326;
+
+    --m-rail: #0e131c;
+    --m-tree: #10151f;
+  }
+}
+
+/* The console is a full-page surface and owns the viewport. The wallet's other
+ * surfaces are sized by their container (a popup, an options frame), so this
+ * belongs here rather than in `theme.css`. */
+html,
+body,
+#root {
+  height: 100%;
+}
+
+body {
+  overflow: hidden;
+}
diff --git a/packages/extension/src/manager.tsx b/packages/extension/src/manager.tsx
new file mode 100644
index 0000000..8fa6681
--- /dev/null
+++ b/packages/extension/src/manager.tsx
@@ -0,0 +1,32 @@
+/// <reference types="chrome" />
+
+// The management console's entry point.
+//
+// A separate bundle from every other extension surface, and the separation is
+// load-bearing rather than tidy: `@openvtc/pnm-core/admin` is operator
+// authority — granting it, revoking it, destroying contexts — and CI asserts
+// that none of it reaches the wallet's own bundles. Its own vite config
+// (`vite.config.manager.ts`) with `codeSplitting: false` is what makes that
+// assertion structural instead of a promise: Rollup cannot emit a shared chunk
+// between this entry and the popup, offscreen or service worker, because it
+// does not build them together.
+//
+// Reached from the popup and options page via `chrome.tabs.create`. Deliberately
+// NOT `options_ui` (the wallet's settings are the options page, and this is not
+// settings) and deliberately not a `web_accessible_resource` — no page should
+// be able to frame or navigate to it.
+
+import { StrictMode } from "react";
+import { createRoot } from "react-dom/client";
+import { ManagerShell } from "./manager/shell.js";
+import "./theme.css";
+import "./manager-theme.css";
+
+const root = document.getElementById("root");
+if (!root) throw new Error("manager.html is missing its #root element");
+
+createRoot(root).render(
+  <StrictMode>
+    <ManagerShell />
+  </StrictMode>,
+);
diff --git a/packages/extension/src/manager/carrier.ts b/packages/extension/src/manager/carrier.ts
new file mode 100644
index 0000000..a3cda7f
--- /dev/null
+++ b/packages/extension/src/manager/carrier.ts
@@ -0,0 +1,122 @@
+// What crosses the bridge when the console runs an admin task — and what does
+// not.
+//
+// Every helper in `@openvtc/pnm-core/admin` builds a canonical envelope with
+// `buildTrustTask` and hands it to a `TrustTaskSender`. That gives the console
+// the API it wants: typed payloads and responses, with the wire shapes owned by
+// the generated `@openvtc/trust-tasks` bindings rather than transcribed here.
+//
+// But `core/src/vta/request-task.ts` is explicit that **the device mints the
+// envelope**. A wallet that counter-signs a document composed somewhere else
+// attests to every field the agent will subsequently trust *because the wallet
+// signed it* — issuer, recipient, expiry, id — none of which it checked. That
+// rule does not soften because the composer happens to be an extension page:
+// what the signature claims is the same either way.
+//
+// So the envelope the admin helper builds is a **carrier**, not a document.
+// `carrierParams` takes the only two members a caller is entitled to propose
+// and drops the rest; the offscreen document mints the real envelope and the
+// channel signs it (`signOutboundTask`, SPEC §7.2 item 7a).
+//
+// Deliberately free of relative imports so it can be unit-tested in plain Node
+// — the same constraint every other tested module in this package observes, and
+// the reason the chrome-facing half lives in `sender.ts`.
+
+import type { TrustTask } from "@openvtc/pnm-core";
+
+/** The two members that may travel. Mirrors `RequestTaskParams`. */
+export interface CarrierParams {
+  type: string;
+  payload: Record<string, unknown>;
+}
+
+/**
+ * Strip a carrier envelope down to what may cross the bridge.
+ *
+ * An absent payload becomes `{}` rather than `undefined`: `auth/whoami` and
+ * friends legitimately send an empty payload, and relaying `undefined` reaches
+ * the agent as a missing member that fails schema validation for no visible
+ * reason.
+ */
+export function carrierParams(envelope: TrustTask<unknown>): CarrierParams {
+  return {
+    type: envelope.type,
+    payload: (envelope.payload ?? {}) as Record<string, unknown>,
+  };
+}
+
+/**
+ * The agent will not run this task until a human approves it.
+ *
+ * **Not a failure, and it must never be rendered as one.** The refusal carries
+ * the executor-signed consent requests an approver has to see and the salted
+ * digest whose prefix the operator matches on their approving device. A console
+ * that printed "Error: consent required" would discard the informed-consent
+ * ceremony at the exact moment the human was supposed to act.
+ *
+ * `TrustTaskSender.send` returns a value or throws, so this arrives as a
+ * *typed* throw. The panes catch this class specifically; nothing else in the
+ * console is allowed to catch it.
+ */
+export class ConsentRequiredError extends Error {
+  /** Salted digest of the exact payload awaiting approval; a prefix is the
+   *  cross-device match code. */
+  readonly payloadDigest: string;
+  readonly challenge: string;
+  readonly approverSet: string;
+  readonly minApprovals: number;
+  /** Executor-signed `task-consent/request` documents, one per approver. */
+  readonly consentRequests: unknown[];
+  /** Task type the operator was attempting, for the ceremony's copy. */
+  readonly taskType: string;
+
+  constructor(taskType: string, outcome: Record<string, unknown>) {
+    super(`${taskType} needs human approval before the agent will run it`);
+    this.name = "ConsentRequiredError";
+    this.taskType = taskType;
+    this.payloadDigest = typeof outcome.payloadDigest === "string" ? outcome.payloadDigest : "";
+    this.challenge = typeof outcome.challenge === "string" ? outcome.challenge : "";
+    this.approverSet = typeof outcome.approverSet === "string" ? outcome.approverSet : "";
+    this.minApprovals = typeof outcome.minApprovals === "number" ? outcome.minApprovals : 1;
+    this.consentRequests = Array.isArray(outcome.consentRequests) ? outcome.consentRequests : [];
+  }
+}
+
+/** The bridge's reply, structurally. Kept here rather than imported so this
+ *  module stays free of relative imports; `sender.ts` passes the real typed
+ *  value, and a drift between the two breaks its build. */
+export interface RelayReply {
+  ok: boolean;
+  error?: string;
+  result?: Record<string, unknown>;
+}
+
+/**
+ * Turn the bridge's reply into a result, or throw the right kind of error.
+ *
+ * Three outcomes, and the middle one is the reason this is a function rather
+ * than an `if (!ok) throw`: `accepted` unwraps, `consentRequired` throws the
+ * typed ceremony, and anything else means the relay changed shape underneath
+ * this file. That last case must be loud — returning it would hand a pane an
+ * object whose members all read `undefined`, which renders as a convincing
+ * empty result.
+ */
+export function interpretOutcome<Res>(
+  taskType: string,
+  label: string,
+  reply: RelayReply,
+): Res {
+  if (!reply.ok) throw new Error(`${label} failed: ${reply.error ?? "unknown error"}`);
+
+  const outcome = reply.result;
+  if (outcome?.kind === "consentRequired") {
+    throw new ConsentRequiredError(taskType, outcome);
+  }
+  if (outcome?.kind !== "accepted") {
+    throw new Error(
+      `${label} returned an outcome this console does not understand ` +
+        `(kind=${String(outcome?.kind)}). The wallet and console builds may differ.`,
+    );
+  }
+  return outcome.result as Res;
+}
diff --git a/packages/extension/src/manager/context-column.tsx b/packages/extension/src/manager/context-column.tsx
new file mode 100644
index 0000000..901fa6f
--- /dev/null
+++ b/packages/extension/src/manager/context-column.tsx
@@ -0,0 +1,218 @@
+// The persistent context column.
+//
+// This is navigation, not a pane: the selection made here scopes Keys, DIDs,
+// Access and Audit, because `contextId` is a filter parameter on all of them.
+// Which is why it sits beside the sections rather than inside one — an operator
+// picks `work/eng` once and every question they ask afterwards is about
+// `work/eng` until they say otherwise.
+
+import { useMemo, useState } from "react";
+import { c, t, font } from "../theme.js";
+import { buildContextTree, flattenContextTree, type ContextNode } from "./context-tree.js";
+import { contextLabel } from "./format.js";
+import type { ContextRecord } from "@openvtc/pnm-core";
+
+/** `null` means "all contexts" — the filter cleared, not a context named null. */
+export type ContextSelection = string | null;
+
+function Row({
+  node,
+  depth,
+  hasChildren,
+  collapsed,
+  selected,
+  onToggle,
+  onSelect,
+}: {
+  node: ContextNode;
+  depth: number;
+  hasChildren: boolean;
+  collapsed: boolean;
+  selected: boolean;
+  onToggle: () => void;
+  onSelect: () => void;
+}) {
+  // A placeholder stands for a parent this caller's ACL does not reach. It is
+  // drawn so its reachable children are not silently orphaned, but there is no
+  // record behind it — nothing to scope a pane to, nothing to rename, nothing
+  // to delete. So it is not selectable, and says why.
+  const unreachable = !node.record;
+  // The id is what joins this tree to every table beside it, so it is shown
+  // whenever it differs from the label — never dropped in favour of the label.
+  const label = node.record
+    ? contextLabel(node.record)
+    : { primary: node.name, id: undefined };
+
+  return (
+    <div style={{ display: "flex", alignItems: "center", paddingLeft: 8 + depth * 14 }}>
+      <button
+        onClick={onToggle}
+        aria-label={collapsed ? `Expand ${node.name}` : `Collapse ${node.name}`}
+        style={{
+          width: 16,
+          border: "none",
+          background: "none",
+          padding: 0,
+          cursor: hasChildren ? "pointer" : "default",
+          color: c.faint,
+          fontSize: t.sm,
+          lineHeight: 1,
+          visibility: hasChildren ? "visible" : "hidden",
+        }}
+      >
+        {collapsed ? "▸" : "▾"}
+      </button>
+      <button
+        onClick={unreachable ? undefined : onSelect}
+        disabled={unreachable}
+        title={
+          unreachable
+            ? "You do not have access to this context. It is shown because you administer " +
+              "contexts inside it."
+            : node.basePath
+        }
+        style={{
+          flex: 1,
+          minWidth: 0,
+          textAlign: "left",
+          border: "none",
+          borderRadius: "var(--w-r-sm)",
+          padding: "5px 8px",
+          margin: "1px 6px 1px 0",
+          cursor: unreachable ? "default" : "pointer",
+          background: selected ? "var(--m-act-identity-soft)" : "transparent",
+          color: unreachable ? c.faint : selected ? "var(--m-act-identity)" : c.text,
+          fontFamily: font.sans,
+          fontSize: t.sm,
+          fontWeight: selected ? 640 : 440,
+          fontStyle: unreachable ? "italic" : "normal",
+          overflow: "hidden",
+        }}
+      >
+        <span style={{ display: "block", overflow: "hidden", textOverflow: "ellipsis" }}>
+          {label.primary}
+        </span>
+        {label.id && (
+          <span
+            style={{
+              display: "block",
+              fontFamily: font.mono,
+              fontSize: t.xs,
+              fontWeight: 400,
+              color: selected ? "var(--m-act-identity)" : c.faint,
+              overflow: "hidden",
+              textOverflow: "ellipsis",
+            }}
+          >
+            {label.id}
+          </span>
+        )}
+      </button>
+    </div>
+  );
+}
+
+export function ContextTree({
+  records,
+  selected,
+  onSelect,
+  loading,
+  error,
+}: {
+  records: ContextRecord[];
+  selected: ContextSelection;
+  onSelect: (id: ContextSelection) => void;
+  loading: boolean;
+  error: string | null;
+}) {
+  const [collapsed, setCollapsed] = useState<ReadonlySet<string>>(new Set());
+  const roots = useMemo(() => buildContextTree(records), [records]);
+  const rows = useMemo(() => flattenContextTree(roots, collapsed), [roots, collapsed]);
+
+  const toggle = (id: string | undefined) => {
+    if (!id) return;
+    setCollapsed((prev) => {
+      const next = new Set(prev);
+      if (next.has(id)) next.delete(id);
+      else next.add(id);
+      return next;
+    });
+  };
+
+  return (
+    <nav
+      aria-label="Trust contexts"
+      style={{
+        background: "var(--m-tree)",
+        borderRight: `1px solid ${c.line}`,
+        overflowY: "auto",
+        padding: "12px 0",
+        display: "grid",
+        gridAutoRows: "min-content",
+      }}
+    >
+      <h2
+        style={{
+          margin: "0 14px 8px",
+          fontSize: t.xs,
+          textTransform: "uppercase",
+          letterSpacing: 0.5,
+          color: c.faint,
+          fontWeight: 640,
+        }}
+      >
+        Trust contexts
+      </h2>
+
+      <div style={{ paddingLeft: 8 }}>
+        <button
+          onClick={() => onSelect(null)}
+          style={{
+            width: "calc(100% - 14px)",
+            textAlign: "left",
+            border: "none",
+            borderRadius: "var(--w-r-sm)",
+            padding: "5px 8px",
+            margin: "1px 6px 6px 16px",
+            cursor: "pointer",
+            background: selected === null ? "var(--m-act-identity-soft)" : "transparent",
+            color: selected === null ? "var(--m-act-identity)" : c.muted,
+            fontFamily: font.sans,
+            fontSize: t.sm,
+            fontWeight: selected === null ? 640 : 440,
+          }}
+        >
+          All contexts
+        </button>
+      </div>
+
+      {loading && (
+        <span style={{ padding: "6px 14px", fontSize: t.sm, color: c.faint }}>Loading…</span>
+      )}
+      {error && (
+        <span style={{ padding: "6px 14px", fontSize: t.sm, color: c.danger, lineHeight: 1.5 }}>
+          {error}
+        </span>
+      )}
+      {!loading && !error && rows.length === 0 && (
+        <span style={{ padding: "6px 14px", fontSize: t.sm, color: c.faint, lineHeight: 1.5 }}>
+          No contexts you can reach. Contexts you administer appear here — ask an admin at this
+          agent for a grant, or create one below.
+        </span>
+      )}
+
+      {rows.map(({ node, depth, hasChildren }, i) => (
+        <Row
+          key={node.id ?? `placeholder:${node.name}:${i}`}
+          node={node}
+          depth={depth}
+          hasChildren={hasChildren}
+          collapsed={Boolean(node.id && collapsed.has(node.id))}
+          selected={Boolean(node.id && node.id === selected)}
+          onToggle={() => toggle(node.id)}
+          onSelect={() => node.id && onSelect(node.id)}
+        />
+      ))}
+    </nav>
+  );
+}
diff --git a/packages/extension/src/manager/context-tree.ts b/packages/extension/src/manager/context-tree.ts
new file mode 100644
index 0000000..fb0c0ea
--- /dev/null
+++ b/packages/extension/src/manager/context-tree.ts
@@ -0,0 +1,130 @@
+// Flat `ContextRecord[]` → the tree the console navigates by.
+//
+// Contexts are the spine of this surface, not one section of it: `contextId` is
+// already a filter parameter on `keysList`, `aclList` and `auditList`, so the
+// selection made here scopes every pane to its right. That is why the tree is a
+// persistent column rather than the content of a "Contexts" page.
+//
+// ## Why an unreachable parent is drawn rather than dropped
+//
+// A caller sees the contexts their ACL entries reach, and those entries are not
+// obliged to cover a whole subtree — `work/eng` can be granted without `work`.
+// So `parent` routinely names a context this caller cannot list, and the
+// obvious tree build (index by id, attach to `byId[parent]`, keep what
+// attached) silently loses exactly those children.
+//
+// That failure is invisible in the worst way: the console renders a shorter,
+// entirely plausible tree, and an operator concludes they have no access to a
+// context they are in fact administering. So an orphan gets a **placeholder**
+// parent instead — drawn, named by the DID-less id the record itself carries,
+// and marked unreachable. A placeholder is not selectable: there is no record
+// behind it, so there is nothing to scope a pane to and nothing to delete.
+//
+// The placeholder stands for the parent and nothing more. It deliberately does
+// not try to reconstruct the chain above it from `basePath`, whose segmentation
+// this code does not own — `basePath` is shown verbatim as the node's path
+// instead, which is the agent's own answer and cannot drift from it.
+
+import type { ContextRecord } from "@openvtc/pnm-core";
+
+export interface ContextNode {
+  /** Context id — the value panes filter on. Absent on a placeholder. */
+  id?: string;
+  /** What to draw. A placeholder shows the id its child named as its parent. */
+  name: string;
+  /** The agent's own resolved path, shown verbatim. Absent on a placeholder. */
+  basePath?: string;
+  /** The record behind this node. Absent on a placeholder, which is the test
+   *  for "this node is real" — a node with no record can be expanded and read
+   *  but never selected, renamed or deleted. */
+  record?: ContextRecord;
+  children: ContextNode[];
+}
+
+/** Depth-first order with the tree's shape flattened for rendering. */
+export interface FlatContextNode {
+  node: ContextNode;
+  depth: number;
+  /** Whether any descendant exists — drives the disclosure triangle. */
+  hasChildren: boolean;
+}
+
+function byName(a: ContextNode, b: ContextNode): number {
+  return a.name.localeCompare(b.name);
+}
+
+/**
+ * Build the forest.
+ *
+ * Roots are records with no `parent`, plus one placeholder per distinct
+ * unreachable parent. Order is by name at every level, so the tree does not
+ * reshuffle between reads of the same agent.
+ */
+export function buildContextTree(records: readonly ContextRecord[]): ContextNode[] {
+  const nodes = new Map<string, ContextNode>();
+  for (const record of records) {
+    nodes.set(record.id, {
+      id: record.id,
+      name: record.name || record.id,
+      basePath: record.basePath,
+      record,
+      children: [],
+    });
+  }
+
+  const roots: ContextNode[] = [];
+  const placeholders = new Map<string, ContextNode>();
+
+  for (const record of records) {
+    const node = nodes.get(record.id);
+    if (!node) continue;
+    if (!record.parent) {
+      roots.push(node);
+      continue;
+    }
+    const parent = nodes.get(record.parent);
+    if (parent) {
+      parent.children.push(node);
+      continue;
+    }
+    // Unreachable parent — see the header. One placeholder per parent id, so
+    // two siblings under the same invisible parent share a node rather than
+    // producing two identical roots.
+    let stand = placeholders.get(record.parent);
+    if (!stand) {
+      stand = { name: record.parent, children: [] };
+      placeholders.set(record.parent, stand);
+      roots.push(stand);
+    }
+    stand.children.push(node);
+  }
+
+  const sortDeep = (list: ContextNode[]): void => {
+    list.sort(byName);
+    for (const n of list) sortDeep(n.children);
+  };
+  sortDeep(roots);
+  return roots;
+}
+
+/**
+ * Depth-first flatten, honouring a collapsed set.
+ *
+ * `collapsed` holds node ids; a placeholder has none and so can never be
+ * collapsed — hiding an unreachable parent would hide the reachable children it
+ * exists to reveal.
+ */
+export function flattenContextTree(
+  roots: readonly ContextNode[],
+  collapsed: ReadonlySet<string>,
+): FlatContextNode[] {
+  const out: FlatContextNode[] = [];
+  const walk = (node: ContextNode, depth: number): void => {
+    const hasChildren = node.children.length > 0;
+    out.push({ node, depth, hasChildren });
+    if (node.id && collapsed.has(node.id)) return;
+    for (const child of node.children) walk(child, depth + 1);
+  };
+  for (const root of roots) walk(root, 0);
+  return out;
+}
diff --git a/packages/extension/src/manager/destructive.tsx b/packages/extension/src/manager/destructive.tsx
new file mode 100644
index 0000000..6ecc9f3
--- /dev/null
+++ b/packages/extension/src/manager/destructive.tsx
@@ -0,0 +1,274 @@
+// Preview-then-confirm, and the consent ceremony that can interrupt it.
+//
+// ## Why the preview comes from the agent
+//
+// A generic "Are you sure?" is worth nothing: the operator already believes
+// they are sure, and the dialog adds a click rather than information. What
+// changes a decision is *what would actually be destroyed*, and only the agent
+// knows that — `contextPreviewDelete` returns the real keys and DIDs a context
+// holds, which is precisely the list an operator does not have in their head.
+//
+// So every irreversible action here is two calls: ask the agent what the change
+// would cost, render its answer verbatim, then send the change. `force` is a
+// separate explicit tick rather than something the confirm button implies,
+// because the agent refuses a non-empty deletion on purpose and overriding that
+// refusal is a second decision.
+//
+// ## Why `consentRequired` renders here
+//
+// The agent may answer "a human must approve this first". That is not a
+// failure — the refusal carries the salted payload digest whose prefix the
+// operator matches on their approving device. Rendering it as a red error would
+// discard the informed-consent ceremony at the exact moment the human was meant
+// to act, so it gets the same surface as the preview: this is the one place the
+// console catches `ConsentRequiredError`.
+
+import { useCallback, useState, type ReactNode } from "react";
+import { Button, Note } from "../ui.js";
+import { c, t, font } from "../theme.js";
+import { ConsentRequiredError } from "./carrier.js";
+
+/** How much of the digest an operator compares across devices. The full value
+ *  is unreadable aloud and nobody checks 64 characters; the prefix is what the
+ *  approving surface shows too. */
+const MATCH_CODE_LENGTH = 8;
+
+function MatchCode({ digest }: { digest: string }) {
+  const code = digest.slice(0, MATCH_CODE_LENGTH).toUpperCase();
+  return (
+    <span
+      style={{
+        fontFamily: font.mono,
+        fontSize: t.lg,
+        letterSpacing: 3,
+        fontWeight: 650,
+        color: c.text,
+      }}
+    >
+      {code || "—"}
+    </span>
+  );
+}
+
+/** The ceremony panel. Shown in place of the confirm button once the agent has
+ *  asked for approval; the operator's next move is on another device. */
+export function ConsentCeremony({ pending }: { pending: ConsentRequiredError }) {
+  return (
+    <Note tone="accent">
+      <div style={{ display: "grid", gap: 8 }}>
+        <strong>Your agent will not run this until a human approves it.</strong>
+        <div style={{ display: "flex", alignItems: "baseline", gap: 12, flexWrap: "wrap" }}>
+          <span style={{ color: c.muted }}>Match code</span>
+          <MatchCode digest={pending.payloadDigest} />
+        </div>
+        <span style={{ color: c.muted }}>
+          Approve on your approving device, and check that the code shown there is the same. It
+          is derived from this exact change — a different code means you would be approving
+          something else.
+          {pending.minApprovals > 1
+            ? ` ${pending.minApprovals} approvals are required.`
+            : ""}
+        </span>
+      </div>
+    </Note>
+  );
+}
+
+export interface DestructiveProps<P> {
+  /** Button copy for the action itself, e.g. "Delete context". */
+  label: string;
+  /** Disabled reason, or null when the action is available. Shown rather than
+   *  hiding the control — see `hasRole` in `use-vta.ts`. */
+  disabledReason?: string | null;
+  /** Ask the agent what the change would cost. */
+  preview: () => Promise<P>;
+  /** Render the agent's answer. Returning `false` from `blocking` keeps the
+   *  confirm button disabled until `force` is ticked. */
+  renderPreview: (preview: P) => ReactNode;
+  /** Whether this preview describes collateral that `force` must override. */
+  needsForce?: (preview: P) => boolean;
+  /** Copy for the force tick, when `needsForce` is true. */
+  forceLabel?: string;
+  /** Perform it. */
+  commit: (force: boolean) => Promise<void>;
+  /** Called after a successful commit, so the caller can refetch. */
+  onDone: () => void;
+}
+
+type Phase<P> =
+  | { kind: "idle" }
+  | { kind: "previewing" }
+  | { kind: "preview"; preview: P }
+  | { kind: "committing"; preview: P }
+  | { kind: "consent"; pending: ConsentRequiredError }
+  | { kind: "error"; message: string };
+
+/**
+ * The shared two-step for every irreversible action in this console.
+ *
+ * Generic over the preview shape because the previews differ (a context's keys
+ * and DIDs, a key's usages, an ACL subject's grants) while the *shape of the
+ * decision* does not: see the cost, then decide, with `force` as its own step.
+ */
+export function Destructive<P>({
+  label,
+  disabledReason = null,
+  preview,
+  renderPreview,
+  needsForce,
+  forceLabel = "Delete anyway, destroying the items listed above",
+  commit,
+  onDone,
+}: DestructiveProps<P>) {
+  const [phase, setPhase] = useState<Phase<P>>({ kind: "idle" });
+  const [force, setForce] = useState(false);
+
+  const reset = useCallback(() => {
+    setPhase({ kind: "idle" });
+    setForce(false);
+  }, []);
+
+  const start = useCallback(async () => {
+    setPhase({ kind: "previewing" });
+    try {
+      setPhase({ kind: "preview", preview: await preview() });
+    } catch (e) {
+      setPhase({
+        kind: "error",
+        message: e instanceof Error ? e.message : String(e),
+      });
+    }
+  }, [preview]);
+
+  const run = useCallback(
+    async (p: P) => {
+      setPhase({ kind: "committing", preview: p });
+      try {
+        await commit(force);
+        reset();
+        onDone();
+      } catch (e) {
+        // The one class that is not an error. See the header.
+        if (e instanceof ConsentRequiredError) {
+          setPhase({ kind: "consent", pending: e });
+          return;
+        }
+        setPhase({ kind: "error", message: e instanceof Error ? e.message : String(e) });
+      }
+    },
+    [commit, force, onDone, reset],
+  );
+
+  if (phase.kind === "idle") {
+    return (
+      <Button
+        kind="danger"
+        disabled={Boolean(disabledReason)}
+        {...(disabledReason ? { title: disabledReason } : {})}
+        onClick={() => void start()}
+      >
+        {label}
+      </Button>
+    );
+  }
+
+  if (phase.kind === "previewing") {
+    return <span style={{ fontSize: t.sm, color: c.muted }}>Asking your agent what this would destroy…</span>;
+  }
+
+  if (phase.kind === "consent") {
+    return (
+      <div style={{ display: "grid", gap: 10 }}>
+        <ConsentCeremony pending={phase.pending} />
+        <div>
+          <Button kind="quiet" onClick={reset}>
+            Close
+          </Button>
+        </div>
+      </div>
+    );
+  }
+
+  if (phase.kind === "error") {
+    return (
+      // `maxWidth` because this often renders inside a table cell.
+      //
+      // The agent's refusals are prose, and some are long — a DID delete that
+      // is still depended on comes back naming the dependant and the command
+      // to fix it. Unconstrained, that text sets the column's width, the
+      // browser widens the cell to fit, and every other column in the table
+      // collapses: the DID column ends up a few characters wide, wrapping
+      // mid-identifier. The message is the most useful thing on screen at that
+      // moment, and it was wrecking the row that gave it context.
+      <div style={{ display: "grid", gap: 10, maxWidth: 480 }}>
+        <Note tone="danger">{phase.message}</Note>
+        <div>
+          <Button kind="quiet" onClick={reset}>
+            Back
+          </Button>
+        </div>
+      </div>
+    );
+  }
+
+  const p = phase.preview;
+  const blocked = Boolean(needsForce?.(p)) && !force;
+  const busy = phase.kind === "committing";
+
+  return (
+    <div style={{ display: "grid", gap: 12, maxWidth: 460 }}>
+      <Note tone="danger">
+        <div style={{ display: "grid", gap: 8 }}>{renderPreview(p)}</div>
+      </Note>
+
+      {needsForce?.(p) && (
+        <label style={{ display: "flex", gap: 8, alignItems: "flex-start", fontSize: t.sm }}>
+          <input
+            type="checkbox"
+            checked={force}
+            onChange={(e) => setForce(e.target.checked)}
+            style={{ marginTop: 2 }}
+          />
+          <span>{forceLabel}</span>
+        </label>
+      )}
+
+      <div style={{ display: "flex", gap: 8 }}>
+        <Button kind="danger" disabled={blocked || busy} onClick={() => void run(p)}>
+          {busy ? "Working…" : label}
+        </Button>
+        <Button kind="quiet" disabled={busy} onClick={reset}>
+          Cancel
+        </Button>
+      </div>
+    </div>
+  );
+}
+
+/**
+ * Run a non-destructive mutation, routing a consent refusal to the ceremony.
+ *
+ * Every mutating call in the console goes through this or through
+ * {@link Destructive}; nothing calls an admin helper and catches `Error`
+ * directly, because that is how a `ConsentRequiredError` ends up rendered as a
+ * red string.
+ */
+export async function runMutation(
+  action: () => Promise<void>,
+  handlers: {
+    onConsent: (pending: ConsentRequiredError) => void;
+    onError: (message: string) => void;
+  },
+): Promise<boolean> {
+  try {
+    await action();
+    return true;
+  } catch (e) {
+    if (e instanceof ConsentRequiredError) {
+      handlers.onConsent(e);
+      return false;
+    }
+    handlers.onError(e instanceof Error ? e.message : String(e));
+    return false;
+  }
+}
diff --git a/packages/extension/src/manager/format.ts b/packages/extension/src/manager/format.ts
new file mode 100644
index 0000000..abebbf3
--- /dev/null
+++ b/packages/extension/src/manager/format.ts
@@ -0,0 +1,88 @@
+// Rendering helpers that refuse to state more than the agent said.
+//
+// Both of these exist because of the same failure, seen against a live agent:
+// a value the console did not have was rendered as a confident, wrong one.
+
+import type { ContextRecord } from "@openvtc/pnm-core";
+
+/**
+ * Anything at or before this is treated as "no timestamp", not as a date.
+ *
+ * `new Date(null)`, `new Date(0)` and `new Date(undefined as never)` all land
+ * on or near the epoch, and `toLocaleString()` renders that as
+ * "01/01/1970, 01:00:00" — which reads as a real answer and is not one. A
+ * session whose expiry the agent did not send is not a session that expired
+ * fifty-six years ago, and the difference matters on a banner whose whole job
+ * is to say how long your authority lasts.
+ *
+ * A year is generous: no real timestamp in this system predates the protocol.
+ */
+const NOT_A_TIMESTAMP = Date.UTC(1971, 0, 1);
+
+/** Parse to a Date, or null when the value cannot be one. */
+function parseInstant(value: string | number | null | undefined): Date | null {
+  if (value === null || value === undefined || value === "") return null;
+  const d = new Date(value);
+  const ms = d.getTime();
+  if (Number.isNaN(ms) || ms <= NOT_A_TIMESTAMP) return null;
+  return d;
+}
+
+/** Date and time, or `fallback` when the agent gave nothing usable. */
+export function formatInstant(
+  value: string | number | null | undefined,
+  fallback = "unknown",
+): string {
+  return parseInstant(value)?.toLocaleString() ?? fallback;
+}
+
+/** Date only, or `fallback`. */
+export function formatDate(
+  value: string | number | null | undefined,
+  fallback = "unknown",
+): string {
+  return parseInstant(value)?.toLocaleDateString() ?? fallback;
+}
+
+/** Whether an instant has passed. `false` when there is no usable instant —
+ *  "we don't know" must never render as "expired". */
+export function isPast(value: string | number | null | undefined): boolean {
+  const d = parseInstant(value);
+  return d !== null && d.getTime() < Date.now();
+}
+
+/**
+ * How a context is named everywhere in this console.
+ *
+ * The tree used to render `name` ("Verifiable Trust Agent") while every table
+ * column and pane title rendered `id` ("vta"), so the same context had two
+ * names on one screen and nothing connecting them. An operator selecting
+ * "Verifiable Trust Agent" and reading "Audit for vta" has to guess those are
+ * the same thing — and when the ids are `vta`, `vtc` and `webvh`, guessing is
+ * exactly what they should not be doing.
+ *
+ * So both are shown, always, in the same order: the operator's own label reads
+ * first because that is what they navigate by, and the `id` follows in
+ * monospace because that is the vocabulary the agent's own records carry — a
+ * key's `contextId`, a DID's `contextId`, an ACL scope. The id is what joins
+ * this tree to every table beside it, so it is never the half that gets
+ * dropped.
+ */
+export interface ContextLabel {
+  /** What to read first. The operator's label, or the id when there is none. */
+  primary: string;
+  /** The agent's own identifier, when it differs from `primary`. Monospace. */
+  id?: string;
+}
+
+export function contextLabel(record: ContextRecord): ContextLabel {
+  const name = record.name?.trim();
+  return name && name !== record.id ? { primary: name, id: record.id } : { primary: record.id };
+}
+
+/** One-line form for a heading: `Verifiable Trust Agent (vta)`. */
+export function contextHeading(record: ContextRecord | undefined, id: string): string {
+  if (!record) return id;
+  const label = contextLabel(record);
+  return label.id ? `${label.primary} (${label.id})` : label.primary;
+}
diff --git a/packages/extension/src/manager/panes/access.tsx b/packages/extension/src/manager/panes/access.tsx
new file mode 100644
index 0000000..ee8869b
--- /dev/null
+++ b/packages/extension/src/manager/panes/access.tsx
@@ -0,0 +1,370 @@
+// Access — who may act at this agent, in which contexts, until when.
+//
+// The sharpest pane in the console: an ACL entry is the authority itself, and
+// `acl/grant` is how someone who could do nothing here comes to be able to do
+// everything.
+//
+// Two things the agent enforces that this pane must not paper over:
+//
+//  - **`aclUpdate` replaces scopes wholesale, and refuses to narrow.** Sending
+//    a shorter set is not "remove these" — the agent rejects a reduction here
+//    on purpose, because a narrowing typed into an edit box looks identical to
+//    a mistake. Taking authority away goes through `aclRevoke`, which says so.
