diff --git a/docs/guides/identity-and-keys.md b/docs/guides/identity-and-keys.md
index 62ed2415b..c3b407268 100644
--- a/docs/guides/identity-and-keys.md
+++ b/docs/guides/identity-and-keys.md
@@ -8,7 +8,9 @@ On Dash Forge, your account is a **Dash Platform identity**. No company holds it
 4. [Where keys live today](#where-keys-live-today)
 5. [Never paste a master key into a web page](#never-paste-a-master-key-into-a-web-page)
 6. [Rotating and disabling keys](#rotating-and-disabling-keys)
-7. [Limited keys (coming with protocol 14)](#limited-keys-coming-with-protocol-14)
+7. [Limited keys and the web app](#limited-keys-and-the-web-app)
+8. [The browser vault and its limits](#the-browser-vault-and-its-limits)
+9. [Trust roots](#trust-roots)
 
 ---
 
@@ -75,15 +77,16 @@ Your **repository data** needs no backup of its own. Refs, issues and PRs are on
 | `dg` | A copy of the identity file in `~/.config/dash-forge/identities/<network>/<id>.identity.json` | `--identity <file>` > `DASH_FORGE_KEY` > the default recorded by `dg auth login` |
 | `git-remote-dash` | The same file | `DASH_FORGE_KEY`, else `~/.config/dash-forge/identities/<owner>.identity.json` |
 | `forge-import` | The same file | `--identity <file>` > `DASH_FORGE_KEY` |
-| Web app | The CRITICAL (or HIGH) key's private key, **unencrypted** in the browser's `localStorage` | Loaded from an identity file or pasted in the **Sign in** dialog |
+| Web app, forge-v2 networks (devnet moutai) | A **limited key** only, encrypted in the browser's IndexedDB (passkey or passphrase), unlocked for the session | Registered once from your identity file, recovery phrase, a new identity, or your wallet; see [below](#limited-keys-and-the-web-app) |
+| Web app, testnet (v1) | The file's CRITICAL (or HIGH) key, held in the tab's memory only; gone on reload | Loaded from an identity file in the **Sign in** sheet |
 
 Things to know:
 
 - `DASH_FORGE_KEY` holds a **path** to an identity file today, not the key itself.
 - The identity file on disk is plaintext JSON. Protect it with file permissions and full-disk encryption.
-- In the web app, the key stays in that browser (it is never sent anywhere), but any script running on the page could read it. Sign out on shared machines. That removes it.
+- In the web app, the key never leaves that browser, but any script running on the page can use it while it is unlocked ([details](#the-browser-vault-and-its-limits)). Lock or sign out on shared machines.
 
-**Coming soon:** keys in the OS keychain (macOS Keychain, Secret Service, Windows Credential Manager) with a passphrase-encrypted fallback file; `dg auth new` to create an identity from the terminal; a browser key vault encrypted with a passkey or passphrase; `dg auth export` to write a backup file.
+**Coming soon:** keys in the OS keychain (macOS Keychain, Secret Service, Windows Credential Manager) with a passphrase-encrypted fallback file; `dg auth new` to create an identity from the terminal; `dg auth export` to write a backup file.
 
 ---
 
@@ -92,11 +95,12 @@ Things to know:
 A web page is whoever served it. If the page, or a script it loads, is compromised, anything you paste into it is gone.
 
 - **Never paste your MASTER key, your 12 words, or your main identity file into a website.** That includes forge.dashhq.org. Nothing on Forge needs them.
-- The web app's sign-in picks the CRITICAL key (or HIGH) from the file you load. It does not store the MASTER key or the mnemonic, but it does read the whole file you choose. If you want to be careful, give it a copy that contains only the HIGH or CRITICAL key (the `jq` recipe in the [mirror guide](mirror-a-github-repo.md#the-ci-secret) makes one).
+- On forge-v2 networks the web app's **Import** reads your identity file (or recovery phrase) once: its master key signs one update that registers a [limited key](#limited-keys-and-the-web-app) for this browser, and is not retained. If you would rather not load the master key into a web page at all, use **Use my Dash wallet** instead (the wallet registers the key), or register a limited key with `dg` once that lands.
+- On testnet (v1) the sign-in picks the CRITICAL key (or HIGH) from the file you load and keeps it in the tab only. It does not store the MASTER key or the mnemonic, but it does read the whole file you choose. If you want to be careful, give it a copy that contains only the HIGH or CRITICAL key (the `jq` recipe in the [mirror guide](mirror-a-github-repo.md#the-ci-secret) makes one).
 - The same goes for CI: give a pipeline a stripped copy or, better, a separate identity with a small balance.
 - Prefer a copy of the web app that you [serve yourself](verify-forge.md#run-your-own-copy-of-the-web-app) if you do not want to trust the one on forge.dashhq.org.
 
-When limited keys arrive (below), the web app will never see anything but a limited key. The master key will be used only in one-time steps, such as registering a limited key.
+With limited keys (below) the web app keeps nothing but a limited key. The master key is used only in one-time steps: registering, renewing or revoking a limited key.
 
 ---
 
@@ -122,28 +126,41 @@ If the **MASTER** key or the 12 words leak, rotating does not help: whoever has
 
 ---
 
-## Limited keys (coming with protocol 14)
+## Limited keys and the web app
 
-*Available on devnet moutai once client support lands; mainnet after Platform protocol 14 activates.*
+*Live in the web app on devnet moutai (protocol 14). Mainnet after Platform protocol 14 activates. CLI support (`dg auth …`) is coming.*
 
-Protocol 14 adds keys with a **spending budget and an expiry**, bound to the Forge contracts. A limited key can spend at most its budget, only on Forge documents, and only until it expires. It cannot touch your other keys or move credits.
+A limited key is an identity key with four restrictions:
 
-The planned defaults:
+- AUTHENTICATION purpose, HIGH security level;
+- bound to the `dash-forge` **contract group**: it can sign batches on forge-core and forge-collab only. Identity updates, credit transfers and writes to any other contract are refused at consensus;
+- a **budget**: the most its transitions can ever take from your identity;
+- an **expiry**.
 
 | Where | Budget | Expires |
 |---|---|---|
 | Browser | 0.05 DASH | 90 days |
-| CLI | 0.25 DASH | 180 days |
-| CI runner (Mirror Action) | 0.5 DASH | 365 days |
+| CLI (planned) | 0.25 DASH | 180 days |
+| CI runner (Mirror Action, planned) | 0.5 DASH | 365 days |
 
-With limited keys:
+Ways to get one in the web app (**Sign in**):
 
-- the **master key never lives in the browser, on disk unencrypted, or in CI**. It signs only one-time ceremonies: registering a limited key, a username, or an encryption key;
-- losing a device costs nothing beyond that key's remaining budget. Register a new limited key and disable the old one;
-- the web app will show the key's remaining budget and expiry, and warn when either runs low;
-- CI gets one pasteable value, `DASH_FORGE_KEY=dfk1:<network>:<identity id>:<key id>:<wif>`, in place of a file.
+| Route | What happens |
+|---|---|
+| Import an identity file or recovery phrase | Your master key signs one IdentityUpdate that adds the limited key. It is used once and not retained. |
+| Create a new identity | 12 words, a short backup check, then a deposit from any Dash wallet (the faucet on devnets). One IdentityCreate registers the standard key set plus this browser's limited key, so no second signature is needed. |
+| Use my Dash wallet (App Connect) | Your wallet registers the limited key and hands it over encrypted. **Check that the identity shown is yours**: a response does not prove who answered, and anyone who saw the QR code could answer. The app refuses if more than one identity answers. |
+| Advanced: paste a key | A HIGH or CRITICAL key, for this tab only. It has no limits Forge set. Never paste a master key. |
 
-The planned commands (**not available yet**):
+The header shows your balance and the key's remaining budget. It turns amber when the budget drops under 20 % or expiry is less than 7 days away, and red when the key is spent or expired. **Settings → This browser's key** shows the budget and expiry and has these actions:
+
+- **Renew key** registers a fresh key and disables the previous one in the same update.
+- **Revoke on chain** disables this browser's key. It needs your identity file once.
+- **Sign out & forget key** deletes the key from this device. Forgetting is **not** revoking: a forgotten key stays valid on chain until it expires.
+
+Losing a device costs nothing beyond that key's remaining budget. Register a new key and disable the old one.
+
+The planned CLI (**not available yet**):
 
 ```sh
 dg auth new [--amount 0.05] [--name alice]      # create + fund an identity from the terminal
@@ -152,3 +169,25 @@ dg auth keys add --budget 0.25 --expires 180d --bound dash-forge
 dg auth keys disable <id>
 dg auth name register <label>
 ```
+
+CI will get one pasteable value, `DASH_FORGE_KEY=dfk1:<network>:<identity id>:<key id>:<wif>`, in place of a file.
+
+---
+
+## The browser vault and its limits
+
+The limited key is stored in IndexedDB, encrypted with AES-256-GCM. The data key is wrapped by a passkey's PRF output (stretched with HKDF), by Argon2id of your passphrase (64 MiB, 3 passes, 16-byte salt), or by both. Each ciphertext is bound to its network and identity. Unlocked, the key lives only in page memory. It locks after 12 hours, and is cleared when you lock or sign out.
+
+What the vault does **not** protect against:
+
+- **Script running in the page.** The vault protects the key at rest. While it is unlocked, any script running on the page (an XSS) can use it. The page's CSP allows inline scripts, which Next's static bootstrap needs. It does not allow JavaScript `eval`, only `wasm-unsafe-eval` for the SDK's WebAssembly.
+- **Clickjacking where the host cannot send headers.** `frame-ancestors` only works as an HTTP header, and GitHub Pages cannot send one, so the Pages deployment can be framed. Serve the app from a host that sends `Content-Security-Policy: frame-ancestors 'none'` if that matters to you.
+- **A shared origin.** On a GitHub Pages project site (`*.github.io/<repo>`) or an IPFS path gateway (`ipfs.io/ipfs/…`), other sites share the origin and could read the vault or ask the browser for the passkey's PRF output. So the app refuses to create or unlock a vault there. Browsing still works. Use <https://forge.dashhq.org> (the Pages deployment's custom domain, set in the repository's Pages settings) or an IPFS subdomain gateway (`<cid>.ipfs.dweb.link`).
+
+---
+
+## Trust roots
+
+- **The contract group id** comes from `forge-contracts/deployments/<network>.json`, which is built into the app. Before binding a key to the group, the app checks on chain that the group holds forge-core and forge-collab. The group's owner (and any admins) can **add** contracts to it later, and every group-bound key can then sign for those contracts too. Binding a key to the group means trusting its owner. On devnet moutai that is the deployer `8HGxMu4atPn4jThH5h9X1MajzhoD3PRnzCRGrAsFcLcV`.
+- **The block explorer** (Insight, changeable in Settings) is used only while creating an identity. Its amounts are not trusted: each deposit output is proven from its raw funding transaction, fetched and hashed against its txid, before the asset lock is signed. A lying explorer can delay you or hide funds, but it cannot redirect or burn them. The asset lock is broadcast through the explorer, because the SDK has no Core broadcast. If the explorer drops it, the signed bytes are kept and sent again.
+- **The quorum keys** every proof is checked against come from `quorums.<network>.networks.dash.org`, as for every read.
diff --git a/forge-web/app/layout.tsx b/forge-web/app/layout.tsx
index 3468df50d..70df4d7a8 100644
--- a/forge-web/app/layout.tsx
+++ b/forge-web/app/layout.tsx
@@ -10,12 +10,16 @@ export const metadata: Metadata = {
 }
 
