From d0aa56761a99c237b524d064c48e275dbdf19f5e Mon Sep 17 00:00:00 2001
From: Pitrick3141 <andy.yichenwang@gmail.com>
Date: Wed, 12 Aug 2026 16:53:54 +0800
Subject: [PATCH] feat(wallet): Enable local deletion for unusable identities

---
 apps/wallet/src/App.tsx                       | 18 +++++
 apps/wallet/src/components/IdentityCard.tsx   | 31 +++++---
 apps/wallet/src/components/IdentityDetail.tsx | 52 ++++++++++---
 apps/wallet/src/components/flows.tsx          | 73 +++++++++++++++++++
 .../src/lib/identity-capabilities.test.ts     | 14 ++++
 apps/wallet/src/lib/identity-capabilities.ts  | 15 ++++
 apps/wallet/src/lib/wallet-adapter.ts         |  4 +
 packages/wallet-core/src/types.ts             |  2 +
 packages/wallet-core/src/wallet-core.ts       | 55 ++++++++++++++
 packages/wallet-core/test/device-v2.test.ts   | 33 +++++++++
 packages/wallet-core/test/wallet-core.test.ts | 26 +++++++
 tests/browser-e2e/security.spec.ts            |  9 +++
 12 files changed, 311 insertions(+), 21 deletions(-)

diff --git a/apps/wallet/src/App.tsx b/apps/wallet/src/App.tsx
index 45e054b..bac4f76 100644
--- a/apps/wallet/src/App.tsx
+++ b/apps/wallet/src/App.tsx
@@ -31,6 +31,7 @@ import {
   ContinuityLinkModal,
   CreateIdentityModal,
   DisposeIdentityModal,
+  RemoveLocalIdentityModal,
   RotateIdentityModal,
 } from './components/flows';
 import {
@@ -64,6 +65,7 @@ type Flow =
       device: LocalIdentitySummary['issuedDevices'][number];
     }
   | { type: 'dispose'; identity: LocalIdentitySummary }
+  | { type: 'remove-local'; identity: LocalIdentitySummary }
   | { type: 'rotate'; identity: LocalIdentitySummary }
   | { type: 'continuity'; identity: LocalIdentitySummary };
 
@@ -169,6 +171,14 @@ function App() {
     });
   };
 