+//  - **`aclChangeRole` compare-and-swaps against the current role.** The form
+//    carries `fromRole` from the row it was opened on, so a role someone else
+//    changed in between rejects rather than silently overwriting their change.
+
+import { useCallback, useState } from "react";
+import {
+  aclChangeRole,
+  aclList,
+  aclRevoke,
+  aclGrant,
+  type AclEntry,
+} from "@openvtc/pnm-core/admin";
+import { Button, Did, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Redacted, Table, Truncated, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { formatDate, isPast } from "../format.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+function Expiry({ entry }: { entry: AclEntry }) {
+  if (!entry.expiresAt) {
+    // Not "—". An entry that never expires is a standing grant, and that is a
+    // decision worth reading as one.
+    return <span style={{ color: c.warn }}>never</span>;
+  }
+  const past = isPast(entry.expiresAt);
+  return (
+    <span style={{ color: past ? c.faint : c.muted, whiteSpace: "nowrap" }}>
+      {formatDate(entry.expiresAt)}
+      {past ? " (expired)" : ""}
+    </span>
+  );
+}
+
+function ChangeRole({
+  parties,
+  entry,
+  onDone,
+}: {
+  parties: Parties;
+  entry: AclEntry;
+  onDone: () => void;
+}) {
+  const [open, setOpen] = useState(false);
+  const [toRole, setToRole] = useState(entry.role);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  if (!open) {
+    return (
+      <Button kind="quiet" onClick={() => setOpen(true)}>
+        Change role
+      </Button>
+    );
+  }
+
+  return (
+    <div style={{ display: "grid", gap: 7 }}>
+      <input style={fieldStyle} value={toRole} onChange={(e) => setToRole(e.target.value)} />
+      <span style={{ fontSize: t.xs, color: c.faint }}>
+        from <strong>{entry.role}</strong> — rejected if it changed since this list was read
+      </span>
+      {error && <Note tone="danger">{error}</Note>}
+      {pending && <ConsentCeremony pending={pending} />}
+      <div style={{ display: "flex", gap: 6 }}>
+        <Button
+          disabled={busy || !toRole.trim() || toRole === entry.role}
+          onClick={() => {
+            setBusy(true);
+            setError(null);
+            void runMutation(
+              async () => {
+                await aclChangeRole(managerSender, {
+                  ...parties,
+                  subject: entry.subject,
+                  // Compare-and-swap against what this row was read at.
+                  fromRole: entry.role,
+                  toRole: toRole.trim(),
+                });
+              },
+              { onConsent: setPending, onError: setError },
+            ).then((ok) => {
+              setBusy(false);
+              if (ok) {
+                setOpen(false);
+                onDone();
+              }
+            });
+          }}
+        >
+          {busy ? "Changing…" : "Change"}
+        </Button>
+        <Button kind="quiet" onClick={() => setOpen(false)}>
+          Cancel
+        </Button>
+      </div>
+    </div>
+  );
+}
+
+function GrantAccess({
+  parties,
+  contextId,
+  authority,
+  onGranted,
+}: {
+  parties: Parties;
+  contextId: ContextSelection;
+  authority: Authority | null;
+  onGranted: () => void;
+}) {
+  const [subject, setSubject] = useState("");
+  const [role, setRole] = useState("");
+  const [label, setLabel] = useState("");
+  const [expiresAt, setExpiresAt] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Granting access needs the admin role at this agent."
+    : null;
+
+  const submit = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const entry: AclEntry = {
+      subject: subject.trim(),
+      role: role.trim(),
+      ...(contextId ? { scopes: [contextId] } : {}),
+      ...(label.trim() ? { label: label.trim() } : {}),
+      // A date input gives a local day; the wire wants an instant.
+      ...(expiresAt ? { expiresAt: new Date(`${expiresAt}T23:59:59`).toISOString() } : {}),
+    };
+    const ok = await runMutation(
+      async () => {
+        await aclGrant(managerSender, { ...parties, entry });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) {
+      setSubject("");
+      setRole("");
+      setLabel("");
+      setExpiresAt("");
+      onGranted();
+    }
+  }, [parties, subject, role, label, expiresAt, contextId, onGranted]);
+
+  return (
+    <Panel
+      title="Grant access"
+      description={
+        contextId ? (
+          <>
+            Scoped to <code style={{ fontFamily: font.mono }}>{contextId}</code>. The subject will
+            be able to act at this agent within that context, as the role allows.
+          </>
+        ) : (
+          <>
+            <strong>Unscoped.</strong> With no context selected this grant reaches everything the
+            role permits, everywhere. Select a context in the tree to confine it.
+          </>
+        )
+      }
+    >
+      <div style={{ display: "grid", gap: 10, maxWidth: 620 }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>SUBJECT DID</span>
+          <input
+            style={{ ...fieldStyle, fontFamily: font.mono }}
+            value={subject}
+            onChange={(e) => setSubject(e.target.value)}
+            placeholder="did:key:z6Mk…"
+          />
+        </label>
+        <div style={{ display: "flex", gap: 10, flexWrap: "wrap" }}>
+          <label style={{ display: "grid", gap: 4 }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>ROLE</span>
+            <input style={fieldStyle} value={role} onChange={(e) => setRole(e.target.value)} />
+          </label>
+          <label style={{ display: "grid", gap: 4 }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>LABEL (optional)</span>
+            <input style={fieldStyle} value={label} onChange={(e) => setLabel(e.target.value)} />
+          </label>
+          <label style={{ display: "grid", gap: 4 }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>EXPIRES (optional)</span>
+            <input
+              type="date"
+              style={fieldStyle}
+              value={expiresAt}
+              onChange={(e) => setExpiresAt(e.target.value)}
+            />
+          </label>
+        </div>
+
+        {!expiresAt && (
+          <Note tone="warn">
+            With no expiry this is a standing grant — it lasts until someone revokes it. An expiry
+            is the difference between access you decided to give and access you forgot about.
+          </Note>
+        )}
+        {!contextId && (
+          <Note tone="danger">
+            No context is selected, so this grant is not confined to one. That is rarely what you
+            want.
+          </Note>
+        )}
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        <div>
+          <Button
+            kind="primary"
+            disabled={busy || !subject.trim() || !role.trim() || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void submit()}
+          >
+            {busy ? "Granting…" : "Grant access"}
+          </Button>
+        </div>
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+export function AccessPane({
+  parties,
+  authority,
+  contextId,
+  contextHeading,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  contextId: ContextSelection;
+  /** How the selected context is named in the tree, so heading and navigation
+   *  agree. See `contextLabel` in `format.ts`. */
+  contextHeading?: string | undefined;
+}) {
+  const list = useAsync(
+    () => aclList(managerSender, { ...parties, ...(contextId ? { scope: contextId } : {}) }),
+    [parties.holder.did, parties.service.did, contextId],
+  );
+
+  const revokeDenied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Revoking access needs the admin role at this agent."
+    : null;
+
+  const columns: Column<AclEntry>[] = [
+    {
+      key: "subject",
+      header: "Subject",
+      render: (e) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <Did value={e.subject} />
+          {e.label && <span style={{ color: c.muted, fontSize: t.xs }}>{e.label}</span>}
+        </div>
+      ),
+    },
+    { key: "role", header: "Role", render: (e) => <Pill tone="accent">{e.role}</Pill> },
+    {
+      key: "scopes",
+      header: "Contexts",
+      render: (e) =>
+        e.scopes?.length ? (
+          <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{e.scopes.join(", ")}</span>
+        ) : (
+          // An entry with no scopes is not restricted to none — it is
+          // restricted to nothing, i.e. everywhere. Say which.
+          <span style={{ color: c.warn }}>everywhere</span>
+        ),
+    },
+    { key: "expires", header: "Expires", render: (e) => <Expiry entry={e} /> },
+    {
+      key: "actions",
+      header: "",
+      render: (e) => (
+        <div style={{ display: "grid", gap: 8, minWidth: 200 }}>
+          <ChangeRole parties={parties} entry={e} onDone={list.reload} />
+          <Destructive<AclEntry>
+            label="Revoke"
+            disabledReason={revokeDenied}
+            preview={async () => e}
+            renderPreview={(p) => (
+              <>
+                <strong>Revoking this entry takes away all of its authority.</strong>
+                <span>
+                  <Did value={p.subject} size={t.xs} /> loses the <strong>{p.role}</strong> role
+                  {p.scopes?.length ? ` in ${p.scopes.join(", ")}` : " everywhere"}. Anything
+                  running as that subject stops working immediately — including, if it is a
+                  device or an agent you rely on, one you may not be watching.
+                </span>
+              </>
+            )}
+            commit={async () => {
+              await aclRevoke(managerSender, { ...parties, subject: e.subject });
+            }}
+            onDone={list.reload}
+          />
+        </div>
+      ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={contextHeading ? `Access to ${contextHeading}` : "Access to this agent"}
+        description="Who may act here, as what, and until when. This is the authority itself —
+          the agent checks it on every task, including the ones this console sends."
+      >
+        {list.error && <LoadError what="the access list" error={list.error} />}
+        {list.loading && !list.data && <Loading what="the access list" />}
+        {list.data && (
+          <>
+            <Redacted fields={list.data.redactedFields} />
+            <Table
+              columns={columns}
+              rows={list.data.entries}
+              rowKey={(e) => e.subject}
+              empty={
+                contextId
+                  ? `Nobody holds an entry scoped to ${contextId}.`
+                  : "No entries you can read. Grants you administer appear here."
+              }
+            />
+            {list.data.truncated && <Truncated what="the access list" />}
+          </>
+        )}
+      </Panel>
+
+      <GrantAccess
+        parties={parties}
+        contextId={contextId}
+        authority={authority}
+        onGranted={list.reload}
+      />
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/app-state.tsx b/packages/extension/src/manager/panes/app-state.tsx
new file mode 100644
index 0000000..b9aa22b
--- /dev/null
+++ b/packages/extension/src/manager/panes/app-state.tsx
@@ -0,0 +1,485 @@
+// App state — where applications keep their metadata in the agent.
+//
+// `vta/app-state/*`: durable key/value records the *agent* holds, as opposed to
+// the wallet's own `KVStore`, which is this browser profile's state and is
+// invisible to a phone or a second laptop signed in as the same holder. This is
+// the only place an application can keep something that has to be true on every
+// device — so it is also the place where a wrong or stale record follows the
+// user everywhere.
+//
+// ## Why this pane demands a context, rather than defaulting to all of them
+//
+// Every other context-scoped pane treats `contextId` as a filter: omit it and
+// the agent answers for everything the caller can reach. App-state does not
+// work that way — `contextId` is part of the *address*. A record is
+// `(contextId, namespace, key)`, and two contexts holding the same namespace
+// and key hold two unrelated records.
+//
+// So there is no "all contexts" answer to give, and inventing one by fanning
+// out across contexts would produce a list in which identical-looking rows are
+// different records. The pane asks for a context instead.
+//
+// ## Two things the agent tracks that this pane must not flatten
+//
+// Records are **versioned**, and every write can carry `expectedVersion` — so
+// an edit compare-and-swaps against what was read rather than overwriting
+// whatever arrived since. And deletes are **soft**: `includeDeleted` reveals
+// tombstones, which is the difference between "no application ever wrote this"
+// and "something deleted it".
+
+import { useCallback, useState } from "react";
+import {
+  appStateDelete,
+  appStateList,
+  appStatePut,
+  type AppStateRecord,
+} from "@openvtc/pnm-core";
+import { Button, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, Truncated, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { formatInstant } from "../format.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const PAGE = 100;
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+const codeStyle: React.CSSProperties = {
+  ...fieldStyle,
+  fontFamily: font.mono,
+  fontSize: t.xs,
+  minHeight: 140,
+  width: "100%",
+  lineHeight: 1.5,
+  resize: "vertical",
+};
+
+/** The record's value, rendered as the agent stored it. */
+function Value({ record }: { record: AppStateRecord }) {
+  if (record.value === undefined) {
+    // `appStateList` can be asked for keys without values, and a tombstone has
+    // none. Three different facts — not fetched, deleted, stored empty — that
+    // an empty cell would collapse into one.
+    return (
+      <span style={{ color: c.faint }}>{record.deleted ? "deleted" : "not fetched"}</span>
+    );
+  }
+  const text = JSON.stringify(record.value, null, 2);
+  return (
+    <pre
+      style={{
+        margin: 0,
+        fontFamily: font.mono,
+        fontSize: t.xs,
+        lineHeight: 1.5,
+        whiteSpace: "pre-wrap",
+        wordBreak: "break-word",
+        maxHeight: 160,
+        overflowY: "auto",
+        maxWidth: 460,
+      }}
+    >
+      {text}
+    </pre>
+  );
+}
+
+function WriteRecord({
+  parties,
+  contextId,
+  authority,
+  existing,
+  onDone,
+  onCancel,
+}: {
+  parties: Parties;
+  contextId: string;
+  authority: Authority | null;
+  existing?: AppStateRecord;
+  onDone: () => void;
+  onCancel?: () => void;
+}) {
+  const [namespace, setNamespace] = useState(existing?.namespace ?? "");
+  const [key, setKey] = useState(existing?.key ?? "");
+  const [value, setValue] = useState(() => {
+    return existing?.value === undefined ? "{}" : JSON.stringify(existing.value, null, 2);
+  });
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Writing app state needs an administrative role at this agent."
+    : null;
+
+  const save = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    // The schema types `value` as a JSON object, so anything else is refused
+    // here rather than sent and rejected. Reporting "expected an object" beside
+    // the box beats the agent's parse error arriving with no cursor in it.
+    let parsed: Record<string, unknown>;
+    try {
+      const candidate: unknown = JSON.parse(value);
+      if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) {
+        setError("A record's value must be a JSON object — an array or a bare value is not one.");
+        setBusy(false);
+        return;
+      }
+      parsed = candidate as Record<string, unknown>;
+    } catch {
+      setError("That is not valid JSON. A record's value must be a JSON object.");
+      setBusy(false);
+      return;
+    }
+    const ok = await runMutation(
+      async () => {
+        await appStatePut(managerSender, {
+          ...parties,
+          contextId,
+          namespace: namespace.trim(),
+          key: key.trim(),
+          value: parsed,
+          // Compare-and-swap against the version this editor opened on, so an
+          // application that wrote since is not silently overwritten.
+          ...(existing ? { expectedVersion: existing.version } : {}),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) onDone();
+  }, [parties, contextId, namespace, key, value, existing, onDone]);
+
+  return (
+    <Panel
+      title={existing ? `Edit ${existing.namespace}/${existing.key}` : "New record"}
+      description={
+        existing ? (
+          <>
+            Saving is compare-and-swapped against version{" "}
+            <strong>{existing.version}</strong> — if an application has written
+            since this editor opened, your save is refused rather than overwriting it.
+          </>
+        ) : (
+          <>
+            Written into <code style={{ fontFamily: font.mono }}>{contextId}</code>. Applications
+            read this on every device the holder uses, so a wrong value here follows them
+            everywhere.
+          </>
+        )
+      }
+    >
+      <div style={{ display: "grid", gap: 10 }}>
+        <div style={{ display: "flex", gap: 10, flexWrap: "wrap" }}>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 220px" }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>NAMESPACE</span>
+            <input
+              style={{ ...fieldStyle, fontFamily: font.mono }}
+              value={namespace}
+              onChange={(e) => setNamespace(e.target.value)}
+              disabled={Boolean(existing)}
+              placeholder="net.openvtc.app"
+            />
+          </label>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 220px" }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>KEY</span>
+            <input
+              style={{ ...fieldStyle, fontFamily: font.mono }}
+              value={key}
+              onChange={(e) => setKey(e.target.value)}
+              disabled={Boolean(existing)}
+            />
+          </label>
+        </div>
+        {existing && (
+          <span style={{ fontSize: t.xs, color: c.faint }}>
+            Namespace and key form the record's address and cannot be changed — write a new
+            record and delete this one instead.
+          </span>
+        )}
+
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>VALUE</span>
+          <textarea
+            style={codeStyle}
+            value={value}
+            onChange={(e) => setValue(e.target.value)}
+            spellCheck={false}
+          />
+        </label>
+        <span style={{ fontSize: t.xs, color: c.faint }}>
+          A JSON object. Applications read this shape directly, so a key renamed here is a key
+          the application stops finding.
+        </span>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        <div style={{ display: "flex", gap: 8 }}>
+          <Button
+            kind="primary"
+            disabled={busy || !namespace.trim() || !key.trim() || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void save()}
+          >
+            {busy ? "Saving…" : existing ? "Save changes" : "Write record"}
+          </Button>
+          {onCancel && (
+            <Button kind="quiet" disabled={busy} onClick={onCancel}>
+              Cancel
+            </Button>
+          )}
+        </div>
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+export function AppStatePane({
+  parties,
+  authority,
+  contextId,
+  contextHeading,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  contextId: ContextSelection;
+  contextHeading?: string | undefined;
+}) {
+  const [namespace, setNamespace] = useState("");
+  const [applied, setApplied] = useState("");
+  const [includeDeleted, setIncludeDeleted] = useState(false);
+  const [editing, setEditing] = useState<AppStateRecord | null>(null);
+  const [creating, setCreating] = useState(false);
+
+  const list = useAsync(
+    async () =>
+      contextId
+        ? appStateList(managerSender, {
+            ...parties,
+            contextId,
+            includeValues: true,
+            includeDeleted,
+            pageSize: PAGE,
+            ...(applied ? { namespace: applied } : {}),
+          })
+        : null,
+    [parties.holder.did, parties.service.did, contextId, applied, includeDeleted],
+  );
+
+  const deleteDenied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Deleting app state needs an administrative role at this agent."
+    : null;
+
+  // `contextId` is the record's address, not a filter — there is no
+  // agent-wide answer to give. See the header.
+  if (!contextId) {
+    return (
+      <Panel
+        title="App state"
+        description="Durable key/value records applications keep in your agent, so they are true
+          on every device you use rather than only in this browser."
+      >
+        <Note tone="accent">
+          <strong>Select a context in the tree.</strong> Unlike keys or DIDs, a context is part of
+          an app-state record's address rather than a filter over it —{" "}
+          <code style={{ fontFamily: font.mono }}>(context, namespace, key)</code> together name
+          one record. Two contexts holding the same namespace and key hold two unrelated records,
+          so there is no agent-wide list to show you.
+        </Note>
+      </Panel>
+    );
+  }
+
+  const records = list.data?.records ?? [];
+  const done = () => {
+    setEditing(null);
+    setCreating(false);
+    list.reload();
+  };
+
+  if (editing) {
+    return (
+      <WriteRecord
+        key={`${editing.namespace}/${editing.key}`}
+        parties={parties}
+        contextId={contextId}
+        authority={authority}
+        existing={editing}
+        onDone={done}
+        onCancel={() => setEditing(null)}
+      />
+    );
+  }
+
+  const columns: Column<AppStateRecord>[] = [
+    {
+      key: "ns",
+      header: "Namespace",
+      render: (r) => (
+        <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{r.namespace}</span>
+      ),
+    },
+    {
+      key: "key",
+      header: "Key",
+      render: (r) => <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{r.key}</span>,
+    },
+    { key: "value", header: "Value", render: (r) => <Value record={r} /> },
+    {
+      key: "version",
+      header: "Version",
+      render: (r) => <span style={{ color: c.muted }}>{r.version}</span>,
+    },
+    {
+      key: "state",
+      header: "State",
+      render: (r) =>
+        // A tombstone is not an absent record, and the difference is the whole
+        // reason `includeDeleted` exists.
+        r.deleted ? (
+          <Pill tone="off">deleted</Pill>
+        ) : (
+          <Pill tone="ok">live</Pill>
+        ),
+    },
+    {
+      key: "updated",
+      header: "Updated",
+      render: (r) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
+          {formatInstant(r.updatedAt, "—")}
+        </span>
+      ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (r) =>
+        r.deleted ? (
+          <span style={{ color: c.faint, fontSize: t.xs }}>deleted</span>
+        ) : (
+          <div style={{ display: "grid", gap: 8, minWidth: 190 }}>
+            <Button kind="quiet" onClick={() => setEditing(r)}>
+              Edit
+            </Button>
+            <Destructive<AppStateRecord>
+              label="Delete"
+              disabledReason={deleteDenied}
+              preview={async () => r}
+              renderPreview={(p) => (
+                <>
+                  <strong>
+                    Deleting {p.namespace}/{p.key} takes it away on every device.
+                  </strong>
+                  <span>
+                    App state is the agent's copy, not this browser's — whatever application
+                    reads this key stops finding it everywhere the holder is signed in, not just
+                    here. If the application treats an absent record as "not set up yet", that is
+                    the state it will fall back to.
+                  </span>
+                </>
+              )}
+              commit={async () => {
+                await appStateDelete(managerSender, {
+                  ...parties,
+                  contextId,
+                  namespace: r.namespace,
+                  key: r.key,
+                  expectedVersion: r.version,
+                });
+              }}
+              onDone={done}
+            />
+          </div>
+        ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={`App state in ${contextHeading ?? contextId}`}
+        description="Durable key/value records applications keep in your agent. Unlike the
+          wallet's own storage these follow the holder to every device, so what is here is what
+          every one of them sees."
+      >
+        <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 260px" }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>NAMESPACE</span>
+            <input
+              style={{ ...fieldStyle, fontFamily: font.mono }}
+              value={namespace}
+              onChange={(e) => setNamespace(e.target.value)}
+              placeholder="all namespaces"
+            />
+          </label>
+          <div style={{ paddingBottom: 1 }}>
+            <Button onClick={() => setApplied(namespace.trim())}>Filter</Button>
+          </div>
+          <label
+            style={{ display: "flex", gap: 7, alignItems: "center", fontSize: t.sm, paddingBottom: 7 }}
+          >
+            <input
+              type="checkbox"
+              checked={includeDeleted}
+              onChange={(e) => setIncludeDeleted(e.target.checked)}
+            />
+            Show deleted
+          </label>
+        </div>
+
+        {list.error && <LoadError what="app state" error={list.error} />}
+        {list.loading && !list.data && <Loading what="app state" />}
+        {list.data && (
+          <>
+            <Table
+              columns={columns}
+              rows={records}
+              rowKey={(r) => `${r.namespace}/${r.key}`}
+              empty={
+                applied
+                  ? `No records in namespace ${applied}. Clear the filter to see the rest.`
+                  : `No application has written anything into ${contextId}.`
+              }
+            />
+            {list.data.cursor && <Truncated what="this context's records" />}
+          </>
+        )}
+
+        {!creating && (
+          <div>
+            <Button onClick={() => setCreating(true)}>New record</Button>
+          </div>
+        )}
+      </Panel>
+
+      {creating && (
+        <WriteRecord
+          key="new"
+          parties={parties}
+          contextId={contextId}
+          authority={authority}
+          onDone={done}
+          onCancel={() => setCreating(false)}
+        />
+      )}
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/approvals.tsx b/packages/extension/src/manager/panes/approvals.tsx
new file mode 100644
index 0000000..c622f91
--- /dev/null
+++ b/packages/extension/src/manager/panes/approvals.tsx
@@ -0,0 +1,332 @@
+// Approvals — who gets asked when your agent will not act alone.
+//
+// This is the pane with the most leverage over the wallet's own behaviour. An
+// approver binding decides which party is sent the `task-consent/request` that
+// the wallet renders as a consent prompt; a wrong or missing one is a gated
+// action that never got its human check, which is the failure the whole consent
+// path exists to prevent.
+//
+// Two lists, and they answer different questions. **Approvers** is
+// configuration — who will be asked, per platform and context. **Grants** is
+// history — what has already been consented to, and until when.
+
+import { useCallback, useState } from "react";
+import {
+  consentApproverList,
+  consentApproverSet,
+  consentList,
+  consentRevoke,
+  type ApproverBinding,
+  type ConsentGrant,
+} from "@openvtc/pnm-core/admin";
+import { Button, Did, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { formatDate } from "../format.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+function SetApprover({
+  parties,
+  contextId,
+  authority,
+  onSet,
+}: {
+  parties: Parties;
+  contextId: ContextSelection;
+  authority: Authority | null;
+  onSet: () => void;
+}) {
+  const [platform, setPlatform] = useState("");
+  const [approver, setApprover] = useState("");
+  const [route, setRoute] = useState<"wake" | "bridge-relay">("wake");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Setting an approver needs the admin role at this agent."
+    : !contextId
+      ? "Select a context in the tree — an approver is bound to one."
+      : null;
+
+  const submit = useCallback(async () => {
+    if (!contextId) return;
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await consentApproverSet(managerSender, {
+          ...parties,
+          platform: platform.trim(),
+          context: contextId,
+          approver: approver.trim(),
+          route,
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) {
+      setPlatform("");
+      setApprover("");
+      onSet();
+    }
+  }, [parties, platform, contextId, approver, route, onSet]);
+
+  return (
+    <Panel
+      title="Bind an approver"
+      description="The party your agent asks when a task needs a human. Getting this wrong is not
+        a cosmetic error: the request goes somewhere nobody is watching, and a gated action never
+        gets its check."
+    >
+      <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>PLATFORM</span>
+          <input
+            style={fieldStyle}
+            value={platform}
+            onChange={(e) => setPlatform(e.target.value)}
+          />
+        </label>
+        <label style={{ display: "grid", gap: 4, flex: "1 1 320px" }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>APPROVER DID</span>
+          <input
+            style={{ ...fieldStyle, fontFamily: font.mono }}
+            value={approver}
+            onChange={(e) => setApprover(e.target.value)}
+            placeholder="did:key:z6Mk…"
+          />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>ROUTE</span>
+          <select
+            style={fieldStyle}
+            value={route}
+            onChange={(e) => setRoute(e.target.value as typeof route)}
+          >
+            <option value="wake">wake</option>
+            <option value="bridge-relay">bridge-relay</option>
+          </select>
+        </label>
+      </div>
+
+      {error && <Note tone="danger">{error}</Note>}
+      {pending && <ConsentCeremony pending={pending} />}
+
+      <div>
+        <Button
+          kind="primary"
+          disabled={busy || !platform.trim() || !approver.trim() || Boolean(denied)}
+          {...(denied ? { title: denied } : {})}
+          onClick={() => void submit()}
+        >
+          {busy ? "Binding…" : "Bind approver"}
+        </Button>
+      </div>
+      {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+    </Panel>
+  );
+}
+
+export function ApprovalsPane({
+  parties,
+  authority,
+  contextId,
+  contextHeading,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  contextId: ContextSelection;
+  /** How the selected context is named in the tree, so heading and navigation
+   *  agree. See `contextLabel` in `format.ts`. */
+  contextHeading?: string | undefined;
+}) {
+  const approvers = useAsync(
+    () =>
+      consentApproverList(managerSender, {
+        ...parties,
+        ...(contextId ? { context: contextId } : {}),
+      }),
+    [parties.holder.did, parties.service.did, contextId],
+  );
+
+  const grants = useAsync(
+    () => consentList(managerSender, parties),
+    [parties.holder.did, parties.service.did],
+  );
+
+  const revokeDenied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Revoking consent needs the admin role at this agent."
+    : null;
+
+  const approverColumns: Column<ApproverBinding>[] = [
+    { key: "platform", header: "Platform", render: (a) => a.platform },
+    {
+      key: "context",
+      header: "Context",
+      render: (a) => <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{a.context}</span>,
+    },
+    { key: "approver", header: "Approver", render: (a) => <Did value={a.approver} /> },
+    {
+      key: "route",
+      header: "Route",
+      render: (a) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <Pill tone="accent">{a.route ?? "wake"}</Pill>
+          {a.routeHint && <span style={{ color: c.faint, fontSize: t.xs }}>{a.routeHint}</span>}
+        </div>
+      ),
+    },
+  ];
+
+  const grantColumns: Column<ConsentGrant>[] = [
+    {
+      key: "subject",
+      header: "Conversation",
+      render: (g) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <span style={{ fontSize: t.sm }}>
+            {g.subject.platform} · {g.subject.kind}
+          </span>
+          <span style={{ fontFamily: font.mono, fontSize: t.xs, color: c.faint, wordBreak: "break-all" }}>
+            {g.subject.conversationRef}
+          </span>
+        </div>
+      ),
+    },
+    { key: "agent", header: "Agent", render: (g) => <Did value={g.subject.agent} /> },
+    {
+      key: "effect",
+      header: "Effect",
+      render: (g) => <Pill tone={g.effect === "allow" ? "ok" : "danger"}>{g.effect}</Pill>,
+    },
+    {
+      key: "scope",
+      header: "Scope",
+      render: (g) => <span style={{ color: c.muted }}>{g.scope ?? "—"}</span>,
+    },
+    {
+      key: "granted",
+      header: "Granted",
+      render: (g) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
+          {formatDate(g.grantedAt)}
+        </span>
+      ),
+    },
+    {
+      key: "expires",
+      header: "Expires",
+      render: (g) =>
+        g.expiresAt ? (
+          <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
+            {formatDate(g.expiresAt)}
+          </span>
+        ) : (
+          <span style={{ color: c.warn }}>never</span>
+        ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (g) => (
+        <div style={{ minWidth: 180 }}>
+          <Destructive<ConsentGrant>
+            label="Revoke"
+            disabledReason={revokeDenied}
+            preview={async () => g}
+            renderPreview={(p) => (
+              <>
+                <strong>Revoking this consent takes effect immediately.</strong>
+                <span>
+                  {p.subject.agent} loses its <strong>{p.effect}</strong> decision for this
+                  conversation. The next thing it tries will be gated again, and somebody will be
+                  asked.
+                </span>
+              </>
+            )}
+            commit={async () => {
+              await consentRevoke(managerSender, { ...parties, subject: g.subject });
+            }}
+            onDone={grants.reload}
+          />
+        </div>
+      ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={contextHeading ? `Approvers for ${contextHeading}` : "Approvers"}
+        description="Who your agent asks when a task needs a human. Your wallet renders that
+          request as a consent prompt — so a binding that points nowhere is silent, not noisy."
+      >
+        {approvers.error && <LoadError what="approver bindings" error={approvers.error} />}
+        {approvers.loading && !approvers.data && <Loading what="approver bindings" />}
+        {approvers.data && (
+          <>
+            <Table
+              columns={approverColumns}
+              rows={approvers.data}
+              rowKey={(a) => `${a.platform}:${a.context}:${a.approver}`}
+              empty={
+                contextId
+                  ? `No approver is bound for ${contextId}. Tasks in this context that need a ` +
+                    "human have nobody to ask."
+                  : "No approvers bound. Tasks that need a human have nobody to ask."
+              }
+            />
+            {approvers.data.length === 0 && (
+              <Note tone="warn">
+                With no approver bound, a task your agent's policy gates on human consent cannot
+                be approved by anyone — it will be refused rather than queued.
+              </Note>
+            )}
+          </>
+        )}
+      </Panel>
+
+      <SetApprover
+        parties={parties}
+        contextId={contextId}
+        authority={authority}
+        onSet={approvers.reload}
+      />
+
+      <Panel
+        title="Consent grants"
+        description="What has already been agreed to, and until when. Unlike the approver list
+          above this is history, not configuration."
+      >
+        {grants.error && <LoadError what="consent grants" error={grants.error} />}
+        {grants.loading && !grants.data && <Loading what="consent grants" />}
+        {grants.data && (
+          <Table
+            columns={grantColumns}
+            rows={grants.data.grants}
+            rowKey={(g) => `${g.subject.platform}:${g.subject.conversationRef}:${g.subject.agent}`}
+            empty="Nothing has been consented to yet. Decisions your approvers make appear here."
+          />
+        )}
+      </Panel>
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/audit.tsx b/packages/extension/src/manager/panes/audit.tsx
new file mode 100644
index 0000000..cb121cb
--- /dev/null
+++ b/packages/extension/src/manager/panes/audit.tsx
@@ -0,0 +1,441 @@
+// Audit — the agent's account of what happened, and the whole of each entry.
+//
+// **Truncation is rendered, never swallowed.** `AuditListResult.truncated` says
+// the agent stopped early, and its own documentation is explicit about why that
+// matters: an operator reading "nothing else occurred" off a partial page is
+// exactly the failure an audit trail exists to prevent.
+//
+// ## Why a row opens
+//
+// A table row can only show what fits, and what does not fit is the part that
+// answers "why". `AuditEnvelope.detail` is free-form per action, `target` and
+// `actor` are full DID URLs that a column truncates, and `prevHash`/`entryHash`
+// are the only evidence of chaining there is. A summary the operator cannot get
+// behind is a summary they have to take on trust — from the surface whose whole
+// purpose is not needing to.
+//
+// So the row expands to the entry as the agent sent it, `detail` included and
+// unformatted beyond indentation. Nothing here reinterprets it: this pane's job
+// is to hand over the record, not to explain it.
+//
+// ## What is deliberately not claimed
+//
+// Entries carry `prevHash`/`entryHash`. Verifying a chain needs the whole
+// chain, and this is a page of it — so the console reports whether the links are
+// *present* and never that they were checked. Against a live agent every entry
+// came back with no hash at all, which is worth saying once, plainly, rather
+// than repeating "no" down a column.