 // CSP is delivered via <meta> so it survives static export (yappr pattern).
-// - script 'unsafe-eval' + 'wasm-unsafe-eval': required by the evo-sdk WASM runtime.
+// - script 'wasm-unsafe-eval': the evo-sdk WASM runtime. JS 'unsafe-eval' is not granted
+//   (verified: reads, writes and sign-in run without it). 'unsafe-inline' stays for Next's
+//   inline bootstrap scripts.
+// - frame-ancestors is ignored in a <meta> CSP; the host must send it as a header (GitHub
+//   Pages cannot; see docs/guides/identity-and-keys.md).
 // - connect-src https:/wss:: DAPI endpoints + IPFS/S3/HTTPS pack backends.
 // - worker-src blob:: materialization / search / pack workers run off-main-thread.
 const CSP = [
   "default-src 'self'",
-  "script-src 'self' 'unsafe-eval' 'wasm-unsafe-eval' 'unsafe-inline'",
+  "script-src 'self' 'wasm-unsafe-eval' 'unsafe-inline'",
   "style-src 'self' 'unsafe-inline'",
   "img-src 'self' data: https: blob:",
   "font-src 'self'",
diff --git a/forge-web/app/login/page.tsx b/forge-web/app/login/page.tsx
index dd24c5765..e229bc828 100644
--- a/forge-web/app/login/page.tsx
+++ b/forge-web/app/login/page.tsx
@@ -38,7 +38,7 @@ export default function LoginPage(): JSX.Element {
           icon={KeyRound}
           title="Sign in to Dash Forge"
           body="Import an identity file or paste a key + id. Read-only browsing works without signing in."
-          action={<Button variant="primary" onClick={openLogin}>Open sign-in</Button>}
+          action={<Button variant="primary" onClick={() => openLogin()}>Open sign-in</Button>}
         />
       )}
     </AppShell>
diff --git a/forge-web/app/new/page.tsx b/forge-web/app/new/page.tsx
index bfa9a8196..c3c51af0a 100644
--- a/forge-web/app/new/page.tsx
+++ b/forge-web/app/new/page.tsx
@@ -141,7 +141,7 @@ export default function NewRepoPage(): JSX.Element {
           icon={Lock}
           title="Sign in to forge a repo"
           body="Creating a repo writes three small documents signed by your identity."
-          action={<Button variant="primary" onClick={openLogin}>Sign in</Button>}
+          action={<Button variant="primary" onClick={() => openLogin()}>Sign in</Button>}
         />
       </AppShell>
     )
diff --git a/forge-web/app/settings/page.tsx b/forge-web/app/settings/page.tsx
index 5b172af52..a8f17feb1 100644
--- a/forge-web/app/settings/page.tsx
+++ b/forge-web/app/settings/page.tsx
@@ -3,7 +3,7 @@
 /** `/settings` — account settings: identity, network, balance, the local spend ledger, sign out. */
 
 import Link from 'next/link'
-import { LogOut, Wallet } from 'lucide-react'
+import { Wallet } from 'lucide-react'
 import { AppShell } from '@/components/app-shell'
 import { Button } from '@/components/ui/button'
 import { EmptyState } from '@/components/ui/states'
@@ -13,11 +13,12 @@ import { useAuth } from '@/contexts/auth-context'
 import { useUiStore } from '@/hooks/use-ui-store'
 import { NetworkBadge } from '@/components/ui/network-badge'
 import { SpendPanel } from '@/components/spend-panel'
+import { KeysPanel } from '@/components/keys-panel'
 import { creditsToDash } from '@/lib/sdk'
 import { balanceToDash, dashToUsd } from '@/lib/view/format'
 
 export default function SettingsPage(): JSX.Element {
-  const { identity, balance, logout } = useAuth()
+  const { identity, balance } = useAuth()
   const openLogin = useUiStore((s) => s.openLogin)
   const openTopUp = useUiStore((s) => s.openTopUp)
 
@@ -28,7 +29,7 @@ export default function SettingsPage(): JSX.Element {
           icon={Wallet}
           title="Not signed in"
           body="Sign in to see your balance and account settings."
-          action={<Button variant="primary" onClick={openLogin}>Sign in</Button>}
+          action={<Button variant="primary" onClick={() => openLogin()}>Sign in</Button>}
         />
       </AppShell>
     )
@@ -49,7 +50,7 @@ export default function SettingsPage(): JSX.Element {
           </div>
           <div className="mt-3 flex items-center justify-between gap-3 border-t border-anvil-100 pt-3 dark:border-anvil-850">
             <span className="text-dense text-anvil-500 dark:text-anvil-400">Identity ID</span>
-            <Oid value={identity} chars={12} label="identity id" />
+            <span data-testid="settings-identity" data-identity={identity}><Oid value={identity} chars={12} label="identity id" /></span>
           </div>
         </section>
 
@@ -70,15 +71,8 @@ export default function SettingsPage(): JSX.Element {
         </section>
 
         <section className="rounded-lg border border-anvil-200 p-4 dark:border-anvil-800">
-          <div className="flex items-center justify-between">
-            <div>
-              <div className="text-dense font-medium">Sign out</div>
-              <p className="text-[12px] text-anvil-500 dark:text-anvil-400">Wipes your signing key from the browser keystore on this device.</p>
-            </div>
-            <Button variant="danger" onClick={logout}>
-              <LogOut className="h-3.5 w-3.5" aria-hidden /> Sign out
-            </Button>
-          </div>
+          <h2 className="mb-3 text-dense font-medium text-anvil-500 dark:text-anvil-400">This browser&apos;s key</h2>
+          <KeysPanel />
         </section>
 