+  const removeLocalIdentity = async (identity: LocalIdentitySummary) => {
+    await walletAdapter.removeLocalIdentity(identity.localId);
+    setSelectedId(undefined);
+    await refresh();
+    setFlow(undefined);
+    setNotice({ kind: 'success', message: 'Identity removed from this wallet.' });
+  };
+
   const rotateIdentity = async (identity: LocalIdentitySummary, input: RotateIdentityInput) => {
     const created = await walletAdapter.rotate(identity.localId, input);
     await refresh();
@@ -555,6 +565,7 @@ function App() {
               onClose={() => setSelectedId(undefined)}
               onRotate={() => setFlow({ type: 'rotate', identity: selectedIdentity })}
               onDispose={() => setFlow({ type: 'dispose', identity: selectedIdentity })}
+              onRemoveLocal={() => setFlow({ type: 'remove-local', identity: selectedIdentity })}
               onContinuity={() => setFlow({ type: 'continuity', identity: selectedIdentity })}
               retryingRegistration={retryingRegistrationId === selectedIdentity.localId}
               onRetryRegistration={() => void retryRegistration(selectedIdentity)}
@@ -632,6 +643,13 @@ function App() {
             onDispose={() => disposeIdentity(flow.identity)}
           />
         )}
+        {flow?.type === 'remove-local' && (
+          <RemoveLocalIdentityModal
+            identity={flow.identity}
+            onClose={() => setFlow(undefined)}
+            onRemove={() => removeLocalIdentity(flow.identity)}
+          />
+        )}
         {flow?.type === 'rotate' && (
           <RotateIdentityModal
             identity={flow.identity}
diff --git a/apps/wallet/src/components/IdentityCard.tsx b/apps/wallet/src/components/IdentityCard.tsx
index 91ce889..266eb03 100644
--- a/apps/wallet/src/components/IdentityCard.tsx
+++ b/apps/wallet/src/components/IdentityCard.tsx
@@ -32,13 +32,20 @@ export function IdentityCard({
   const [copied, setCopied] = useState(false);
   const active = identity.localState === 'active';
   const deviceState = identity.device?.localState;
-  const statusLabel =
-    deviceState === 'pending-activation'
-      ? 'Pending activation'
-      : deviceState === 'active'
-        ? 'Active device'
-        : deviceState === 'revoked'
-          ? 'Revoked device'
+  const deviceRevoked = deviceState === 'revoked' || identity.device?.registryState === 'revoked';
+  const deviceExpired =
+    identity.device !== undefined &&
+    (identity.device.registryState === 'expired' ||
+      Math.floor(Date.now() / 1_000) >= identity.device.expiresAt);
+  const terminal = !active || deviceRevoked;
+  const statusLabel = deviceRevoked
+    ? 'Revoked device'
+    : deviceExpired
+      ? 'Expired device'
+      : deviceState === 'pending-activation'
+        ? 'Pending activation'
+        : deviceState === 'active'
+          ? 'Active device'
           : active
             ? identity.registered
               ? 'Active'
@@ -57,7 +64,7 @@ export function IdentityCard({
       layout
       initial={{ opacity: 0, y: 12 }}
       animate={{ opacity: 1, y: 0 }}
-      {...(active ? { whileHover: { y: -2 } } : {})}
+      {...(!terminal ? { whileHover: { y: -2 } } : {})}
       className={`overflow-hidden rounded-2xl border bg-white transition-all ${
         selected
           ? 'border-indigo-300 ring-2 ring-indigo-100'
@@ -68,10 +75,10 @@ export function IdentityCard({
         <div className="flex items-start gap-3">
           <div
             className={`flex h-11 w-11 shrink-0 items-center justify-center rounded-2xl ${
-              active ? 'bg-indigo-100 text-indigo-600' : 'bg-slate-100 text-slate-500'
+              !terminal ? 'bg-indigo-100 text-indigo-600' : 'bg-slate-100 text-slate-500'
             }`}
           >
-            {active ? (
+            {!terminal ? (
               <KeyRound className="h-5 w-5" aria-hidden="true" />
             ) : (
               <Unplug className="h-5 w-5" aria-hidden="true" />
@@ -84,7 +91,7 @@ export function IdentityCard({
               </h2>
               <span
                 className={`inline-flex items-center gap-1 rounded-full px-2.5 py-1 text-xs font-medium ${
-                  active
+                  !terminal
                     ? ready
                       ? 'bg-emerald-100 text-emerald-800'
                       : 'bg-amber-100 text-amber-800'
@@ -93,7 +100,7 @@ export function IdentityCard({
               >
                 <span
                   className={`h-1.5 w-1.5 rounded-full ${
-                    active ? (ready ? 'bg-emerald-500' : 'bg-amber-500') : 'bg-rose-500'
+                    !terminal ? (ready ? 'bg-emerald-500' : 'bg-amber-500') : 'bg-rose-500'
                   }`}
                 />
                 {statusLabel}
diff --git a/apps/wallet/src/components/IdentityDetail.tsx b/apps/wallet/src/components/IdentityDetail.tsx
index 9fc254b..23baffb 100644
--- a/apps/wallet/src/components/IdentityDetail.tsx
+++ b/apps/wallet/src/components/IdentityDetail.tsx
@@ -22,6 +22,7 @@ import { motion } from 'motion/react';
 import type { LocalIdentitySummary } from '@nexus/wallet-core';
 