+
+import { useCallback, useMemo, useState } from "react";
+import { auditList, type AuditEnvelope } from "@openvtc/pnm-core/admin";
+import { Button, Did, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { Loading, LoadError } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { formatInstant } from "../format.js";
+import type { Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const PAGE = 50;
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+function Outcome({ outcome }: { outcome: string | undefined }) {
+  if (!outcome) return <span style={{ color: c.faint }}>—</span>;
+  const ok = /^(ok|success|allow|allowed|granted)$/i.test(outcome);
+  const bad = /^(deny|denied|error|fail|failed|refused|rejected)$/i.test(outcome);
+  return <Pill tone={ok ? "ok" : bad ? "danger" : "off"}>{outcome}</Pill>;
+}
+
+/** One field of the opened entry. Absent values say so rather than vanishing —
+ *  "the agent recorded no target" is information. */
+function Field({ label, children }: { label: string; children: React.ReactNode }) {
+  return (
+    <>
+      <dt style={{ color: c.muted, whiteSpace: "nowrap" }}>{label}</dt>
+      <dd style={{ margin: 0, minWidth: 0, wordBreak: "break-word" }}>{children}</dd>
+    </>
+  );
+}
+
+function Absent() {
+  return <span style={{ color: c.faint }}>not recorded</span>;
+}
+
+function EntryDetail({ entry }: { entry: AuditEnvelope }) {
+  const detail = useMemo(() => {
+    if (!entry.detail || Object.keys(entry.detail).length === 0) return null;
+    try {
+      return JSON.stringify(entry.detail, null, 2);
+    } catch {
+      // A detail object the agent sent that will not serialise is itself worth
+      // reporting; silently showing nothing would hide the interesting case.
+      return "(this entry's detail could not be displayed)";
+    }
+  }, [entry.detail]);
+
+  return (
+    <div
+      style={{
+        background: c.raised,
+        border: `1px solid ${c.line}`,
+        borderRadius: "var(--w-r-sm)",
+        padding: "14px 16px",
+        display: "grid",
+        gap: 12,
+      }}
+    >
+      <dl
+        style={{
+          margin: 0,
+          display: "grid",
+          gridTemplateColumns: "auto minmax(0, 1fr)",
+          gap: "6px 18px",
+          fontSize: t.sm,
+          alignItems: "baseline",
+        }}
+      >
+        <Field label="Event id">
+          <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{entry.eventId}</span>
+        </Field>
+        <Field label="Recorded">{formatInstant(entry.recordedAt)}</Field>
+        <Field label="Action">
+          <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{entry.action}</span>
+        </Field>
+        <Field label="Outcome">
+          <Outcome outcome={entry.outcome} />
+        </Field>
+        <Field label="Actor">
+          {entry.actor ? (
+            entry.actor.startsWith("did:") ? (
+              <Did value={entry.actor} size={t.xs} />
+            ) : (
+              // Not every actor is a DID — a live agent records things like
+              // `internal:webvh-rest-auth`. Rendering that through the DID
+              // component would style a non-DID as one.
+              <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{entry.actor}</span>
+            )
+          ) : (
+            <Absent />
+          )}
+        </Field>
+        <Field label="Target">
+          {entry.target ? (
+            entry.target.startsWith("did:") ? (
+              <Did value={entry.target} size={t.xs} />
+            ) : (
+              <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{entry.target}</span>
+            )
+          ) : (
+            <Absent />
+          )}
+        </Field>
+        <Field label="Context">
+          {entry.contextId ? (
+            <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{entry.contextId}</span>
+          ) : (
+            <Absent />
+          )}
+        </Field>
+        <Field label="Chain">
+          {entry.entryHash ? (
+            <div style={{ display: "grid", gap: 3 }}>
+              <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all" }}>
+                this: {entry.entryHash}
+              </span>
+              <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all", color: c.muted }}>
+                prev: {entry.prevHash ?? "—"}
+              </span>
+              <span style={{ color: c.faint, fontSize: t.xs }}>
+                Present, not verified — checking a chain needs all of it.
+              </span>
+            </div>
+          ) : (
+            <span style={{ color: c.warn }}>
+              This entry carries no hash, so nothing links it to the one before it.
+            </span>
+          )}
+        </Field>
+      </dl>
+
+      {detail && (
+        <div style={{ display: "grid", gap: 5 }}>
+          <span style={{ fontSize: t.xs, color: c.muted, textTransform: "uppercase", letterSpacing: 0.4 }}>
+            Detail, as the agent recorded it
+          </span>
+          <pre
+            style={{
+              margin: 0,
+              padding: "10px 12px",
+              background: c.ground,
+              border: `1px solid ${c.line}`,
+              borderRadius: "var(--w-r-sm)",
+              fontSize: t.xs,
+              lineHeight: 1.5,
+              overflowX: "auto",
+              maxHeight: 320,
+            }}
+          >
+            {detail}
+          </pre>
+        </div>
+      )}
+      {!detail && (
+        <span style={{ fontSize: t.sm, color: c.faint }}>
+          This entry carries no detail beyond the fields above.
+        </span>
+      )}
+    </div>
+  );
+}
+
+/** Compact cell for a value that may be a DID URL far wider than its column. */
+function Truncated({ value }: { value: string }) {
+  return (
+    <span
+      title={value}
+      style={{
+        fontFamily: font.mono,
+        fontSize: t.xs,
+        display: "block",
+        maxWidth: 260,
+        overflow: "hidden",
+        textOverflow: "ellipsis",
+        whiteSpace: "nowrap",
+      }}
+    >
+      {value}
+    </span>
+  );
+}
+
+function Row({
+  entry,
+  open,
+  onToggle,
+}: {
+  entry: AuditEnvelope;
+  open: boolean;
+  onToggle: () => void;
+}) {
+  return (
+    <>
+      <tr
+        onClick={onToggle}
+        style={{ cursor: "pointer", background: open ? c.raised : "transparent" }}
+      >
+        {[
+          <span key="x" style={{ color: c.faint, fontSize: t.xs }} aria-hidden>
+            {open ? "▾" : "▸"}
+          </span>,
+          <span key="w" style={{ color: c.muted, whiteSpace: "nowrap" }}>
+            {formatInstant(entry.recordedAt)}
+          </span>,
+          <span key="a" style={{ fontFamily: font.mono, fontSize: t.xs }}>
+            {entry.action}
+          </span>,
+          entry.actor ? <Truncated key="ac" value={entry.actor} /> : <Absent key="ac" />,
+          entry.target ? <Truncated key="tg" value={entry.target} /> : <Absent key="tg" />,
+          <Outcome key="o" outcome={entry.outcome} />,
+          <span key="c" style={{ fontFamily: font.mono, fontSize: t.xs, color: c.muted }}>
+            {entry.contextId ?? "—"}
+          </span>,
+        ].map((cell, i) => (
+          <td
+            key={i}
+            style={{
+              padding: "7px 12px 7px 0",
+              borderBottom: open ? "none" : `1px solid ${c.lineSoft}`,
+              verticalAlign: "top",
+            }}
+          >
+            {cell}
+          </td>
+        ))}
+      </tr>
+      {open && (
+        <tr>
+          <td
+            colSpan={7}
+            style={{ padding: "0 12px 14px 0", borderBottom: `1px solid ${c.lineSoft}` }}
+          >
+            <EntryDetail entry={entry} />
+          </td>
+        </tr>
+      )}
+    </>
+  );
+}
+
+export function AuditPane({
+  parties,
+  contextId,
+  contextHeading,
+}: {
+  parties: Parties;
+  contextId: ContextSelection;
+  /** How the selected context is named in the tree — so the heading and the
+   *  navigation agree. See `contextLabel` in `format.ts`. */
+  contextHeading?: string | undefined;
+}) {
+  const [action, setAction] = useState("");
+  const [actor, setActor] = useState("");
+  // Applied filters, separate from the inputs: typing should not fire a request
+  // per keystroke against an agent over a mediator.
+  const [applied, setApplied] = useState({ action: "", actor: "" });
+  const [pageSize, setPageSize] = useState(PAGE);
+  const [openId, setOpenId] = useState<string | null>(null);
+
+  const list = useAsync(
+    () =>
+      auditList(managerSender, {
+        ...parties,
+        pageSize,
+        ...(contextId ? { contextId } : {}),
+        ...(applied.action ? { action: applied.action } : {}),
+        ...(applied.actor ? { actor: applied.actor } : {}),
+      }),
+    [parties.holder.did, parties.service.did, contextId, applied.action, applied.actor, pageSize],
+  );
+
+  const apply = useCallback(() => {
+    setPageSize(PAGE);
+    setOpenId(null);
+    setApplied({ action: action.trim(), actor: actor.trim() });
+  }, [action, actor]);
+
+  const entries = list.data?.entries ?? [];
+  // Said once, as a note, rather than repeated down a column of "no". Against a
+  // live agent this is every row, and a column that always reads the same
+  // carries no information while costing the width a DID needed.
+  const unchained = entries.length > 0 && entries.every((e) => !e.entryHash);
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={contextHeading ? `Audit for ${contextHeading}` : "Audit"}
+        description="What your agent recorded. Select a row to see the whole entry, including the
+          detail the agent attached to it."
+      >
+        <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+          <label style={{ display: "grid", gap: 4 }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>ACTION</span>
+            <input
+              style={fieldStyle}
+              value={action}
+              onChange={(e) => setAction(e.target.value)}
+              placeholder="acl/grant"
+            />
+          </label>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 300px" }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>ACTOR</span>
+            <input
+              style={{ ...fieldStyle, fontFamily: font.mono }}
+              value={actor}
+              onChange={(e) => setActor(e.target.value)}
+            />
+          </label>
+          <div style={{ paddingBottom: 1 }}>
+            <Button onClick={apply}>Apply filters</Button>
+          </div>
+        </div>
+
+        {list.error && <LoadError what="the audit trail" error={list.error} />}
+        {list.loading && !list.data && <Loading what="the audit trail" />}
+
+        {list.data && (
+          <>
+            {/* Before the table, not after. A warning under a long list is a
+                warning nobody reads. */}
+            {list.data.truncated && (
+              <Note tone="warn">
+                <strong>This is not the whole record.</strong> Your agent stopped early, so
+                anything you conclude from what is below — including that something did
+                <em> not</em> happen — may be wrong.{" "}
+                <button
+                  onClick={() => setPageSize((n) => n + PAGE)}
+                  style={{
+                    border: "none",
+                    background: "none",
+                    padding: 0,
+                    color: c.accent,
+                    cursor: "pointer",
+                    font: "inherit",
+                    textDecoration: "underline",
+                  }}
+                >
+                  Load more
+                </button>
+                , or narrow the filters.
+              </Note>
+            )}
+
+            {unchained && (
+              <Note tone="warn">
+                None of these entries carries a hash linking it to the one before it, so the
+                trail cannot be checked for gaps or reordering. That is the agent's recording
+                configuration, not something this console can establish from here.
+              </Note>
+            )}
+
+            {entries.length === 0 ? (
+              <div style={{ fontSize: t.sm, color: c.faint, padding: "10px 0", lineHeight: 1.55 }}>
+                {applied.action || applied.actor
+                  ? "Nothing matches those filters. Clear them to see the rest."
+                  : "Your agent has recorded nothing here yet."}
+              </div>
+            ) : (
+              <div style={{ overflowX: "auto" }}>
+                <table
+                  style={{ borderCollapse: "collapse", width: "100%", minWidth: 800, fontSize: t.sm }}
+                >
+                  <thead>
+                    <tr>
+                      {["", "When", "Action", "Actor", "Target", "Outcome", "Context"].map((h) => (
+                        <th
+                          key={h || "disclose"}
+                          style={{
+                            textAlign: "left",
+                            padding: "6px 12px 6px 0",
+                            borderBottom: `1px solid ${c.line}`,
+                            color: c.faint,
+                            fontSize: t.xs,
+                            textTransform: "uppercase",
+                            letterSpacing: 0.4,
+                            fontWeight: 640,
+                            whiteSpace: "nowrap",
+                          }}
+                        >
+                          {h}
+                        </th>
+                      ))}
+                    </tr>
+                  </thead>
+                  <tbody>
+                    {entries.map((e) => (
+                      <Row
+                        key={e.eventId}
+                        entry={e}
+                        open={openId === e.eventId}
+                        onToggle={() => setOpenId((cur) => (cur === e.eventId ? null : e.eventId))}
+                      />
+                    ))}
+                  </tbody>
+                </table>
+              </div>
+            )}
+          </>
+        )}
+      </Panel>
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/contexts.tsx b/packages/extension/src/manager/panes/contexts.tsx
new file mode 100644
index 0000000..902f806
--- /dev/null
+++ b/packages/extension/src/manager/panes/contexts.tsx
@@ -0,0 +1,567 @@
+// Contexts — the pane behind the tree.
+//
+// Reads and writes the same records the tree navigates, so the two are driven
+// from one fetch in the shell rather than each holding its own copy: a rename
+// that updated the pane but not the tree would leave the operator looking at
+// two names for one context and no way to tell which is current.
+
+import { useCallback, useState } from "react";
+import {
+  contextsCreate,
+  contextsUpdate,
+  contextsUpdateDid,
+  type ContextRecord,
+} from "@openvtc/pnm-core";
+import { contextDelete, contextPreviewDelete } from "@openvtc/pnm-core/admin";
+import { Button, Did, Empty, Note, Panel } from "../../ui.js";
+import { LoadError } from "../table.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+// `webvhDidList`, not `vtaListDids`. The latter is typed on `Identity` —
+// it wants key material — and this console deliberately holds none; that
+// type is the guard, not an inconvenience (see CLAUDE.md on `TaskParty`).
+import { webvhDidList } from "@openvtc/pnm-core/webvh";
+import { useAsync } from "../use-async.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { Destructive, ConsentCeremony, runMutation } from "../destructive.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import { formatInstant } from "../format.js";
+import type { ContextSelection } from "../context-column.js";
+
+const fieldStyle: React.CSSProperties = {
+  width: "100%",
+  boxSizing: "border-box",
+  padding: "7px 10px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+function Label({ children }: { children: React.ReactNode }) {
+  return (
+    <span style={{ fontSize: t.xs, color: c.muted, textTransform: "uppercase", letterSpacing: 0.4 }}>
+      {children}
+    </span>
+  );
+}
+
+/** What deleting a context would destroy, in the agent's own words. */
+interface DeletePreview {
+  id: string;
+  keys: string[];
+  webvhDids: string[];
+}
+
+function CreateContext({
+  parties,
+  parent,
+  authority,
+  onCreated,
+}: {
+  parties: Parties;
+  parent: ContextSelection;
+  authority: Authority | null;
+  onCreated: () => void;
+}) {
+  const [id, setId] = useState("");
+  const [name, setName] = useState("");
+  const [description, setDescription] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  // `contexts/create` is super-admin at the agent — it also applies a finer
+  // check on the parent. Disabled-with-a-reason rather than hidden: an operator
+  // who cannot create needs to know that is the rule, not that the console
+  // forgot the feature.
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Creating a context needs the admin role at this agent."
+    : null;
+
+  const submit = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await contextsCreate(managerSender, {
+          ...parties,
+          id: id.trim(),
+          ...(name.trim() ? { name: name.trim() } : {}),
+          ...(description.trim() ? { description: description.trim() } : {}),
+          ...(parent ? { parent } : {}),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) {
+      setId("");
+      setName("");
+      setDescription("");
+      onCreated();
+    }
+  }, [parties, id, name, description, parent, onCreated]);
+
+  return (
+    <Panel
+      title="New context"
+      description={
+        parent ? (
+          <>
+            Nested under <code style={{ fontFamily: font.mono }}>{parent}</code>. A context is a
+            sealed compartment: the keys and DIDs inside it are isolated from every other one, so
+            a compromise stops at its edge.
+          </>
+        ) : (
+          <>
+            Top-level. Select a context in the tree first to nest inside it. A context is a sealed
+            compartment: the keys and DIDs inside it are isolated from every other one, so a
+            compromise stops at its edge.
+          </>
+        )
+      }
+    >
+      <div style={{ display: "grid", gap: 10, maxWidth: 520 }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Id {parent ? "(leaf segment)" : ""}</Label>
+          <input
+            style={fieldStyle}
+            value={id}
+            onChange={(e) => setId(e.target.value)}
+            placeholder={parent ? "payroll" : "work"}
+          />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Name (optional)</Label>
+          <input style={fieldStyle} value={name} onChange={(e) => setName(e.target.value)} />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Description (optional)</Label>
+          <input
+            style={fieldStyle}
+            value={description}
+            onChange={(e) => setDescription(e.target.value)}
+          />
+        </label>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        <div>
+          <Button
+            kind="primary"
+            disabled={busy || !id.trim() || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void submit()}
+          >
+            {busy ? "Creating…" : "Create context"}
+          </Button>
+        </div>
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+function EditContext({
+  parties,
+  record,
+  authority,
+  onChanged,
+}: {
+  parties: Parties;
+  record: ContextRecord;
+  authority: Authority | null;
+  onChanged: () => void;
+}) {
+  const [name, setName] = useState(record.name ?? "");
+  const [description, setDescription] = useState(record.description ?? "");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Editing a context needs an administrative role at this agent."
+    : null;
+
+  const save = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        // `policy` is deliberately not sent. `contextsUpdate` replaces it whole
+        // rather than merging, so writing it from a form that never read it
+        // would silently drop every constraint the form does not know about.
+        await contextsUpdate(managerSender, {
+          ...parties,
+          id: record.id,
+          name: name.trim(),
+          description: description.trim(),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) onChanged();
+  }, [parties, record.id, name, description, onChanged]);
+
+  const dirty = name !== (record.name ?? "") || description !== (record.description ?? "");
+
+  return (
+    <Panel title={record.name || record.id} description={<code style={{ fontFamily: font.mono }}>{record.basePath}</code>}>
+      <dl
+        style={{
+          margin: 0,
+          display: "grid",
+          gridTemplateColumns: "auto 1fr",
+          gap: "6px 18px",
+          fontSize: t.sm,
+          alignItems: "baseline",
+        }}
+      >
+        <dt style={{ color: c.muted }}>Id</dt>
+        <dd style={{ margin: 0, fontFamily: font.mono }}>{record.id}</dd>
+        <dt style={{ color: c.muted }}>DID</dt>
+        <dd style={{ margin: 0 }}>
+          {record.did ? <Did value={record.did} /> : <span style={{ color: c.faint }}>none bound</span>}
+        </dd>
+        <dt style={{ color: c.muted }}>Created</dt>
+        <dd style={{ margin: 0, color: c.muted }}>{formatInstant(record.createdAt)}</dd>
+        <dt style={{ color: c.muted }}>Updated</dt>
+        <dd style={{ margin: 0, color: c.muted }}>{formatInstant(record.updatedAt)}</dd>
+      </dl>
+
+      <div style={{ display: "grid", gap: 10, maxWidth: 520, marginTop: 6 }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Name</Label>
+          <input style={fieldStyle} value={name} onChange={(e) => setName(e.target.value)} />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Description</Label>
+          <input
+            style={fieldStyle}
+            value={description}
+            onChange={(e) => setDescription(e.target.value)}
+          />
+        </label>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        <div>
+          <Button
+            disabled={busy || !dirty || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void save()}
+          >
+            {busy ? "Saving…" : "Save changes"}
+          </Button>
+        </div>
+      </div>
+    </Panel>
+  );
+}
+
+function DeleteContext({
+  parties,
+  record,
+  authority,
+  onDeleted,
+}: {
+  parties: Parties;
+  record: ContextRecord;
+  authority: Authority | null;
+  onDeleted: () => void;
+}) {
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Deleting a context needs the admin role at this agent."
+    : null;
+
+  return (
+    <Panel
+      title="Delete this context"
+      description="The keys and DIDs a context holds do not come back. Your agent is asked what
+        this would destroy before anything is sent."
+    >
+      <Destructive<DeletePreview>
+        label="Delete context"
+        disabledReason={denied}
+        preview={() => contextPreviewDelete(managerSender, { ...parties, id: record.id })}
+        needsForce={(p) => p.keys.length > 0 || p.webvhDids.length > 0}
+        forceLabel="Delete anyway, destroying the keys and DIDs listed above"
+        renderPreview={(p) => (
+          <>
+            <strong>
+              Deleting {record.name || record.id} is irreversible.
+            </strong>
+            {p.keys.length === 0 && p.webvhDids.length === 0 ? (
+              <span>Your agent reports it holds no keys and no DIDs.</span>
+            ) : (
+              <>
+                {p.keys.length > 0 && (
+                  <div>
+                    <div style={{ color: c.muted, marginBottom: 3 }}>
+                      {p.keys.length} key{p.keys.length === 1 ? "" : "s"} destroyed:
+                    </div>
+                    <ul style={{ margin: 0, paddingLeft: 18, fontFamily: font.mono, fontSize: t.xs }}>
+                      {p.keys.map((k) => (
+                        <li key={k}>{k}</li>
+                      ))}
+                    </ul>
+                  </div>
+                )}
+                {p.webvhDids.length > 0 && (
+                  <div>
+                    <div style={{ color: c.muted, marginBottom: 3 }}>
+                      {p.webvhDids.length} DID{p.webvhDids.length === 1 ? "" : "s"} destroyed:
+                    </div>
+                    <ul style={{ margin: 0, paddingLeft: 18 }}>
+                      {p.webvhDids.map((d) => (
+                        <li key={d}>
+                          <Did value={d} size={t.xs} />
+                        </li>
+                      ))}
+                    </ul>
+                  </div>
+                )}
+              </>
+            )}
+          </>
+        )}
+        commit={async (force) => {
+          await contextDelete(managerSender, { ...parties, id: record.id, force });
+        }}
+        onDone={onDeleted}
+      />
+    </Panel>
+  );
+}
+
+
+/**
+ * Assign, reassign or clear the DID a context acts as.
+ *
+ * This existed in `pnm-core` and nowhere in the console, which put the
+ * operator in an odd spot: deleting a DID that a context depends on fails
+ * with the agent's own instruction to `pnm contexts update <ctx> --did
+ * <new-did>` — an instruction the console could carry out and did not offer.
+ * Being told the fix and handed no way to apply it is worse than not being
+ * told.
+ *
+ * A separate panel from name/description on purpose. Those are labels; this
+ * changes which identity the context presents to every counterparty, and the
+ * agent refuses to delete a DID while a context still points at it. Same
+ * form, same Save button would have made a rename and an identity change look
+ * like one decision.
+ */
+function ContextDid({
+  parties,
+  record,
+  authority,
+  onChanged,
+}: {
+  parties: Parties;
+  record: ContextRecord;
+  authority: Authority | null;
+  onChanged: () => void;
+}) {
+  const [did, setDid] = useState(record.did ?? "");
+
+  const dids = useAsync(
+    () => webvhDidList(managerSender, { ...parties, contextId: record.id }),
+    [parties.holder.did, parties.service.did, record.id],
+  );
+
+  // The current DID is always offered, even if the agent no longer lists it
+  // under this context — otherwise selecting nothing would silently look like
+  // a deliberate change.
+  const options = Array.from(
+    new Set([
+      ...(dids.data?.dids ?? []).map((d) => d.did),
+      ...(record.did ? [record.did] : []),
+    ]),
+  );
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied =
+    authority && !hasRole(authority, "admin", "super-admin")
+      ? "Changing a context's DID needs the admin role at this agent."
+      : null;
+
+  const save = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await contextsUpdateDid(managerSender, {
+          ...parties,
+          id: record.id,
+          did: did.trim(),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) onChanged();
+  }, [parties, record.id, did, onChanged]);
+
+  const unchanged = did.trim() === (record.did ?? "");
+
+  return (
+    <Panel
+      title="Identity"
+      description="The DID this context acts as. Counterparties see this one, so changing it changes
+        who the context presents itself as — not just what it is called."
+    >
+      <div style={{ display: "grid", gap: 10 }}>
+        {!record.did && (
+          <Note tone="accent">
+            This context has no DID of its own yet. That is a state, not a fault — it simply has no
+            identity to present until one is assigned.
+          </Note>
+        )}
+
+        {/* A list, not a paste box.
+            The console already knows which DIDs exist — asking an operator to
+            copy a `did:webvh:Qm…` out of another pane and paste it here made
+            them do the lookup by hand, and a mistyped identifier is not
+            something they could spot by reading it back.
+
+            Scoped to this context's own DIDs, which is what a context acts as.
+            The current value is added to the list even when it is not among
+            them, so a DID assigned from elsewhere is never silently dropped
+            from the options and replaced by whatever happened to be first. */}
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>DID</span>
+          <select
+            style={{
+              boxSizing: "border-box",
+              padding: "6px 9px",
+              background: c.ground,
+              color: c.text,
+              border: `1px solid ${c.line}`,
+              borderRadius: "var(--w-r-sm)",
+              fontSize: t.sm,
+              fontFamily: font.mono,
+            }}
+            value={did}
+            onChange={(e) => setDid(e.target.value)}
+            disabled={dids.loading && !dids.data}
+          >
+            <option value="">— none —</option>
+            {options.map((d) => (
+              <option key={d} value={d}>
+                {d}
+              </option>
+            ))}
+          </select>
+        </label>
+        {dids.error && <LoadError what="this context's DIDs" error={dids.error} />}
+        {dids.data && options.length === 0 && (
+          <span style={{ fontSize: t.xs, color: c.faint }}>
+            This context holds no DIDs yet. Create one under <b>DIDs</b> and it will appear here.
+          </span>
+        )}
+        <span style={{ fontSize: t.xs, color: c.faint }}>
+          Choosing <b>none</b> leaves the context with no identity of its own.
+        </span>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        <div>
+          <Button
+            kind="primary"
+            disabled={busy || unchanged || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void save()}
+          >
+            {busy ? "Saving…" : record.did ? "Reassign DID" : "Assign DID"}
+          </Button>
+        </div>
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+export function ContextsPane({
+  parties,
+  authority,
+  records,
+  selected,
+  onChanged,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  records: ContextRecord[];
+  selected: ContextSelection;
+  onChanged: () => void;
+}) {
+  const record = selected ? records.find((r) => r.id === selected) : undefined;
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      {selected && !record && (
+        <Empty>
+          That context is no longer in your agent's list. It may have been deleted, or your access
+          to it revoked.
+        </Empty>
+      )}
+
+      {record && (
+        <>
+          {/* `key` is load-bearing, not decoration.
+              `EditContext` seeds its `name` and `description` fields with
+              `useState(record.name)`, which runs on mount and never again.
+              This panel is a single instance that swaps records as the
+              operator moves through the tree, so without a key React reuses
+              it — and every context showed the FIRST context's name in an
+              editable field sitting above the right id and DID. An operator
+              pressing Save would have renamed the context they were looking
+              at to the name of one they were not.
+
+              Keying on the record's id makes selecting a different context a
+              different component, which is what re-runs the initialisers.
+              The sibling editors in `keys.tsx` and `access.tsx` use the same
+              seeding pattern and are fine, because `Table` renders them per
+              row under `rowKey` — the key is already there. */}
+          <EditContext
+            key={record.id}
+            parties={parties}
+            record={record}
+            authority={authority}
+            onChanged={onChanged}
+          />
+          <ContextDid
+            key={`did:${record.id}`}
+            parties={parties}
+            record={record}
+            authority={authority}
+            onChanged={onChanged}
+          />
+          <DeleteContext
+            parties={parties}
+            record={record}
+            authority={authority}
+            onDeleted={onChanged}
+          />
+        </>
+      )}
+
+      <CreateContext
+        parties={parties}
+        parent={selected}
+        authority={authority}
+        onCreated={onChanged}
+      />
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/credentials.tsx b/packages/extension/src/manager/panes/credentials.tsx
new file mode 100644
index 0000000..755b08d
--- /dev/null
+++ b/packages/extension/src/manager/panes/credentials.tsx
@@ -0,0 +1,1071 @@
+// Credentials — what this agent issues to others, and takes back.
+//
+// ## What it took to show the issued list
+//
+// `vta/credentials` declared `issue` and `revoke` and nothing else, so this
+// pane spent its first version saying so — "there is no list of issued
+// credentials, and this is not an empty one" — rather than rendering a blank
+// table, which would have read as "you have issued nothing" and been wrong the
+// moment anything had been.
+//
+// The task now exists: specified at trustoverip/dtgwg-trust-tasks-tf#342 and
+// implemented at OpenVTC/verifiable-trust-infrastructure#1235. `IssuedList`
+// below is what the notice became.
+//
+// Two things it renders that the shape makes easy to lose. `truncated` means
+// the agent stopped early, so a caller must not read the page as a complete
+// account of what was issued — it is surfaced above the table rather than
+// below it. And `status` is derived by the agent at read time with `revoked`
+// beating `expired`, so it is never cached and never recomputed here: a copy
+// of a fact about the clock is wrong from the first second after it is made.
+//
+// The holder side — the credentials this agent *holds* — lives in a different
+// family again (`vault/credentials/*`) and is in `HeldCredentials` below. It
+// waited on `trustoverip/dtgwg-trust-tasks-tf#338`, which specified that family
+// from the implementation that had been dispatching it unspecified; before that
+// there were no bindings and hand-transcribing the shapes would have been the
+// copy-that-drifts this repo has removed once already.
+//
+// Two things that surface carries which a list of credentials would otherwise
+// flatten. **Query refuses an unconstrained filter** — an empty one returns the
+// shape of the holder's whole life, so the pane requires a filter and says so
+// rather than firing a request it knows will be refused. And **validity and
+// lifecycle are orthogonal**: a credential can be `valid` and `archived`, or
+// `revoked` and `active`, so both are rendered and neither is derived from the
+// other.
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import {
+  issueCredential,
+  listCredentials,
+  revokeCredential,
+  type IssuedCredentialSummary,
+} from "@openvtc/pnm-core/admin";
+import {
+  credVaultArchive,
+  credVaultDelete,
+  credVaultPurge,
+  credVaultGet,
+  credVaultQuery,
+  credVaultRestore,
+  credVaultUnarchive,
+  isRunnableCredentialQuery,
+  type CredentialDescriptor,
+  type CredentialFilter,
+  type CredentialStatus,
+} from "@openvtc/pnm-core";
+import { Button, Did, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { formatDate, isPast } from "../format.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+
+const DAY = 86400;
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+const codeStyle: React.CSSProperties = {
+  ...fieldStyle,
+  fontFamily: font.mono,
+  fontSize: t.xs,
+  minHeight: 140,
+  width: "100%",
+  lineHeight: 1.5,
+  resize: "vertical",
+};
+
+function Label({ children }: { children: React.ReactNode }) {
+  return (
+    <span style={{ fontSize: t.xs, color: c.muted, textTransform: "uppercase", letterSpacing: 0.4 }}>
+      {children}
+    </span>
+  );
+}
+
+function IssueCredential({
+  parties,
+  authority,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+}) {
+  const [holderDid, setHolderDid] = useState("");
+  const [credentialType, setCredentialType] = useState("");
+  const [claims, setClaims] = useState("{\n  \n}");
+  const [validityDays, setValidityDays] = useState("365");
+  const [purpose, setPurpose] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+  const [issued, setIssued] = useState<string | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Issuing a credential needs the admin role at this agent."
+    : null;
+
+  const days = Number(validityDays);
+  const daysValid = Number.isFinite(days) && days > 0;
+
+  const submit = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    setIssued(null);
+
+    let parsed: Record<string, unknown>;
+    try {
+      const candidate: unknown = JSON.parse(claims);
+      if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) {
+        setError("Claims must be a JSON object.");
+        setBusy(false);
+        return;
+      }
+      parsed = candidate as Record<string, unknown>;
+    } catch {
+      setError("Claims are not valid JSON.");
+      setBusy(false);
+      return;
+    }
+
+    const ok = await runMutation(
+      async () => {
+        const res = await issueCredential(managerSender, {
+          ...parties,
+          holderDid: holderDid.trim(),
+          claims: parsed as never,
+          validitySeconds: Math.round(days * DAY),
+          ...(credentialType.trim() ? { credentialType: credentialType.trim() } : {}),
+          ...(purpose.trim() ? { purpose: purpose.trim() } : {}),
+        });
+        // The id is the only handle revocation has, and there is no list to
+        // recover it from later. Surfaced prominently for exactly that reason.
+        const id = (res as { credentialId?: string; id?: string }).credentialId
+          ?? (res as { id?: string }).id
+          ?? null;
+        setIssued(id);
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) {
+      setHolderDid("");
+      setClaims("{\n  \n}");
+    }
+  }, [parties, holderDid, claims, days, credentialType, purpose]);
+
+  return (
+    <Panel
+      title="Issue a credential"
+      description="Your agent signs this as issuer. Once it reaches the holder it is theirs to
+        present anywhere, to anyone who trusts your agent — revocation is the only way back."
+    >
+      <div style={{ display: "grid", gap: 10, maxWidth: 680 }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Holder DID</Label>
+          <input
+            style={{ ...fieldStyle, fontFamily: font.mono }}
+            value={holderDid}
+            onChange={(e) => setHolderDid(e.target.value)}
+            placeholder="did:key:z6Mk…"
+          />
+        </label>
+
+        <div style={{ display: "flex", gap: 10, flexWrap: "wrap" }}>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 220px" }}>
+            <Label>Type (optional)</Label>
+            <input
+              style={fieldStyle}
+              value={credentialType}
+              onChange={(e) => setCredentialType(e.target.value)}
+              placeholder="MembershipCredential"
+            />
+          </label>
+          <label style={{ display: "grid", gap: 4 }}>
+            <Label>Valid for (days)</Label>
+            <input
+              style={{ ...fieldStyle, width: 120 }}
+              value={validityDays}
+              onChange={(e) => setValidityDays(e.target.value)}
+            />
+          </label>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 200px" }}>
+            <Label>Purpose (optional)</Label>
+            <input style={fieldStyle} value={purpose} onChange={(e) => setPurpose(e.target.value)} />
+          </label>
+        </div>
+
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Claims</Label>
+          <textarea
+            style={codeStyle}
+            value={claims}
+            onChange={(e) => setClaims(e.target.value)}
+            spellCheck={false}
+          />
+        </label>
+        <span style={{ fontSize: t.xs, color: c.faint }}>
+          A JSON object. Everything in here is asserted by your agent and readable by anyone the
+          holder shows it to.