         <p className="text-center text-[12px] text-anvil-400">
diff --git a/forge-web/components/app-header.tsx b/forge-web/components/app-header.tsx
index 4fae7fdd1..ffbd4c902 100644
--- a/forge-web/components/app-header.tsx
+++ b/forge-web/components/app-header.tsx
@@ -73,7 +73,7 @@ export function AppHeader(): JSX.Element {
               <AccountMenu identity={identity} balance={balance} onLogout={logout} />
             </>
           ) : (
-            <Button variant="primary" size="sm" onClick={openLogin}>
+            <Button variant="primary" size="sm" onClick={() => openLogin()}>
               Sign in
             </Button>
           )}
@@ -90,7 +90,7 @@ function AccountMenu({
 }: {
   identity: string
   balance: string | null
-  onLogout: () => void
+  onLogout: (forget?: boolean) => void
 }): JSX.Element {
   const [open, setOpen] = useState(false)
   const ref = useRef<HTMLDivElement>(null)
@@ -151,11 +151,11 @@ function AccountMenu({
             role="menuitem"
             onClick={() => {
               setOpen(false)
-              onLogout()
+              onLogout(false)
             }}
             className="flex w-full items-center gap-2 rounded-md px-3 py-2 text-left text-dense text-danger hover:bg-danger/5"
           >
-            <LogOut className="h-3.5 w-3.5" aria-hidden /> Sign out
+            <LogOut className="h-3.5 w-3.5" aria-hidden /> Lock &amp; sign out
           </button>
         </div>
       ) : null}
diff --git a/forge-web/components/auth/create-identity-flow.tsx b/forge-web/components/auth/create-identity-flow.tsx
new file mode 100644
index 000000000..01e9ebaed
--- /dev/null
+++ b/forge-web/components/auth/create-identity-flow.tsx
@@ -0,0 +1,318 @@
+'use client'
+
+/**
+ * "Create a new identity" (`ux-dx-spec.md` §2.2 tile 2, §2.5):
+ *   1. twelve words, shown once, with the honest backup warning;
+ *   2. a quiz on three of them (the flow does not continue until they match);
+ *   3. how to protect this browser's key (passkey / passphrase);
+ *   4. the deposit QR + address (any Dash wallet; the faucet on dev networks), watched through
+ *      the block explorer; then the asset lock, its proof, and one IdentityCreate that also
+ *      registers this browser's limited key — stored in the vault before it is registered.
+ * A closed tab resumes from step 4 once the same words are typed in again; an unfinished
+ * creation can be discarded (after a warning when its deposit address holds funds).
+ *
+ * One run at a time: the run's AbortController lives in a ref, is aborted when the sheet
+ * unmounts, and the buttons are disabled while a run is active.
+ */
+
+import { useEffect, useRef, useState } from 'react'
+import { AlertTriangle, Check, Loader2 } from 'lucide-react'
+import { useAuth } from '@/contexts/auth-context'
+import { Button } from '@/components/ui/button'
+import { Field, Input, Textarea } from '@/components/ui/input'
+import { Qr } from '@/components/ui/qr'
+import { ErrorBox, useProtection } from '@/components/auth/protection-fields'
+import { faucetUrl } from '@/components/top-up-sheet'
+import { ACTIVE_NETWORK } from '@/lib/constants'
+import { ensureSdk } from '@/lib/sdk'
+import { isAbort } from '@/lib/sdk/facade'
+import { coreEndpoints } from '@/lib/auth/asset-lock'
+import {
+  clearCreationJournal,
+  createIdentityFromMnemonic,
+  depositAddressOf,
+  depositBalance,
+  readCreationJournal,
+  MIN_DEPOSIT_DUFFS,
+  type CreateStage,
+  type CreationJournal,
+} from '@/lib/auth/create-identity'
+import { isValidMnemonic, newMnemonic, normalizeMnemonic, quizPositions } from '@/lib/auth/hd'
+import { errorMessage } from '@/lib/utils'
+
+type Step = 'loading' | 'words' | 'quiz' | 'protect' | 'fund' | 'resume'
+
+const STAGE_TEXT: Readonly<Record<CreateStage, string>> = {
+  'waiting-deposit': 'Watching for your deposit…',
+  locking: 'Locking the deposit for Platform…',
+  proving: 'Waiting for the lock to be provable…',
+  registering: 'Registering your identity…',
+  verifying: 'Checking your browser key on Platform…',
+}
+
+export function CreateIdentityFlow({ onDone }: { onDone: () => void }): JSX.Element {
+  const { controller, reloadVaults } = useAuth()
+  const network = ACTIVE_NETWORK.network
+  const [step, setStep] = useState<Step>('loading')
+  // The words are the identity: held in a ref (not React state) and dropped on unmount. They
+  // are rendered once for the backup, which is unavoidable; nothing else keeps them.
+  const mnemonicRef = useRef<string | null>(null)
+  const [wordsShown, setWordsShown] = useState(0)
+  const mnemonic = wordsShown > 0 ? mnemonicRef.current : null
+  const setMnemonic = (m: string | null): void => {
+    mnemonicRef.current = m
+    setWordsShown((n) => n + 1)
+  }
+  const [positions, setPositions] = useState<number[]>([])
+  const [answers, setAnswers] = useState<string[]>(['', '', ''])
+  const [journal, setJournal] = useState<CreationJournal | null>(null)
+  const [address, setAddress] = useState<string | null>(null)
+  const [stage, setStage] = useState<string | null>(null)
+  const [seen, setSeen] = useState(0)
+  const [error, setError] = useState<string | null>(null)
+  const [running, setRunning] = useState(false)
+  const [resumeWords, setResumeWords] = useState('')
+  // Cleared as soon as a run starts (start() empties it).
+  const [discardWarning, setDiscardWarning] = useState<string | null>(null)
+  const { fields, protection, problem } = useProtection()
+  const words = mnemonic?.split(' ') ?? []
+  const run = useRef<AbortController | null>(null)
+
+  useEffect(() => {
+    let cancelled = false
+    void (async () => {
+      const j = await readCreationJournal(network)
+      if (cancelled) return
+      if (j) {
+        setJournal(j)
+        setAddress(j.depositAddress)
+        setStep('resume')
+        return
+      }
+      const m = await newMnemonic()
+      if (cancelled) return
+      setMnemonic(m)
+      setPositions(quizPositions(12, 3))
+      setStep('words')
+    })()
+    return () => {
+      cancelled = true
+      run.current?.abort()
+      mnemonicRef.current = null
+    }
+  }, [network])
+
+  const quizOk = positions.length === 3 && positions.every((p, i) => (answers[i] ?? '').trim().toLowerCase() === words[p])
+
+  const start = async (phrase: string): Promise<void> => {
+    if (!protection || running) return
+    setError(null)
+    const m = normalizeMnemonic(phrase)
+    if (!(await isValidMnemonic(m))) {
+      setError('Those words are not a valid recovery phrase.')
+      return
+    }
+    const deposit = await depositAddressOf(m, network)
+    if (journal && journal.depositAddress !== deposit) {
+      setError('These words do not match the creation in progress on this device.')
+      return
+    }
+    const v2 = ACTIVE_NETWORK.v2
+    if (!v2) {
+      setError('forge-v2 is not deployed here.')
+      return
+    }
+    const controllerRun = new AbortController()
+    run.current = controllerRun
+    setRunning(true)
+    setAddress(deposit)
+    setStep('fund')
+    setResumeWords('')
+    try {
+      const sdk = await ensureSdk(network)
+      const { identityId, key } = await createIdentityFromMnemonic(sdk, {
+        network,
+        mnemonic: m,
+        group: v2.group,
+        contracts: [v2.core, v2.collab],
+        minDepositDuffs: MIN_DEPOSIT_DUFFS,
+        signal: controllerRun.signal,
+        persistKey: (id, k) => controller.persistKey({ identityId: id, keyId: k.keyId, wif: k.wif }, protection),
+        onStage: (s, detail) => setStage(detail ?? STAGE_TEXT[s]),
+        onDeposit: setSeen,
+      })
+      reloadVaults()
+      await controller.openStored(identityId, null, key.limits)
+      await clearCreationJournal(network)
+      setMnemonic(null)
+      onDone()
+    } catch (e) {
+      // Never leave an unlocked key in memory without a session.
+      controller.logout()
+      if (!isAbort(e)) setError(errorMessage(e))
+      reloadVaults()
+    } finally {
+      if (run.current === controllerRun) run.current = null
+      setRunning(false)
+    }
+  }
+
+  const discard = async (): Promise<void> => {
+    if (!journal) return
+    if (discardWarning === null) {
+      const held = await depositBalance(network, journal.depositAddress).catch(() => -1)
+      if (held !== 0) {
+        setDiscardWarning(
+          held > 0
+            ? `The deposit address still holds ${(held / 1e8).toFixed(4)} DASH. Discarding forgets this creation; only your 12 words can recover those funds. Discard anyway?`
+            : "Couldn't check the deposit address for funds. If you sent any, only your 12 words can recover them. Discard anyway?",
+        )
+        return
+      }
+    }
+    run.current?.abort()
+    await clearCreationJournal(network)
+    setJournal(null)
+    setDiscardWarning(null)
+    setResumeWords('')
+    const m = await newMnemonic()
+    setMnemonic(m)
+    setPositions(quizPositions(12, 3))
+    setAnswers(['', '', ''])
+    setStep('words')
+  }
+
+  if (step === 'loading') return <Loader2 className="h-5 w-5 animate-spin text-anvil-400" aria-label="Loading" />
+
+  if (step === 'resume') {
+    return (
+      <div className="space-y-3">
+        <p className="text-dense">
+          An identity creation is in progress on this device (deposit address <span className="font-mono">{address}</span>). Type
+          your 12 words to finish it.
+        </p>
+        <Field label="Your 12 words" htmlFor="resume-words">
+          <Textarea id="resume-words" value={resumeWords} onChange={(e) => setResumeWords(e.target.value)} className="min-h-[72px] font-mono" spellCheck={false} autoComplete="off" />
+        </Field>
+        {fields}
+        <Button
+          variant="primary"
+          className="w-full"
+          loading={running}
+          disabled={running || resumeWords.trim().split(/\s+/).length < 12 || protection === null}
+          onClick={() => start(resumeWords)}
+        >
+          Continue
+        </Button>
+        {discardWarning ? <p className="text-dense text-caution">{discardWarning}</p> : null}
+        <Button variant="ghost" size="sm" disabled={running} onClick={discard}>
+          {discardWarning ? 'Discard anyway' : 'Discard this creation'}
+        </Button>
+        <ErrorBox error={error} />
+      </div>
+    )
+  }
+
+  if (step === 'words') {
+    return (
+      <div className="space-y-3">
+        <p className="text-dense font-medium">Write these 12 words down, in order, on paper.</p>
+        <ol data-testid="mnemonic-words" className="grid grid-cols-3 gap-1.5 rounded-md border border-anvil-200 p-3 font-mono text-dense dark:border-anvil-800">
+          {words.map((w, i) => (
+            <li key={i}>
+              <span className="text-anvil-400">{i + 1}.</span> <span data-word={i}>{w}</span>
+            </li>
+          ))}
+        </ol>
+        <div className="flex gap-2 rounded-md border border-caution/40 bg-caution/5 px-3 py-2 text-dense text-caution">
+          <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0" aria-hidden />
+          <span>
+            The 12 words are the identity. Lose them and nobody can recover it. Keep them offline; Forge only ever keeps a limited
+            key in this browser.
+          </span>
+        </div>
+        <Button variant="primary" className="w-full" disabled={words.length === 0} onClick={() => setStep('quiz')}>
+          I wrote them down
+        </Button>
+      </div>
+    )
+  }
+
+  if (step === 'quiz') {
+    return (
+      <div className="space-y-3">
+        <p className="text-dense">Check your backup: type these words.</p>
+        {positions.map((p, i) => (
+          <Field key={p} label={`Word ${p + 1}`} htmlFor={`quiz-${p}`}>
+            <Input
+              id={`quiz-${p}`}
+              value={answers[i] ?? ''}
+              autoComplete="off"
+              spellCheck={false}
+              onChange={(e) => setAnswers((a) => a.map((x, j) => (j === i ? e.target.value : x)))}
+            />
+          </Field>
+        ))}
+        <div className="flex gap-2">
+          <Button variant="ghost" onClick={() => setStep('words')}>
+            Show words again
+          </Button>
+          <Button variant="primary" className="flex-1" disabled={!quizOk} onClick={() => setStep('protect')}>
+            Continue
+          </Button>
+        </div>
+      </div>
+    )
+  }
+
+  if (step === 'protect') {
+    return (
+      <div className="space-y-3">
+        {fields}
+        <Button
+          variant="primary"
+          className="w-full"
+          loading={running}
+          disabled={running || protection === null || mnemonic === null}
+          onClick={() => mnemonic && start(mnemonic)}
+        >
+          Continue to funding
+        </Button>
+        {problem ? <p className="text-[12px] text-anvil-500">{problem}</p> : null}
+        <ErrorBox error={error} />
+      </div>
+    )
+  }
+
+  const faucet = faucetUrl()
+  return (
+    <div className="space-y-3" data-testid="fund-step">
+      <p className="text-dense">
+        Send at least <span className="font-mono">0.02 DASH</span> (0.05 suggested) to this address from any Dash wallet. It becomes your
+        Platform credits: ~0.0005 DASH per issue or push.
+      </p>
+      {address ? <Qr value={address} label={`Deposit address ${address}`} /> : null}
+      {address ? <span data-testid="deposit-address" className="sr-only">{address}</span> : null}
+      {faucet ? (
+        <a href={faucet} target="_blank" rel="noreferrer noopener" className="block text-center text-dense text-forge-600 underline dark:text-forge-400">
+          Get test DASH from the {ACTIVE_NETWORK.key} faucet
+        </a>
+      ) : null}
+      <div className="flex items-center gap-2 text-dense text-anvil-600 dark:text-anvil-300" aria-live="polite">
+        {running ? <Loader2 className="h-4 w-4 animate-spin" aria-hidden /> : null}
+        <span data-testid="create-stage">{stage ?? STAGE_TEXT['waiting-deposit']}</span>
+        {seen > 0 ? (
+          <span className="inline-flex items-center gap-1 text-verify">
+            <Check className="h-3.5 w-3.5" aria-hidden /> {(seen / 1e8).toFixed(4)} DASH seen
+          </span>
+        ) : null}
+      </div>
+      <p className="text-[12px] text-anvil-500 dark:text-anvil-400">
+        To see your deposit this page asks a Dash block explorer ({new URL(coreEndpoints(network).insight).host}, changeable in
+        Settings). It can delay you, but amounts are checked against the raw transactions, so it cannot take funds or keys. On {ACTIVE_NETWORK.key} the lock is proven once a block
+        chain-locks it, which can take a few minutes.
+      </p>
+      {error ? <ErrorBox error={`${error} — your deposit is recorded on this device; reopen this sheet and type your 12 words to resume.`} /> : null}
+    </div>
+  )
+}
diff --git a/forge-web/components/auth/protection-fields.tsx b/forge-web/components/auth/protection-fields.tsx
new file mode 100644
index 000000000..9c7387e42
--- /dev/null
+++ b/forge-web/components/auth/protection-fields.tsx
@@ -0,0 +1,106 @@
+'use client'
+
+/**
+ * How this browser's limited key is protected at rest (`ux-dx-spec.md` §2.3): a passkey (PRF)
+ * when the browser supports it, a passphrase (Argon2id) otherwise — or both. Produces the
+ * {@link Protection} the vault seals with. A passkey is enrolled on demand, so the ceremony
+ * runs only when the user asks for it.
+ */
+
+import { useEffect, useRef, useState } from 'react'
+import { Fingerprint, KeyRound } from 'lucide-react'
+import { enrollPasskey, MIN_PASSPHRASE, passkeysAvailable, type Protection } from '@/lib/auth'
+import { Button } from '@/components/ui/button'
+import { Field, Input } from '@/components/ui/input'
+import { errorMessage } from '@/lib/utils'
+
+export function useProtection(): {
+  readonly fields: JSX.Element
+  /** The protection, or null with `problem` set when not ready. */
+  readonly protection: Protection | null
+  readonly problem: string | null
+} {
+  const [passphrase, setPassphrase] = useState('')
+  const [confirm, setConfirm] = useState('')