 import {
+  canRemoveLocalIdentity,
   canUseRegisteredIdentityActions,
   needsRegistrationRecovery,
 } from '../lib/identity-capabilities';
@@ -32,6 +33,7 @@ interface IdentityDetailProps {
   onClose: () => void;
   onRotate: () => void;
   onDispose: () => void;
+  onRemoveLocal: () => void;
   onContinuity: () => void;
   retryingRegistration: boolean;
   onRetryRegistration: () => void;
@@ -52,6 +54,7 @@ export function IdentityDetail({
   onClose,
   onRotate,
   onDispose,
+  onRemoveLocal,
   onContinuity,
   retryingRegistration,
   onRetryRegistration,
@@ -77,10 +80,19 @@ export function IdentityDetail({
   const deviceCapabilities = deviceManagementCapabilities(identity, now);
   const installedRegistryState = identity.device?.registryState;
   const hasDeviceStatuses = identity.device !== undefined || identity.issuedDevices.length > 0;
+  const removableLocally = canRemoveLocalIdentity(identity, now);
+  const installedDeviceExpired =
+    identity.device !== undefined &&
+    (installedRegistryState === 'expired' || now >= identity.device.expiresAt);
+  const installedDeviceRevoked =
+    identity.device?.localState === 'revoked' || installedRegistryState === 'revoked';
 
   useEffect(() => {
-    if (identity.device?.localState !== 'pending-activation') return;
-    const cutoff = Math.min(identity.device.activationDeadline, identity.device.expiresAt);
+    if (identity.device === undefined || identity.device.localState === 'revoked') return;
+    const cutoff =
+      identity.device.localState === 'pending-activation'
+        ? Math.min(identity.device.activationDeadline, identity.device.expiresAt)
+        : identity.device.expiresAt;
     if (now >= cutoff) return;
     const delay = Math.min((cutoff - now) * 1_000 + 25, 2_147_483_647);
     const handle = window.setTimeout(() => setNow(Math.floor(Date.now() / 1_000)), delay);
@@ -250,11 +262,13 @@ export function IdentityDetail({
             <dd className="mt-2 flex items-center gap-2 text-sm font-semibold text-slate-900">
               <ShieldCheck className="h-4 w-4 text-indigo-600" aria-hidden="true" />
               {identity.device !== undefined
-                ? identity.device.localState === 'active'
-                  ? 'Active delegated device'
-                  : identity.device.localState === 'pending-activation'
-                    ? 'Delegated device pending activation'
-                    : 'Delegated device revoked'
+                ? installedDeviceRevoked
+                  ? 'Delegated device revoked'
+                  : installedDeviceExpired
+                    ? 'Delegated device expired'
+                    : identity.device.localState === 'active'
+                      ? 'Active delegated device'
+                      : 'Delegated device pending activation'
                 : active && identity.registered
                   ? 'Active and registered'
                   : active
@@ -326,9 +340,9 @@ export function IdentityDetail({
                 <div className="flex flex-wrap items-start justify-between gap-3">
                   <div className="min-w-0">
                     <p className="text-sm font-semibold text-slate-900">
-                      {installedRegistryState === 'revoked'
+                      {installedDeviceRevoked
                         ? 'Revoked delegated key'
-                        : installedRegistryState === 'expired'
+                        : installedDeviceExpired
                           ? 'Expired delegated key'
                           : installedRegistryState === 'unknown'
                             ? 'Not active at registry'
@@ -590,6 +604,26 @@ export function IdentityDetail({
           </p>
         </div>
 
+        {removableLocally && (
+          <div className="mt-6 flex flex-wrap items-center justify-between gap-3 rounded-2xl border border-rose-200 bg-rose-50 p-4">
+            <div>
+              <h3 className="text-sm font-semibold text-rose-950">Remove local wallet entry</h3>
+              <p className="mt-1 text-xs leading-relaxed text-rose-800">
+                This identity is revoked or expired and can no longer create proofs. Remove its
+                local metadata and any remaining private material from this wallet.
+              </p>
+            </div>
+            <button
+              type="button"
+              onClick={onRemoveLocal}
+              disabled={deviceActionBusy || refreshingDevices}
+              className={smallDangerButton}
+            >
+              <Trash2 className="h-3.5 w-3.5" /> Remove from wallet
+            </button>
+          </div>
+        )}
+
         {registeredActions && (
           <div className="mt-6 grid gap-3 border-t border-slate-100 pt-6 sm:grid-cols-3">
             <button
diff --git a/apps/wallet/src/components/flows.tsx b/apps/wallet/src/components/flows.tsx
index 7103300..5357256 100644
--- a/apps/wallet/src/components/flows.tsx
+++ b/apps/wallet/src/components/flows.tsx
@@ -197,6 +197,79 @@ export function DisposeIdentityModal({ identity, onClose, onDispose }: DisposeId
   );
 }
 