+        </span>
+
+        {!daysValid && validityDays.trim() !== "" && (
+          <Note tone="danger">Validity must be a positive number of days.</Note>
+        )}
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        {issued !== null && (
+          <Note tone="warn">
+            <div style={{ display: "grid", gap: 6 }}>
+              <strong>Issued. Keep this id.</strong>
+              <span style={{ fontFamily: font.mono, fontSize: t.sm, wordBreak: "break-all" }}>
+                {issued || "(your agent returned no id)"}
+              </span>
+              <span>
+                It is the only handle revocation has, and your agent offers no way to list
+                issued credentials — so if this is lost, the audit trail is the only place it
+                can be recovered from.
+              </span>
+            </div>
+          </Note>
+        )}
+
+        <div>
+          <Button
+            kind="primary"
+            disabled={busy || !holderDid.trim() || !daysValid || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void submit()}
+          >
+            {busy ? "Issuing…" : "Issue credential"}
+          </Button>
+        </div>
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+function RevokeCredential({
+  parties,
+  authority,
+  prefillId,
+  onConsumed,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  /** A credential id picked from the list above, so an operator never copies an
+   *  opaque identifier by eye before an irreversible action. */
+  prefillId?: string | null;
+  onConsumed?: () => void;
+}) {
+  const [credentialId, setCredentialId] = useState("");
+  const [reason, setReason] = useState("");
+  const [confirming, setConfirming] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+  const [done, setDone] = useState(false);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Revoking a credential needs the admin role at this agent."
+    : null;
+
+  // A pick from the list replaces whatever was typed, and clears any previous
+  // outcome — a stale "Revoked." beside a different id reads as a result for
+  // the one now in the field.
+  useEffect(() => {
+    if (!prefillId) return;
+    setCredentialId(prefillId);
+    setConfirming(false);
+    setDone(false);
+    setError(null);
+  }, [prefillId]);
+
+  const submit = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await revokeCredential(managerSender, {
+          ...parties,
+          credentialId: credentialId.trim(),
+          ...(reason.trim() ? { reason: reason.trim() } : {}),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) {
+      setDone(true);
+      setConfirming(false);
+      setCredentialId("");
+      setReason("");
+      onConsumed?.();
+    }
+  }, [parties, credentialId, reason, onConsumed]);
+
+  return (
+    <Panel
+      title="Revoke a credential"
+      description="By id. Pick a row above and its id lands here — copying an opaque identifier
+        by eye before an irreversible action is how the wrong credential gets revoked."
+    >
+      <div style={{ display: "grid", gap: 10, maxWidth: 680 }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Credential id</Label>
+          <input
+            style={{ ...fieldStyle, fontFamily: font.mono }}
+            value={credentialId}
+            onChange={(e) => {
+              setCredentialId(e.target.value);
+              setConfirming(false);
+              setDone(false);
+            }}
+          />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Reason (optional, recorded)</Label>
+          <input style={fieldStyle} value={reason} onChange={(e) => setReason(e.target.value)} />
+        </label>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+        {done && <Note tone="accent">Revoked.</Note>}
+
+        {/* No preview is possible — there is no read task to preview *from*.
+            So the confirm step states what cannot be checked rather than
+            dressing up a guess as a preview. */}
+        {confirming ? (
+          <>
+            <Note tone="danger">
+              <div style={{ display: "grid", gap: 6 }}>
+                <strong>Revoking cannot be undone.</strong>
+                <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all" }}>
+                  {credentialId.trim()}
+                </span>
+                <span>
+                  Whoever holds this stops being able to present it anywhere that checks
+                  revocation. The list above shows who holds it and when it was issued; what it
+                  actually <em>claims</em> cannot be shown — there is no task that reads a
+                  credential body back — so if the claims are what you are deciding on, check
+                  your own records first.
+                </span>
+              </div>
+            </Note>
+            <div style={{ display: "flex", gap: 8 }}>
+              <Button kind="danger" disabled={busy} onClick={() => void submit()}>
+                {busy ? "Revoking…" : "Revoke it"}
+              </Button>
+              <Button kind="quiet" disabled={busy} onClick={() => setConfirming(false)}>
+                Cancel
+              </Button>
+            </div>
+          </>
+        ) : (
+          <div>
+            <Button
+              kind="danger"
+              disabled={!credentialId.trim() || Boolean(denied)}
+              {...(denied ? { title: denied } : {})}
+              onClick={() => setConfirming(true)}
+            >
+              Revoke
+            </Button>
+          </div>
+        )}
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+/** Validity and lifecycle are separate axes, so they get separate pills. A
+ *  single "status" column would have to pick one and would be wrong about the
+ *  other — a revoked-but-active credential and a valid-but-archived one are
+ *  both real, and mean opposite things. */
+function ValidityPill({ status }: { status: CredentialDescriptor["status"] }) {
+  const tone = status === "valid" ? "ok" : status === "unknown" ? "off" : "danger";
+  return <Pill tone={tone}>{status}</Pill>;
+}
+
+function LifecyclePill({ record }: { record: CredentialDescriptor }) {
+  const state = record.lifecycle ?? "active";
+  if (state === "active") return <Pill tone="ok">active</Pill>;
+  if (state === "archived") return <Pill tone="off">archived</Pill>;
+  // A tombstone's grace window is the whole reason to show this row: after it
+  // passes the agent has erased the credential and restore does nothing.
+  const expired = isPast(record.graceUntil);
+  return (
+    <div style={{ display: "grid", gap: 2 }}>
+      <Pill tone="danger">deleted</Pill>
+      <span style={{ fontSize: t.xs, color: expired ? c.faint : c.warn, whiteSpace: "nowrap" }}>
+        {record.graceUntil
+          ? expired
+            ? "grace expired"
+            : `restorable until ${formatDate(record.graceUntil)}`
+          : "not restorable"}
+      </span>
+    </div>
+  );
+}
+
+function HeldCredentials({
+  parties,
+  authority,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+}) {
+  const [filter, setFilter] = useState<CredentialFilter>({});
+  const [applied, setApplied] = useState<CredentialFilter | null>(null);
+  const [includeArchived, setIncludeArchived] = useState(false);
+  const [includeDeleted, setIncludeDeleted] = useState(false);
+  const [rows, setRows] = useState<CredentialDescriptor[] | null>(null);
+  const [viewing, setViewing] = useState<string | null>(null);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  // The agent refuses an unconstrained query, so the control is disabled rather
+  // than firing a request whose refusal the operator would have to interpret.
+  const runnable = isRunnableCredentialQuery(filter);
+
+  const search = useCallback(
+    async (f: CredentialFilter = filter, arch = includeArchived, del = includeDeleted) => {
+      if (!isRunnableCredentialQuery(f)) return;
+      setLoading(true);
+      setError(null);
+      try {
+        setRows(await credVaultQuery(managerSender, {
+          ...parties, ...f, includeArchived: arch, includeDeleted: del,
+        }));
+        setApplied(f);
+      } catch (e) {
+        setError(e instanceof Error ? e.message : String(e));
+      } finally {
+        setLoading(false);
+      }
+    },
+    [parties, filter, includeArchived, includeDeleted],
+  );
+
+  const reload = useCallback(() => {
+    if (applied) void search(applied, includeArchived, includeDeleted);
+  }, [applied, search, includeArchived, includeDeleted]);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Changing a stored credential needs an administrative role at this agent."
+    : null;
+
+  const set = (k: keyof CredentialFilter) => (e: React.ChangeEvent<HTMLInputElement | HTMLSelectElement>) =>
+    setFilter((prev) => {
+      const next = { ...prev };
+      if (e.target.value) (next as Record<string, string>)[k] = e.target.value;
+      else delete next[k];
+      return next;
+    });
+
+  const columns: Column<CredentialDescriptor>[] = useMemo(() => [
+    {
+      key: "types",
+      header: "Credential",
+      render: (r) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <span style={{ fontWeight: 600 }}>
+            {r.types.filter((x) => x !== "VerifiableCredential").join(", ") || "VerifiableCredential"}
+          </span>
+          <span style={{ fontFamily: font.mono, fontSize: t.xs, color: c.faint }}>{r.id}</span>
+        </div>
+      ),
+    },
+    {
+      key: "issuer",
+      header: "Issuer",
+      render: (r) => (r.issuerDid ? <Did value={r.issuerDid} size={t.xs} /> : <span style={{ color: c.faint }}>—</span>),
+    },
+    {
+      key: "purpose",
+      header: "Purpose",
+      render: (r) => <span style={{ color: c.muted }}>{r.purpose ?? "—"}</span>,
+    },
+    { key: "validity", header: "Validity", render: (r) => <ValidityPill status={r.status} /> },
+    { key: "lifecycle", header: "State", render: (r) => <LifecyclePill record={r} /> },
+    {
+      key: "until",
+      header: "Valid until",
+      render: (r) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>{formatDate(r.validUntil, "—")}</span>
+      ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (r) => {
+        const state = r.lifecycle ?? "active";
+        return (
+          <div style={{ display: "grid", gap: 8, minWidth: 200 }}>
+            {/* Reading a credential is its own request. The search returned
+                metadata; this fetches the document by id. */}
+            <Button
+              kind="quiet"
+              onClick={() => setViewing((cur) => (cur === r.id ? null : r.id))}
+            >
+              {viewing === r.id ? "Hide" : "View"}
+            </Button>
+            {state === "active" && (
+              <Button
+                kind="quiet"
+                disabled={Boolean(denied)}
+                {...(denied ? { title: denied } : {})}
+                onClick={() => void credVaultArchive(managerSender, { ...parties, id: r.id }).then(reload)}
+              >
+                Archive
+              </Button>
+            )}
+            {state === "archived" && (
+              <Button
+                kind="quiet"
+                disabled={Boolean(denied)}
+                {...(denied ? { title: denied } : {})}
+                onClick={() => void credVaultUnarchive(managerSender, { ...parties, id: r.id }).then(reload)}
+              >
+                Unarchive
+              </Button>
+            )}
+            {state === "deleted" && !isPast(r.graceUntil) && (
+              <Button
+                kind="quiet"
+                disabled={Boolean(denied)}
+                {...(denied ? { title: denied } : {})}
+                onClick={() => void credVaultRestore(managerSender, { ...parties, id: r.id }).then(reload)}
+              >
+                Restore
+              </Button>
+            )}
+            {state !== "deleted" ? (
+              <Destructive<CredentialDescriptor>
+                label="Delete"
+                disabledReason={denied}
+                preview={async () => r}
+                renderPreview={(p) => (
+                  <>
+                    <strong>This moves the credential to the trash, recoverably.</strong>
+                    <span>
+                      It stops being presentable straight away. Your agent keeps it until its
+                      grace window passes, then erases it — after that, getting it back means
+                      going back to {p.issuerDid ? "the issuer" : "whoever issued it"}, which for
+                      an invitation or a one-time membership may not be possible at all.
+                    </span>
+                  </>
+                )}
+                commit={async () => {
+                  await credVaultDelete(managerSender, { ...parties, id: r.id });
+                }}
+                onDone={reload}
+              />
+            ) : (
+              <Destructive<CredentialDescriptor>
+                label="Purge"
+                disabledReason={denied}
+                preview={async () => r}
+                renderPreview={() => (
+                  <>
+                    <strong>Purging erases this now, and nothing can bring it back.</strong>
+                    <span>
+                      Not a faster delete — it skips the grace window entirely. Use it when the
+                      requirement is that the material stop existing.
+                    </span>
+                  </>
+                )}
+                commit={async () => {
+                  await credVaultPurge(managerSender, { ...parties, id: r.id });
+                }}
+                onDone={reload}
+              />
+            )}
+          </div>
+        );
+      },
+    },
+  ], [parties, denied, reload]);
+
+  return (
+    <Panel
+      title="Credentials this agent holds"
+      description="Invitations, memberships and roles issued to you and stored by your agent.
+        Searching returns metadata only — your agent never puts a credential's contents in a
+        search result."
+    >
+      <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+        <label style={{ display: "grid", gap: 4, flex: "1 1 200px" }}>
+          <Label>Type</Label>
+          <input style={fieldStyle} value={filter.type ?? ""} onChange={set("type")}
+            placeholder="MembershipCredential" />
+        </label>
+        <label style={{ display: "grid", gap: 4, flex: "1 1 200px" }}>
+          <Label>Purpose</Label>
+          <input style={fieldStyle} value={filter.purpose ?? ""} onChange={set("purpose")}
+            placeholder="membership" />
+        </label>
+        <label style={{ display: "grid", gap: 4, flex: "1 1 240px" }}>
+          <Label>Issuer DID</Label>
+          <input style={{ ...fieldStyle, fontFamily: font.mono }} value={filter.issuerDid ?? ""}
+            onChange={set("issuerDid")} />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Validity</Label>
+          <select style={fieldStyle} value={filter.status ?? ""} onChange={set("status")}>
+            <option value="">any</option>
+            <option value="valid">valid</option>
+            <option value="expired">expired</option>
+            <option value="revoked">revoked</option>
+            <option value="unknown">unknown</option>
+          </select>
+        </label>
+        <div style={{ paddingBottom: 1 }}>
+          <Button
+            kind="primary"
+            disabled={!runnable || loading}
+            {...(!runnable ? { title: "Set at least one filter — see below." } : {})}
+            onClick={() => void search()}
+          >
+            {loading ? "Searching…" : "Search"}
+          </Button>
+        </div>
+      </div>
+
+      <div style={{ display: "flex", gap: 16, flexWrap: "wrap" }}>
+        <label style={{ display: "flex", gap: 7, alignItems: "center", fontSize: t.sm }}>
+          <input type="checkbox" checked={includeArchived}
+            onChange={(e) => { setIncludeArchived(e.target.checked); if (applied) void search(applied, e.target.checked, includeDeleted); }} />
+          Include archived
+        </label>
+        <label style={{ display: "flex", gap: 7, alignItems: "center", fontSize: t.sm }}>
+          <input type="checkbox" checked={includeDeleted}
+            onChange={(e) => { setIncludeDeleted(e.target.checked); if (applied) void search(applied, includeArchived, e.target.checked); }} />
+          Include deleted (trash)
+        </label>
+      </div>
+
+      {!runnable && (
+        <Note tone="accent">
+          <div style={{ display: "grid", gap: 8 }}>
+            <span>
+              <strong>Set at least one filter.</strong> Your agent refuses a search that constrains
+              nothing, because the answer would be the shape of everything you hold — every
+              community, every role, every issuer. The two tick-boxes widen a search rather than
+              narrowing one, so they do not count on their own.
+            </span>
+            {/* The refusal is the agent's, and it is reasonable — but "set a
+                filter" is a poor answer to "what do I have?", which is the
+                question almost everyone opens this pane with. Answering it
+                needed a `type` or an issuer DID the operator would have to
+                know in advance, so a wallet holding credentials looked
+                identical to one holding none.
+
+                `status` counts as a filter, so one click gets there. Not a way
+                round the rule — it is the rule satisfied with the narrowest
+                thing that still answers the question. Named for what it
+                returns, because `valid` excludes expired and revoked and the
+                button should not imply otherwise. */}
+            <div>
+              <Button
+                onClick={() => {
+                  const f = { ...filter, status: "valid" as CredentialStatus };
+                  setFilter(f);
+                  void search(f);
+                }}
+              >
+                Show what is currently valid
+              </Button>
+            </div>
+            <span style={{ fontSize: t.xs, color: c.faint }}>
+              Expired and revoked credentials are still held — pick their status above to see them.
+            </span>
+          </div>
+        </Note>
+      )}
+
+      {error && <LoadError what="your stored credentials" error={error} />}
+      {loading && !rows && <Loading what="your stored credentials" />}
+
+      {rows && (
+        <Table
+          columns={columns}
+          rows={rows}
+          rowKey={(r) => r.id}
+          // Under the row it belongs to, not after the table. See `Table`.
+          expanded={(r) =>
+            viewing === r.id ? (
+              <CredentialView
+                key={r.id}
+                parties={parties}
+                id={r.id}
+                onClose={() => setViewing(null)}
+              />
+            ) : null
+          }
+          empty="Nothing matches that filter. Your agent answered — this is not a failed search."
+        />
+      )}
+    </Panel>
+  );
+}
+
+
+/**
+ * Fetch and show one credential's contents.
+ *
+ * Separate from the search on purpose, and the panel says why: a query answers
+ * with metadata, and the contents only ever arrive because someone asked for
+ * this one credential by id. Rendering the whole document from a list would
+ * have quietly turned "show me what I hold" into "read everything I hold".
+ *
+ * The copy button hands over the exact bytes the agent returned, canonically
+ * formatted — this is the form a verifier expects, so it must not be a
+ * prettified approximation of it.
+ */
+function CredentialView({
+  parties,
+  id,
+  onClose,
+}: {
+  parties: Parties;
+  id: string;
+  onClose: () => void;
+}) {
+  const [doc, setDoc] = useState<Record<string, unknown> | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [copied, setCopied] = useState(false);
+
+  useEffect(() => {
+    let live = true;
+    setDoc(null);
+    setError(null);
+    credVaultGet(managerSender, { ...parties, id })
+      .then((d) => live && setDoc(d))
+      .catch((e) => live && setError(e instanceof Error ? e.message : String(e)));
+    return () => {
+      live = false;
+    };
+  }, [parties, id]);
+
+  const text = doc ? JSON.stringify(doc, null, 2) : "";
+
+  return (
+    <Panel
+      title="Credential"
+      description={<code style={{ fontFamily: font.mono, fontSize: t.xs }}>{id}</code>}
+    >
+      <div style={{ display: "grid", gap: 10 }}>
+        {error && <LoadError what="this credential" error={error} />}
+        {!doc && !error && <Loading what="this credential" />}
+
+        {doc && (
+          <>
+            <div style={{ display: "flex", gap: 8 }}>
+              <Button
+                onClick={() => {
+                  void navigator.clipboard.writeText(text).then(
+                    () => {
+                      setCopied(true);
+                      setTimeout(() => setCopied(false), 1500);
+                    },
+                    // Clipboard access can be refused — say so rather than
+                    // showing "Copied" over a clipboard that did not change.
+                    () => setError("The browser refused clipboard access."),
+                  );
+                }}
+              >
+                {copied ? "Copied" : "Copy JSON"}
+              </Button>
+              <Button kind="quiet" onClick={onClose}>
+                Close
+              </Button>
+            </div>
+            <pre
+              style={{
+                margin: 0,
+                padding: 12,
+                background: c.ground,
+                border: `1px solid ${c.line}`,
+                borderRadius: "var(--w-r-sm)",
+                fontFamily: font.mono,
+                fontSize: t.xs,
+                lineHeight: 1.5,
+                overflowX: "auto",
+                maxHeight: 460,
+                overflowY: "auto",
+                whiteSpace: "pre",
+              }}
+            >
+              {text}
+            </pre>
+          </>
+        )}
+      </div>
+    </Panel>
+  );
+}
+
+/** Validity of an issued credential. Derived by the agent at read time — see
+ *  the header — so this only paints what it was told. */
+function IssuedStatus({ row }: { row: IssuedCredentialSummary }) {
+  if (row.status === "revoked") {
+    return (
+      <div style={{ display: "grid", gap: 2 }}>
+        <Pill tone="danger">revoked</Pill>
+        {row.revokedAt && (
+          <span style={{ fontSize: t.xs, color: c.muted, whiteSpace: "nowrap" }}>
+            {formatDate(row.revokedAt)}
+          </span>
+        )}
+        {row.revocationReason && (
+          <span style={{ fontSize: t.xs, color: c.faint, maxWidth: 200, lineHeight: 1.4 }}>
+            {row.revocationReason}
+          </span>
+        )}
+      </div>
+    );
+  }
+  return <Pill tone={row.status === "active" ? "ok" : "off"}>{row.status}</Pill>;
+}
+
+function IssuedList({
+  parties,
+  authority,
+  onRevoke,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  /** Hand a credential id to the revoke form below, so an operator never has to
+   *  copy an opaque identifier by eye. */
+  onRevoke: (credentialId: string) => void;
+}) {
+  const [holderDid, setHolderDid] = useState("");
+  const [status, setStatus] = useState("");
+  const [applied, setApplied] = useState({ holderDid: "", status: "" });
+  const [pageSize, setPageSize] = useState(50);
+
+  const list = useAsync(
+    () =>
+      listCredentials(managerSender, {
+        ...parties,
+        pageSize,
+        ...(applied.holderDid ? { holderDid: applied.holderDid } : {}),
+        ...(applied.status
+          ? { status: applied.status as IssuedCredentialSummary["status"] }
+          : {}),
+      }),
+    [parties.holder.did, parties.service.did, applied.holderDid, applied.status, pageSize],
+  );
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Reading the issuance log needs an administrative role at this agent."
+    : null;
+
+  const columns: Column<IssuedCredentialSummary>[] = [
+    {
+      key: "id",
+      header: "Credential",
+      render: (r) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <span style={{ fontWeight: 600 }}>{r.credentialType ?? "VerifiableCredential"}</span>
+          <span
+            style={{ fontFamily: font.mono, fontSize: t.xs, color: c.faint, wordBreak: "break-all" }}
+          >
+            {r.credentialId}
+          </span>
+        </div>
+      ),
+    },
+    { key: "holder", header: "Issued to", render: (r) => <Did value={r.holder} size={t.xs} /> },
+    { key: "status", header: "Status", render: (r) => <IssuedStatus row={r} /> },
+    {
+      key: "issued",
+      header: "Issued",
+      render: (r) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>{formatDate(r.issuedAt)}</span>
+      ),
+    },
+    {
+      key: "expires",
+      header: "Expires",
+      render: (r) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>{formatDate(r.expiresAt)}</span>
+      ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (r) =>
+        r.status === "revoked" ? (
+          <span style={{ color: c.faint, fontSize: t.xs }}>revoked</span>
+        ) : (
+          <Button
+            kind="quiet"
+            disabled={Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => onRevoke(r.credentialId)}
+          >
+            Revoke…
+          </Button>
+        ),
+    },
+  ];
+
+  return (
+    <Panel
+      title="Credentials this agent has issued"
+      description="Metadata only — your agent returns no claim bodies here, and this console does
+        not ask for any. Status is computed when the list is read, so it is current rather than
+        remembered."
+    >
+      <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+        <label style={{ display: "grid", gap: 4, flex: "1 1 300px" }}>
+          <Label>Holder DID</Label>
+          <input
+            style={{ ...fieldStyle, fontFamily: font.mono }}
+            value={holderDid}
+            onChange={(e) => setHolderDid(e.target.value)}
+            placeholder="all holders"
+          />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Status</Label>
+          <select style={fieldStyle} value={status} onChange={(e) => setStatus(e.target.value)}>
+            <option value="">any</option>
+            <option value="active">active</option>
+            <option value="expired">expired</option>
+            <option value="revoked">revoked</option>
+          </select>
+        </label>
+        <div style={{ paddingBottom: 1 }}>
+          <Button
+            onClick={() => {
+              setPageSize(50);
+              setApplied({ holderDid: holderDid.trim(), status });
+            }}
+          >
+            Filter
+          </Button>
+        </div>
+      </div>
+
+      {list.error && <LoadError what="the issuance log" error={list.error} />}
+      {list.loading && !list.data && <Loading what="the issuance log" />}
+
+      {list.data && (
+        <>
+          {/* Above the table. A caution under a long list is one nobody reads,
+              and this one changes what the list *means*. */}
+          {list.data.truncated && (
+            <Note tone="warn">
+              <strong>This is not everything your agent has issued.</strong> It stopped early, so
+              anything you conclude from what is below — including that a credential was never
+              issued — may be wrong.{" "}
+              <button
+                onClick={() => setPageSize((n) => n + 50)}
+                style={{
+                  border: "none",
+                  background: "none",
+                  padding: 0,
+                  color: c.accent,
+                  cursor: "pointer",
+                  font: "inherit",
+                  textDecoration: "underline",
+                }}
+              >
+                Load more
+              </button>
+              , or narrow by holder.
+            </Note>
+          )}
+          <Table
+            columns={columns}
+            rows={list.data.credentials}
+            rowKey={(r) => r.credentialId}
+            empty={
+              applied.holderDid || applied.status
+                ? "Nothing matches those filters. Clear them to see the rest."
+                : "Your agent has issued nothing yet."
+            }
+          />
+        </>
+      )}
+    </Panel>
+  );
+}
+
+export function CredentialsPane({
+  parties,
+  authority,
+  onOpenAudit,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  /** The audit trail — still the place that answers "what happened", which the
+   *  issuance list deliberately does not: one is a record of events, the other
+   *  a view of current state. */
+  onOpenAudit: () => void;
+}) {
+  // Set by a row's "Revoke…", read by the revoke form. The id is opaque and
+  // long, and asking an operator to copy one by eye before an irreversible
+  // action is how the wrong credential gets revoked.
+  const [revokeId, setRevokeId] = useState<string | null>(null);
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title="Credentials this agent issues"
+        description="Your agent as an issuer: minting credentials for others, and taking them
+          back."
+      >
+        <div style={{ fontSize: t.sm, color: c.muted, lineHeight: 1.55 }}>
+          Issuing as <Did value={parties.service.did} size={t.xs} />. For the history of
+          issuance and revocation events rather than what is current,{" "}
+          <button
+            onClick={onOpenAudit}
+            style={{
+              border: "none",
+              background: "none",
+              padding: 0,
+              color: c.accent,
+              cursor: "pointer",
+              font: "inherit",
+              textDecoration: "underline",
+            }}
+          >
+            open the audit trail
+          </button>
+          .
+        </div>
+      </Panel>
+
+      <IssuedList parties={parties} authority={authority} onRevoke={setRevokeId} />
+
+      <IssueCredential parties={parties} authority={authority} />
+      <RevokeCredential
+        parties={parties}
+        authority={authority}
+        prefillId={revokeId}
+        onConsumed={() => setRevokeId(null)}
+      />
+
+      <HeldCredentials parties={parties} authority={authority} />
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/dids.tsx b/packages/extension/src/manager/panes/dids.tsx
new file mode 100644
index 0000000..7b935a2
--- /dev/null
+++ b/packages/extension/src/manager/panes/dids.tsx
@@ -0,0 +1,273 @@
+// DIDs — the `did:webvh` identifiers a context publishes.
+//
+// Scoped to the selected context like Keys, and for the same reason:
+// `webvhDidList` takes a `contextId`, so a changed selection asks the agent a
+// different question rather than filtering an answer it already gave.
+//
+// A DID here is a *published* identifier: its log lives on a hosting server and
+// anyone can resolve it. That is why deletion is treated as the sharpest action
+// in this console — see the confirm copy.
+
+import { useCallback, useState } from "react";
+import {
+  webvhDidCreate,
+  webvhDidDelete,
+  webvhDidList,
+  type WebvhDidRecord,
+} from "@openvtc/pnm-core/webvh";
+import { Button, Did, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { formatDate } from "../format.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+function CreateDid({
+  parties,
+  contextId,
+  authority,
+  onCreated,
+}: {
+  parties: Parties;
+  contextId: ContextSelection;
+  authority: Authority | null;
+  onCreated: () => void;
+}) {
+  const [serverId, setServerId] = useState("");
+  const [portable, setPortable] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Creating a DID needs an administrative role at this agent."
+    : !contextId
+      ? "Select a context in the tree first — a DID is created inside one."
+      : null;
+
+  const submit = useCallback(async () => {
+    if (!contextId) return;
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await webvhDidCreate(managerSender, {
+          ...parties,
+          contextId,
+          portable,
+          ...(serverId.trim() ? { serverId: serverId.trim() } : {}),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) {
+      setServerId("");
+      onCreated();
+    }
+  }, [parties, contextId, serverId, portable, onCreated]);
+
+  return (
+    <Panel
+      title="New DID"
+      description={
+        contextId ? (
+          <>
+            Created in <code style={{ fontFamily: font.mono }}>{contextId}</code> and published as
+            a <code style={{ fontFamily: font.mono }}>did:webvh</code> log on a hosting server.
+            Once published it is resolvable by anyone.
+          </>
+        ) : (
+          "Select a context in the tree to create a DID inside it."
+        )
+      }
+    >
+      <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>SERVER ID (optional)</span>
+          <input
+            style={fieldStyle}
+            value={serverId}
+            onChange={(e) => setServerId(e.target.value)}
+            placeholder="your agent's default"
+          />
+        </label>
+        <label style={{ display: "flex", gap: 7, alignItems: "center", fontSize: t.sm, paddingBottom: 7 }}>
+          <input type="checkbox" checked={portable} onChange={(e) => setPortable(e.target.checked)} />
+          Portable
+        </label>
+      </div>
+
+      {portable && (
+        <Note tone="warn">
+          A portable DID can be moved to another hosting domain later. That flexibility is decided
+          now and cannot be added afterwards — but it also means the DID's identifier does not pin
+          it to one host.
+        </Note>
+      )}
+      {error && <Note tone="danger">{error}</Note>}
+      {pending && <ConsentCeremony pending={pending} />}
+
+      <div>
+        <Button
+          kind="primary"
+          disabled={busy || Boolean(denied)}
+          {...(denied ? { title: denied } : {})}
+          onClick={() => void submit()}
+        >
+          {busy ? "Creating…" : "Create DID"}
+        </Button>
+      </div>
+      {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+    </Panel>
+  );
+}
+
+export function DidsPane({
+  parties,
+  authority,
+  contextId,
+  contextHeading,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  contextId: ContextSelection;
+  /** How the selected context is named in the tree, so heading and navigation
+   *  agree. See `contextLabel` in `format.ts`. */
+  contextHeading?: string | undefined;
+}) {
+  const list = useAsync(
+    () =>
+      webvhDidList(managerSender, {
+        ...parties,
+        ...(contextId ? { contextId } : {}),
+      }),
+    [parties.holder.did, parties.service.did, contextId],
+  );
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Deleting a DID needs the admin role at this agent."
+    : null;
+
+  const columns: Column<WebvhDidRecord>[] = [
+    // A floor on the identifier column. A `did:webvh` has no natural break
+    // points, so when something else in the row demands width — a long refusal
+    // from the agent, say — the browser squeezes this one and the DID wraps
+    // every few characters, which is unreadable exactly when you most need to
+    // tell two of them apart.
+    {
+      key: "did",
+      header: "DID",
+      width: "26ch",
+      render: (d) => <Did value={d.did} />,
+    },
+    {
+      key: "context",
+      header: "Context",
+      render: (d) => <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{d.contextId}</span>,
+    },
+    {
+      key: "server",
+      header: "Server",
+      render: (d) => <span style={{ color: c.muted }}>{d.serverId}</span>,
+    },
+    {
+      key: "portable",
+      header: "Portable",
+      render: (d) => (d.portable ? <Pill tone="accent">portable</Pill> : <span style={{ color: c.faint }}>—</span>),
+    },
+    {
+      key: "log",
+      header: "Log entries",
+      render: (d) => <span style={{ color: c.muted }}>{d.logEntryCount}</span>,
+    },
+    {
+      key: "created",
+      header: "Created",
+      render: (d) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
+          {formatDate(d.createdAt)}
+        </span>
+      ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (d) => (
+        <div style={{ minWidth: 190 }}>
+          <Destructive<WebvhDidRecord>
+            label="Delete"
+            disabledReason={denied}
+            preview={async () => d}
+            forceLabel="Delete anyway"
+            renderPreview={(p) => (
+              <>
+                <strong>Deleting this DID cannot be undone.</strong>
+                <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all" }}>
+                  {p.did}
+                </span>
+                <span>
+                  Its {p.logEntryCount} log{p.logEntryCount === 1 ? " entry" : " entries"} and the
+                  keys behind them go with it. Anyone still resolving this DID — a relying party
+                  holding a credential you issued, an ACL entry naming it — stops being able to
+                  verify anything signed by it.
+                </span>
+              </>
+            )}
+            commit={async () => {
+              await webvhDidDelete(managerSender, { ...parties, did: d.did });
+            }}
+            onDone={list.reload}
+          />
+        </div>
+      ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={contextHeading ? `DIDs in ${contextHeading}` : "DIDs in every context you can reach"}
+        description="Published did:webvh identifiers. Each one's log is served by a hosting
+          server and resolvable by anyone — these are the identities others see."
+      >
+        {list.error && <LoadError what="DIDs" error={list.error} />}
+        {list.loading && !list.data && <Loading what="DIDs" />}
+        {list.data && (
+          <Table
+            columns={columns}
+            rows={list.data.dids}
+            rowKey={(d) => d.did}
+            empty={
+              contextId
+                ? `No DIDs in ${contextId}. Identifiers published from this context appear here.`
+                : "No DIDs you can reach. Published identifiers you administer appear here."
+            }
+          />
+        )}
+      </Panel>
+
+      <CreateDid
+        parties={parties}
+        contextId={contextId}
+        authority={authority}
+        onCreated={list.reload}
+      />
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/keys.tsx b/packages/extension/src/manager/panes/keys.tsx
new file mode 100644
index 0000000..91a814c
--- /dev/null
+++ b/packages/extension/src/manager/panes/keys.tsx
@@ -0,0 +1,385 @@
+// Keys — scoped to the selected context.