+  // The passkey's PRF output is key material: a ref (not React state), zeroed on unmount.
+  const passkeyRef = useRef<Protection['passkey'] | null>(null)
+  const [hasPasskey, setHasPasskey] = useState(false)
+  useEffect(
+    () => () => {
+      passkeyRef.current?.output.fill(0)
+      passkeyRef.current = null
+    },
+    [],
+  )
+  const passkey = hasPasskey ? passkeyRef.current : null
+  const [enrolling, setEnrolling] = useState(false)
+  const [passkeyError, setPasskeyError] = useState<string | null>(null)
+  const canPasskey = passkeysAvailable()
+
+  const enroll = async (): Promise<void> => {
+    setEnrolling(true)
+    setPasskeyError(null)
+    try {
+      const p = await enrollPasskey(`Dash Forge (${new Date().toISOString().slice(0, 10)})`)
+      if (p === null) setPasskeyError("This passkey can't protect keys here (no PRF support). Use a passphrase.")
+      else {
+        passkeyRef.current = p
+        setHasPasskey(true)
+      }
+    } catch (e) {
+      setPasskeyError(errorMessage(e, 'passkey setup was cancelled'))
+    } finally {
+      setEnrolling(false)
+    }
+  }
+
+  const passphraseSet = passphrase.length > 0
+  let problem: string | null = null
+  if (passphraseSet && passphrase.length < MIN_PASSPHRASE) problem = `Use at least ${MIN_PASSPHRASE} characters.`
+  else if (passphraseSet && passphrase !== confirm) problem = 'The passphrases do not match.'
+  else if (!passphraseSet && !passkey) problem = 'Protect the key with a passkey or a passphrase.'
+
+  const protection: Protection | null =
+    problem !== null ? null : { ...(passphraseSet ? { passphrase } : {}), ...(passkey ? { passkey } : {}) }
+
+  const fields = (
+    <div className="space-y-3 rounded-md border border-anvil-200 p-3 dark:border-anvil-800">
+      <p className="text-dense font-medium">Protect this browser&apos;s key</p>
+      {canPasskey ? (
+        <div className="flex flex-wrap items-center gap-2">
+          <Button type="button" variant={passkey ? 'subtle' : 'outline'} size="sm" onClick={enroll} loading={enrolling} disabled={passkey !== null}>
+            <Fingerprint className="h-3.5 w-3.5" aria-hidden /> {passkey ? 'Passkey added' : 'Use a passkey'}
+          </Button>
+          <span className="text-[12px] text-anvil-500 dark:text-anvil-400">Recommended: Touch ID, Windows Hello or a security key.</span>
+        </div>
+      ) : null}
+      {passkeyError ? <p className="text-[12px] text-caution">{passkeyError}</p> : null}
+      <Field
+        label={passkey ? 'Passphrase (optional backup)' : 'Passphrase'}
+        htmlFor="vault-passphrase"
+        hint="Encrypts the key on this device (Argon2id, 64 MiB). Never sent anywhere."
+      >
+        <Input id="vault-passphrase" type="password" autoComplete="new-password" value={passphrase} onChange={(e) => setPassphrase(e.target.value)} />
+      </Field>
+      {passphraseSet ? (
+        <Field label="Repeat passphrase" htmlFor="vault-passphrase-2">
+          <Input id="vault-passphrase-2" type="password" autoComplete="new-password" value={confirm} onChange={(e) => setConfirm(e.target.value)} />
+        </Field>
+      ) : null}
+      <p className="flex items-center gap-1 text-[12px] text-anvil-500 dark:text-anvil-400">
+        <KeyRound className="h-3 w-3" aria-hidden /> Locks itself after 12 hours or when you sign out.
+      </p>
+    </div>
+  )
+  return { fields, protection, problem }
+}
+
+/** An error line in the sign-in sheet (alert role, wraps long SDK messages). */
+export function ErrorBox({ error }: { error: string | null }): JSX.Element | null {
+  if (!error) return null
+  return (
+    <div role="alert" className="mt-3 rounded-md border border-danger/30 bg-danger/5 px-3 py-2 text-dense text-danger break-words">
+      {error}
+    </div>
+  )
+}
diff --git a/forge-web/components/auth/wallet-connect-flow.tsx b/forge-web/components/auth/wallet-connect-flow.tsx
new file mode 100644
index 000000000..79edfab2a
--- /dev/null
+++ b/forge-web/components/auth/wallet-connect-flow.tsx
@@ -0,0 +1,123 @@
+'use client'
+
+/**
+ * "Use my Dash wallet" (`ux-dx-spec.md` §2.2 tile 1): shows the App Connect request as a QR
+ * and a deep link, waits for the wallet's `loginKeyResponse`, verifies the granted key on chain
+ * (live, HIGH, bound to the dash-forge group, budgeted, expiring), then — after the user
+ * confirms the full identity id (and DPNS name) is theirs — stores it in the vault.
+ *
+ * The response does not prove who answered: anyone who saw the QR could answer from their own
+ * identity. So the user confirms the identity, and more than one valid answer is refused.
+ * The granted key is held in a ref, never React state, and dropped when the sheet closes.
+ */
+
+import { useEffect, useRef, useState } from 'react'
+import { Loader2 } from 'lucide-react'
+import { useAuth } from '@/contexts/auth-context'
+import { Button } from '@/components/ui/button'
+import { Qr } from '@/components/ui/qr'
+import { ErrorBox, useProtection } from '@/components/auth/protection-fields'
+import { ACTIVE_NETWORK } from '@/lib/constants'
+import { BROWSER_KEY_DEFAULTS, type LimitedKey } from '@/lib/auth'
+import { awaitWalletLogin, newRequest } from '@/lib/auth/app-connect'
+import { ensureSdk } from '@/lib/sdk'
+import { isAbort } from '@/lib/sdk/facade'
+import { resolveDpnsName } from '@/lib/view/dpns'
+import { errorMessage } from '@/lib/utils'
+
+export function WalletConnectFlow({ onDone }: { onDone: () => void }): JSX.Element {
+  const { adoptLimitedKey, isLoading } = useAuth()
+  const [uri, setUri] = useState<string | null>(null)
+  const [pairing, setPairing] = useState('')
+  const [slow, setSlow] = useState(false)
+  const [who, setWho] = useState<{ identityId: string; name: string | null } | null>(null)
+  const [confirmed, setConfirmed] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const grant = useRef<LimitedKey | null>(null)
+  const { fields, protection, problem } = useProtection()
+
+  useEffect(() => {
+    const controller = new AbortController()
+    const timer = setTimeout(() => setSlow(true), 3 * 60 * 1000)
+    void (async () => {
+      try {
+        const v2 = ACTIVE_NETWORK.v2
+        if (!v2) throw new Error('forge-v2 is not deployed here')
+        const req = newRequest(ACTIVE_NETWORK.network, v2.group)
+        setUri(req.uri)
+        setPairing(req.pairingCode)
+        const sdk = await ensureSdk(ACTIVE_NETWORK.network)
+        const login = await awaitWalletLogin(sdk, req, { network: ACTIVE_NETWORK.network, group: v2.group, signal: controller.signal })
+        grant.current = { keyId: login.keyId, wif: login.wif, limits: login.limits }
+        const name = await resolveDpnsName(sdk, login.identityId, ACTIVE_NETWORK.network).catch(() => null)
+        setWho({ identityId: login.identityId, name: name ?? null })
+      } catch (e) {
+        if (!isAbort(e)) setError(errorMessage(e))
+      }
+    })()
+    return () => {
+      controller.abort()
+      clearTimeout(timer)
+      grant.current = null
+    }
+  }, [])
+
+  if (who) {
+    return (
+      <div className="space-y-3">
+        <p className="text-dense">A wallet granted a key, verified on Platform, for this identity:</p>
+        <div className="rounded-md border border-anvil-200 px-3 py-2 dark:border-anvil-800">
+          {who.name ? <div className="text-dense font-medium">{who.name}</div> : null}
+          <div data-testid="granted-identity" className="break-all font-mono text-dense">
+            {who.identityId}
+          </div>
+        </div>
+        <label className="flex items-start gap-2 text-dense">
+          <input type="checkbox" checked={confirmed} onChange={(e) => setConfirmed(e.target.checked)} className="mt-1" />
+          <span>This is my identity. (If it is not, someone else answered the QR code: close this and start again.)</span>
+        </label>
+        {fields}
+        <Button
+          variant="primary"
+          className="w-full"
+          loading={isLoading}
+          disabled={!confirmed || protection === null || isLoading}
+          onClick={async () => {
+            const key = grant.current
+            if (!protection || !key) return
+            try {
+              await adoptLimitedKey(who.identityId, key, protection)
+              grant.current = null
+              onDone()
+            } catch (e) {
+              setError(errorMessage(e))
+            }
+          }}
+        >
+          Finish signing in
+        </Button>
+        {problem ? <p className="text-[12px] text-anvil-500">{problem}</p> : null}
+        <ErrorBox error={error} />
+      </div>
+    )
+  }
+
+  return (
+    <div className="space-y-3">
+      {uri ? <Qr value={uri} label="Wallet login request" size={200} /> : <Loader2 className="mx-auto h-5 w-5 animate-spin text-anvil-400" aria-hidden />}
+      {uri ? (
+        <a href={uri} className="block text-center text-dense text-forge-600 underline dark:text-forge-400">
+          Open in a wallet on this device
+        </a>
+      ) : null}
+      <p className="text-dense">
+        Approve in your wallet. Forge gets a key that can spend at most {BROWSER_KEY_DEFAULTS.budgetDash} DASH, only here, for{' '}
+        {BROWSER_KEY_DEFAULTS.days} days. Check the wallet shows code <span className="font-mono font-semibold">{pairing}</span>. Keep
+        this QR code private: anyone who scans it can answer it.
+      </p>
+      {slow ? <p className="text-dense text-caution">No response yet. Keep this tab open, or choose another method.</p> : null}
+      <p className="text-[12px] text-anvil-500 dark:text-anvil-400">Needs a wallet with Platform login (App Connect).</p>
+      <ErrorBox error={error} />
+    </div>
+  )
+}
diff --git a/forge-web/components/keys-panel.tsx b/forge-web/components/keys-panel.tsx
new file mode 100644
index 000000000..d01fc7fc1
--- /dev/null
+++ b/forge-web/components/keys-panel.tsx
@@ -0,0 +1,125 @@
+'use client'
+
+/**
+ * Settings → This browser's key (`ux-dx-spec.md` §2.3): which key signs here, what is left of
+ * its budget, when it expires, and how to renew it. Renewal registers a fresh limited key (it
+ * needs the master key once: import the identity file or phrase again); raising an existing
+ * key's limits (`IdentityKeyLimitsUpdate`) is P1. Also: lock now, and sign out + forget.
+ */
+
+import { useRef, useState } from 'react'
+import { Lock, LogOut, RefreshCw, ShieldOff } from 'lucide-react'
+import { errorMessage } from '@/lib/utils'
+import { useAuth } from '@/contexts/auth-context'
+import { useUiStore } from '@/hooks/use-ui-store'
+import { Button } from '@/components/ui/button'
+import { Field, Input } from '@/components/ui/input'
+import { creditsAsDash, formatDate } from '@/lib/view/format'
+import { INSIGHT_OVERRIDE_KEY } from '@/lib/auth/asset-lock'
+
+/** Shown before deleting a stored key: for a wallet-granted key this is the only copy. */
+export const FORGET_CONFIRM =
+  "Delete this browser's key from this device? This does not revoke it: the key stays valid on chain until it expires (use \"Revoke on chain\" for that). You will need your identity file, recovery phrase or wallet to sign in again here."
+
+export function KeysPanel(): JSX.Element {
+  const { identity, keyLimits, storage, funds, logout, forget, revokeStored, isLoading } = useAuth()
+  const revokeRef = useRef<HTMLInputElement>(null)
+  const [revokeError, setRevokeError] = useState<string | null>(null)
+  const revoke = async (file: File): Promise<void> => {
+    if (!identity) return
+    setRevokeError(null)
+    try {
+      await revokeStored(identity, { fileText: await file.text() })
+    } catch (e) {
+      setRevokeError(errorMessage(e))
+    }
+  }
+  const openLogin = useUiStore((s) => s.openLogin)
+  const [explorer, setExplorer] = useState(() =>
+    typeof window === 'undefined' ? '' : window.localStorage.getItem(INSIGHT_OVERRIDE_KEY) ?? '',
+  )
+  const low = funds?.reason === 'key-budget' || funds?.reason === 'key-expiry'
+
+  return (
+    <div className="space-y-4 text-dense" data-testid="keys-panel">
+      {storage === 'session' ? (
+        <p className="rounded-md border border-danger/40 bg-danger/5 px-3 py-2 text-danger">
+          This tab signs with a pasted key that has no Forge limits. It is forgotten on reload.
+        </p>
+      ) : keyLimits ? (
+        <dl className="grid grid-cols-2 gap-2">
+          <dt className="text-anvil-500 dark:text-anvil-400">Budget left</dt>
+          <dd data-testid="key-budget" className="font-mono">
+            {keyLimits.remaining === null ? '—' : `${creditsAsDash(Number(keyLimits.remaining))} of ${creditsAsDash(Number(keyLimits.total ?? 0n))} DASH`}
+          </dd>
+          <dt className="text-anvil-500 dark:text-anvil-400">Expires</dt>
+          <dd data-testid="key-expiry">{keyLimits.expiresAt === null ? 'never' : formatDate(keyLimits.expiresAt)}</dd>
+          <dt className="text-anvil-500 dark:text-anvil-400">Scope</dt>
+          <dd>dash-forge contracts only</dd>
+        </dl>
+      ) : (
+        <p className="text-anvil-500 dark:text-anvil-400">This key has no budget or expiry.</p>
+      )}
+      {low ? (
+        <p className="text-caution">This browser&apos;s key is nearly used up. Renew it (uses your master key once).</p>
+      ) : null}
+      <div className="flex flex-wrap gap-2">
+        <Button variant="outline" size="sm" onClick={() => openLogin('import')}>
+          <RefreshCw className="h-3.5 w-3.5" aria-hidden /> Renew key
+        </Button>
+        <Button variant="outline" size="sm" onClick={() => logout()}>
+          <Lock className="h-3.5 w-3.5" aria-hidden /> Lock
+        </Button>
+        <Button
+          variant="danger"
+          size="sm"
+          onClick={() => {
+            if (identity && window.confirm(FORGET_CONFIRM)) void forget(identity)
+          }}
+        >
+          <LogOut className="h-3.5 w-3.5" aria-hidden /> Sign out &amp; forget key
+        </Button>
+        {storage === 'vault' ? (
+          <>
+            <Button variant="danger" size="sm" loading={isLoading} onClick={() => revokeRef.current?.click()}>
+              <ShieldOff className="h-3.5 w-3.5" aria-hidden /> Revoke on chain
+            </Button>
+            <input
+              ref={revokeRef}
+              type="file"
+              aria-label="Identity file to revoke with"
+              accept="application/json,.json,.txt"
+              className="sr-only"
+              onChange={(e) => {
+                const f = e.target.files?.[0]
+                if (f && window.confirm('Disable this browser\'s key on chain? Your identity file\'s master key signs it once and is not stored.')) void revoke(f)
+                e.target.value = ''
+              }}
+            />
+          </>
+        ) : null}
+      </div>
+      <p className="text-[12px] text-anvil-500 dark:text-anvil-400">
+        Forgetting deletes the key from this device only. Revoking disables it on chain (needs your identity file once).
+      </p>
+      {revokeError ? <p role="alert" className="text-[12px] text-danger">{revokeError}</p> : null}
+      <Field
+        label="Block explorer (used only to watch identity deposits)"
+        htmlFor="explorer-url"
+        hint="Insight API base URL. Leave empty for the network default. It can delay you but cannot take funds or keys."
+      >
+        <Input
+          id="explorer-url"
+          value={explorer}
+          placeholder="https://insight.dash.org/insight-api"
+          onChange={(e) => {
+            setExplorer(e.target.value)
+            const v = e.target.value.trim()
+            if (v === '') window.localStorage.removeItem(INSIGHT_OVERRIDE_KEY)
+            else if (/^https:\/\//.test(v)) window.localStorage.setItem(INSIGHT_OVERRIDE_KEY, v.replace(/\/+$/, ''))
+          }}
+        />
+      </Field>
+    </div>
+  )
+}
diff --git a/forge-web/components/login-modal.tsx b/forge-web/components/login-modal.tsx
index 77d62b2ef..fde8ded7a 100644
--- a/forge-web/components/login-modal.tsx
+++ b/forge-web/components/login-modal.tsx
@@ -1,164 +1,470 @@
 'use client'
 