+interface RemoveLocalIdentityModalProps {
+  identity: LocalIdentitySummary;
+  onClose: () => void;
+  onRemove: () => Promise<void>;
+}
+
+export function RemoveLocalIdentityModal({
+  identity,
+  onClose,
+  onRemove,
+}: RemoveLocalIdentityModalProps) {
+  const [confirmed, setConfirmed] = useState(false);
+  const [state, setState] = useState<AsyncFormState>(idle);
+
+  const submit = async (event: FormEvent) => {
+    event.preventDefault();
+    if (!confirmed) return;
+    setState({ busy: true });
+    try {
+      await onRemove();
+    } catch (error) {
+      setState({ busy: false, error: errorMessage(error) });
+    }
+  };
+
+  return (
+    <ModalShell
+      title="Remove from this wallet"
+      description="Delete this revoked or expired identity's local wallet entry."
+      icon={<Trash2 className="h-5 w-5" aria-hidden="true" />}
+      onClose={onClose}
+      closeDisabled={state.busy}
+    >
+      <form onSubmit={(event) => void submit(event)} className="space-y-5">
+        <div className="rounded-xl border border-amber-200 bg-amber-50 p-4 text-sm leading-relaxed text-amber-950">
+          <div className="mb-2 flex items-center gap-2 font-semibold">
+            <ShieldAlert className="h-4 w-4" aria-hidden="true" /> Local deletion only
+          </div>
+          This removes <strong>{identity.label ?? 'this identity'}</strong>, its nickname, history,
+          metadata, and any remaining private material from this wallet. It does not delete public
+          registry records or copies held by another wallet.
+        </div>
+        <label className="flex items-start gap-3 rounded-xl border border-rose-200 p-4">
+          <input
+            type="checkbox"
+            checked={confirmed}
+            onChange={(event) => setConfirmed(event.target.checked)}
+            disabled={state.busy}
+            className="mt-1 accent-rose-600"
+          />
+          <span className="text-sm font-medium leading-relaxed text-slate-800">
+            Remove this identity and its remaining local data from this wallet.
+          </span>
+        </label>
+        {state.error !== undefined && <ErrorNotice message={state.error} />}
+        <div className="flex gap-2">
+          <button type="button" onClick={onClose} disabled={state.busy} className={secondaryButton}>
+            Keep identity
+          </button>
+          <button
+            type="submit"
+            disabled={state.busy || !confirmed}
+            className="flex flex-1 items-center justify-center gap-2 rounded-xl bg-rose-600 px-4 py-2.5 text-sm font-medium text-white shadow-sm transition-colors hover:bg-rose-700 disabled:cursor-not-allowed disabled:bg-rose-300"
+          >
+            {state.busy && <Loader2 className="h-4 w-4 animate-spin" />}
+            {state.busy ? 'Removing…' : 'Remove from wallet'}
+          </button>
+        </div>
+      </form>
+    </ModalShell>
+  );
+}
+
 interface RotateIdentityModalProps {
   identity: LocalIdentitySummary;
   onClose: () => void;
diff --git a/apps/wallet/src/lib/identity-capabilities.test.ts b/apps/wallet/src/lib/identity-capabilities.test.ts
index fbf9604..33490ad 100644
--- a/apps/wallet/src/lib/identity-capabilities.test.ts
+++ b/apps/wallet/src/lib/identity-capabilities.test.ts
@@ -3,6 +3,7 @@ import { describe, expect, it } from 'vitest';
 