+//
+// `keysList` takes a `contextId`, so this pane asks a different question when
+// the tree selection changes rather than filtering a full list client-side. The
+// difference matters: a caller's ACL may not reach every context, and asking
+// per-context gets the agent's answer for the one being looked at instead of
+// silently rendering a subset of a list that failed elsewhere.
+//
+// **Nothing here signs anything.** `keysSign` and `keysDeriveAndSign` exist in
+// the admin module and are deliberately not surfaced: signing with an operator
+// key is not an administration task, it is use, and a console that offers a
+// "sign this" box turns an audit trail of key management into an oracle.
+
+import { useCallback, useState } from "react";
+import {
+  keysCreate,
+  keysList,
+  keysRename,
+  keysRevoke,
+  type KeyRecord,
+  type KeyStatus,
+} from "@openvtc/pnm-core/admin";
+import { Button, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, Truncated, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { formatDate } from "../format.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const PAGE = 50;
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+function StatusPill({ status }: { status: KeyStatus }) {
+  return <Pill tone={status === "active" ? "ok" : "off"}>{status}</Pill>;
+}
+
+/** Where the key came from, which is the difference between recoverable and
+ *  gone forever. `internal` keys are generated from the CSPRNG and derive from
+ *  no seed — nothing reconstitutes them. */
+function OriginNote({ record }: { record: KeyRecord }) {
+  if (record.origin !== "internal") {
+    return <span style={{ color: c.muted }}>{record.origin ?? "derived"}</span>;
+  }
+  return (
+    <span style={{ color: c.warn }} title="Generated from the CSPRNG, not derived from a seed. Nothing can reconstitute it.">
+      internal · unrecoverable
+    </span>
+  );
+}
+
+function CreateKey({
+  parties,
+  contextId,
+  authority,
+  onCreated,
+}: {
+  parties: Parties;
+  contextId: ContextSelection;
+  authority: Authority | null;
+  onCreated: () => void;
+}) {
+  const [keyType, setKeyType] = useState<"ed25519" | "x25519" | "p256">("ed25519");
+  const [label, setLabel] = useState("");
+  const [keyId, setKeyId] = useState("");
+  const [internal, setInternal] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Creating a key needs an administrative role at this agent."
+    : !contextId
+      ? "Select a context in the tree first — a key is minted into one."
+      : null;
+
+  // `keyId` is optional for a derived key (the agent names it after the
+  // derivation path) but there is no path for an internal one, so the agent has
+  // nothing to name it after. Required here rather than discovered as a reject.
+  const needsKeyId = internal && !keyId.trim();
+
+  const submit = useCallback(async () => {
+    if (!contextId) return;
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await keysCreate(managerSender, {
+          ...parties,
+          keyType,
+          contextId,
+          internal,
+          ...(label.trim() ? { label: label.trim() } : {}),
+          ...(keyId.trim() ? { keyId: keyId.trim() } : {}),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) {
+      setLabel("");
+      setKeyId("");
+      onCreated();
+    }
+  }, [parties, contextId, keyType, label, keyId, internal, onCreated]);
+
+  return (
+    <Panel
+      title="New key"
+      description={
+        contextId ? (
+          <>
+            Minted into <code style={{ fontFamily: font.mono }}>{contextId}</code>. Your agent
+            holds the private half and never returns it — only the public key comes back.
+          </>
+        ) : (
+          "Select a context in the tree to mint a key into it."
+        )
+      }
+    >
+      <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>TYPE</span>
+          <select
+            style={fieldStyle}
+            value={keyType}
+            onChange={(e) => setKeyType(e.target.value as typeof keyType)}
+          >
+            <option value="ed25519">ed25519 (signing)</option>
+            <option value="x25519">x25519 (key agreement)</option>
+            <option value="p256">p256</option>
+          </select>
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>LABEL</span>
+          <input style={fieldStyle} value={label} onChange={(e) => setLabel(e.target.value)} />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>
+            KEY ID {internal ? "(required)" : "(optional)"}
+          </span>
+          <input style={fieldStyle} value={keyId} onChange={(e) => setKeyId(e.target.value)} />
+        </label>
+        <label style={{ display: "flex", gap: 7, alignItems: "center", fontSize: t.sm, paddingBottom: 7 }}>
+          <input type="checkbox" checked={internal} onChange={(e) => setInternal(e.target.checked)} />
+          Generate from the CSPRNG
+        </label>
+      </div>
+
+      {internal && (
+        <Note tone="warn">
+          An internal key derives from no seed. It cannot be re-derived, exported or recovered by
+          any means — losing the agent's keyspace loses this key and everything it authorises.
+        </Note>
+      )}
+      {error && <Note tone="danger">{error}</Note>}
+      {pending && <ConsentCeremony pending={pending} />}
+
+      <div>
+        <Button
+          kind="primary"
+          disabled={busy || Boolean(denied) || needsKeyId}
+          {...(denied ? { title: denied } : {})}
+          onClick={() => void submit()}
+        >
+          {busy ? "Minting…" : "Mint key"}
+        </Button>
+      </div>
+      {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+    </Panel>
+  );
+}
+
+function RenameKey({
+  parties,
+  record,
+  onDone,
+}: {
+  parties: Parties;
+  record: KeyRecord;
+  onDone: () => void;
+}) {
+  const [open, setOpen] = useState(false);
+  const [next, setNext] = useState(record.keyId);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  if (!open) {
+    return (
+      <Button kind="quiet" onClick={() => setOpen(true)}>
+        Rename
+      </Button>
+    );
+  }
+
+  return (
+    <div style={{ display: "grid", gap: 7 }}>
+      <input style={fieldStyle} value={next} onChange={(e) => setNext(e.target.value)} />
+      {error && <Note tone="danger">{error}</Note>}
+      {pending && <ConsentCeremony pending={pending} />}
+      <div style={{ display: "flex", gap: 6 }}>
+        <Button
+          disabled={busy || !next.trim() || next === record.keyId}
+          onClick={() => {
+            setBusy(true);
+            setError(null);
+            void runMutation(
+              async () => {
+                await keysRename(managerSender, {
+                  ...parties,
+                  keyId: record.keyId,
+                  newKeyId: next.trim(),
+                });
+              },
+              { onConsent: setPending, onError: setError },
+            ).then((ok) => {
+              setBusy(false);
+              if (ok) {
+                setOpen(false);
+                onDone();
+              }
+            });
+          }}
+        >
+          {busy ? "Saving…" : "Save"}
+        </Button>
+        <Button kind="quiet" onClick={() => setOpen(false)}>
+          Cancel
+        </Button>
+      </div>
+    </div>
+  );
+}
+
+export function KeysPane({
+  parties,
+  authority,
+  contextId,
+  contextHeading,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  contextId: ContextSelection;
+  /** How the selected context is named in the tree, so heading and navigation
+   *  agree. See `contextLabel` in `format.ts`. */
+  contextHeading?: string | undefined;
+}) {
+  const [limit, setLimit] = useState(PAGE);
+
+  const list = useAsync(
+    () =>
+      keysList(managerSender, {
+        ...parties,
+        limit,
+        ...(contextId ? { contextId } : {}),
+      }),
+    [parties.holder.did, parties.service.did, contextId, limit],
+  );
+
+  const revokeDenied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Revoking a key needs an administrative role at this agent."
+    : null;
+
+  const columns: Column<KeyRecord>[] = [
+    {
+      key: "keyId",
+      header: "Key",
+      render: (k) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <span style={{ fontFamily: font.mono, wordBreak: "break-all" }}>{k.keyId}</span>
+          {k.label && <span style={{ color: c.muted, fontSize: t.xs }}>{k.label}</span>}
+        </div>
+      ),
+    },
+    { key: "type", header: "Type", render: (k) => <span style={{ color: c.muted }}>{k.keyType}</span> },
+    { key: "status", header: "Status", render: (k) => <StatusPill status={k.status} /> },
+    { key: "origin", header: "Origin", render: (k) => <OriginNote record={k} /> },
+    {
+      key: "path",
+      header: "Derivation",
+      render: (k) => (
+        <span style={{ fontFamily: font.mono, fontSize: t.xs, color: c.faint }}>
+          {k.derivationPath ?? "—"}
+        </span>
+      ),
+    },
+    {
+      key: "created",
+      header: "Created",
+      render: (k) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
+          {formatDate(k.createdAt)}
+        </span>
+      ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (k) =>
+        k.status === "revoked" ? (
+          <span style={{ color: c.faint, fontSize: t.xs }}>revoked</span>
+        ) : (
+          <div style={{ display: "grid", gap: 8, minWidth: 190 }}>
+            <RenameKey parties={parties} record={k} onDone={list.reload} />
+            <Destructive<KeyRecord>
+              label="Revoke"
+              disabledReason={revokeDenied}
+              // There is no `keys/preview-revoke`, so the preview is the record
+              // itself — read back from the agent so what the operator confirms
+              // against is the agent's current view, not a row that may have
+              // been stale since the list was fetched.
+              preview={async () => k}
+              renderPreview={(p) => (
+                <>
+                  <strong>Revoking {p.keyId} cannot be undone.</strong>
+                  <span>
+                    Anything this key authorises stops working, and any signature made with it
+                    from now on will not verify. Existing signatures are unaffected.
+                  </span>
+                </>
+              )}
+              commit={async () => {
+                await keysRevoke(managerSender, { ...parties, keyId: k.keyId });
+              }}
+              onDone={list.reload}
+            />
+          </div>
+        ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={contextHeading ? `Keys in ${contextHeading}` : "Keys in every context you can reach"}
+        description="Your agent holds every private half. This console never sees one, and never
+          asks for a signature — that is use, not administration."
+      >
+        {list.error && <LoadError what="keys" error={list.error} />}
+        {list.loading && !list.data && <Loading what="keys" />}
+        {list.data && (
+          <>
+            <Table
+              columns={columns}
+              rows={list.data.keys}
+              rowKey={(k) => k.keyId}
+              empty={
+                contextId
+                  ? `No keys in ${contextId}. Keys minted into this context appear here.`
+                  : "No keys you can reach. Keys you administer appear here."
+              }
+            />
+            {list.data.total > list.data.keys.length && (
+              <Truncated
+                what={`your agent's ${list.data.total} keys`}
+                onMore={() => setLimit((n) => n + PAGE)}
+              />
+            )}
+          </>
+        )}
+      </Panel>
+
+      <CreateKey
+        parties={parties}
+        contextId={contextId}
+        authority={authority}
+        onCreated={list.reload}
+      />
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/maintenance.tsx b/packages/extension/src/manager/panes/maintenance.tsx
new file mode 100644
index 0000000..4d7172a
--- /dev/null
+++ b/packages/extension/src/manager/panes/maintenance.tsx
@@ -0,0 +1,382 @@
+// Maintenance — operations whose subject is the agent itself.
+//
+// Everything else in this console acts on something the agent *holds*: a
+// context, a key, a credential, an ACL entry. These two act on the agent. That
+// is the whole reason they share a pane, and it is why neither belongs where it
+// first landed.
+//
+// Reload-services sat under Transports because restarting transports is what
+// you observe. But the task is `vta/management/reload-services` — it re-reads
+// the agent's entire configuration, and the transports going down is a
+// consequence rather than the subject. Transports is per-transport CRUD:
+// enable this one, drain that one. An agent-wide restart in that pane reads as
+// another row in the same list, which is exactly what it is not.
+//
+// Backup was under Wire & execution for want of anywhere better, and was never
+// really "wire" at all.
+//
+// The grouping also happens to be the step-up boundary: these are the two
+// controls in the console gated on proof of presence, because they are the two
+// that act on the whole agent. That is not a coincidence to design around, it
+// is the same fact stated twice.
+//
+// ## What is here, and what is deliberately not
+//
+// Backup offers `abort` alone. `initiate-export` and `finalize-import` both
+// carry a `password` — the key that protects, or unlocks, a complete copy of
+// the agent. It travels inbound, typed by the operator, and a browser form is
+// reachable by autofill, by a password manager, by any other extension with
+// host access, and by anything recording the screen. A step-up does not help:
+// it proves a human is present for the action, and the password was typed
+// before the prompt appeared.
+//
+// So the wallet does not ask for it. The CLI does, in a terminal, where it is
+// prompted rather than passed as a flag and so never enters shell history or
+// the process list. The pane says all of this on screen, because an empty
+// panel is indistinguishable from an unfinished one and someone would
+// reasonably "complete" the family later.
+
+import { useCallback, useState } from "react";
+import { backupAbort, reloadServices, type BackupAbortResult } from "@openvtc/pnm-core/admin";
+import { Button, Note, Panel } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, runMutation } from "../destructive.js";
+import { requirePresence, StepUpError } from "../step-up.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+  fontFamily: font.mono,
+};
+
+// The agent generates these, and there is no verb that lists them — so the
+// operator pastes what the CLI printed. Checked here only so an obvious typo is
+// caught before a round trip, never as authorization: the agent decides whether
+// this caller may touch this bundle, and answers a stranger's guess as
+// not-found rather than as a refusal.
+const UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+
+
+// The CLI half of the answer.
+//
+// Telling an operator "use the CLI" and stopping there sends them to
+// `--help` to find out what this pane already knows. The commands are
+// short enough to print, and the two details worth knowing are not
+// discoverable from a flag list: `--preview` is a real rehearsal, and the
+// password is prompted rather than passed.
+function Cmd({ children, note }: { children: string; note: string }) {
+  return (
+    <div style={{ display: "grid", gap: 3 }}>
+      <code
+        style={{
+          fontFamily: font.mono,
+          fontSize: t.xs,
+          background: c.ground,
+          border: `1px solid ${c.line}`,
+          borderRadius: "var(--w-r-sm)",
+          padding: "6px 9px",
+          overflowX: "auto",
+          whiteSpace: "pre",
+        }}
+      >
+        {children}
+      </code>
+      <span style={{ fontSize: t.xs, color: c.faint }}>{note}</span>
+    </div>
+  );
+}
+
+function WhyExportIsAbsent() {
+  return (
+    <Panel
+      title="Export and import are done from the CLI"
+      description="Not missing — declined, and it is worth knowing why before you go looking for them."
+    >
+      <div style={{ display: "grid", gap: 12, fontSize: t.sm, lineHeight: 1.6, color: c.muted }}>
+        <p style={{ margin: 0 }}>
+          Starting an export, and finishing an import, both require the{" "}
+          <strong style={{ color: c.text }}>password that protects the whole bundle</strong> — every
+          key, access-control entry and trust context the agent holds. It is sent{" "}
+          <em>to</em> the agent, which means something has to collect it first.
+        </p>
+        <p style={{ margin: 0 }}>
+          A field in a browser page is reachable by autofill, by a password manager, by any other
+          extension you have granted access to this page, and by anything recording the screen. None
+          of that is under this wallet's control. Asking for the approval prompt first would not
+          change it: that prompt proves a human is here for the action, and the password was typed
+          before it appeared.
+        </p>
+        <p style={{ margin: 0 }}>
+          So the wallet does not ask for it at all. The CLI collects it in a terminal, which is not a
+          perfect place either, but is a much smaller one.
+        </p>
+        <div style={{ display: "grid", gap: 8, paddingTop: 2 }}>
+          <span style={{ fontSize: t.xs, color: c.muted, letterSpacing: 0.4 }}>
+            WHAT TO RUN
+          </span>
+          <Cmd note="Writes vta-backup-<timestamp>.vtabak. Add -o <path> to choose the file.">
+            pnm backup export
+          </Cmd>
+          <Cmd note="Adds the agent's audit trail — its dealings with counterparties who were never party to this export. Off by default.">
+            pnm backup export --include-audit
+          </Cmd>
+          <Cmd note="Rehearses: decrypts, validates, reports what it found, changes nothing. Worth doing first — the common mistake is the right password on the wrong bundle.">
+            pnm backup import &lt;file&gt; --preview
+          </Cmd>
+          <Cmd note="Applies it. Replaces this agent's keys, access and contexts with the bundle's.">
+            pnm backup import &lt;file&gt;
+          </Cmd>
+          <span style={{ fontSize: t.sm, color: c.muted, lineHeight: 1.55 }}>
+            The password is <strong>prompted, never passed as a flag</strong> — there is no
+            <code style={{ fontFamily: font.mono, fontSize: t.xs }}> --password</code> option to
+            find. That is the concrete reason the terminal is the smaller surface: it keeps the
+            password out of your shell history and out of the process list. Minimum 15
+            characters, and export asks twice.
+          </span>
+        </div>
+
+        <Note tone="accent">
+          <strong>Where the bundle goes.</strong> An export is fetched over HTTPS from an address the
+          agent publishes, so an agent reachable only over DIDComm or TSP cannot produce one at all —
+          it has no address to hand you, and will say so rather than returning a link that does not
+          work. That is a fact about how the agent is deployed, not something the console can work
+          around.
+        </Note>
+      </div>
+    </Panel>
+  );
+}
+
+export function MaintenancePane({
+  parties,
+  authority,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+}) {
+  const [bundleId, setBundleId] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+  const [result, setResult] = useState<BackupAbortResult | null>(null);
+
+  const denied =
+    authority && !hasRole(authority, "admin", "super-admin", "operator")
+      ? "Cancelling a backup bundle needs an administrative role at this agent."
+      : null;
+
+  const malformed = bundleId.trim() !== "" && !UUID.test(bundleId.trim());
+
+  const abort = useCallback(async () => {
+    setError(null);
+    setPending(null);
+    setResult(null);
+
+    // The step-up runs FIRST, and nothing is sent if it does not complete.
+    // Dismissing is a decision, not a fault: the pane goes quiet rather than
+    // reporting an error the operator caused on purpose.
+    try {
+      await requirePresence(chrome.runtime.id, "cancel a backup bundle");
+    } catch (e) {
+      if (e instanceof StepUpError && e.reason === "cancelled") return;
+      setError(e instanceof Error ? e.message : String(e));
+      return;
+    }
+
+    setBusy(true);
+    const ok = await runMutation(
+      async () => {
+        setResult(
+          await backupAbort(managerSender, { ...parties, bundleId: bundleId.trim() }),
+        );
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) setBundleId("");
+  }, [parties, bundleId]);
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title="Cancel a backup bundle"
+        description="Discards the staged bytes and closes the bundle. On the export side the encrypted
+          copy is deleted and cannot be re-minted — a new export re-reads the agent and produces
+          different bytes."
+      >
+        <div style={{ display: "grid", gap: 12 }}>
+          <Note tone="accent">
+            <strong>There is no list to pick from.</strong> The agent offers no way to ask which
+            bundles are in flight, so paste the bundle id the CLI printed. Nothing is lost by getting
+            it wrong: an id the agent does not recognise, or one belonging to another operator, comes
+            back the same way — not found.
+          </Note>
+
+          <label style={{ display: "grid", gap: 4 }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>BUNDLE ID</span>
+            <input
+              style={fieldStyle}
+              value={bundleId}
+              onChange={(e) => setBundleId(e.target.value)}
+              placeholder="3f2504e0-4f89-41d3-9a0c-0305e82c3301"
+              spellCheck={false}
+            />
+          </label>
+          {malformed && (
+            <span style={{ fontSize: t.xs, color: c.muted }}>
+              That is not the shape of a bundle id. They are UUIDs, and the agent generates them.
+            </span>
+          )}
+
+          {error && <Note tone="danger">{error}</Note>}
+          {pending && <ConsentCeremony pending={pending} />}
+
+          {result &&
+            (result.aborted ? (
+              <Note tone="accent">
+                Bundle cancelled. Its staged bytes are gone and the download address no longer works.
+              </Note>
+            ) : (
+              // Not an error. Abort is idempotent because the situation it
+              // exists for — a dropped connection, an operator unsure whether
+              // the cancel landed — is the one that produces duplicates.
+              <Note tone="accent">
+                That bundle was already closed: completed, expired, or cancelled earlier. Nothing was
+                left to discard, and nothing changed.
+              </Note>
+            ))}
+
+          <div>
+            <Button
+              kind="danger"
+              disabled={busy || !UUID.test(bundleId.trim()) || Boolean(denied)}
+              {...(denied ? { title: denied } : {})}
+              onClick={() => void abort()}
+            >
+              {busy ? "Cancelling…" : "Approve and cancel bundle"}
+            </Button>
+          </div>
+          <span style={{ fontSize: t.xs, color: c.faint }}>
+            {denied ?? "Your passkey is checked before anything is sent."}
+          </span>
+        </div>
+      </Panel>
+
+      <ReloadServices
+        parties={parties}
+        denied={
+          authority && !hasRole(authority, "admin", "super-admin")
+            ? "Restarting this agent needs the admin role."
+            : null
+        }
+      />
+
+      <WhyExportIsAbsent />
+    </div>
+  );
+}
+
+/**
+ * Re-read the agent's configuration and restart its transports.
+ *
+ * Behind the step-up despite creating, deleting and disclosing nothing — the
+ * cost here is measured in availability, and it falls on every counterparty of
+ * the agent rather than on the operator who clicked. That includes this
+ * wallet's own inbound sessions, which is the part an operator is most likely
+ * to be surprised by, so the copy says it rather than implying it.
+ */
+function ReloadServices({ parties, denied }: { parties: Parties; denied: string | null }) {
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+  const [done, setDone] = useState(false);
+
+  const reload = useCallback(async () => {
+    setError(null);
+    setPending(null);
+    setDone(false);
+
+    try {
+      await requirePresence(chrome.runtime.id, "restart this agent's transports");
+    } catch (e) {
+      // A dismissal is a decision. Say nothing and send nothing.
+      if (e instanceof StepUpError && e.reason === "cancelled") return;
+      setError(e instanceof Error ? e.message : String(e));
+      return;
+    }
+
+    setBusy(true);
+    await runMutation(
+      async () => {
+        await reloadServices(managerSender, parties);
+        setDone(true);
+      },
+      {
+        onConsent: setPending,
+        onError: (message) => {
+          // A successful reload drops the transport the response would have
+          // travelled on, so a lost connection is the EXPECTED shape of
+          // success here, not a failure. Reporting it as an error would send
+          // an operator hunting for a fault that is the agent restarting, and
+          // — worse — invite a retry that restarts it again.
+          if (/network|connection|closed|timeout|aborted/i.test(message)) {
+            setDone(true);
+          } else {
+            setError(message);
+          }
+        },
+      },
+    );
+    setBusy(false);
+  }, [parties]);
+
+  return (
+    <Panel
+      title="Reload services"
+      description="Re-reads the agent's configuration and restarts its transports. Use this after
+        changing configuration elsewhere; it applies what is written down and takes no options of
+        its own."
+    >
+      <div style={{ display: "grid", gap: 12 }}>
+        <Note tone="warn">
+          <strong>Every open session drops, including this wallet's.</strong> Your inbound sessions
+          go down while the agent restarts, so anything pushed during that window — approval
+          requests included — waits at the mediator. Every other client of this agent is
+          disconnected at the same moment, and none of them asked.
+        </Note>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+        {done && (
+          <Note tone="accent">
+            Restart requested. The agent may have dropped this connection to do it, which is normal
+            and not a reason to send it again — reconnect and see whether it answers. If it does not
+            come back, its configuration is the place to look.
+          </Note>
+        )}
+
+        <div>
+          <Button
+            kind="danger"
+            disabled={busy || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void reload()}
+          >
+            {busy ? "Restarting…" : "Approve and reload services"}
+          </Button>
+        </div>
+        <span style={{ fontSize: t.xs, color: c.faint }}>
+          {denied ?? "Your passkey is checked before anything is sent."}
+        </span>
+      </div>
+    </Panel>
+  );
+}
diff --git a/packages/extension/src/manager/panes/memory.tsx b/packages/extension/src/manager/panes/memory.tsx
new file mode 100644
index 0000000..c2e4e78
--- /dev/null
+++ b/packages/extension/src/manager/panes/memory.tsx
@@ -0,0 +1,335 @@
+// Agent memory — what your agent has been told to remember.
+//
+// `vta/memory/*`: plain string key/value, scoped to a context. This is the
+// store behind the memory tooling an assistant uses, so what is listed here is
+// what it will recall in a future conversation — which makes deletion the
+// operation that matters most. A memory formed from a misunderstanding does not
+// decay; it gets recalled, acted on, and quietly shapes answers until somebody
+// removes it.
+//
+// **`contextId` is required**, and the module says why: memory has no global
+// namespace. The context is the isolation boundary — an agent scoped elsewhere
+// cannot see these — so, as with app-state, there is no agent-wide list to
+// show and the pane asks for a context instead of inventing one.
+//
+// ## Writing by hand
+//
+// `memoryPut` is offered here, and it is worth being clear about what it does:
+// a memory written from this console is stored identically to one the agent
+// formed during a conversation. There is no provenance marker in the record, so
+// nothing downstream can tell them apart — the value is simply what the agent
+// will recall. Useful for correcting; not a place to be casual.
+
+import { useCallback, useMemo, useState } from "react";
+import { memoryDelete, memoryList, memoryPut } from "@openvtc/pnm-core/admin";
+import { Button, Note, Panel } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+interface MemoryItem {
+  key: string;
+  value: string;
+}
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+function WriteMemory({
+  parties,
+  contextId,
+  authority,
+  existing,
+  onDone,
+  onCancel,
+}: {
+  parties: Parties;
+  contextId: string;
+  authority: Authority | null;
+  existing?: MemoryItem;
+  onDone: () => void;
+  onCancel?: () => void;
+}) {
+  const [key, setKey] = useState(existing?.key ?? "");
+  const [value, setValue] = useState(existing?.value ?? "");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Writing memory needs an administrative role at this agent."
+    : null;
+
+  const save = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await memoryPut(managerSender, {
+          ...parties,
+          contextId,
+          key: key.trim(),
+          value,
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) onDone();
+  }, [parties, contextId, key, value, onDone]);
+
+  return (
+    <Panel
+      title={existing ? `Edit ${existing.key}` : "New memory"}
+      description={
+        existing
+          ? "Writing replaces whatever this key held. There is no version check on this " +
+            "family, so a write here wins over anything stored since this editor opened."
+          : "Your agent will recall this in future conversations, exactly as if it had formed " +
+            "the memory itself — nothing in the record marks it as hand-written."
+      }
+    >
+      <div style={{ display: "grid", gap: 10 }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>KEY</span>
+          <input
+            style={{ ...fieldStyle, fontFamily: font.mono }}
+            value={key}
+            onChange={(e) => setKey(e.target.value)}
+            disabled={Boolean(existing)}
+          />
+        </label>
+        {existing && (
+          <span style={{ fontSize: t.xs, color: c.faint }}>
+            The key is the record's address. To rename, write a new memory and forget this one.
+          </span>
+        )}
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>VALUE</span>
+          <textarea
+            style={{ ...fieldStyle, minHeight: 110, width: "100%", lineHeight: 1.55, resize: "vertical" }}
+            value={value}
+            onChange={(e) => setValue(e.target.value)}
+          />
+        </label>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        <div style={{ display: "flex", gap: 8 }}>
+          <Button
+            kind="primary"
+            disabled={busy || !key.trim() || !value.trim() || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void save()}
+          >
+            {busy ? "Saving…" : existing ? "Save" : "Remember this"}
+          </Button>
+          {onCancel && (
+            <Button kind="quiet" disabled={busy} onClick={onCancel}>
+              Cancel
+            </Button>
+          )}
+        </div>
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+export function MemoryPane({
+  parties,
+  authority,
+  contextId,
+  contextHeading,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  contextId: ContextSelection;
+  contextHeading?: string | undefined;
+}) {
+  const [filter, setFilter] = useState("");
+  const [editing, setEditing] = useState<MemoryItem | null>(null);
+  const [creating, setCreating] = useState(false);
+
+  const list = useAsync(
+    async () => (contextId ? memoryList(managerSender, { ...parties, contextId }) : null),
+    [parties.holder.did, parties.service.did, contextId],
+  );
+
+  const items = list.data ?? [];
+  // Filtering happens here because `vta/memory/list` takes no filter — the
+  // agent sends the whole context. Said plainly rather than implied, so the
+  // count below is not mistaken for a server-side search.
+  const shown = useMemo(() => {
+    const needle = filter.trim().toLowerCase();
+    if (!needle) return items;
+    return items.filter(
+      (i) => i.key.toLowerCase().includes(needle) || i.value.toLowerCase().includes(needle),
+    );
+  }, [items, filter]);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Forgetting a memory needs an administrative role at this agent."
+    : null;
+
+  if (!contextId) {
+    return (
+      <Panel
+        title="Agent memory"
+        description="What your agent remembers between conversations."
+      >
+        <Note tone="accent">
+          <strong>Select a context in the tree.</strong> Memory has no global namespace — the
+          context is the isolation boundary, and an agent scoped to a different one cannot see
+          these at all. There is no agent-wide list to show you.
+        </Note>
+      </Panel>
+    );
+  }
+
+  const done = () => {
+    setEditing(null);
+    setCreating(false);
+    list.reload();
+  };
+
+  if (editing) {
+    return (
+      <WriteMemory
+        key={editing.key}
+        parties={parties}
+        contextId={contextId}
+        authority={authority}
+        existing={editing}
+        onDone={done}
+        onCancel={() => setEditing(null)}
+      />
+    );
+  }
+
+  const columns: Column<MemoryItem>[] = [
+    {
+      key: "key",
+      header: "Key",
+      width: "220px",
+      render: (m) => (
+        <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-word" }}>
+          {m.key}
+        </span>
+      ),
+    },
+    {
+      key: "value",
+      header: "Remembered",
+      render: (m) => (
+        <span style={{ lineHeight: 1.55, whiteSpace: "pre-wrap", wordBreak: "break-word" }}>
+          {m.value}
+        </span>
+      ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (m) => (
+        <div style={{ display: "grid", gap: 8, minWidth: 190 }}>
+          <Button kind="quiet" onClick={() => setEditing(m)}>
+            Edit
+          </Button>
+          <Destructive<MemoryItem>
+            label="Forget"
+            disabledReason={denied}
+            preview={async () => m}
+            renderPreview={(p) => (
+              <>
+                <strong>Forgetting this cannot be undone.</strong>
+                <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{p.key}</span>
+                <span style={{ whiteSpace: "pre-wrap" }}>{p.value}</span>
+                <span>
+                  Your agent stops recalling this in future conversations. Anything it has
+                  already said or done on the strength of it is unaffected.
+                </span>
+              </>
+            )}
+            commit={async () => {
+              await memoryDelete(managerSender, { ...parties, contextId, key: m.key });
+            }}
+            onDone={done}
+          />
+        </div>
+      ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={`Memory in ${contextHeading ?? contextId}`}
+        description="What your agent will recall in future conversations. A memory formed from a
+          misunderstanding does not decay on its own — this is where it gets removed."
+      >
+        <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 320px" }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>FILTER</span>
+            <input
+              style={fieldStyle}
+              value={filter}
+              onChange={(e) => setFilter(e.target.value)}
+              placeholder="key or text"
+            />
+          </label>
+          {filter.trim() && (
+            <span style={{ fontSize: t.sm, color: c.muted, paddingBottom: 7 }}>
+              {shown.length} of {items.length}
+            </span>
+          )}
+        </div>
+
+        {list.error && <LoadError what="agent memory" error={list.error} />}
+        {list.loading && !list.data && <Loading what="agent memory" />}
+        {list.data && (
+          <Table
+            columns={columns}
+            rows={shown}
+            rowKey={(m) => m.key}
+            empty={
+              filter.trim()
+                ? "Nothing here matches that. Clear the filter to see the rest."
+                : `Your agent remembers nothing in ${contextId}.`
+            }
+          />
+        )}
+
+        {!creating && (
+          <div>
+            <Button onClick={() => setCreating(true)}>New memory</Button>
+          </div>
+        )}
+      </Panel>
+
+      {creating && (
+        <WriteMemory
+          key="new"
+          parties={parties}
+          contextId={contextId}
+          authority={authority}
+          onDone={done}
+          onCancel={() => setCreating(false)}
+        />
+      )}
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/policy.tsx b/packages/extension/src/manager/panes/policy.tsx
new file mode 100644
index 0000000..d4a891b
--- /dev/null
+++ b/packages/extension/src/manager/panes/policy.tsx
@@ -0,0 +1,341 @@
+// Policy — the Rego modules the agent evaluates before it acts.
+//
+// A power-user surface, and labelled as one. For "which tasks need a human"
+// the answer is the Approvals pane; this is the layer underneath, where the
+// rule is written rather than chosen.
+//
+// **Every write carries `expectedVersion`.** `PolicyModule` has a `version`,
+// and both upsert and delete accept the version the editor was opened on. That
+// is the difference between saving your edit and silently discarding somebody
+// else's: without it, two operators editing the same module means last-write-
+// wins, and the loser never finds out.
+
+import { useCallback, useState } from "react";
+import {
+  policyDelete,
+  policyList,
+  policyUpsert,
+  type PolicyModule,
+} from "@openvtc/pnm-core/admin";
+import { Button, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, Truncated, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { formatDate } from "../format.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+const codeStyle: React.CSSProperties = {
+  ...fieldStyle,
+  fontFamily: font.mono,
+  fontSize: t.xs,
+  minHeight: 180,
+  width: "100%",
+  lineHeight: 1.5,
+  resize: "vertical",
+};
+
+function PolicyEditor({
+  parties,
+  existing,
+  authority,
+  onSaved,
+  onCancel,
+}: {
+  parties: Parties;
+  /** Absent for a new module. */
+  existing?: PolicyModule;
+  authority: Authority | null;
+  onSaved: () => void;
+  onCancel?: () => void;
+}) {
+  const [name, setName] = useState(existing?.name ?? "");
+  const [description, setDescription] = useState(existing?.description ?? "");
+  const [module, setModule] = useState(existing?.module ?? "");
+  const [enabled, setEnabled] = useState(existing?.enabled ?? false);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Editing policy needs the admin role at this agent."