 /**
- * Login modal — imports a bridge identity file OR a pasted WIF + identity id into the headless
- * {@link useAuth} session. The signing key is stored in the network keystore and never enters
- * React state (see AuthController). Read-only browsing works logged-out; this only gates writes.
+ * The sign-in sheet (`ux-dx-spec.md` §2.2). Three tiles plus an Advanced disclosure:
+ *
+ *   1. Use my Dash wallet — App Connect (shown only when the system contract exists here);
+ *   2. Create a new identity — mnemonic + backup quiz + deposit QR, registered with a limited
+ *      key inside the IdentityCreate;
+ *   3. Import an identity file (or mnemonic) — the master key signs one IdentityUpdate that
+ *      registers a limited key for this browser, and is not stored;
+ *   Advanced: paste a raw key (developer path; this tab only; red warning).
+ *
+ * When this device already holds an encrypted key, the sheet opens on "Unlock" instead
+ * (callers can open it on a view directly: Renew opens Import). On a network without forge-v2
+ * (no contract group to bind a key to, testnet today) only the v1 path exists: the identity
+ * file signs with its HIGH/CRITICAL key for this tab.
  */
 
-import { useRef, useState } from 'react'
-import { KeyRound, Upload } from 'lucide-react'
+import { useEffect, useRef, useState } from 'react'
+import { ArrowLeft, Fingerprint, KeyRound, Lock, Plus, Upload, Wallet } from 'lucide-react'
 import { useAuth } from '@/contexts/auth-context'
-import { useUiStore } from '@/hooks/use-ui-store'
+import { useUiStore, type LoginView } from '@/hooks/use-ui-store'
 import { Dialog } from '@/components/ui/dialog'
 import { Button } from '@/components/ui/button'
-import { Field, Input } from '@/components/ui/input'
+import { Field, Input, Textarea } from '@/components/ui/input'
+import { ErrorBox, useProtection } from '@/components/auth/protection-fields'
+import { CreateIdentityFlow } from '@/components/auth/create-identity-flow'
+import { WalletConnectFlow } from '@/components/auth/wallet-connect-flow'
+import { FORGET_CONFIRM } from '@/components/keys-panel'
 import { ACTIVE_NETWORK } from '@/lib/constants'
-import { errorMessage } from '@/lib/utils'
+import { BROWSER_KEY_DEFAULTS, masterMaterialFromFile, parseIdentityFileText } from '@/lib/auth'
+import { appConnectAvailable } from '@/lib/auth/app-connect'
+import { ensureSdk } from '@/lib/sdk'
+import { formatDate } from '@/lib/view/format'
+import { cn, errorMessage } from '@/lib/utils'
 