 import {
   canCreateProof,
+  canRemoveLocalIdentity,
   canUseRegisteredIdentityActions,
   needsRegistrationRecovery,
 } from './identity-capabilities';
@@ -74,5 +75,18 @@ describe('identity action capabilities', () => {
     };
 
     expect(canCreateProof(expiredDevice)).toBe(false);
+    expect(canRemoveLocalIdentity(expiredDevice, 1_799_999_999)).toBe(false);
+    expect(canRemoveLocalIdentity(expiredDevice, 1_800_000_000)).toBe(true);
+    expect(
+      canRemoveLocalIdentity({
+        ...expiredDevice,
+        device: { ...expiredDevice.device!, registryState: 'revoked' },
+      }),
+    ).toBe(true);
+  });
+
+  it('offers local removal for a revoked root identity but not an active root', () => {
+    expect(canRemoveLocalIdentity(identity('active', true))).toBe(false);
+    expect(canRemoveLocalIdentity(identity('revoked', true))).toBe(true);
   });
 });
diff --git a/apps/wallet/src/lib/identity-capabilities.ts b/apps/wallet/src/lib/identity-capabilities.ts
index 71bca3c..b129c38 100644
--- a/apps/wallet/src/lib/identity-capabilities.ts
+++ b/apps/wallet/src/lib/identity-capabilities.ts
@@ -13,3 +13,18 @@ export function canUseRegisteredIdentityActions(identity: LocalIdentitySummary):
   // devices get their own self-revocation flow and must never be offered root operations.
   return identity.device === undefined && identity.localState === 'active' && identity.registered;
 }
+
+export function canRemoveLocalIdentity(
+  identity: LocalIdentitySummary,
+  now = Math.floor(Date.now() / 1_000),
+): boolean {
+  if (identity.localState === 'revoked') return true;
+  const device = identity.device;
+  return (
+    device !== undefined &&
+    (device.localState === 'revoked' ||
+      device.registryState === 'revoked' ||
+      device.registryState === 'expired' ||
+      now >= device.expiresAt)
+  );
+}
diff --git a/apps/wallet/src/lib/wallet-adapter.ts b/apps/wallet/src/lib/wallet-adapter.ts
index c382342..1725ca5 100644
--- a/apps/wallet/src/lib/wallet-adapter.ts
+++ b/apps/wallet/src/lib/wallet-adapter.ts
@@ -305,6 +305,10 @@ export const walletAdapter = {
     });
   },
 
+  removeLocalIdentity(localId: string): Promise<void> {
+    return walletCore.removeLocalIdentity(localId);
+  },
+
   async rotate(oldLocalId: string, input: RotateIdentityInput): Promise<CreatedLocalIdentity> {
     // Independent create + optional disposal deliberately emits no old/new link.
     const created = await walletCore.createIdentity({
diff --git a/packages/wallet-core/src/types.ts b/packages/wallet-core/src/types.ts
index eae7dda..fa1c966 100644
--- a/packages/wallet-core/src/types.ts
+++ b/packages/wallet-core/src/types.ts
@@ -321,6 +321,8 @@ export interface WalletCoreApi {
   clearAuthorizationHistory(localId: string): Promise<void>;
   revoke(localId: string, options?: RevokeIdentityOptions): Promise<RegistryReceiptV1>;
   dispose(localId: string, options?: DisposeIdentityOptions): Promise<RegistryReceiptV1>;
+  /** Deletes a terminally revoked or expired identity and its remaining material from this wallet. */
+  removeLocalIdentity(localId: string): Promise<void>;
   rotate(
     oldLocalId: string,
     boundary: TrustedWalletEventBoundary,
diff --git a/packages/wallet-core/src/wallet-core.ts b/packages/wallet-core/src/wallet-core.ts
index 311ba15..63c9196 100644
--- a/packages/wallet-core/src/wallet-core.ts
+++ b/packages/wallet-core/src/wallet-core.ts
@@ -538,6 +538,61 @@ export class WalletCore implements WalletCoreApi {
     return structuredClone(terminal.receipt);
   }
 