+    : null;
+
+  const save = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await policyUpsert(managerSender, {
+          ...parties,
+          ...(existing ? { id: existing.id, expectedVersion: existing.version } : {}),
+          name: name.trim(),
+          module,
+          enabled,
+          ...(description.trim() ? { description: description.trim() } : {}),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) onSaved();
+  }, [parties, existing, name, description, module, enabled, onSaved]);
+
+  return (
+    <Panel
+      title={existing ? `Edit ${existing.name}` : "New policy module"}
+      description={
+        existing ? (
+          <>
+            Saving is compare-and-swapped against version{" "}
+            <strong>{existing.version}</strong> — if someone else has changed this module since
+            this editor opened, your save is refused rather than overwriting theirs.
+          </>
+        ) : (
+          "A Rego module the agent evaluates before it acts. Written by hand; for the common " +
+          "case of 'this task needs a human', use the Approvals pane instead."
+        )
+      }
+    >
+      <div style={{ display: "grid", gap: 10 }}>
+        <div style={{ display: "flex", gap: 10, flexWrap: "wrap" }}>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 220px" }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>NAME</span>
+            <input style={fieldStyle} value={name} onChange={(e) => setName(e.target.value)} />
+          </label>
+          <label style={{ display: "grid", gap: 4, flex: "2 1 320px" }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>DESCRIPTION</span>
+            <input
+              style={fieldStyle}
+              value={description}
+              onChange={(e) => setDescription(e.target.value)}
+            />
+          </label>
+        </div>
+
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>REGO MODULE</span>
+          <textarea
+            style={codeStyle}
+            value={module}
+            onChange={(e) => setModule(e.target.value)}
+            spellCheck={false}
+            placeholder={"package vta.policy\n\ndefault allow := false\n"}
+          />
+        </label>
+
+        <label style={{ display: "flex", gap: 8, alignItems: "center", fontSize: t.sm }}>
+          <input type="checkbox" checked={enabled} onChange={(e) => setEnabled(e.target.checked)} />
+          Enabled — the agent evaluates this module on every gated task
+        </label>
+
+        {enabled && (
+          <Note tone="warn">
+            An enabled module takes effect as soon as it is saved. A module that denies more than
+            you intended will refuse real work, including work this console does.
+          </Note>
+        )}
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        <div style={{ display: "flex", gap: 8 }}>
+          <Button
+            kind="primary"
+            disabled={busy || !name.trim() || !module.trim() || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void save()}
+          >
+            {busy ? "Saving…" : existing ? "Save changes" : "Create module"}
+          </Button>
+          {onCancel && (
+            <Button kind="quiet" onClick={onCancel}>
+              Cancel
+            </Button>
+          )}
+        </div>
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+export function PolicyPane({
+  parties,
+  authority,
+  contextId,
+  contextHeading,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  contextId: ContextSelection;
+  /** How the selected context is named in the tree, so heading and navigation
+   *  agree. See `contextLabel` in `format.ts`. */
+  contextHeading?: string | undefined;
+}) {
+  const [editing, setEditing] = useState<PolicyModule | null>(null);
+  const [creating, setCreating] = useState(false);
+
+  const list = useAsync(
+    () => policyList(managerSender, { ...parties, ...(contextId ? { contextId } : {}) }),
+    [parties.holder.did, parties.service.did, contextId],
+  );
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Deleting policy needs the admin role at this agent."
+    : null;
+
+  const done = () => {
+    setEditing(null);
+    setCreating(false);
+    list.reload();
+  };
+
+  const columns: Column<PolicyModule>[] = [
+    {
+      key: "name",
+      header: "Module",
+      render: (p) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <span style={{ fontWeight: 600 }}>{p.name}</span>
+          {p.description && (
+            <span style={{ color: c.muted, fontSize: t.xs }}>{p.description}</span>
+          )}
+        </div>
+      ),
+    },
+    {
+      key: "enabled",
+      header: "State",
+      render: (p) => (p.enabled ? <Pill tone="ok">enabled</Pill> : <Pill tone="off">disabled</Pill>),
+    },
+    {
+      key: "applies",
+      header: "Applies to",
+      render: (p) =>
+        p.appliesTo?.length ? (
+          <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{p.appliesTo.join(", ")}</span>
+        ) : (
+          <span style={{ color: c.muted }}>every task</span>
+        ),
+    },
+    {
+      key: "version",
+      header: "Version",
+      render: (p) => <span style={{ color: c.muted }}>{p.version}</span>,
+    },
+    {
+      key: "updated",
+      header: "Updated",
+      render: (p) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
+          {formatDate(p.updatedAt)}
+        </span>
+      ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (p) => (
+        <div style={{ display: "grid", gap: 8, minWidth: 190 }}>
+          <Button kind="quiet" onClick={() => setEditing(p)}>
+            Edit
+          </Button>
+          <Destructive<PolicyModule>
+            label="Delete"
+            disabledReason={denied}
+            preview={async () => p}
+            renderPreview={(m) => (
+              <>
+                <strong>Deleting {m.name} removes the rule it enforces.</strong>
+                <span>
+                  {m.enabled
+                    ? "It is currently enabled, so whatever it was refusing becomes allowed as " +
+                      "soon as this is deleted."
+                    : "It is currently disabled, so nothing changes about what the agent " +
+                      "allows today — but the module itself is not recoverable."}
+                </span>
+              </>
+            )}
+            commit={async () => {
+              await policyDelete(managerSender, {
+                ...parties,
+                id: p.id,
+                // Same compare-and-swap as the editor: delete the version that
+                // was read, not whatever is there now.
+                expectedVersion: p.version,
+              });
+            }}
+            onDone={done}
+          />
+        </div>
+      ),
+    },
+  ];
+
+  if (editing) {
+    return (
+      <PolicyEditor
+        key={editing.name}
+        parties={parties}
+        existing={editing}
+        authority={authority}
+        onSaved={done}
+        onCancel={() => setEditing(null)}
+      />
+    );
+  }
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={contextHeading ? `Policy in ${contextHeading}` : "Policy"}
+        description="Hand-authored Rego the agent evaluates before it acts. For the common case
+          — which tasks need a human — the Approvals pane is the surface to use."
+      >
+        {list.error && <LoadError what="policy modules" error={list.error} />}
+        {list.loading && !list.data && <Loading what="policy modules" />}
+        {list.data && (
+          <>
+            <Table
+              columns={columns}
+              rows={list.data.policies}
+              rowKey={(p) => p.id}
+              empty="No policy modules. Without one the agent falls back to its configured
+                defaults — which, for consent enforcement, is off."
+            />
+            {list.data.truncated && <Truncated what="the policy list" />}
+          </>
+        )}
+        {!creating && (
+          <div>
+            <Button onClick={() => setCreating(true)}>New module</Button>
+          </div>
+        )}
+      </Panel>
+
+      {creating && (
+        <PolicyEditor
+          key="new"
+          parties={parties}
+          authority={authority}
+          onSaved={done}
+          onCancel={() => setCreating(false)}
+        />
+      )}
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/services.tsx b/packages/extension/src/manager/panes/services.tsx
new file mode 100644
index 0000000..70bcabf
--- /dev/null
+++ b/packages/extension/src/manager/panes/services.tsx
@@ -0,0 +1,287 @@
+// Services — what the agent advertises, beside what the wallet has observed.
+//
+// **Advertisement is not availability.** A DID document says what an agent
+// *offers*; `buildVtaSession` skips a channel whose mediator it cannot reach
+// and falls through to the next, so an agent routinely advertises TSP, DIDComm
+// and REST while every byte goes over REST. A services list alone therefore
+// answers a different question from the one an operator is asking when
+// something misbehaves.
+//
+// So both columns are shown, and the third state is load-bearing: `up` needs
+// positive evidence (a completed mediator handshake and an open socket), `down`
+// is a skip the wallet recorded, and `unknown` means **not observed** — a REST
+// channel is built from a URL without contacting anything. `unknown` is not a
+// failure and must never be rendered as one; presenting it as a problem is how
+// an operator ends up chasing a transport that is working.
+
+import { servicesList, serviceDisable, serviceEnable, type ServiceState } from "@openvtc/pnm-core/admin";
+import { agentPing } from "@openvtc/pnm-core/admin";
+import { useCallback, useState } from "react";
+import { Button, Did, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { formatInstant } from "../format.js";
+import { useTransportHealth } from "../../use-transport-health.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { Transport, TransportObservation } from "../../transports.js";
+
+/** `ServiceKind` → the name `TransportHealth` records observations under. */
+const OBSERVED_AS: Partial<Record<ServiceState["kind"], Transport>> = {
+  tsp: "TSP",
+  didcomm: "DIDComm",
+  rest: "REST",
+};
+
+function Observed({ observation }: { observation: TransportObservation | undefined }) {
+  if (!observation) {
+    return (
+      <span style={{ color: c.faint }} title="No session has been built over this transport yet.">
+        not observed
+      </span>
+    );
+  }
+  if (observation.state === "up") return <Pill tone="ok">up</Pill>;
+  if (observation.state === "unknown") {
+    return (
+      <span
+        style={{ color: c.faint }}
+        title="Built from a URL without contacting anything — construction is not evidence."
+      >
+        not observed
+      </span>
+    );
+  }
+  return (
+    <div style={{ display: "grid", gap: 2 }}>
+      <Pill tone="danger">down</Pill>
+      {observation.detail && (
+        <span style={{ color: c.muted, fontSize: t.xs, maxWidth: 320, lineHeight: 1.45 }}>
+          {observation.detail}
+        </span>
+      )}
+    </div>
+  );
+}
+
+function HealthCheck({ parties }: { parties: Parties }) {
+  const [result, setResult] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  const ping = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setResult(null);
+    const started = performance.now();
+    try {
+      await agentPing(managerSender, parties);
+      setResult(`answered in ${Math.round(performance.now() - started)} ms`);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setBusy(false);
+    }
+  }, [parties]);
+
+  return (
+    <Panel
+      title="Reachability"
+      description="Sends a messaging/ping over whichever transport the wallet actually selects.
+        A round trip proves the path this console is using works end to end — which is a
+        different claim from any transport being advertised."
+    >
+      <div style={{ display: "flex", gap: 12, alignItems: "center", flexWrap: "wrap" }}>
+        <Button onClick={() => void ping()} disabled={busy}>
+          {busy ? "Pinging…" : "Ping agent"}
+        </Button>
+        {result && <span style={{ color: c.ok, fontSize: t.sm }}>{result}</span>}
+        {error && <span style={{ color: c.danger, fontSize: t.sm }}>{error}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+export function ServicesPane({
+  parties,
+  authority,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+}) {
+  const list = useAsync(
+    () => servicesList(managerSender, parties),
+    [parties.holder.did, parties.service.did],
+  );
+  const { health, sessions } = useTransportHealth(parties.service.did);
+
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Changing a transport needs the admin role at this agent."
+    : null;
+
+  const columns: Column<ServiceState>[] = [
+    {
+      key: "kind",
+      header: "Transport",
+      render: (s) => <span style={{ fontWeight: 600 }}>{s.kind}</span>,
+    },
+    {
+      key: "advertised",
+      header: "Advertised",
+      render: (s) => (s.enabled ? <Pill tone="ok">enabled</Pill> : <Pill tone="off">disabled</Pill>),
+    },
+    {
+      key: "observed",
+      header: "Observed",
+      render: (s) => {
+        const key = OBSERVED_AS[s.kind];
+        return <Observed observation={key ? health[key] : undefined} />;
+      },
+    },
+    {
+      key: "endpoint",
+      header: "Endpoint",
+      render: (s) => (
+        <div style={{ display: "grid", gap: 2, maxWidth: 380 }}>
+          {s.mediatorDid && <Did value={s.mediatorDid} size={t.xs} />}
+          {s.url && (
+            <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all" }}>
+              {s.url}
+            </span>
+          )}
+          {!s.mediatorDid && !s.url && <span style={{ color: c.faint }}>—</span>}
+        </div>
+      ),
+    },
+    {
+      key: "drain",
+      header: "Draining",
+      render: (s) =>
+        s.drainsUntil ? (
+          <span style={{ color: c.warn, whiteSpace: "nowrap" }}>
+            until {formatInstant(s.drainsUntil)}
+          </span>
+        ) : (
+          <span style={{ color: c.faint }}>—</span>
+        ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (s) => (
+        <div style={{ minWidth: 190 }}>
+          {s.enabled ? (
+            <Destructive<ServiceState>
+              label="Disable"
+              disabledReason={denied}
+              preview={async () => s}
+              renderPreview={(p) => (
+                <>
+                  <strong>Disabling {p.kind} stops the agent advertising it.</strong>
+                  <span>
+                    Anything reaching this agent over {p.kind} falls back to another transport if
+                    it has one — and fails outright if it does not. Your wallet's own inbox rides
+                    the mediator transports, so disabling one can leave approval requests with
+                    nowhere to arrive.
+                  </span>
+                </>
+              )}
+              commit={async () => {
+                await serviceDisable(managerSender, { ...parties, kind: s.kind });
+              }}
+              onDone={list.reload}
+            />
+          ) : (
+            <Button
+              disabled={Boolean(denied)}
+              {...(denied ? { title: denied } : {})}
+              onClick={() => {
+                setError(null);
+                setPending(null);
+                void runMutation(
+                  async () => {
+                    // An empty config is schema-valid — every member of it is
+                    // optional — and means "re-enable on whatever you last
+                    // held". Inventing a mediator DID here would be this
+                    // console deciding one, which it has no basis to do.
+                    await serviceEnable(managerSender, {
+                      ...parties,
+                      kind: s.kind,
+                      config: {},
+                    });
+                  },
+                  { onConsent: setPending, onError: setError },
+                ).then((ok) => ok && list.reload());
+              }}
+            >
+              Enable
+            </Button>
+          )}
+        </div>
+      ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title="Transports"
+        description="What your agent offers, beside what your wallet has actually seen work. The
+          two differ more often than you would expect — a transport can be advertised for months
+          while every byte goes over another one."
+      >
+        {list.error && <LoadError what="the service list" error={list.error} />}
+        {list.loading && !list.data && <Loading what="the service list" />}
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+        {list.data && (
+          <Table
+            columns={columns}
+            rows={list.data}
+            rowKey={(s) => s.kind}
+            empty="Your agent advertises no transports, which would make it unreachable. That is
+              almost certainly wrong rather than deliberate."
+          />
+        )}
+        <Note tone="accent">
+          <strong>"Not observed" is not a failure.</strong> A REST channel is built from a URL
+          without contacting anything, so construction proves nothing either way — and a
+          transport nothing has used yet has simply not been tested. Only <em>down</em> means the
+          wallet tried and could not.
+        </Note>
+      </Panel>
+
+      <HealthCheck parties={parties} />
+
+      <Panel
+        title="Mediator sessions"
+        description="The live sockets your wallet holds. The one marked as your inbox is the one
+          whose death means nothing pushed to this wallet arrives — approval requests included."
+      >
+        <Table
+          columns={[
+            { key: "mediator", header: "Mediator", render: (s) => <Did value={s.mediatorDid} /> },
+            { key: "vta", header: "For agent", render: (s) => <Did value={s.vtaDid} /> },
+            {
+              key: "inbox",
+              header: "Role",
+              render: (s) =>
+                s.isInbox ? <Pill tone="ok">inbox</Pill> : <span style={{ color: c.muted }}>outbound</span>,
+            },
+          ]}
+          rows={sessions}
+          rowKey={(s) => `${s.mediatorDid}:${s.vtaDid}`}
+          empty="No mediator session is open. Nothing pushed to this wallet will arrive —
+            including approval requests — until one is."
+        />
+      </Panel>
+
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/sessions.tsx b/packages/extension/src/manager/panes/sessions.tsx
new file mode 100644
index 0000000..5f69209
--- /dev/null
+++ b/packages/extension/src/manager/panes/sessions.tsx
@@ -0,0 +1,132 @@
+// Sessions — **yours**, and only yours.
+//
+// `sessionsList` returns the caller's own sessions and nothing else. The agent
+// has a separate admin route that lists everyone's, and this task deliberately
+// does not use it. So the heading says "your sessions": a console that put this
+// answer under "all sessions" would be lying about its own scope, and an
+// operator would read an empty list as "nobody else is signed in".
+
+import {
+  sessionRevoke,
+  sessionsList,
+  type Session,
+} from "@openvtc/pnm-core/admin";
+import { Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { Destructive } from "../destructive.js";
+import { Loading, LoadError, Table, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { formatInstant } from "../format.js";
+import type { Authority, Parties } from "../use-vta.js";
+
+function When({ iso }: { iso: string }) {
+  return (
+    <span style={{ color: c.muted, whiteSpace: "nowrap" }}>{formatInstant(iso)}</span>
+  );
+}
+
+export function SessionsPane({
+  parties,
+  authority,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+}) {
+  const list = useAsync(
+    () => sessionsList(managerSender, parties),
+    [parties.holder.did, parties.service.did],
+  );
+
+  const current = authority?.session.id;
+
+  const columns: Column<Session>[] = [
+    {
+      key: "id",
+      header: "Session",
+      render: (s) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all" }}>
+            {s.id}
+          </span>
+          {s.id === current && <Pill tone="accent">this console</Pill>}
+        </div>
+      ),
+    },
+    {
+      key: "amr",
+      header: "Signed in with",
+      render: (s) => (
+        <span style={{ color: c.muted }}>{s.amr?.length ? s.amr.join(" + ") : "—"}</span>
+      ),
+    },
+    {
+      key: "acr",
+      header: "Assurance",
+      render: (s) => <span style={{ color: c.muted }}>{s.acr ?? "—"}</span>,
+    },
+    { key: "issued", header: "Started", render: (s) => <When iso={s.issuedAt} /> },
+    { key: "expires", header: "Expires", render: (s) => <When iso={s.expiresAt} /> },
+    {
+      key: "actions",
+      header: "",
+      render: (s) => (
+        <div style={{ minWidth: 180 }}>
+          <Destructive<Session>
+            label="Revoke"
+            preview={async () => s}
+            renderPreview={(p) => (
+              <>
+                <strong>
+                  {p.id === current
+                    ? "This is the session this console is using."
+                    : "Revoking this session signs it out immediately."}
+                </strong>
+                <span>
+                  {p.id === current
+                    ? "Revoking it signs you out here. You will need to authenticate again " +
+                      "before this console can do anything else."
+                    : "Whatever is using it stops being able to act at this agent until it " +
+                      "authenticates again."}
+                </span>
+              </>
+            )}
+            commit={async () => {
+              await sessionRevoke(managerSender, { ...parties, sessionId: s.id });
+            }}
+            onDone={list.reload}
+          />
+        </div>
+      ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title="Your sessions"
+        description="Every session authenticated as you at this agent. Your agent also knows
+          about other people's; this list is deliberately not that one, so an empty result here
+          says nothing about anybody else."
+      >
+        {list.error && <LoadError what="your sessions" error={list.error} />}
+        {list.loading && !list.data && <Loading what="your sessions" />}
+        {list.data && (
+          <Table
+            columns={columns}
+            rows={list.data}
+            rowKey={(s) => s.id}
+            empty="Your agent reports no sessions for you — including, apparently, the one this
+              console is using, which is worth a second look."
+          />
+        )}
+        {list.data && list.data.length > 1 && (
+          <Note tone="warn">
+            More than one session is signed in as you. That is normal if you use several devices,
+            and worth a look if you do not.
+          </Note>
+        )}
+      </Panel>
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/sender.ts b/packages/extension/src/manager/sender.ts
new file mode 100644
index 0000000..da2001f
--- /dev/null
+++ b/packages/extension/src/manager/sender.ts
@@ -0,0 +1,43 @@
+/// <reference types="chrome" />
+
+// The console's `TrustTaskSender` — the chrome-facing half.
+//
+// All the reasoning about what may cross the bridge, and what a consent refusal
+// means, lives in `carrier.ts`, which is free of relative imports so it can be
+// unit-tested in plain Node. This file is the wiring: put the two permitted
+// members on a runtime message, and interpret what comes back.
+//
+// What routing through the wallet's own relay buys, with no change to
+// `offscreen.ts`: transport selection and fallback (TSP > DIDComm > REST),
+// `TransportHealth` recording, outbound signing, and the same-browser approver
+// ceremony on a `consentRequired`.
+
+import type { SendOpts, TrustTask, TrustTaskSender } from "@openvtc/pnm-core";
+import { RUNTIME_MANAGER_TASK, type RuntimeManagerTaskResponse } from "../bridge-protocol.js";
+import { sendToBackground } from "../send-message.js";
+import { carrierParams, interpretOutcome } from "./carrier.js";
+
+/**
+ * A `TrustTaskSender` backed by the wallet's runtime bridge.
+ *
+ * Stateless and cheap — construct one per pane or share one, it makes no
+ * difference. The session it ultimately runs on is the offscreen document's
+ * warm one, pooled there and shared with the wallet's own traffic.
+ */
+export class ManagerTaskSender implements TrustTaskSender {
+  async send<Res>(envelope: TrustTask<unknown>, opts?: SendOpts): Promise<Res> {
+    const reply = await sendToBackground<RuntimeManagerTaskResponse>({
+      type: RUNTIME_MANAGER_TASK,
+      // The carrier is unpacked here and nowhere else.
+      params: carrierParams(envelope),
+    });
+    return interpretOutcome<Res>(
+      envelope.type,
+      opts?.operationLabel ?? envelope.type,
+      reply,
+    );
+  }
+}
+
+/** One shared instance; the class holds nothing worth having twice. */
+export const managerSender = new ManagerTaskSender();
diff --git a/packages/extension/src/manager/shell.tsx b/packages/extension/src/manager/shell.tsx
new file mode 100644
index 0000000..7d1b530
--- /dev/null
+++ b/packages/extension/src/manager/shell.tsx
@@ -0,0 +1,482 @@
+/// <reference types="chrome" />
+
+// The console shell: act rail, context tree, pane.
+//
+// Three columns, and the middle one is the idea. Sections answer "what am I
+// looking at"; the context tree answers "about which compartment", and it
+// persists across sections because `contextId` is a filter on Keys, DIDs,
+// Access and Audit alike. Folding the tree into a Contexts *page* would force
+// the operator to re-answer the second question every time they changed the
+// first.
+//
+// Routing is on `location.hash`, matching `app-shell.tsx`, so a pane is
+// linkable and a reload lands where the operator was.
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { contextsList, type ContextRecord } from "@openvtc/pnm-core";
+import { c, t } from "../theme.js";
+import { Note } from "../ui.js";
+import { ContextTree, type ContextSelection } from "./context-column.js";
+import { WhoamiBanner } from "./whoami-banner.js";
+import { ContextsPane } from "./panes/contexts.js";
+import { KeysPane } from "./panes/keys.js";
+import { DidsPane } from "./panes/dids.js";
+import { AccessPane } from "./panes/access.js";
+import { SessionsPane } from "./panes/sessions.js";
+import { ApprovalsPane } from "./panes/approvals.js";
+import { PolicyPane } from "./panes/policy.js";
+import { ServicesPane } from "./panes/services.js";
+import { MaintenancePane } from "./panes/maintenance.js";
+import { AuditPane } from "./panes/audit.js";
+import { CredentialsPane } from "./panes/credentials.js";
+import { MemoryPane } from "./panes/memory.js";
+import { AppStatePane } from "./panes/app-state.js";
+import { managerSender } from "./sender.js";
+import { useVta, type Parties } from "./use-vta.js";
+import { contextHeading } from "./format.js";
+
+/** Section ids double as the URL hash. */
+export type SectionId =
+  | "contexts"
+  | "keys"
+  | "dids"
+  | "credentials"
+  | "memory"
+  | "app-state"
+  | "services"
+  | "maintenance"
+  | "audit"
+  | "access"
+  | "sessions"
+  | "approvals"
+  | "policy";
+
+interface Section {
+  id: SectionId;
+  label: string;
+  /**
+   * Whether the selected context actually narrows what this pane asks.
+   *
+   * Declared per section rather than inferred, because getting it wrong is
+   * invisible: Transports and Sessions take no `contextId` at all, so with the
+   * tree always on screen an operator could pick a context, watch nothing
+   * change, and reasonably conclude the filter was broken — or worse, that the
+   * list they were reading *was* scoped when it never was. A filter that does
+   * not filter is not clutter, it is a false claim about what is on screen.
+   *
+   * A new pane has to answer this, which is the point.
+   */
+  contextScoped: boolean;
+}
+
+interface Act {
+  title: string;
+  /** CSS custom property holding this act's colour. */
+  colour: string;
+  soft: string;
+  sections: Section[];
+}
+
+// The deck's three acts. The grouping is not decorative — each answers a
+// different question, and the colour is how the rail says which one you are in.
+const ACTS: Act[] = [
+  {
+    title: "Identity & custody",
+    colour: "var(--m-act-identity)",
+    soft: "var(--m-act-identity-soft)",
+    sections: [
+      { id: "contexts", label: "Contexts", contextScoped: true },
+      { id: "keys", label: "Keys", contextScoped: true },
+      { id: "dids", label: "DIDs", contextScoped: true },
+    ],
+  },
+  {
+    // A fourth act, not in the deck. The three there answer "who am I", "how do
+    // bytes move" and "who may act"; none of them answers "what is stored
+    // here", which is the one question credentials, memory and app-state share.
+    title: "Data & credentials",
+    colour: "var(--m-act-data)",
+    soft: "var(--m-act-data-soft)",
+    sections: [
+      // Issuer-side only, and agent-wide: `vta/credentials` takes no context.
+      { id: "credentials", label: "Credentials", contextScoped: false },
+      // For both of these `contextId` is part of the record's address rather
+      // than a filter, so the pane refuses to answer agent-wide. The column is
+      // shown because the selection is required, not merely useful.
+      { id: "memory", label: "Memory", contextScoped: true },
+      { id: "app-state", label: "App state", contextScoped: true },
+    ],
+  },
+  {
+    title: "Wire & execution",
+    colour: "var(--m-act-wire)",
+    soft: "var(--m-act-wire-soft)",
+    sections: [
+      // Transports are agent-wide: `servicesList` takes no context, because a
+      // transport is not owned by one.
+      { id: "services", label: "Transports", contextScoped: false },
+      // Operations whose subject is the agent itself rather than anything it
+      // holds — backup and restart. Agent-wide by definition, so no context.
+      { id: "maintenance", label: "Maintenance", contextScoped: false },
+      { id: "audit", label: "Audit", contextScoped: true },
+    ],
+  },
+  {
+    title: "Authority & graph",
+    colour: "var(--m-act-graph)",
+    soft: "var(--m-act-graph-soft)",
+    sections: [
+      { id: "access", label: "Access", contextScoped: true },
+      { id: "approvals", label: "Approvals", contextScoped: true },
+      { id: "policy", label: "Policy", contextScoped: true },
+      // `sessionsList` returns the caller's sessions; a session is held at the
+      // agent, not inside a context.
+      { id: "sessions", label: "Sessions", contextScoped: false },
+    ],
+  },
+];
+
+const SECTIONS: Section[] = ACTS.flatMap((a) => a.sections);
+
+/** Whether the context column belongs on screen for `section`. */
+function isContextScoped(section: SectionId): boolean {
+  return SECTIONS.find((s) => s.id === section)?.contextScoped ?? false;
+}
+
+function sectionFromHash(): SectionId {
+  const raw = location.hash.replace(/^#/, "");
+  const known = SECTIONS.map((s) => s.id);
+  return (known as string[]).includes(raw) ? (raw as SectionId) : "contexts";
+}
+
+function ActRail({
+  section,
+  onSelect,
+}: {
+  section: SectionId;
+  onSelect: (id: SectionId) => void;
+}) {
+  return (
+    <nav
+      aria-label="Sections"
+      style={{
+        background: "var(--m-rail)",
+        borderRight: `1px solid ${c.line}`,
+        overflowY: "auto",
+        padding: "12px 0",
+        display: "grid",
+        gridAutoRows: "min-content",
+        gap: 14,
+      }}
+    >
+      {ACTS.map((act) => (
+        <div key={act.title} style={{ borderLeft: `4px solid ${act.colour}`, paddingLeft: 11 }}>
+          <h2
+            style={{
+              margin: "0 0 5px",
+              fontSize: t.xs,
+              textTransform: "uppercase",
+              letterSpacing: 0.5,
+              // The act's own colour, not a neutral. The rail is the only thing
+              // saying which of the three questions a section answers, and a
+              // 4px edge alone is too quiet to carry it.
+              color: act.colour,
+              fontWeight: 640,
+            }}
+          >
+            {act.title}
+          </h2>
+          {act.sections.map((s) => {
+            const active = s.id === section;
+            return (
+              <button
+                key={s.id}
+                onClick={() => onSelect(s.id)}
+                aria-current={active ? "page" : undefined}
+                style={{
+                  display: "block",
+                  width: "calc(100% - 10px)",
+                  textAlign: "left",
+                  border: "none",
+                  borderRadius: "var(--w-r-sm)",
+                  padding: "6px 9px",
+                  margin: "1px 0",
+                  cursor: "pointer",
+                  background: active ? act.soft : "transparent",
+                  color: active ? act.colour : c.text,
+                  fontSize: t.sm,
+                  fontWeight: active ? 640 : 440,
+                }}
+              >
+                {s.label}
+              </button>
+            );
+          })}
+        </div>
+      ))}
+    </nav>
+  );
+}
+
+/** Contexts are fetched once here and handed to both the tree and the pane, so
+ *  a rename cannot leave the two showing different names for one context. */
+function useContexts(parties: Parties | null) {
+  const [records, setRecords] = useState<ContextRecord[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  const reload = useCallback(async () => {
+    if (!parties) return;
+    setLoading(true);
+    setError(null);
+    try {
+      setRecords(await contextsList(managerSender, parties));
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setLoading(false);
+    }
+  }, [parties]);
+
+  useEffect(() => {
+    void reload();
+  }, [reload]);
+
+  return { records, loading, error, reload };
+}
+
+export function ManagerShell() {
+  const vta = useVta();
+  const [section, setSection] = useState<SectionId>(sectionFromHash);
+  const [selected, setSelected] = useState<ContextSelection>(null);
+
+  useEffect(() => {
+    const onHash = () => setSection(sectionFromHash());
+    addEventListener("hashchange", onHash);
+    return () => removeEventListener("hashchange", onHash);
+  }, []);
+
+  const go = useCallback((id: SectionId) => {
+    location.hash = id;
+    setSection(id);
+  }, []);
+
+  const parties = vta.status === "ready" ? vta.parties : null;
+  const contexts = useContexts(parties);
+
+  // Every mutation refetches both: the records that were changed, and the
+  // authority that change may have altered.
+  const onChanged = useCallback(() => {
+    void contexts.reload();
+    void vta.refreshAuthority();
+  }, [contexts, vta]);
+
+  // One name for the selected context, shared by every pane heading, so a
+  // heading can never disagree with the tree entry that produced it.
+  const heading = selected
+    ? contextHeading(
+        contexts.records.find((r) => r.id === selected),
+        selected,
+      )
+    : undefined;
+
+  const body = useMemo(() => {
+    if (vta.status !== "ready" || !parties) return null;
+    switch (section) {
+      case "contexts":
+        return (
+          <ContextsPane
+            parties={parties}
+            authority={vta.authority}
+            records={contexts.records}
+            selected={selected}
+            onChanged={onChanged}
+          />
+        );
+      case "keys":
+        return (
+          <KeysPane
+            parties={parties}
+            authority={vta.authority}
+            contextId={selected}
+            contextHeading={heading}
+          />
+        );
+      case "dids":
+        return (
+          <DidsPane
+            parties={parties}
+            authority={vta.authority}
+            contextId={selected}
+            contextHeading={heading}
+          />
+        );
+      case "credentials":
+        return (
+          <CredentialsPane
+            parties={parties}
+            authority={vta.authority}
+            onOpenAudit={() => go("audit")}
+          />
+        );
+      case "memory":
+        return (
+          <MemoryPane
+            parties={parties}
+            authority={vta.authority}
+            contextId={selected}
+            contextHeading={heading}
+          />
+        );
+      case "app-state":
+        return (
+          <AppStatePane
+            parties={parties}
+            authority={vta.authority}
+            contextId={selected}
+            contextHeading={heading}
+          />
+        );
+      case "services":
+        return <ServicesPane parties={parties} authority={vta.authority} />;
+      case "maintenance":
+        return <MaintenancePane parties={parties} authority={vta.authority} />;
+      case "audit":
+        return <AuditPane parties={parties} contextId={selected} contextHeading={heading} />;
+      case "access":
+        return (
+          <AccessPane
+            parties={parties}
+            authority={vta.authority}
+            contextId={selected}
+            contextHeading={heading}
+          />
+        );
+      case "approvals":
+        return (
+          <ApprovalsPane
+            parties={parties}
+            authority={vta.authority}
+            contextId={selected}
+            contextHeading={heading}
+          />
+        );
+      case "policy":
+        return (
+          <PolicyPane
+            parties={parties}
+            authority={vta.authority}
+            contextId={selected}
+            contextHeading={heading}
+          />
+        );
+      case "sessions":
+        return <SessionsPane parties={parties} authority={vta.authority} />;
+    }
+  }, [vta, parties, section, contexts.records, selected, heading, onChanged, go]);
+
+  if (vta.status === "loading") {
+    return <Centered>Reading your wallet's connection…</Centered>;
+  }
+
+  if (vta.status === "disconnected") {
+    return (
+      <Centered>
+        <div style={{ display: "grid", gap: 12, maxWidth: "60ch" }}>
+          <strong style={{ fontSize: t.md }}>No agent connected</strong>
+          <span style={{ color: c.muted, lineHeight: 1.6 }}>
+            This console administers the agent your wallet is onboarded with, and there isn't one
+            yet. Open the wallet's setup and connect an agent first.