-type Tab = 'file' | 'key'
+type View = 'choose' | 'unlock' | 'advanced' | LoginView
 
 export function LoginModal(): JSX.Element {
   const open = useUiStore((s) => s.loginOpen)
+  const requested = useUiStore((s) => s.loginView)
   const close = useUiStore((s) => s.closeLogin)
-  const { login, loginWithIdentityFile, isLoading, error } = useAuth()
+  const { vaults, limitedKeys } = useAuth()
+  const [view, setView] = useState<View>('choose')
+  const [unlockFor, setUnlockFor] = useState<string | null>(null)
+  const hasVault = vaults.length > 0
 
-  const [tab, setTab] = useState<Tab>('file')
-  const [identityId, setIdentityId] = useState('')
-  const [privateKey, setPrivateKey] = useState('')
-  const [localError, setLocalError] = useState<string | null>(null)
-  const fileRef = useRef<HTMLInputElement>(null)
+  // Pick the view when the sheet opens. If the stored-key list arrives after it opened (the
+  // /login route opens it on load), move from the untouched tile list to Unlock — never
+  // away from a flow the user already started.
+  const opened = useRef<{ hasVault: boolean } | null>(null)
+  useEffect(() => {
+    if (!open) {
+      opened.current = null
+      return
+    }
+    if (opened.current === null) {
+      opened.current = { hasVault }
+      setView(requested ?? (hasVault ? 'unlock' : 'choose'))
+      setUnlockFor(null)
+      return
+    }
+    if (!opened.current.hasVault && hasVault && requested === null) {
+      opened.current = { hasVault }
+      setView((v) => (v === 'choose' ? 'unlock' : v))
+    }
+  }, [open, requested, hasVault])
+
+  const back = view === 'choose' || view === 'unlock' ? null : () => setView('choose')
+  const description =
+    view === 'advanced'
+      ? 'A pasted key signs for this tab only, with whatever power it has.'
+      : limitedKeys
+        ? `Forge signs with a limited key: at most ${BROWSER_KEY_DEFAULTS.budgetDash} DASH, only on Forge, for ${BROWSER_KEY_DEFAULTS.days} days.`
+        : `Your key signs writes on ${ACTIVE_NETWORK.key}. It stays in this tab, never sent anywhere.`
+
+  return (
+    <Dialog open={open} onClose={close} title="Sign in to Dash Forge" description={description} className="max-w-lg">
+      {back ? (
+        <button type="button" onClick={back} className="mb-3 inline-flex items-center gap-1 text-dense text-anvil-500 hover:text-anvil-800 dark:hover:text-anvil-100">
+          <ArrowLeft className="h-3.5 w-3.5" aria-hidden /> All options
+        </button>
+      ) : null}
+      {view === 'unlock' ? <UnlockView initial={unlockFor} onDone={close} onOther={() => setView('choose')} onRenew={() => setView('import')} /> : null}
+      {view === 'choose' ? <ChooseView onPick={setView} /> : null}
+      {view === 'import' ? (
+        limitedKeys ? (
+          <ImportView
+            onDone={close}
+            onStored={(id) => {
+              setUnlockFor(id)
+              setView('unlock')
+            }}
+          />
+        ) : (
+          <V1FileView onDone={close} />
+        )
+      ) : null}
+      {view === 'create' ? <CreateIdentityFlow onDone={close} /> : null}
+      {view === 'wallet' ? <WalletConnectFlow onDone={close} /> : null}
+      {view === 'advanced' ? <AdvancedView onDone={close} /> : null}
+    </Dialog>
+  )
+}
+
+function Tile({ icon: Icon, title, body, onClick, testId }: { icon: typeof Wallet; title: string; body: string; onClick: () => void; testId: string }): JSX.Element {
+  return (
+    <button
+      type="button"
+      data-testid={testId}
+      onClick={onClick}
+      className="flex w-full items-start gap-3 rounded-lg border border-anvil-200 px-3 py-3 text-left transition-colors hover:border-forge-400 hover:bg-anvil-50 dark:border-anvil-750 dark:hover:bg-anvil-850"
+    >
+      <Icon className="mt-0.5 h-5 w-5 shrink-0 text-forge-500" aria-hidden />
+      <span>
+        <span className="block text-dense font-medium text-anvil-900 dark:text-anvil-50">{title}</span>
+        <span className="block text-[12px] text-anvil-500 dark:text-anvil-400">{body}</span>
+      </span>
+    </button>
+  )
+}
+
+function ChooseView({ onPick }: { onPick: (v: View) => void }): JSX.Element {
+  const { limitedKeys } = useAuth()
+  const walletAvailable = useWalletAvailability(limitedKeys)
+  const [advanced, setAdvanced] = useState(false)
+  return (
+    <div className="space-y-2">
+      {limitedKeys && walletAvailable ? (
+        <Tile testId="tile-wallet" icon={Wallet} title="Use my Dash wallet" body="Scan a QR with a wallet that supports Platform login. It grants Forge a limited key." onClick={() => onPick('wallet')} />
+      ) : null}
+      {limitedKeys ? (
+        <Tile testId="tile-create" icon={Plus} title="Create a new identity" body="12 words you write down, then fund it from any Dash wallet. ~0.0005 DASH per issue or push." onClick={() => onPick('create')} />
+      ) : null}
+      <Tile
+        testId="tile-import"
+        icon={Upload}
+        title={limitedKeys ? 'Import an identity file or recovery phrase' : 'Import an identity file'}
+        body={
+          limitedKeys
+            ? 'Your master key is used once, right now, to create a limited key for this browser. It is not stored.'
+            : 'The bridge / dg JSON export. Its signing key stays in this tab only.'
+        }
+        onClick={() => onPick('import')}
+      />
+      <div className="pt-2">
+        <button type="button" aria-expanded={advanced} onClick={() => setAdvanced((a) => !a)} className="text-[12px] text-anvil-500 underline hover:text-anvil-800 dark:hover:text-anvil-100">
+          Advanced
+        </button>
+        {advanced ? (
+          <div className="mt-2">
+            <Tile testId="tile-advanced" icon={KeyRound} title="Paste a private key" body="Developer path. The key is held in this tab only and is lost on reload." onClick={() => onPick('advanced')} />
+          </div>
+        ) : null}
+      </div>
+    </div>
+  )
+}
+
+/** Whether the App Connect tile applies here (protocol 14 + the system contract present). */
+function useWalletAvailability(limitedKeys: boolean): boolean {
+  const [available, setAvailable] = useState(false)
+  useEffect(() => {
+    if (!limitedKeys) return
+    let cancelled = false
+    ensureSdk(ACTIVE_NETWORK.network)
+      .then(appConnectAvailable)
+      .then(
+        (ok) => !cancelled && setAvailable(ok),
+        () => undefined,
+      )
+    return () => {
+      cancelled = true
+    }
+  }, [limitedKeys])
+  return available
+}
+
+/** A dashed "choose a file" button over a hidden file input. */
+function FilePicker({ label, detail, onFile, disabled }: { label: string; detail?: string; onFile: (f: File) => void; disabled?: boolean }): JSX.Element {
+  const ref = useRef<HTMLInputElement>(null)
+  return (
+    <>
+      <button
+        type="button"
+        disabled={disabled}
+        onClick={() => ref.current?.click()}
+        className="flex w-full flex-col items-center gap-1 rounded-lg border border-dashed border-anvil-300 px-4 py-5 text-center hover:border-forge-400 dark:border-anvil-700"
+      >
+        <Upload className="h-5 w-5 text-forge-500" aria-hidden />
+        <span className="text-dense font-medium">{label}</span>
+        {detail ? <span className="font-mono text-[12px] text-anvil-500">{detail}</span> : null}
+      </button>
+      <input
+        ref={ref}
+        type="file"
+        aria-label="Identity file"
+        accept="application/json,.json,.txt"
+        className="sr-only"
+        onChange={(e) => {
+          const f = e.target.files?.[0]
+          if (f) onFile(f)
+          e.target.value = ''
+        }}
+      />
+    </>
+  )
+}
+
+function UnlockView({ initial, onDone, onOther, onRenew }: { initial: string | null; onDone: () => void; onOther: () => void; onRenew: () => void }): JSX.Element {
+  const { vaults, unlock, forget, isLoading } = useAuth()
+  const [pick, setPick] = useState(() => Math.max(0, vaults.findIndex((v) => v.identityId === initial)))
+  const [passphrase, setPassphrase] = useState('')
+  const [error, setError] = useState<string | null>(null)
+  const v = vaults[pick] ?? vaults[0]
+  if (!v) {
+    return (
+      <div className="space-y-3">
+        <p className="text-dense">No key is stored on this device.</p>
+        <Button variant="primary" className="w-full" onClick={onOther}>
+          Sign-in options
+        </Button>
+      </div>
+    )
+  }
+  const go = async (method: { passphrase: string } | 'passkey'): Promise<void> => {
+    if (isLoading) return
+    setError(null)
+    try {
+      await unlock(v.identityId, method)
+      setPassphrase('')
+      onDone()
+    } catch (e) {
+      setError(errorMessage(e))
+    }
+  }
+  const expired = error !== null && /no longer usable|renew/i.test(error)
+  return (
+    <div className="space-y-3">
+      <div className="flex items-center gap-2 text-dense">
+        <Lock className="h-4 w-4 text-anvil-400" aria-hidden />
+        This browser holds a key for{' '}
+        {vaults.length > 1 ? (
+          <select aria-label="Identity" value={pick} onChange={(e) => setPick(Number(e.target.value))} className="rounded border border-anvil-300 bg-transparent px-1 font-mono dark:border-anvil-700">
+            {vaults.map((x, i) => (
+              <option key={x.identityId} value={i}>
+                {x.identityId.slice(0, 10)}…
+              </option>
+            ))}
+          </select>
+        ) : (
+          <span className="font-mono">{v.identityId.slice(0, 10)}…</span>
+        )}
+      </div>
+      {v.methods.includes('passkey') ? (
+        <Button variant="primary" className="w-full" onClick={() => go('passkey')} loading={isLoading} disabled={isLoading}>
+          <Fingerprint className="h-4 w-4" aria-hidden /> Unlock with passkey
+        </Button>
+      ) : null}
+      {v.methods.includes('passphrase') ? (
+        <form
+          className="space-y-2"
+          onSubmit={(e) => {
+            e.preventDefault()
+            void go({ passphrase })
+          }}
+        >
+          <Field label="Passphrase" htmlFor="unlock-passphrase">
+            <Input id="unlock-passphrase" type="password" autoComplete="current-password" value={passphrase} onChange={(e) => setPassphrase(e.target.value)} autoFocus />
+          </Field>
+          <Button type="submit" variant={v.methods.includes('passkey') ? 'outline' : 'primary'} className="w-full" loading={isLoading} disabled={passphrase === '' || isLoading}>
+            Unlock
+          </Button>
+        </form>
+      ) : null}
+      <ErrorBox error={error} />
+      {expired ? (
+        <Button variant="outline" className="w-full" onClick={onRenew}>
+          Renew this browser&apos;s key
+        </Button>
+      ) : null}
+      <div className="flex justify-between pt-1 text-[12px]">
+        <button type="button" onClick={onOther} className="text-anvil-500 underline">
+          Other sign-in options
+        </button>
+        <button
+          type="button"
+          onClick={() => {
+            if (window.confirm(FORGET_CONFIRM)) void forget(v.identityId).then(() => setPick(0))
+          }}
+          className="text-danger underline"
+        >
+          Forget this key
+        </button>
+      </div>
+      <p className="text-[12px] text-anvil-500 dark:text-anvil-400">
+        Stored {formatDate(v.createdAt)} · key #{v.keyId}
+      </p>
+    </div>
+  )
+}
 