+  public async removeLocalIdentity(localId: string): Promise<void> {
+    const record = await this.#getRecord(localId);
+    const now = this.#clock.now();
+    validateEpochSeconds(now, 'clock.now()');
+    const device = record.deviceV2;
+    const removable =
+      record.localState === 'revoked' ||
+      (device !== undefined &&
+        (device.localState === 'revoked' ||
+          device.registryState === 'revoked' ||
+          device.registryState === 'expired' ||
+          now >= device.authorization.payload.expiresAt));
+    if (!removable) {
+      throw new WalletCoreError(
+        'INVALID_REQUEST',
+        'Only a revoked or expired identity can be removed from this wallet.',
+      );
+    }
+
+    const keyRefs = new Set<KeyRef>();
+    if (record.signingPrivateKeyRef !== undefined) keyRefs.add(record.signingPrivateKeyRef);
+    if (record.agreementPrivateKeyRef !== undefined) keyRefs.add(record.agreementPrivateKeyRef);
+    if (device?.signingPrivateKeyRef !== undefined) keyRefs.add(device.signingPrivateKeyRef);
+    const deletions = await Promise.allSettled([
+      ...[...keyRefs].map((ref) => this.#keyVault.deleteKey(ref)),
+      ...(record.revocationSecretRef === undefined
+        ? []
+        : [this.#keyVault.deleteSecret(record.revocationSecretRef)]),
+    ]);
+    const deletionFailure = deletions.find(
+      (result): result is PromiseRejectedResult => result.status === 'rejected',
+    );
+    if (deletionFailure !== undefined) {
+      throw new WalletCoreError(
+        'STORAGE_ERROR',
+        'The identity remains in the wallet because some local private material could not be deleted.',
+        { cause: deletionFailure.reason },
+      );
+    }
+
+    await this.#updateRecord(localId, (latest) => {
+      const publicRecord = { ...latest };
+      delete publicRecord.signingPrivateKeyRef;
+      delete publicRecord.agreementPrivateKeyRef;
+      delete publicRecord.revocationSecretRef;
+      if (publicRecord.deviceV2 !== undefined) {
+        const publicDevice = { ...publicRecord.deviceV2 };
+        delete publicDevice.signingPrivateKeyRef;
+        publicRecord.deviceV2 = publicDevice;
+      }
+      return publicRecord;
+    });
+    await this.#identityStore.delete(localId);
+  }
+
   public async rotate(
     oldLocalId: string,
     boundary: TrustedWalletEventBoundary,
diff --git a/packages/wallet-core/test/device-v2.test.ts b/packages/wallet-core/test/device-v2.test.ts
index abc955c..61ee718 100644
--- a/packages/wallet-core/test/device-v2.test.ts
+++ b/packages/wallet-core/test/device-v2.test.ts
@@ -652,6 +652,39 @@ describe('v2 root-authorized devices', () => {
     ).toHaveLength(1);
   });
 