+          </span>
+          <div>
+            <button
+              onClick={() => void chrome.tabs.create({ url: chrome.runtime.getURL("options.html#setup") })}
+              style={{
+                border: `1px solid ${c.line}`,
+                background: c.accent,
+                color: "var(--w-accent-ink)",
+                borderRadius: "var(--w-r-sm)",
+                padding: "7px 13px",
+                fontSize: t.sm,
+                cursor: "pointer",
+              }}
+            >
+              Open wallet setup
+            </button>
+          </div>
+        </div>
+      </Centered>
+    );
+  }
+
+  // The context column appears only where the selection actually narrows the
+  // question. On Transports and Sessions it would be a filter that filters
+  // nothing — see `Section.contextScoped`.
+  const scoped = isContextScoped(section);
+
+  return (
+    <div
+      style={{
+        height: "100%",
+        display: "grid",
+        gridTemplateColumns: scoped ? "186px 244px minmax(0, 1fr)" : "186px minmax(0, 1fr)",
+        gridTemplateRows: "auto minmax(0, 1fr)",
+        gridTemplateAreas: scoped
+          ? `"rail tree banner" "rail tree pane"`
+          : `"rail banner" "rail pane"`,
+      }}
+    >
+      <div style={{ gridArea: "rail", minHeight: 0 }}>
+        <ActRail section={section} onSelect={go} />
+      </div>
+
+      {scoped && (
+        <div style={{ gridArea: "tree", minHeight: 0, display: "grid" }}>
+          <ContextTree
+            records={contexts.records}
+            selected={selected}
+            onSelect={setSelected}
+            loading={contexts.loading}
+            error={contexts.error}
+          />
+        </div>
+      )}
+
+      <div style={{ gridArea: "banner" }}>
+        <WhoamiBanner
+          agentDid={vta.parties.service.did}
+          authority={vta.authority}
+          error={vta.authorityError}
+        />
+      </div>
+
+      <main style={{ gridArea: "pane", overflowY: "auto", padding: "20px 24px", minWidth: 0 }}>
+        {contexts.error && (
+          <div style={{ marginBottom: 16 }}>
+            <Note tone="danger">
+              Your agent would not list contexts — {contexts.error}
+            </Note>
+          </div>
+        )}
+        {body}
+      </main>
+    </div>
+  );
+}
+
+function Centered({ children }: { children: React.ReactNode }) {
+  return (
+    <div
+      style={{
+        height: "100%",
+        display: "grid",
+        placeItems: "center",
+        padding: 32,
+        fontSize: t.base,
+        color: c.text,
+      }}
+    >
+      {children}
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/step-up.ts b/packages/extension/src/manager/step-up.ts
new file mode 100644
index 0000000..277b44c
--- /dev/null
+++ b/packages/extension/src/manager/step-up.ts
@@ -0,0 +1,154 @@
+// Proof of presence, for the console's two irreversible controls.
+//
+// ## What this proves, and what it does not
+//
+// `requirePresence` runs a WebAuthn assertion and throws if it does not
+// complete. That establishes exactly one thing: **a human with the enrolled
+// authenticator is at this machine right now.** It is a gate on the console's
+// own UI.
+//
+// It is *not* an authorization of the operation, and the distinction is worth
+// stating plainly because the ceremony looks like one. Nothing verifies this
+// assertion against the Trust Task that follows — the agent never sees it, the
+// document carries no trace of it, and the audit trail at the other end records
+// an ordinary request. A caller who reached the extension's own code could send
+// the task without ever calling this.
+//
+// So the honest claim is: this stops an unattended console from being used by
+// whoever walks past, and it makes an irreversible action deliberate rather
+// than one click deep. That is worth having. It is not a second factor on the
+// agent, and anyone reasoning about the agent's security should not count it as
+// one.
+//
+// ## Why it does not reuse the PRF ceremony
+//
+// `runPrfUnlockCeremony` returns PRF output — the AES key root, as sensitive as
+// the holder seed. A presence check needs none of that, and a primitive that
+// hands back key material to answer "is someone there?" is one that will
+// eventually have its output stored by a caller who only wanted the boolean.
+// This runs the same assertion with **no `prf` extension** and returns
+// `void`. There is nothing to leak because there is nothing to return.
+//
+// ## Why it never consults unlock state
+//
+// A step-up that a prior unlock satisfies is not a step-up. The wallet may well
+// be unlocked — that is a fact about this session, established possibly hours
+// ago, and re-using it would mean the gate is open for as long as the console
+// is. Every call runs a fresh assertion with a fresh challenge. That is the
+// whole point, and it is the first thing to break if someone later adds a
+// cache "because the prompt is annoying".
+//
+// ## Where it must run
+//
+// The manager page, in a click handler. `navigator.credentials.get` needs a
+// visible, focused context — the same constraint documented in
+// `webauthn-prf-unlock.ts`, for the same reason: a hidden page hangs forever
+// rather than failing. The console is a normal extension page, so this holds,
+// but it is why the call belongs in the pane and not in the offscreen document
+// that ends up sending the task.
+
+import { base64url } from "@openvtc/vti-didcomm-js";
+import { IndexedDBKVStore } from "@openvtc/pnm-core";
+
+// The credential the wallet enrolled. Same slot `webauthn-prf-unlock.ts` reads;
+// the salt beside it is deliberately not read here, because that is the PRF
+// input and this ceremony evaluates no PRF.
+const CREDENTIAL_KEY = "pnm/holder-prf/credentialId";
+
+/** Why a step-up could not be completed, in terms the operator can act on. */
+export class StepUpError extends Error {
+  readonly reason: "cancelled" | "no-authenticator" | "unexpected";
+  constructor(reason: StepUpError["reason"], message: string) {
+    super(message);
+    this.name = "StepUpError";
+    this.reason = reason;
+  }
+}
+
+/**
+ * Require a fresh proof of presence before an irreversible action.
+ *
+ * Resolves only if the assertion completed. Throws `StepUpError` otherwise —
+ * `cancelled` when the human dismissed the prompt, which is a decision and not
+ * a fault, so callers should abandon the action silently rather than surfacing
+ * it as an error.
+ *
+ * `purpose` is shown to the operator by the caller, not passed to the
+ * authenticator: WebAuthn has no field that renders caller-supplied text, and
+ * pretending otherwise would let a pane imply the prompt says something it does
+ * not. It is taken here so the reason is recorded next to the call site.
+ */
+export async function requirePresence(rpId: string, purpose: string): Promise<void> {
+  void purpose;
+
+  // Which credential to name is an optimisation, so a failure to answer it
+  // must not become a failure to ask for presence. `IndexedDBKVStore.get`
+  // *throws* where IndexedDB is unavailable rather than returning nothing — a
+  // private window, or a browser set to block site data — and letting that
+  // propagate would turn "we could not look up your credential" into "you
+  // cannot approve this action", which is the wrong failure by a long way.
+  let credentialIdB64u: string | undefined;
+  try {
+    credentialIdB64u = await new IndexedDBKVStore().get<string>(CREDENTIAL_KEY);
+  } catch {
+    credentialIdB64u = undefined;
+  }
+
+  // A fresh random challenge, every time.
+  //
+  // Not bound to the action, and that is not an oversight: binding buys
+  // something only where a verifier checks the challenge against the request,
+  // and there is no verifier here. Claiming the assertion is "for this bundle"
+  // when nothing enforces it would be the kind of overstatement the module
+  // header exists to avoid.
+  const challenge = crypto.getRandomValues(new Uint8Array(32));
+
+  // An enrolled credential is used when there is one, so the prompt names the
+  // authenticator the operator already knows. With none, fall back to whatever
+  // discoverable credential exists for this rpId rather than refusing outright:
+  // enrolment is about encrypting the holder, and an operator who declined that
+  // has not thereby declined to prove they are present.
+  const allowCredentials = credentialIdB64u
+    ? [
+        {
+          type: "public-key" as const,
+          id: base64url.decode(credentialIdB64u).buffer as ArrayBuffer,
+        },
+      ]
+    : [];
+
+  let assertion: Credential | null;
+  try {
+    assertion = await navigator.credentials.get({
+      publicKey: {
+        rpId,
+        challenge: challenge as BufferSource,
+        allowCredentials,
+        // Presence alone is not the bar. `required` asks the authenticator for
+        // the biometric or PIN, which is what makes this a step-up rather than
+        // a touch anyone standing at the machine can supply.
+        userVerification: "required",
+      },
+    });
+  } catch (e) {
+    // `NotAllowedError` is what both a dismissal and a timeout raise, and the
+    // API gives no way to tell them apart — deliberately, so a site cannot
+    // learn whether a user refused. Reported as cancelled because that is the
+    // reading a caller should act on: do nothing, say nothing.
+    const name = e instanceof DOMException ? e.name : "";
+    if (name === "NotAllowedError") {
+      throw new StepUpError("cancelled", "Approval was dismissed. Nothing was sent.");
+    }
+    throw new StepUpError(
+      "unexpected",
+      e instanceof Error ? e.message : "The authenticator could not be reached.",
+    );
+  }
+
+  if (!assertion) {
+    throw new StepUpError(
+      "no-authenticator",
+      "No authenticator answered. Enrol one in Settings, then try again.",
+    );
+  }
+}
diff --git a/packages/extension/src/manager/table.tsx b/packages/extension/src/manager/table.tsx
new file mode 100644
index 0000000..de62f4b
--- /dev/null
+++ b/packages/extension/src/manager/table.tsx
@@ -0,0 +1,201 @@
+// The console's list vocabulary.
+//
+// Nine panes render "a list of records the agent holds", and each one has the
+// same three states worth distinguishing — loading, the agent refused, and the
+// agent answered with nothing. Written per-pane those collapse: an empty array
+// and a failed call both render as no rows, and the operator reads "you have no
+// keys" off a permission error.
+//
+// So the states are separated here, once, and each says something different.
+
+import { Fragment, type ReactNode } from "react";
+import { c, t } from "../theme.js";
+import { Note } from "../ui.js";
+
+export interface Column<R> {
+  key: string;
+  header: string;
+  /** Column width; omit to let it take its share. */
+  width?: string;
+  render: (row: R) => ReactNode;
+}
+
+export function Table<R>({
+  columns,
+  rows,
+  rowKey,
+  expanded,
+  empty,
+}: {
+  columns: Column<R>[];
+  rows: R[];
+  rowKey: (row: R) => string;
+  /**
+   * Detail to show directly beneath a row, or `null` for rows that have none.
+   *
+   * A detail panel rendered *after* the table is a detail panel the operator
+   * does not notice: they click View on the third row, the content appears
+   * below the fold, and the table looks like it did nothing. Putting it in the
+   * flow under the row it belongs to is the difference between an answer and a
+   * thing that happened somewhere else.
+   */
+  expanded?: (row: R) => ReactNode | null;
+  /** What would appear here. An empty state is a chance to explain, so this is
+   *  required rather than defaulting to "None". */
+  empty: ReactNode;
+}) {
+  if (rows.length === 0) {
+    return (
+      <div style={{ fontSize: t.sm, color: c.faint, padding: "10px 0", lineHeight: 1.55 }}>
+        {empty}
+      </div>
+    );
+  }
+  return (
+    // Wide tables scroll inside their own box rather than pushing the page
+    // sideways — a DID column is wider than any pane.
+    <div style={{ overflowX: "auto" }}>
+      <table
+        style={{
+          borderCollapse: "collapse",
+          width: "100%",
+          // A floor, not a width. Without it a wide cell — a destructive
+          // preview opening inside the actions column — steals space from
+          // the identifier columns and wraps DIDs mid-token. The container
+          // scrolls instead, which is the tradeoff already chosen above.
+          minWidth: 760,
+          fontSize: t.sm,
+        }}
+      >
+        <thead>
+          <tr>
+            {columns.map((col) => (
+              <th
+                key={col.key}
+                style={{
+                  textAlign: "left",
+                  padding: "6px 12px 6px 0",
+                  borderBottom: `1px solid ${c.line}`,
+                  color: c.faint,
+                  fontSize: t.xs,
+                  textTransform: "uppercase",
+                  letterSpacing: 0.4,
+                  fontWeight: 640,
+                  whiteSpace: "nowrap",
+                  ...(col.width ? { width: col.width } : {}),
+                }}
+              >
+                {col.header}
+              </th>
+            ))}
+          </tr>
+        </thead>
+        <tbody>
+          {rows.map((row) => {
+            const detail = expanded?.(row) ?? null;
+            return (
+              <Fragment key={rowKey(row)}>
+                <tr>
+                  {columns.map((col) => (
+                    <td
+                      key={col.key}
+                      style={{
+                        padding: "7px 12px 7px 0",
+                        // No bottom rule when a detail follows: the row and its
+                        // detail are one thing, and a line between them reads
+                        // as two.
+                        ...(detail ? {} : { borderBottom: `1px solid ${c.lineSoft}` }),
+                        verticalAlign: "top",
+                      }}
+                    >
+                      {col.render(row)}
+                    </td>
+                  ))}
+                </tr>
+                {detail && (
+                  <tr>
+                    <td
+                      colSpan={columns.length}
+                      style={{
+                        padding: "0 12px 14px 0",
+                        borderBottom: `1px solid ${c.lineSoft}`,
+                      }}
+                    >
+                      {detail}
+                    </td>
+                  </tr>
+                )}
+              </Fragment>
+            );
+          })}
+        </tbody>
+      </table>
+    </div>
+  );
+}
+
+/** The agent is being asked. Distinct from "answered with nothing". */
+export function Loading({ what }: { what: string }) {
+  return <div style={{ fontSize: t.sm, color: c.faint, padding: "10px 0" }}>Reading {what}…</div>;
+}
+
+/**
+ * The agent refused, or could not be reached.
+ *
+ * Rendered as a note rather than an empty list, because the two mean opposite
+ * things: "you have none" and "we could not find out" are different answers,
+ * and only one of them should stop an operator worrying.
+ */
+export function LoadError({ what, error }: { what: string; error: string }) {
+  return (
+    <Note tone="danger">
+      Your agent would not return {what} — {error}
+    </Note>
+  );
+}
+
+/**
+ * A page that stopped early.
+ *
+ * Worth its own component because the failure it prevents is specific: an
+ * operator reading "nothing else happened" off a truncated list. `auditList`'s
+ * own documentation is explicit that this is what an audit trail exists to
+ * prevent.
+ */
+export function Truncated({ what, onMore }: { what: string; onMore?: () => void }) {
+  return (
+    <Note tone="warn">
+      This is not all of {what} — your agent stopped early.{" "}
+      {onMore ? (
+        <button
+          onClick={onMore}
+          style={{
+            border: "none",
+            background: "none",
+            padding: 0,
+            color: c.accent,
+            cursor: "pointer",
+            font: "inherit",
+            textDecoration: "underline",
+          }}
+        >
+          Load more
+        </button>
+      ) : (
+        "Narrow the filters to see the rest."
+      )}
+    </Note>
+  );
+}
+
+/** A redaction list from the agent, shown rather than silently ignored — a
+ *  field the agent withheld is not a field that is absent. */
+export function Redacted({ fields }: { fields: string[] }) {
+  if (fields.length === 0) return null;
+  return (
+    <Note tone="warn">
+      Your agent withheld {fields.join(", ")} from this answer. What you see is complete except
+      for those.
+    </Note>
+  );
+}
diff --git a/packages/extension/src/manager/use-async.ts b/packages/extension/src/manager/use-async.ts
new file mode 100644
index 0000000..368cab2
--- /dev/null
+++ b/packages/extension/src/manager/use-async.ts
@@ -0,0 +1,59 @@
+// One fetch-and-reload hook for the panes.
+//
+// The three states are kept separate on purpose — see `table.tsx`. `data`
+// stays `null` until the agent answers, so "not asked yet" and "answered with
+// an empty list" are never the same value; a pane that defaulted `data` to `[]`
+// would render its empty state during the first load and tell the operator they
+// have no keys before anyone had asked.
+
+import { useCallback, useEffect, useState } from "react";
+
+export interface Async<T> {
+  data: T | null;
+  loading: boolean;
+  error: string | null;
+  reload: () => void;
+}
+
+/**
+ * Run `fetcher` on mount and whenever `deps` change.
+ *
+ * `fetcher` must be stable or memoised by the caller; `deps` is what actually
+ * drives re-fetching, and in this console it is nearly always the selected
+ * context id — changing the compartment is what changes the question.
+ */
+export function useAsync<T>(fetcher: () => Promise<T>, deps: readonly unknown[]): Async<T> {
+  const [data, setData] = useState<T | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const [nonce, setNonce] = useState(0);
+
+  // eslint-disable-next-line react-hooks/exhaustive-deps
+  const run = useCallback(fetcher, deps);
+
+  useEffect(() => {
+    let live = true;
+    setLoading(true);
+    setError(null);
+    void run().then(
+      (value) => {
+        if (!live) return;
+        setData(value);
+        setLoading(false);
+      },
+      (e: unknown) => {
+        if (!live) return;
+        // The previous answer is deliberately kept. A refresh that fails should
+        // not blank a list the operator is reading — the error says the data is
+        // stale, which is more useful than an empty page that says nothing.
+        setError(e instanceof Error ? e.message : String(e));
+        setLoading(false);
+      },
+    );
+    return () => {
+      live = false;
+    };
+  }, [run, nonce]);
+
+  return { data, loading, error, reload: useCallback(() => setNonce((n) => n + 1), []) };
+}
diff --git a/packages/extension/src/manager/use-vta.ts b/packages/extension/src/manager/use-vta.ts
new file mode 100644
index 0000000..807729d
--- /dev/null
+++ b/packages/extension/src/manager/use-vta.ts
@@ -0,0 +1,108 @@
+/// <reference types="chrome" />
+
+// Which agent this console is administering, and what it may do there.
+//
+// Two separate questions, deliberately answered by two different places:
+//
+//  - **Which agent** comes from `chrome.storage.local` (`active-vta.ts`), the
+//    same connection record the popup and background read. The console does not
+//    get its own notion of "the active VTA"; a second one would drift.
+//
+//  - **What this caller may do** comes from the agent itself, via `whoAmI`, and
+//    is never inferred from anything stored locally. That is the whole point of
+//    the task: it re-resolves roles and scopes at call time rather than reading
+//    them out of an access token, so a role granted or revoked since the token
+//    was minted shows up immediately. A console that cached authority would
+//    show an operator buttons they can no longer use, and — worse — hide ones
+//    they just gained.
+
+import { useCallback, useEffect, useState } from "react";
+import type { TaskParty } from "@openvtc/pnm-core";
+import { whoAmI, type Session } from "@openvtc/pnm-core/admin";
+import { readActiveHolderDid, readActiveVtaDid } from "../active-vta.js";
+import { managerSender } from "./sender.js";
+
+/** The two DIDs an admin envelope names. See `TaskParty` in core for why this
+ *  is the whole of what the console needs — composing a document requires no
+ *  key material, and the console holds none. */
+export interface Parties {
+  holder: TaskParty;
+  service: TaskParty;
+}
+
+export interface Authority {
+  session: Session;
+  roles: string[];
+  scopes: string[];
+}
+
+export type VtaState =
+  | { status: "loading" }
+  /** No agent onboarded, or the connection record is gone. Not an error — a
+   *  fresh install looks exactly like this, and the console says so. */
+  | { status: "disconnected" }
+  | { status: "ready"; parties: Parties; authority: Authority | null; authorityError: string | null };
+
+/**
+ * Resolve the active agent and this caller's authority at it.
+ *
+ * `refreshAuthority` is exported deliberately: **every mutation calls it**. An
+ * `acl/change-role` or a `contexts/create` can change what the caller may do
+ * next, and the honest moment to find that out is immediately after the change,
+ * not on the next full page load.
+ */
+export function useVta(): VtaState & { refreshAuthority: () => Promise<void> } {
+  const [state, setState] = useState<VtaState>({ status: "loading" });
+
+  const loadAuthority = useCallback(async (parties: Parties) => {
+    try {
+      const authority = await whoAmI(managerSender, parties);
+      setState({ status: "ready", parties, authority, authorityError: null });
+    } catch (e) {
+      // An ACL rejection here is an *answer*, not a glitch: the caller really
+      // has no authority at this agent. Keep the console open and say so —
+      // blanking the page would leave an operator unable to see even which
+      // agent they are failing to reach.
+      setState({
+        status: "ready",
+        parties,
+        authority: null,
+        authorityError: e instanceof Error ? e.message : String(e),
+      });
+    }
+  }, []);
+
+  useEffect(() => {
+    void (async () => {
+      const [vtaDid, holderDid] = await Promise.all([readActiveVtaDid(), readActiveHolderDid()]);
+      if (!vtaDid || !holderDid) {
+        setState({ status: "disconnected" });
+        return;
+      }
+      const parties: Parties = { holder: { did: holderDid }, service: { did: vtaDid } };
+      setState({ status: "ready", parties, authority: null, authorityError: null });
+      await loadAuthority(parties);
+    })();
+  }, [loadAuthority]);
+
+  const refreshAuthority = useCallback(async () => {
+    if (state.status !== "ready") return;
+    await loadAuthority(state.parties);
+  }, [state, loadAuthority]);
+
+  return { ...state, refreshAuthority };
+}
+
+/**
+ * Whether the agent has told us this caller holds `role`.
+ *
+ * Used to *disable and explain*, never to hide. A hidden control tells an
+ * operator their agent has no such feature; a disabled one with a reason tells
+ * them who to ask. And it is advisory in both cases — the agent's ACL is the
+ * only authority that decides, and it decides again on every task regardless of
+ * what this returns.
+ */
+export function hasRole(authority: Authority | null, ...roles: string[]): boolean {
+  if (!authority) return false;
+  return roles.some((r) => authority.roles.includes(r));
+}
diff --git a/packages/extension/src/manager/whoami-banner.tsx b/packages/extension/src/manager/whoami-banner.tsx
new file mode 100644
index 0000000..3b93fc4
--- /dev/null
+++ b/packages/extension/src/manager/whoami-banner.tsx
@@ -0,0 +1,190 @@
+// Who this console is, to this agent.
+//
+// Always visible, and refetched after every mutation. `whoAmI` re-resolves
+// roles and scopes at call time rather than reading them out of the access
+// token — a role change or a revocation since the token was minted is visible
+// immediately, and that is the only reason to call it at all. Pinning it to the
+// top of every pane means an operator never has to wonder which identity a
+// change they are about to make will be attributed to.
+
+import { Did, DidNamed, Pill } from "../ui.js";
+import { c, t } from "../theme.js";
+import { formatInstant } from "./format.js";
+import type { Authority } from "./use-vta.js";
+import { useAgentNames } from "../use-agent-names.js";
+import { displayAgentName, type AgentName } from "../agent-name.js";
+import { readAllVtaDids, setActiveVtaDid } from "../active-vta.js";
+import { useEffect, useState } from "react";
+
+function Field({ label, children }: { label: string; children: React.ReactNode }) {
+  return (
+    <div style={{ display: "grid", gap: 2, minWidth: 0 }}>
+      <span style={{ fontSize: t.xs, color: c.faint, textTransform: "uppercase", letterSpacing: 0.4 }}>
+        {label}
+      </span>
+      <span style={{ fontSize: t.sm, color: c.text, minWidth: 0 }}>{children}</span>
+    </div>
+  );
+}
+
+
+/**
+ * Switch the console to another onboarded agent.
+ *
+ * Only rendered where there is somewhere to switch *to* — one agent means no
+ * control, rather than a select with a single option that does nothing.
+ *
+ * **Switching reloads the page**, deliberately. Thirteen panes each hold their
+ * own fetched state, and propagating a change of agent through all of them is
+ * thirteen chances to leave one holding the previous agent's keys, credentials
+ * or ACL under the new agent's name in the header. That is not a stale-data
+ * annoyance — it is the console telling the operator something false about who
+ * they are administering, on the surface whose whole job is to answer that. A
+ * reload is provably clean and costs a second.
+ */
+function SwitchAgent({
+  current,
+  names,
+}: {
+  current: string;
+  names: Record<string, AgentName | undefined>;
+}) {
+  const [dids, setDids] = useState<string[]>([]);
+
+  useEffect(() => {
+    void readAllVtaDids().then(setDids);
+  }, []);
+
+  if (dids.length < 2) return null;
+
+  const label = (did: string) => {
+    const n = names[did];
+    if (n) return displayAgentName(n);
+    // No published name — the tail of a `did:webvh` is its host and label,
+    // which is the most recognisable part and is not a derived *name*: it is
+    // the identifier itself, shortened.
+    const tail = did.split(":").slice(-2).join(":");
+    return tail.length < did.length ? `…${tail}` : did;
+  };
+
+  return (
+    <select
+      value={current}
+      aria-label="Switch agent"
+      onChange={(e) => {
+        const next = e.target.value;
+        if (next === current) return;
+        void setActiveVtaDid(next).then((ok) => {
+          if (ok) window.location.reload();
+        });
+      }}
+      style={{
+        fontSize: t.xs,
+        color: c.muted,
+        background: c.ground,
+        border: `1px solid ${c.line}`,
+        borderRadius: "var(--w-r-sm)",
+        padding: "2px 6px",
+        maxWidth: 260,
+      }}
+    >
+      {dids.map((d) => (
+        <option key={d} value={d}>
+          {label(d)}
+        </option>
+      ))}
+    </select>
+  );
+}
+
+export function WhoamiBanner({
+  agentDid,
+  authority,
+  error,
+}: {
+  agentDid: string;
+  authority: Authority | null;
+  error: string | null;
+}) {
+  const agentNames = useAgentNames([agentDid]);
+
+  return (
+    <header
+      style={{
+        display: "flex",
+        alignItems: "center",
+        gap: 28,
+        flexWrap: "wrap",
+        padding: "12px 22px",
+        borderBottom: `1px solid ${c.line}`,
+        background: c.surface,
+      }}
+    >
+      <Field label="Agent">
+        {/* A name, where the agent publishes one.
+            `useAgentNames` reads `alsoKnownAs` off the DID document and
+            verifies it — it never derives a name from the DID's host or path.
+            That distinction is the whole point: a derived name is a guess
+            dressed as an identity, and this banner is the line an operator
+            reads to check they are administering the agent they think they
+            are. No claim, no name — the DID stands on its own, which is the
+            honest fallback rather than an inferred one. */}
+        <div style={{ display: "flex", alignItems: "baseline", gap: 10, flexWrap: "wrap" }}>
+          <DidNamed
+            value={agentDid}
+            verified
+            {...(agentNames[agentDid] ? { agentName: agentNames[agentDid] } : {})}
+          />
+          <SwitchAgent current={agentDid} names={agentNames} />
+        </div>
+      </Field>
+
+      {authority ? (
+        <>
+          <Field label="Acting as">
+            <Did value={authority.session.subject} />
+          </Field>
+          <Field label="Roles">
+            {authority.roles.length ? (
+              <span style={{ display: "inline-flex", gap: 5, flexWrap: "wrap" }}>
+                {authority.roles.map((r) => (
+                  <Pill key={r} tone="accent">
+                    {r}
+                  </Pill>
+                ))}
+              </span>
+            ) : (
+              // Not the same as "unknown". The agent answered, and the answer
+              // was none — so every manage-gated task below will be refused,
+              // and saying so here is cheaper than thirteen refusals.
+              <span style={{ color: c.warn }}>none held at this agent</span>
+            )}
+          </Field>
+          <Field label="Scopes">
+            <span style={{ color: c.muted }}>
+              {authority.scopes.length ? authority.scopes.join(" · ") : "—"}
+            </span>
+          </Field>
+          <Field label="Session expires">
+            <span style={{ color: c.muted }}>
+              {formatInstant(authority.session.expiresAt)}
+            </span>
+          </Field>
+        </>
+      ) : error ? (
+        // An ACL rejection is an answer: this caller's authority really is
+        // gone, or was never granted. Say which agent refused, and stop short
+        // of guessing why.
+        <Field label="Authority">
+          <span style={{ color: c.danger }}>
+            The agent would not introspect this session — {error}
+          </span>
+        </Field>
+      ) : (
+        <Field label="Authority">
+          <span style={{ color: c.faint }}>resolving…</span>
+        </Field>
+      )}
+    </header>
+  );
+}
diff --git a/packages/extension/src/offscreen.ts b/packages/extension/src/offscreen.ts
index fcc59ef..5286378 100644
--- a/packages/extension/src/offscreen.ts
+++ b/packages/extension/src/offscreen.ts
@@ -1152,7 +1152,10 @@ async function doRequestTask(req: OffscreenRequestTaskRequest) {
     payload: req.params.payload,
     holderDid: holder.did,
     vtaDid: req.vtaDid,
-    origin: req.origin,
+    // Spread rather than passing `undefined`: `requestTask` stamps
+    // `payload.ext` only when an origin is present, and the management console
+    // deliberately supplies none. See `OffscreenRequestTaskRequest.origin`.
+    ...(req.origin ? { origin: req.origin } : {}),
   });
   // Same-browser approver: if this VTA has a local approver identity, surface
   // the ceremony right here on the rejection and relay the signed decision over
diff --git a/packages/extension/src/popup.tsx b/packages/extension/src/popup.tsx
index c28d3a4..34cbff6 100644
--- a/packages/extension/src/popup.tsx
+++ b/packages/extension/src/popup.tsx
@@ -433,6 +433,36 @@ function ConnectedView({
         Role: <b>{connection.role}</b> &nbsp;·&nbsp; Transports: <b>{transports || "—"}</b>
       </div>
 
+      {/* The management console, for the VTA this popup is connected to.
+          It already had an entry point on the options page and none here,
+          which is the wrong way round: this is the surface that tells you
+          which agent you are talking to, so it is where "and now go
+          administer it" belongs.
+
+          A tab, not a pane. Opening it closes the popup — which is the
+          point rather than a cost: the console is a working surface with a
+          context tree and thirteen panes, and a 400px popup that vanishes
+          when it loses focus is no place to destroy a context from.
+
+          Deliberately not role-gated. Several panes are readable at any
+          role, and the console already refuses what the caller may not do,
+          with the reason on the control rather than by hiding it. Gating
+          here would hide the readable half from everyone else.
+
+          This adds no admin code to the popup bundle — it opens a URL. The
+          CI guard that keeps `pnm-core/admin` out of every wallet surface
+          is unaffected, and still passes. */}
+      <button
+        onClick={() => void chrome.tabs.create({ url: chrome.runtime.getURL("manager.html") })}
+        style={{ marginTop: 8 }}
+      >
+        Manage this agent ↗
+      </button>
+      <small style={{ color: "var(--w-muted)" }}>
+        Opens the management console in a new tab — contexts, keys, credentials,
+        access and audit for this VTA.
+      </small>
+
       {encryptOn && (
         <>
           <button onClick={() => void lockWallet()} disabled={lockBusy} style={{ marginTop: 8 }}>
diff --git a/packages/extension/tests/manager-context-tree.test.mts b/packages/extension/tests/manager-context-tree.test.mts
new file mode 100644
index 0000000..7180dd5
--- /dev/null
+++ b/packages/extension/tests/manager-context-tree.test.mts
@@ -0,0 +1,115 @@
+// The context tree — and specifically, that an unreachable parent does not
+// swallow its children.
+//
+// A caller sees the contexts their ACL entries reach, and those entries are not
+// obliged to cover a whole subtree: `work/eng` can be granted without `work`.
+// The obvious tree build (index by id, attach to `byId[parent]`, keep what
+// attached) drops exactly those children, and does it invisibly — the console
+// renders a shorter, entirely plausible tree and the operator concludes they
+// have no access to a context they are in fact administering.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  buildContextTree,
+  flattenContextTree,
+  type ContextNode,
+} from "../src/manager/context-tree.ts";
+import type { ContextRecord } from "@openvtc/pnm-core";
+
+const ctx = (
+  id: string,
+  extra: Partial<ContextRecord> = {},
+): ContextRecord => ({
+  id,
+  name: id,
+  did: null,
+  description: null,
+  basePath: id,
+  createdAt: "2026-01-01T00:00:00Z",
+  updatedAt: "2026-01-01T00:00:00Z",
+  ...extra,
+});
+
+/** Ids in depth-first order, with placeholders shown as `?name`. */
+function shape(nodes: ContextNode[]): string[] {
+  const out: string[] = [];
+  const walk = (n: ContextNode, depth: number) => {
+    out.push(`${"  ".repeat(depth)}${n.record ? n.id : `?${n.name}`}`);
+    for (const c of n.children) walk(c, depth + 1);
+  };
+  for (const n of nodes) walk(n, 0);
+  return out;
+}
+
+test("nests children under the parent they name", () => {
+  const tree = buildContextTree([
+    ctx("work"),
+    ctx("eng", { parent: "work", basePath: "work/eng" }),
+    ctx("payroll", { parent: "work", basePath: "work/payroll" }),
+    ctx("personal"),
+  ]);
+  assert.deepEqual(shape(tree), ["personal", "work", "  eng", "  payroll"]);
+});
+
+test("a child whose parent is not visible is still shown", () => {
+  // The caller administers work/eng but holds no grant on work itself.