-  const shownError = localError ?? error
+function ImportView({ onDone, onStored }: { onDone: () => void; onStored: (identityId: string) => void }): JSX.Element {
+  const { importIdentity, isLoading, vaults, identity } = useAuth()
+  const [mode, setMode] = useState<'file' | 'mnemonic'>('file')
+  // The identity file holds every private key: a ref (not React state), dropped on unmount
+  // and after use; state only records that one was chosen.
+  const fileRef = useRef<string | null>(null)
+  const [fileChosen, setFileChosen] = useState(false)
+  useEffect(
+    () => () => {
+      fileRef.current = null
+    },
+    [],
+  )
+  const [fileName, setFileName] = useState('')
+  const [fileIdentity, setFileIdentity] = useState('')
+  const [mnemonic, setMnemonic] = useState('')
+  const [identityId, setIdentityId] = useState('')
+  const [error, setError] = useState<string | null>(null)
+  const { fields, protection, problem } = useProtection()
+  const who = mode === 'file' ? fileIdentity : identityId.trim()
+  // Offer Unlock for a key this device already holds, unless this is a renewal of the
+  // signed-in identity (then the old key is disabled in the same update).
+  const alreadyStored = who !== '' && who !== identity && vaults.some((v) => v.identityId === who)
 
   const onFile = async (file: File): Promise<void> => {
-    setLocalError(null)
+    setError(null)
+    const text = await file.text()
     try {
-      const text = await file.text()
-      await loginWithIdentityFile(text)
-      close()
+      setFileIdentity(masterMaterialFromFile(text).identityId)
     } catch (e) {
-      setLocalError(errorMessage(e))
+      fileRef.current = null
+      setFileChosen(false)
+      setFileIdentity('')
+      setError(errorMessage(e))
+      return
     }
+    fileRef.current = text
+    setFileChosen(true)
+    setFileName(file.name)
   }
 
-  const onKeyLogin = async (): Promise<void> => {
-    setLocalError(null)
+  const ready = protection !== null && !isLoading && (mode === 'file' ? fileChosen : mnemonic.trim() !== '' && identityId.trim() !== '')
+  const submit = async (): Promise<void> => {
+    if (!protection || isLoading) return
+    setError(null)
     try {
-      await login(identityId.trim(), privateKey.trim())
-      close()
+      const text = fileRef.current
+      if (mode === 'file' && text === null) return
+      await importIdentity(mode === 'file' ? { fileText: text as string } : { mnemonic, identityId }, protection)
+      fileRef.current = null
+      setMnemonic('')
+      onDone()
     } catch (e) {
-      setLocalError(errorMessage(e))
+      setError(errorMessage(e))
     }
   }
 
   return (
-    <Dialog
-      open={open}
-      onClose={close}
-      title="Sign in to Dash Forge"
-      description={`Your key signs writes on ${ACTIVE_NETWORK.key}. It stays in your browser — never sent anywhere.`}
-    >
-      <div className="mb-4 inline-flex rounded-md border border-anvil-200 p-0.5 dark:border-anvil-750">
-        <TabButton active={tab === 'file'} onClick={() => setTab('file')}>
-          <Upload className="h-3.5 w-3.5" aria-hidden /> Identity file
-        </TabButton>
-        <TabButton active={tab === 'key'} onClick={() => setTab('key')}>
-          <KeyRound className="h-3.5 w-3.5" aria-hidden /> Key + ID
-        </TabButton>
-      </div>
-
-      {tab === 'file' ? (
-        <div className="space-y-3">
+    <div className="space-y-3">
+      <div role="tablist" className="inline-flex rounded-md border border-anvil-200 p-0.5 dark:border-anvil-750">
+        {(['file', 'mnemonic'] as const).map((m) => (
           <button
+            key={m}
+            role="tab"
+            aria-selected={mode === m}
             type="button"
-            onClick={() => fileRef.current?.click()}
-            className="flex w-full flex-col items-center justify-center gap-2 rounded-lg border border-dashed border-anvil-300 px-4 py-8 text-center transition-colors hover:border-forge-400 hover:bg-anvil-50 dark:border-anvil-700 dark:hover:bg-anvil-850"
+            onClick={() => setMode(m)}
+            className={cn('rounded px-3 py-1.5 text-dense font-medium', mode === m ? 'bg-forge-500/15 text-forge-600 dark:text-forge-400' : 'text-anvil-500')}
           >
-            <Upload className="h-5 w-5 text-forge-500" aria-hidden />
-            <span className="text-dense font-medium">Choose a bridge identity file</span>
-            <span className="text-[12px] text-anvil-500 dark:text-anvil-400">
-              The .json file exported from the Dash bridge
-            </span>
+            {m === 'file' ? 'Identity file' : 'Recovery phrase'}
           </button>
-          <input
-            ref={fileRef}
-            type="file"
-            accept="application/json,.json,.txt"
-            className="sr-only"
-            onChange={(e) => {
-              const f = e.target.files?.[0]
-              if (f) void onFile(f)
-            }}
-          />
-        </div>
+        ))}
+      </div>
+      {mode === 'file' ? (
+        <FilePicker label={fileName || 'Choose an identity file (.json)'} detail={fileIdentity || undefined} onFile={(f) => void onFile(f)} />
       ) : (
-        <div className="space-y-3">
-          <Field label="Identity ID" htmlFor="login-id" hint="Your base58 identity id.">
-            <Input
-              id="login-id"
-              value={identityId}
-              onChange={(e) => setIdentityId(e.target.value)}
-              placeholder="e.g. 5Dtb9k4wKf3Jpq3mR7nTgH2vQxYzA1BcD8eF6gH9jK"
-              className="font-mono"
-              autoComplete="off"
-              spellCheck={false}
-            />
+        <>
+          <Field label="Identity ID" htmlFor="import-id">
+            <Input id="import-id" value={identityId} onChange={(e) => setIdentityId(e.target.value)} className="font-mono" spellCheck={false} autoComplete="off" />
           </Field>
-          <Field label="Private key (WIF or hex)" htmlFor="login-key" hint="Held in your browser keystore only.">
-            <Input
-              id="login-key"
-              type="password"
-              value={privateKey}
-              onChange={(e) => setPrivateKey(e.target.value)}
-              placeholder="WIF or 64-char hex"
-              className="font-mono"
-              autoComplete="off"
-              spellCheck={false}
-            />
+          <Field label="Recovery phrase (12 or 24 words)" htmlFor="import-mnemonic" hint="Used once to derive the master key; not stored.">
+            <Textarea id="import-mnemonic" value={mnemonic} onChange={(e) => setMnemonic(e.target.value)} className="min-h-[72px] font-mono" spellCheck={false} autoComplete="off" />
           </Field>
-          <Button
-            variant="primary"
-            className="w-full"
-            onClick={onKeyLogin}
-            loading={isLoading}
-            disabled={identityId.trim() === '' || privateKey.trim() === ''}
-          >
-            Sign in
-          </Button>
-        </div>
+        </>
       )}
-
-      {shownError ? (
-        <div className="mt-3 rounded-md border border-danger/30 bg-danger/5 px-3 py-2 text-dense text-danger break-words">
-          {shownError}
+      {alreadyStored ? (
+        <div className="rounded-md border border-anvil-200 px-3 py-2 text-dense dark:border-anvil-800">
+          This device already holds a key for this identity.{' '}
+          <button type="button" className="text-forge-600 underline dark:text-forge-400" onClick={() => onStored(who)}>
+            Unlock it instead
+          </button>{' '}
+          or continue to replace it (the old key is disabled in the same update).
         </div>
       ) : null}
-    </Dialog>
+      {fields}
+      <p className="text-[12px] text-anvil-500 dark:text-anvil-400">
+        Registers a key that can spend at most {BROWSER_KEY_DEFAULTS.budgetDash} DASH, only on Forge, for {BROWSER_KEY_DEFAULTS.days} days (~0.0005 DASH, one master-key signature).
+      </p>
+      <Button variant="primary" className="w-full" onClick={submit} loading={isLoading} disabled={!ready}>
+        Create this browser&apos;s key
+      </Button>
+      {problem && (fileChosen || mnemonic !== '') ? <p className="text-[12px] text-anvil-500">{problem}</p> : null}
+      <ErrorBox error={error} />
+    </div>
   )
 }
 