+  it('removes an expired device identity and its local signing key without changing the root', async () => {
+    const keyVault = new InMemoryKeyVault();
+    const identityStore = new InMemoryIdentityStore();
+    const createWallet = (now: number) =>
+      new WalletCore({
+        keyVault,
+        identityStore,
+        registryClient: new InMemoryRegistryClient({ clock: { now: () => now } }),
+        verifyRegistryReceipt: acceptUnsignedInMemoryRegistryReceipt,
+        clock: { now: () => now },
+      });
+    const wallet = createWallet(NOW);
+    const root = await wallet.createIdentity();
+    const issued = await wallet.issueDeviceTransfer(root.localId, {
+      validFrom: NOW,
+      activationDeadline: NOW + 30,
+      expiresAt: NOW + 60,
+    });
+    const imported = await wallet.importDeviceTransfer(issued.bundle, issued.transferKey);
+    const deviceRecord = await identityStore.get(imported.localId);
+    const signingRef = deviceRecord?.deviceV2?.signingPrivateKeyRef;
+    if (signingRef === undefined) throw new Error('Expected an imported device signing key.');
+
+    await expect(wallet.removeLocalIdentity(imported.localId)).rejects.toMatchObject({
+      code: 'INVALID_REQUEST',
+    });
+    await createWallet(NOW + 60).removeLocalIdentity(imported.localId);
+
+    expect(await identityStore.get(imported.localId)).toBeUndefined();
+    expect(await identityStore.get(root.localId)).toBeDefined();
+    expect(await keyVault.hasKey(signingRef)).toBe(false);
+  });
+
   it('atomically reserves one device ID across two IndexedDB store instances', async () => {
     const source = createHarness();
     const root = await source.wallet.createIdentity();
diff --git a/packages/wallet-core/test/wallet-core.test.ts b/packages/wallet-core/test/wallet-core.test.ts
index e90589a..d8d0a08 100644
--- a/packages/wallet-core/test/wallet-core.test.ts
+++ b/packages/wallet-core/test/wallet-core.test.ts
@@ -272,6 +272,32 @@ describe('identity lifecycle', () => {
     expect(retained?.revocationSecretRef).toBeUndefined();
   });
 
+  it('removes a revoked identity and any remaining private material from the local wallet', async () => {
+    const { wallet, identityStore, keyVault } = createHarness();
+    const identity = await wallet.createIdentity({ withAgreementKey: true });
+    const before = await identityStore.get(identity.localId);
+    if (
+      before?.signingPrivateKeyRef === undefined ||
+      before.agreementPrivateKeyRef === undefined ||
+      before.revocationSecretRef === undefined
+    ) {
+      throw new Error('test identity is missing active private references');
+    }
+
+    await expect(wallet.removeLocalIdentity(identity.localId)).rejects.toMatchObject({
+      code: 'INVALID_REQUEST',
+    });
+    await wallet.revoke(identity.localId);
+    expect(await keyVault.hasKey(before.signingPrivateKeyRef)).toBe(true);
+
+    await wallet.removeLocalIdentity(identity.localId);
+
+    expect(await identityStore.get(identity.localId)).toBeUndefined();
+    expect(await keyVault.hasKey(before.signingPrivateKeyRef)).toBe(false);
+    expect(await keyVault.hasKey(before.agreementPrivateKeyRef)).toBe(false);
+    expect(await keyVault.hasSecret(before.revocationSecretRef)).toBe(false);
+  });
+
   it.each(['signature', 'secret'] as const)(
     'recovers %s disposal after the registry commits but its response is dropped',
     async (method) => {
diff --git a/tests/browser-e2e/security.spec.ts b/tests/browser-e2e/security.spec.ts
index c01968b..275285c 100644
--- a/tests/browser-e2e/security.spec.ts
+++ b/tests/browser-e2e/security.spec.ts
@@ -576,6 +576,15 @@ test.describe.serial('Nexus browser security boundary', () => {
     await wallet.locator('#dispose-confirmation').fill(IDENTITY_LABEL);
     await wallet.getByRole('button', { name: 'Dispose forever' }).click();
     await expect(wallet.getByText('Disposed', { exact: true })).toBeVisible();
+    await wallet.getByRole('button', { name: 'Remove from wallet', exact: true }).click();
+    const removalDialog = wallet.getByRole('dialog', { name: 'Remove from this wallet' });
+    await removalDialog
+      .getByRole('checkbox', {
+        name: 'Remove this identity and its remaining local data from this wallet.',
+      })
+      .check();
+    await removalDialog.getByRole('button', { name: 'Remove from wallet', exact: true }).click();
+    await expect(wallet.getByRole('button', { name: 'Create first identity' })).toBeVisible();
     await wallet.close();
 
     const response = await context.request.post(`${RP_A_ORIGIN}/api/session-operations`, {