+  const tree = buildContextTree([ctx("eng", { parent: "work", basePath: "work/eng" })]);
+  assert.deepEqual(
+    shape(tree),
+    ["?work", "  eng"],
+    "the reachable child was dropped along with its unreachable parent",
+  );
+});
+
+test("siblings under one unreachable parent share a single placeholder", () => {
+  const tree = buildContextTree([
+    ctx("eng", { parent: "work", basePath: "work/eng" }),
+    ctx("payroll", { parent: "work", basePath: "work/payroll" }),
+  ]);
+  assert.deepEqual(shape(tree), ["?work", "  eng", "  payroll"]);
+});
+
+test("a placeholder carries no record, so nothing can be done to it", () => {
+  const [placeholder] = buildContextTree([ctx("eng", { parent: "work" })]);
+  assert.equal(placeholder!.record, undefined);
+  assert.equal(placeholder!.id, undefined, "a placeholder with an id would become selectable");
+});
+
+test("ordering is by name at every level, so the tree does not reshuffle", () => {
+  const tree = buildContextTree([
+    ctx("zeta"),
+    ctx("alpha"),
+    ctx("b", { parent: "alpha" }),
+    ctx("a", { parent: "alpha" }),
+  ]);
+  assert.deepEqual(shape(tree), ["alpha", "  a", "  b", "zeta"]);
+});
+
+test("a record with no name falls back to its id rather than rendering blank", () => {
+  const [node] = buildContextTree([ctx("work", { name: "" })]);
+  assert.equal(node!.name, "work");
+});
+
+test("collapsing hides descendants and nothing else", () => {
+  const tree = buildContextTree([
+    ctx("work"),
+    ctx("eng", { parent: "work" }),
+    ctx("personal"),
+  ]);
+  const rows = flattenContextTree(tree, new Set(["work"]));
+  assert.deepEqual(
+    rows.map((r) => r.node.id ?? `?${r.node.name}`),
+    ["personal", "work"],
+  );
+  assert.equal(rows.find((r) => r.node.id === "work")?.hasChildren, true);
+});
+
+test("an unreachable parent cannot be collapsed", () => {
+  // It has no id, so there is no key to put in the collapsed set — which is the
+  // point: hiding the placeholder would hide the reachable children it exists
+  // to reveal.
+  const tree = buildContextTree([ctx("eng", { parent: "work" })]);
+  const rows = flattenContextTree(tree, new Set(["work", "eng"]));
+  assert.deepEqual(rows.map((r) => r.node.id ?? `?${r.node.name}`), ["?work", "eng"]);
+});
diff --git a/packages/extension/tests/manager-form-state.test.mts b/packages/extension/tests/manager-form-state.test.mts
new file mode 100644
index 0000000..54aabef
--- /dev/null
+++ b/packages/extension/tests/manager-form-state.test.mts
@@ -0,0 +1,129 @@
+// A form seeded from a prop must be keyed on that prop's identity.
+//
+// ## The bug this exists for
+//
+// `EditContext` seeds its fields with `useState(record.name)`. That runs on
+// mount and never again. The context detail panel is a *single* instance that
+// swaps records as the operator moves through the tree, so React reused it —
+// and every context showed the FIRST context's name, in an editable field,
+// sitting directly above the correct id, DID and timestamps.
+//
+// It reads as a display glitch and is not one. The field is the input to
+// `contextsUpdate`, so an operator pressing Save would have renamed the context
+// they were looking at to the name of one they were not — a write, from a
+// screen that showed them the right record everywhere else.
+//
+// Nothing could have caught it. It typechecks, every unit test passes, and the
+// panel renders perfectly for whichever context you happen to open first.
+//
+// ## The rule
+//
+// If a component seeds state from a prop, its call sites must either pass
+// `key`, or be listed in [`KEYED_ELSEWHERE`] with the reason. There is one
+// legitimate reason today: `Table` renders per-row editors under `rowKey`, so
+// the key is already on the row.
+//
+// Source-level, because the alternative is a DOM and a render loop to catch a
+// bug whose whole nature is that it looks fine on first render.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = fileURLToPath(new URL("../src/manager", import.meta.url));
+
+/**
+ * Components whose call sites need no explicit `key`, with the reason.
+ *
+ * An entry is a claim that something else already establishes identity — not
+ * that adding a key is inconvenient.
+ */
+const KEYED_ELSEWHERE: Record<string, string> = {
+  RenameKey: "rendered per row by `Table`, which keys each <tr> on rowKey",
+  ChangeRole: "rendered per row by `Table`, which keys each <tr> on rowKey",
+};
+
+const files = (dir: string): string[] =>
+  readdirSync(dir, { withFileTypes: true }).flatMap((e) =>
+    e.isDirectory()
+      ? files(join(dir, e.name))
+      : /\.tsx?$/.test(e.name)
+        ? [join(dir, e.name)]
+        : [],
+  );
+
+const sources = files(ROOT).map((f) => ({ rel: f.slice(ROOT.length + 1), src: readFileSync(f, "utf8") }));
+
+/** Components that seed state from one of their props. */
+function seededComponents(): { name: string; where: string }[] {
+  const found: { name: string; where: string }[] = [];
+  for (const { rel, src } of sources) {
+    // `function Name({ a, b }: {...}) {`  … then `useState(a.something)`
+    for (const m of src.matchAll(/function ([A-Z][A-Za-z0-9]*)\(\{([^}]*)\}/g)) {
+      const name = m[1] as string;
+      const props = (m[2] as string)
+        .split(",")
+        .map((p) => p.trim().split(/[:=]/)[0]!.trim())
+        .filter(Boolean);
+      // Scope stops at the NEXT top-level declaration, and that has to include
+      // `export function` — stopping only at `\nfunction ` let one component's
+      // scope run past its own closing brace into a sibling's `useState`, and
+      // report a component with no state at all. A guard that cries wolf is one
+      // people learn to skip.
+      const body = src.slice(m.index + m[0].length);
+      const end = body.search(/\n(?:export )?function /);
+      const scope = end === -1 ? body : body.slice(0, end);
+      const seeds = props.some((p) =>
+        new RegExp(`useState\\(\\s*${p}\\.`).test(scope) || new RegExp(`useState\\(\\s*${p}\\?\\.`).test(scope),
+      );
+      if (seeds) found.push({ name, where: rel });
+    }
+  }
+  return found;
+}
+
+test("the sweep finds the components it is meant to, so it cannot pass vacuously", () => {
+  const names = seededComponents().map((c) => c.name);
+  assert.ok(
+    names.includes("EditContext"),
+    `did not find EditContext among prop-seeded components (${names.join(", ") || "none"}) — ` +
+      `the pattern match is stale and this test now checks nothing`,
+  );
+});
+
+test("every prop-seeded form is keyed at its call site", () => {
+  const offenders: string[] = [];
+
+  for (const { name } of seededComponents()) {
+    if (name in KEYED_ELSEWHERE) continue;
+    for (const { rel, src } of sources) {
+      for (const m of src.matchAll(new RegExp(`<${name}\\b[\\s\\S]{0,400}?/?>`, "g"))) {
+        if (!/\bkey=/.test(m[0])) offenders.push(`${name}  (rendered in ${rel})`);
+      }
+    }
+  }
+
+  assert.deepEqual(
+    [...new Set(offenders)].sort(),
+    [],
+    `these components seed state from a prop and are rendered without a \`key\`:\n  ` +
+      `${[...new Set(offenders)].join("\n  ")}\n\n` +
+      `\`useState(prop.field)\` runs on mount and never again, so React reuses the ` +
+      `instance when the prop changes and the form keeps showing — and saving — the ` +
+      `previous record's values. Pass \`key={record.id}\`, or add the component to ` +
+      `KEYED_ELSEWHERE if something else already establishes identity.`,
+  );
+});
+
+test("every KEYED_ELSEWHERE entry still names a prop-seeded component", () => {
+  const names = new Set(seededComponents().map((c) => c.name));
+  const stale = Object.keys(KEYED_ELSEWHERE).filter((n) => !names.has(n));
+  assert.deepEqual(
+    stale,
+    [],
+    `these exemptions no longer name a component that seeds state from a prop — ` +
+      `remove them: ${stale.join(", ")}`,
+  );
+});
diff --git a/packages/extension/tests/manager-sections.test.mts b/packages/extension/tests/manager-sections.test.mts
new file mode 100644
index 0000000..691062f
--- /dev/null
+++ b/packages/extension/tests/manager-sections.test.mts
@@ -0,0 +1,86 @@
+// Three lists describe the console's navigation, and they must agree.
+//
+// `SectionId` (the union), `ACTS` (what the nav renders), and the `switch` in
+// `renderPane` (what each id draws). Nothing forces them together: the union
+// makes the *switch* exhaustive, so a case cannot name an id that does not
+// exist — but neither the compiler nor any existing test notices an id that is
+// in the union and the nav and has **no case**.
+//
+// That is the asymmetry worth guarding. The failure is silent: the section
+// appears in the sidebar, the operator clicks it, and the pane renders nothing
+// at all. No error, no console message, no failed request — a blank column that
+// reads as "this agent has none of those" rather than as a bug. It is the same
+// shape as the pane that died on an `unknown field` error, except quieter,
+// because at least that one said something.
+//
+// Reads the source rather than importing it: `shell.tsx` pulls in every pane,
+// and those reach `chrome` at module scope. Same approach as
+// `manager-surface.test.mts`, for the same reason.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const SRC = readFileSync(
+  fileURLToPath(new URL("../src/manager/shell.tsx", import.meta.url)),
+  "utf8",
+);
+
+const all = (re: RegExp) => [...SRC.matchAll(re)].map((m) => m[1] as string);
+
+/** The `SectionId` union members. */
+const union = () => {
+  const block = /export type SectionId =([\s\S]*?);/.exec(SRC);
+  assert.ok(block, "could not find the SectionId union — has it been renamed?");
+  return [...block[1]!.matchAll(/"([a-z-]+)"/g)].map((m) => m[1] as string);
+};
+
+/** What the nav renders. */
+const sections = () => all(/\{\s*id:\s*"([a-z-]+)",\s*label:/g);
+
+/** What `renderPane` draws. */
+const cases = () => all(/^\s+case "([a-z-]+)":/gm);
+
+const sorted = (xs: string[]) => [...xs].sort();
+
+test("the section list is not empty, so none of this passes vacuously", () => {
+  assert.ok(sections().length > 8, `found only ${sections().length} sections — the regex is stale`);
+  assert.ok(cases().length > 8, `found only ${cases().length} cases — the regex is stale`);
+});
+
+test("every section the nav renders has a pane to draw", () => {
+  const missing = sections().filter((id) => !cases().includes(id));
+  assert.deepEqual(
+    missing,
+    [],
+    `these sections appear in the sidebar and render nothing when clicked: ${missing.join(", ")}. ` +
+      `The union makes the switch exhaustive over ids that EXIST, so nothing else catches an id ` +
+      `that was added to the nav without a case.`,
+  );
+});
+
+test("every pane is reachable from the nav", () => {
+  const orphaned = cases().filter((id) => !sections().includes(id));
+  assert.deepEqual(
+    orphaned,
+    [],
+    `these panes can never be shown, because no section selects them: ${orphaned.join(", ")}. ` +
+      `Either add the section or delete the pane — a pane nothing routes to is code that ` +
+      `reads as live and is not.`,
+  );
+});
+
+test("the union, the nav and the switch name the same set", () => {
+  assert.deepEqual(sorted(union()), sorted(sections()), "SectionId and the nav disagree");
+  assert.deepEqual(sorted(union()), sorted(cases()), "SectionId and renderPane disagree");
+});
+
+test("no section id is declared twice", () => {
+  const seen = sections();
+  assert.equal(
+    new Set(seen).size,
+    seen.length,
+    `a duplicate section id renders two identical-looking entries and the second is unreachable: ${seen.join(", ")}`,
+  );
+});
diff --git a/packages/extension/tests/manager-sender.test.mts b/packages/extension/tests/manager-sender.test.mts
new file mode 100644
index 0000000..da0c106
--- /dev/null
+++ b/packages/extension/tests/manager-sender.test.mts
@@ -0,0 +1,149 @@
+// What crosses the bridge when the console runs an admin task, and what must
+// not.
+//
+// The console composes admin tasks with the `@openvtc/pnm-core/admin` helpers,
+// which build a canonical envelope and hand it to `sender.send`. That envelope
+// is a **carrier**: only its `type` and `payload` may travel. The device mints
+// the real one — id, issuedAt, issuer, recipient — inside the wallet's trust
+// boundary, and the channel signs it.
+//
+// If the carrier's parties ever reach the wire, the wallet is signing a
+// document composed somewhere else and attesting to fields it never checked.
+// That the composer is an extension page rather than a web page does not change
+// what the signature would be claiming — which is why this is pinned here,
+// rather than left resting on the fact that today's background handler happens
+// to ignore them.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  ConsentRequiredError,
+  carrierParams,
+  interpretOutcome,
+} from "../src/manager/carrier.ts";
+
+/** A carrier with every authority-bearing field populated, and deliberately
+ *  populated *wrongly* — if any of it survives, the assertions say which. */
+const carrier = {
+  id: "urn:uuid:carrier-chosen-id",
+  type: "https://trusttasks.org/spec/acl/grant/0.1",
+  issuer: "did:key:zATTACKER",
+  recipient: "did:key:zSOMEONE-ELSES-AGENT",
+  issuedAt: "1999-01-01T00:00:00Z",
+  expiresAt: "2999-01-01T00:00:00Z",
+  threadId: "urn:uuid:carrier-chosen-thread",
+  payload: { entry: { subject: "did:key:zSUBJECT", role: "admin" } },
+};
+
+test("keeps the task type and payload", () => {
+  assert.deepEqual(carrierParams(carrier), {
+    type: carrier.type,
+    payload: carrier.payload,
+  });
+});
+
+test("drops every authority-bearing field", () => {
+  const wire = JSON.stringify(carrierParams(carrier));
+  for (const forged of [
+    carrier.id,
+    carrier.issuer,
+    carrier.recipient,
+    carrier.issuedAt,
+    carrier.expiresAt,
+    carrier.threadId,
+  ]) {
+    assert.ok(
+      !wire.includes(forged),
+      `the carrier's "${forged}" survived. Only type and payload may travel — the device ` +
+        "mints the envelope, and a wallet that signs a document composed elsewhere " +
+        "attests to fields it never checked.",
+    );
+  }
+  // Stated positively too, so a future member added to `TrustTask` is caught by
+  // shape rather than by having been listed above.
+  assert.deepEqual(Object.keys(carrierParams(carrier)).sort(), ["payload", "type"]);
+});
+
+test("an absent payload becomes an empty object, not undefined", () => {
+  // `auth/whoami` and friends legitimately send `{}`. Relaying `undefined`
+  // reaches the agent as a missing member and fails schema validation for no
+  // visible reason.
+  assert.deepEqual(carrierParams({ ...carrier, payload: undefined }).payload, {});
+});
+
+test("an accepted outcome yields the agent's result, unwrapped", () => {
+  const res = interpretOutcome<{ entries: number[] }>("t", "acl/list/0.1", {
+    ok: true,
+    result: { kind: "accepted", result: { entries: [1, 2, 3] } },
+  });
+  assert.deepEqual(res, { entries: [1, 2, 3] });
+});
+
+test("a consent refusal throws ConsentRequiredError with the digest intact", () => {
+  const err = (() => {
+    try {
+      interpretOutcome(carrier.type, "acl/grant/0.1", {
+        ok: true,
+        result: {
+          kind: "consentRequired",
+          payloadDigest: "abcdef0123456789",
+          challenge: "chal",
+          approverSet: "set-1",
+          minApprovals: 2,
+          consentRequests: [{ one: 1 }],
+        },
+      });
+      return null;
+    } catch (e) {
+      return e;
+    }
+  })();
+
+  assert.ok(
+    err instanceof ConsentRequiredError,
+    "a consent refusal must be its own class — caught as a plain Error it renders as a red " +
+      "string, discarding the ceremony at the moment the human was meant to act",
+  );
+  assert.equal(err.payloadDigest, "abcdef0123456789");
+  assert.equal(err.minApprovals, 2);
+  assert.equal(err.taskType, carrier.type);
+  assert.deepEqual(err.consentRequests, [{ one: 1 }]);
+});
+
+test("a consent refusal missing its digest still throws the ceremony class", () => {
+  // Degraded, not reclassified: the operator sees an empty match code and can
+  // tell something is wrong, rather than the refusal arriving as a red error
+  // that offers them nothing to do.
+  const err = (() => {
+    try {
+      interpretOutcome("t", "l", { ok: true, result: { kind: "consentRequired" } });
+      return null;
+    } catch (e) {
+      return e;
+    }
+  })();
+  assert.ok(err instanceof ConsentRequiredError);
+  assert.equal(err.payloadDigest, "");
+  assert.equal(err.minApprovals, 1, "a missing count must not read as zero approvals needed");
+});
+
+test("a failed relay throws, naming the operation", () => {
+  assert.throws(
+    () => interpretOutcome("t", "acl/grant/0.1", { ok: false, error: "no active connection" }),
+    /acl\/grant\/0\.1 failed: no active connection/,
+  );
+});
+
+test("an unrecognised outcome is reported, not returned as a result", () => {
+  // A relay that changed shape underneath this file. Returning it would hand a
+  // pane an object whose members all read undefined, which renders as a
+  // convincing empty result.
+  assert.throws(
+    () => interpretOutcome("t", "l", { ok: true, result: { kind: "somethingNew" } }),
+    /outcome this console does not understand/,
+  );
+});
+
+test("a reply with no result at all is reported rather than unwrapped", () => {
+  assert.throws(() => interpretOutcome("t", "l", { ok: true }), /does not understand/);
+});
diff --git a/packages/extension/tests/manager-step-up.test.mts b/packages/extension/tests/manager-step-up.test.mts
new file mode 100644
index 0000000..9c83d8c
--- /dev/null
+++ b/packages/extension/tests/manager-step-up.test.mts
@@ -0,0 +1,168 @@
+// The step-up is a gate, not a formality.
+//
+// Everything here is about one failure mode: a step-up that quietly stops being
+// one. It does not break loudly — the prompt simply stops appearing, or appears
+// and is not waited for, and the console goes on looking exactly as it did. So
+// each property is pinned rather than left to review.
+//
+// `requirePresence` is exercised against a stubbed `navigator.credentials`,
+// which is the only way to assert *that a ceremony ran* rather than that a
+// function returned. The real one needs a visible page and a human.
+
+import { test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+// Comments stripped before scanning. The module *discusses* the PRF ceremony
+// at length — explaining why it deliberately does not reuse it — and a check
+// that matched prose would fail on the very paragraph documenting the refusal,
+// teaching the next person to delete the explanation to get green.
+const SRC = readFileSync(
+  fileURLToPath(new URL("../src/manager/step-up.ts", import.meta.url)),
+  "utf8",
+)
+  .replace(/\/\*[\s\S]*?\*\//g, "")
+  .replace(/^\s*\/\/.*$/gm, "");
+
+interface GetCall {
+  challenge: Uint8Array;
+  userVerification: string | undefined;
+  extensions: unknown;
+}
+
+let calls: GetCall[] = [];
+let behaviour: () => unknown = () => ({ id: "cred" });
+
+let savedNavigator: PropertyDescriptor | undefined;
+let savedIndexedDB: PropertyDescriptor | undefined;
+
+const define = (name: string, value: unknown) =>
+  Object.defineProperty(globalThis, name, { value, configurable: true, writable: true });
+
+const restore = (name: string, desc: PropertyDescriptor | undefined) => {
+  if (desc) Object.defineProperty(globalThis, name, desc);
+  else delete (globalThis as Record<string, unknown>)[name];
+};
+
+beforeEach(() => {
+  calls = [];
+  behaviour = () => ({ id: "cred" });
+  savedNavigator = Object.getOwnPropertyDescriptor(globalThis, "navigator");
+  savedIndexedDB = Object.getOwnPropertyDescriptor(globalThis, "indexedDB");
+  // `navigator` is an accessor on the Node global, so a plain assignment
+  // throws. Redefining is what a stub needs, and it is restored in afterEach.
+  define("navigator", {
+    credentials: {
+      get: async (opts: { publicKey: Record<string, unknown> }) => {
+        calls.push({
+          challenge: opts.publicKey.challenge as Uint8Array,
+          userVerification: opts.publicKey.userVerification as string | undefined,
+          extensions: opts.publicKey.extensions,
+        });
+        return behaviour();
+      },
+    },
+  });
+  // No IndexedDB in Node: the credential lookup misses, which is the
+  // not-enrolled path. Presence must still be askable there — see the module's
+  // note on why enrolment and presence are different questions.
+  define("indexedDB", undefined);
+});
+
+afterEach(() => {
+  restore("navigator", savedNavigator);
+  restore("indexedDB", savedIndexedDB);
+});
+
+const load = async () => await import("../src/manager/step-up.ts");
+
+test("a completed assertion resolves, and it actually ran one", async () => {
+  const { requirePresence } = await load();
+  await requirePresence("ext-id", "abort a backup bundle");
+  assert.equal(calls.length, 1, "requirePresence must run a WebAuthn assertion");
+});
+
+test("every call runs a fresh assertion — a prior one does not satisfy the next", async () => {
+  const { requirePresence } = await load();
+  await requirePresence("ext-id", "first");
+  await requirePresence("ext-id", "second");
+  assert.equal(
+    calls.length,
+    2,
+    "the second call reused the first — a step-up satisfied by an earlier one is not a step-up",
+  );
+  assert.notDeepEqual(
+    Array.from(calls[0]!.challenge),
+    Array.from(calls[1]!.challenge),
+    "the challenge must be fresh per call, or the ceremony is replayable",
+  );
+});
+
+test("it demands user verification, not a bare touch", async () => {
+  const { requirePresence } = await load();
+  await requirePresence("ext-id", "reload services");
+  assert.equal(
+    calls[0]!.userVerification,
+    "required",
+    "a step-up that accepts presence alone is satisfiable by anyone at the machine",
+  );
+});
+
+test("it asks for no PRF output — there is nothing to return and nothing to leak", async () => {
+  const { requirePresence } = await load();
+  await requirePresence("ext-id", "abort");
+  const ext = calls[0]!.extensions as Record<string, unknown> | undefined;
+  assert.ok(
+    ext === undefined || !("prf" in ext),
+    "the presence check must not evaluate PRF: that output is the AES key root, " +
+      "and a caller wanting a boolean would end up holding key material",
+  );
+});
+
+test("a dismissed prompt aborts, and reports as cancelled rather than as a fault", async () => {
+  const { requirePresence, StepUpError } = await load();
+  behaviour = () => {
+    throw new DOMException("The operation either timed out or was not allowed.", "NotAllowedError");
+  };
+  await assert.rejects(
+    () => requirePresence("ext-id", "abort"),
+    (e: unknown) => {
+      assert.ok(e instanceof StepUpError);
+      assert.equal(
+        (e as InstanceType<typeof StepUpError>).reason,
+        "cancelled",
+        "a dismissal is a decision, not an error to shout about",
+      );
+      return true;
+    },
+  );
+});
+
+test("a null credential is refused rather than read as success", async () => {
+  const { requirePresence, StepUpError } = await load();
+  behaviour = () => null;
+  await assert.rejects(
+    () => requirePresence("ext-id", "abort"),
+    (e: unknown) => {
+      assert.ok(e instanceof StepUpError);
+      assert.equal((e as InstanceType<typeof StepUpError>).reason, "no-authenticator");
+      return true;
+    },
+  );
+});
+
+// A source-level check, because the defect it guards against is an *absence*
+// that no runtime assertion can see: a cache added later would make the tests
+// above pass on their first call and stop the prompt appearing on every one
+// after. Naming the symbols keeps the refusal legible at the place someone
+// would reach for them.
+test("the module consults no unlock or session state", async () => {
+  for (const forbidden of ["cachedKey", "isUnlocked", "sessionStorage", "runPrfUnlockCeremony"]) {
+    assert.ok(
+      !SRC.includes(forbidden),
+      `step-up.ts references \`${forbidden}\` — a step-up must not be satisfiable by ` +
+        `an earlier unlock, and reading session state is how that arrives`,
+    );
+  }
+});
diff --git a/packages/extension/tests/manager-surface.test.mts b/packages/extension/tests/manager-surface.test.mts
new file mode 100644
index 0000000..511f7ad
--- /dev/null
+++ b/packages/extension/tests/manager-surface.test.mts
@@ -0,0 +1,141 @@
+// The management console's relay must not be reachable from a web page.
+//
+// `RUNTIME_MANAGER_TASK` runs admin tasks — granting authority at an agent,
+// revoking it, destroying contexts — and, unlike the page-facing relay, it does
+// not stop to ask a human first. Two things keep a page away from it, and
+// neither fails loudly on its own:
+//
+//  1. It must be absent from `PAGE_FACING_RUNTIME_TYPES`. Membership there is
+//     not a permission grant, but it is the list that says "a page originates
+//     this", and adding it would be the first step of treating it that way.
+//  2. It must be absent from `content.ts`'s dispatch table, which is the only
+//     bridge a page has. The content script inlines its constants by hand (it
+//     bundles as a classic script and cannot import), so nothing but a test
+//     notices a new entry.
+//
+// And the background must gate on the sender being an extension page: every
+// content script carries this extension's id, so `sender.id` cannot separate
+// them and `sender.url` is what does.
+//
+// Reads the sources rather than importing them, the way
+// `page-facing-surface.test.mts` does — `content.ts` touches `chrome` at module
+// scope and `background.ts` registers listeners on import.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const src = (name: string) =>
+  readFileSync(fileURLToPath(new URL(`../src/${name}`, import.meta.url)), "utf8");
+
+const protocol = src("bridge-protocol.ts");
+const content = src("content.ts");
+const background = src("background.ts");
+
+/** The literal wire value, so the assertions below check the string a message
+ *  actually carries rather than the identifier naming it. */
+const MANAGER_TYPE = "vta-wallet/manager-task";
+
+test("the console's wire type is what bridge-protocol declares", () => {
+  assert.match(
+    protocol,
+    new RegExp(`export const RUNTIME_MANAGER_TASK =\\s*"${MANAGER_TYPE}"`),
+    "RUNTIME_MANAGER_TASK's value changed — every assertion here reads the literal, " +
+      "and the console and background must agree on it",
+  );
+});
+
+test("the console's relay is not page-facing", () => {
+  const m = /export const PAGE_FACING_RUNTIME_TYPES = \[([^\]]*)\]/.exec(protocol);
+  assert.ok(m, "PAGE_FACING_RUNTIME_TYPES not found — this test is reading the wrong shape");
+  const members = m[1]!
+    .split(",")
+    .map((s) => s.replace(/\/\/.*$/gm, "").trim())
+    .filter(Boolean);
+  assert.ok(
+    !members.includes("RUNTIME_MANAGER_TASK"),
+    "RUNTIME_MANAGER_TASK is listed as page-facing. That list is for messages a web page " +
+      "originates; the console's relay runs admin tasks without a per-call human check, " +
+      "and no page may originate one.",
+  );
+});
+
+test("the content script cannot route to the console's relay", () => {
+  assert.ok(
+    !content.includes(MANAGER_TYPE),
+    `content.ts mentions ${MANAGER_TYPE}. The content script is the only bridge a web page ` +
+      "has; a route to the console's relay there hands an arbitrary page the operator's " +
+      "authority.",
+  );
+});
+
+test("the background gates the console's relay on an extension-page sender", () => {
+  // The gate's substance, not its spelling: `sender.id` is true for a content
+  // script too, so the check that matters is against the extension's own URL.
+  assert.match(
+    background,
+    /function isExtensionPageSender\([\s\S]{0,400}?chrome\.runtime\.getURL\(""\)[\s\S]{0,200}?sender\.url[\s\S]{0,80}?startsWith/,
+    "isExtensionPageSender no longer compares sender.url against chrome.runtime.getURL(\"\"). " +
+      "sender.id is shared with every content script and cannot make this distinction.",
+  );
+
+  // …and that the gate is actually applied to this message type, before the
+  // handler runs. An unguarded branch is the failure this whole file exists for.
+  const branch =
+    /RUNTIME_MANAGER_TASK\)\s*\{([\s\S]*?)handleManagerTask/.exec(background);
+  assert.ok(branch, "no dispatch branch for RUNTIME_MANAGER_TASK found in background.ts");
+  assert.match(
+    branch[1]!,
+    /if \(!isExtensionPageSender\(sender\)\)/,
+    "the RUNTIME_MANAGER_TASK branch reaches handleManagerTask without checking " +
+      "isExtensionPageSender first",
+  );
+});
+
+test("the console's relay does not carry a page origin", () => {
+  // `RuntimeRequestTaskRequest` has an `origin` member because a page proposed
+  // the task and the browser's attested origin has to travel with it. The
+  // console's request must NOT: there is no page, and a member here would be a
+  // value the background could read instead of stamping its own.
+  const m = /export interface RuntimeManagerTaskRequest \{([\s\S]*?)\}/.exec(protocol);
+  assert.ok(m, "RuntimeManagerTaskRequest not found");
+  assert.ok(
+    !/\borigin\b/.test(m[1]!),
+    "RuntimeManagerTaskRequest carries an `origin`. The console has no page origin to " +
+      "report; the background stamps the extension's own, and a member here is a claim " +
+      "waiting to be trusted.",
+  );
+});
+
+test("the console does not invent an origin for the task it relays", () => {
+  // `requestTask` stamps `payload.ext["openvtc.origin"]` only when given an
+  // origin, and its contract says a caller without an attested one should omit
+  // it rather than invent one. The console has no proposing page.
+  //
+  // This is not stylistic. Stamping the extension's own origin put an `ext`
+  // member on every payload, and a live agent whose `acl/list` and
+  // `policy/list` structs have drifted from their schemas rejected the whole
+  // request — "unknown field `ext`" — taking out two panes entirely.
+  const handler = /async function handleManagerTask\([\s\S]*?\n\}/.exec(background);
+  assert.ok(handler, "handleManagerTask not found in background.ts");
+  assert.ok(
+    !/\borigin:/.test(handler[0]),
+    "handleManagerTask sets an `origin`. There is no proposing page to attest, and the " +
+      "stamp it produces lands in payload.ext, which some agent payload structs reject.",
+  );
+});
+
+test("the page-facing relay still carries its attested origin", () => {
+  // The guard above must not be read as "origin is optional now". The page
+  // path's whole security property is that the browser's origin travels with
+  // the proposal and ends up inside the payload digest a human approves.
+  const handler = /async function handleRequestTask\([\s\S]*?\n\}/.exec(background);
+  assert.ok(handler, "handleRequestTask not found in background.ts");
+  assert.match(
+    handler[0],
+    /origin: req\.origin/,
+    "handleRequestTask no longer forwards the attested origin — a page-proposed task would " +
+      "then be approved without the origin bound to its payload",
+  );
+});
diff --git a/packages/extension/vite.config.manager.ts b/packages/extension/vite.config.manager.ts
new file mode 100644
index 0000000..75e55e8
--- /dev/null
+++ b/packages/extension/vite.config.manager.ts
@@ -0,0 +1,51 @@
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+import wasm from "vite-plugin-wasm";
+import topLevelAwait from "vite-plugin-top-level-await";
+import { resolve } from "node:path";
+
+// Separate build for the management console — the one surface allowed to import
+// `@openvtc/pnm-core/admin`.
+//
+// That module is operator authority: granting it at an agent, revoking it,
+// destroying contexts. CI asserts no admin task URI appears anywhere in `dist/`
+// **except** `manager.js`, and this config is what makes that assertion
+// structural rather than a convention someone has to remember.
+//
+// Two properties do the work, and both would be lost by folding this entry into
+// `vite.config.ts`:
+//
+//  - **Its own Rollup graph.** The main build emits popup, options, confirm and
+//    offscreen together, and Rollup is free to hoist code they share into a
+//    common `assets/*.js` chunk. An admin symbol reaching such a chunk would
+//    land in a file the wallet's surfaces load. Building the console alone
+//    means there is no other entry to share with.
+//  - **`codeSplitting: false`.** One output file, so "which file may contain
+//    admin" has a single answer that a `grep` can check. If this option is ever
+//    lost the build emits extra chunks and the guard fails loudly — which is
+//    the point; the same option protects the service worker for a different
+//    reason (see `vite.config.background.ts`).
+//
+// `emptyOutDir: false` so it does not wipe the main build's output; it runs
+// after both other builds, and the manifest assembly that runs in the main
+// build has already happened by then.
+export default defineConfig({
+  plugins: [react(), wasm(), topLevelAwait()],
+  build: {
+    outDir: "dist",
+    emptyOutDir: false,
+    // es2022 — see vite.config.ts: esbuild 0.28 won't down-level the
+    // top-level-await plugin's destructuring to vite's default targets.
+    target: "es2022",
+    rollupOptions: {
+      input: { manager: resolve(__dirname, "manager.html") },
+      output: {
+        entryFileNames: "manager.js",
+        // Named so the guard can address it, and so a stray second chunk is
+        // visible as `assets/*` rather than hiding among the main build's.
+        chunkFileNames: "manager-split-[name].js",
+        codeSplitting: false,
+      },
+    },
+  },
+});