-function TabButton({
-  active,
-  onClick,
-  children,
-}: {
-  active: boolean
-  onClick: () => void
-  children: React.ReactNode
-}): JSX.Element {
+/** Networks without forge-v2 (testnet): an identity file's HIGH/CRITICAL key, this tab only. */
+function V1FileView({ onDone }: { onDone: () => void }): JSX.Element {
+  const { loginWithRawKey, isLoading, controller } = useAuth()
+  const [error, setError] = useState<string | null>(null)
+  const onFile = async (file: File): Promise<void> => {
+    setError(null)
+    try {
+      const parsed = parseIdentityFileText(await file.text())
+      controller.checkFileNetwork(parsed.networkKey)
+      await loginWithRawKey(parsed.identityId, parsed.signingKeyWif)
+      onDone()
+    } catch (e) {
+      setError(errorMessage(e))
+    }
+  }
   return (
-    <button
-      type="button"
-      onClick={onClick}
-      className={
-        'inline-flex items-center gap-1.5 rounded px-3 py-1.5 text-dense font-medium transition-colors ' +
-        (active
-          ? 'bg-forge-500/15 text-forge-600 dark:text-forge-400'
-          : 'text-anvil-500 hover:text-anvil-800 dark:text-anvil-400 dark:hover:text-anvil-100')
-      }
-    >
-      {children}
-    </button>
+    <div className="space-y-3">
+      <FilePicker label="Choose an identity file" onFile={(f) => void onFile(f)} disabled={isLoading} />
+      <p className="text-[12px] text-anvil-500 dark:text-anvil-400">
+        {ACTIVE_NETWORK.key} has no Forge contract group yet, so there are no limited keys here: the file&apos;s signing key is held in this tab and forgotten on reload.
+      </p>
+      <ErrorBox error={error} />
+    </div>
+  )
+}
+
+function AdvancedView({ onDone }: { onDone: () => void }): JSX.Element {
+  const { loginWithRawKey, isLoading } = useAuth()
+  const [identityId, setIdentityId] = useState('')
+  const [key, setKey] = useState('')
+  const [error, setError] = useState<string | null>(null)
+  const submit = async (): Promise<void> => {
+    if (isLoading) return
+    setError(null)
+    try {
+      await loginWithRawKey(identityId, key)
+      setKey('')
+      onDone()
+    } catch (e) {
+      setError(errorMessage(e))
+    }
+  }
+  return (
+    <div className="space-y-3">
+      <div role="note" className="rounded-md border border-danger/40 bg-danger/5 px-3 py-2 text-dense text-danger">
+        A pasted key has no limits Forge set: anything it can sign, this tab can sign. Never paste a master key. Prefer importing
+        your identity once so Forge gets a limited key instead.
+      </div>
+      <Field label="Identity ID" htmlFor="adv-id">
+        <Input id="adv-id" value={identityId} onChange={(e) => setIdentityId(e.target.value)} className="font-mono" spellCheck={false} autoComplete="off" />
+      </Field>
+      <Field label="Private key (WIF or hex)" htmlFor="adv-key" hint="HIGH or CRITICAL authentication key. Held in this tab only.">
+        <Input id="adv-key" type="password" value={key} onChange={(e) => setKey(e.target.value)} className="font-mono" spellCheck={false} autoComplete="off" />
+      </Field>
+      <Button variant="danger" className="w-full" onClick={submit} loading={isLoading} disabled={identityId.trim() === '' || key.trim() === '' || isLoading}>
+        Sign in for this tab
+      </Button>
+      <ErrorBox error={error} />
+    </div>
   )
 }
diff --git a/forge-web/components/top-up-sheet.tsx b/forge-web/components/top-up-sheet.tsx
index 97e1d7732..0f688d734 100644
--- a/forge-web/components/top-up-sheet.tsx
+++ b/forge-web/components/top-up-sheet.tsx
@@ -12,6 +12,7 @@ import { ExternalLink } from 'lucide-react'
 import { useAuth } from '@/contexts/auth-context'
 import { useUiStore } from '@/hooks/use-ui-store'
 import { Dialog } from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
 import { CopyRow } from '@/components/ui/copy-row'
 import { ACTIVE_NETWORK } from '@/lib/constants'
 import { creditsAsDash } from '@/lib/view/format'
@@ -27,6 +28,7 @@ export function faucetUrl(): string | null {
 export function TopUpSheet(): JSX.Element | null {
   const reason = useUiStore((s) => s.topUp)
   const close = useUiStore((s) => s.closeTopUp)
+  const openLogin = useUiStore((s) => s.openLogin)
   const { identity } = useAuth()
   if (reason === null || identity === null) return null
   const faucet = faucetUrl()
@@ -47,10 +49,21 @@ export function TopUpSheet(): JSX.Element | null {
     >
       <div className="space-y-3 text-dense">
         {keyProblem ? (
-          <p>
-            Sign in again with your identity file or mnemonic to register a fresh limited key for this browser.
-            Your master key is used once and not stored.
-          </p>
+          <>
+            <p>
+              Renew it with your identity file or recovery phrase: the master key registers a fresh limited key for this
+              browser, disables the old one, and is not stored.
+            </p>
+            <Button
+              variant="primary"
+              onClick={() => {
+                close()
+                openLogin('import')
+              }}
+            >
+              Renew key
+            </Button>
+          </>
         ) : (
           <>
             <p>
diff --git a/forge-web/components/ui/qr.tsx b/forge-web/components/ui/qr.tsx
new file mode 100644
index 000000000..09c2d4590
--- /dev/null
+++ b/forge-web/components/ui/qr.tsx
@@ -0,0 +1,21 @@
+'use client'
+
+import { useMemo } from 'react'
+import encodeQR from 'qr'
+
+/** A QR code (SVG, quiet zone included) with its text beneath it (spec §10: QR carries text). */
+export function Qr({ value, label, size = 184 }: { value: string; label: string; size?: number }): JSX.Element {
+  const svg = useMemo(() => encodeQR(value, 'svg', { ecc: 'medium', border: 2 }), [value])
+  return (
+    <figure className="flex flex-col items-center gap-2">
+      <div
+        role="img"
+        aria-label={label}
+        className="rounded-md bg-white p-1 [&>svg]:h-full [&>svg]:w-full"
+        style={{ width: size, height: size }}
+        dangerouslySetInnerHTML={{ __html: svg }}
+      />
+      <figcaption className="max-w-full break-all text-center font-mono text-[12px] text-anvil-600 dark:text-anvil-300">{value}</figcaption>
+    </figure>
+  )
+}
diff --git a/forge-web/contexts/auth-context.tsx b/forge-web/contexts/auth-context.tsx
index 62fcb3b57..d07e9e0d4 100644
--- a/forge-web/contexts/auth-context.tsx
+++ b/forge-web/contexts/auth-context.tsx
@@ -12,22 +12,13 @@
 import React, { createContext, useCallback, useContext, useEffect, useMemo, useState } from 'react'
 import type { EvoSDK } from '@dashevo/evo-sdk'
 
-import { AuthController, type AuthSession } from '../lib/auth'
+import { AuthController, type AuthSession, type LimitedKey, type LimitedKeyRequest, type Protection, type VaultInfo } from '../lib/auth'
 import { DEFAULT_NETWORK, NETWORKS, type Network } from '../lib/constants'
-import { evoSdkService, type SpendEvent, type WriteAuth } from '../lib/sdk'
+import { ensureSdk, type SpendEvent, type WriteAuth } from '../lib/sdk'
 import { recordSpend } from '../lib/spend'
 import { fundsState, type FundsState, type KeyLimits } from '../lib/view/funds'
 import { toast } from '../hooks/use-toasts'
 
-async function ensureSdk(network: Network): Promise<EvoSDK> {
-  const { registryContractId, dpnsContractId, v2 } = NETWORKS[network]
-  const contractIds = [registryContractId, dpnsContractId, v2?.core, v2?.collab].filter(
-    (id): id is string => typeof id === 'string' && id.length > 0,
-  )
-  await evoSdkService.initialize({ network, contractIds, timeoutMs: 15000 })
-  return evoSdkService.getSdk()
-}
-
 /** A write kind (`create:issue`) → the toast title. */
 const SPEND_TITLES: Readonly<Record<string, string>> = {
   'create:repo': 'Repository created',
@@ -61,10 +52,32 @@ interface AuthContextValue {
   readonly error: string | null
   /** The key-free write signer for the WriteEngine, or null when logged out. */
   readonly signer: WriteAuth | null
-  login: (identityId: string, privateKey: string) => Promise<void>
-  loginWithIdentityFile: (text: string) => Promise<void>
+  /** How this session's key is held: a vault-stored limited key, or a tab-only raw key. */
+  readonly storage: AuthSession['storage'] | null
+  /** Whether this network supports limited keys (forge-v2, protocol 14). */
+  readonly limitedKeys: boolean
+  /** Keys stored (encrypted) on this device for this network. */
+  readonly vaults: readonly VaultInfo[]
+  /** The limited-key ceremony: import an identity file or a mnemonic once. */
+  importIdentity: (
+    input: { fileText: string } | { mnemonic: string; identityId: string },
+    protection: Protection,
+    request?: LimitedKeyRequest,
+  ) => Promise<void>
+  adoptLimitedKey: (identityId: string, key: LimitedKey, protection: Protection) => Promise<void>
+  unlock: (identityId: string, method: { passphrase: string } | 'passkey') => Promise<void>
+  /** Advanced: a pasted key, for this tab only. */
+  loginWithRawKey: (identityId: string, privateKey: string) => Promise<void>
   refreshBalance: () => Promise<void>
+  /** Lock: end the session, keep the stored key (unlock to continue). */
   logout: () => void
+  /** Delete the stored key of `identityId` from this device (does not revoke it on chain). */
+  forget: (identityId: string) => Promise<void>
+  /** Disable this device's key on chain with the master key (file or phrase), then forget it. */
+  revokeStored: (identityId: string, input: { fileText: string } | { mnemonic: string }) => Promise<void>
+  reloadVaults: () => void
+  /** The headless controller (identity creation stores its key before registering it). */
+  readonly controller: AuthController
 }
 
 const AuthContext = createContext<AuthContextValue | undefined>(undefined)
@@ -81,28 +94,39 @@ export function AuthProvider({
 
   useEffect(() => controller.subscribe(setState), [controller])
 
-  const login = useCallback(
-    async (identityId: string, privateKey: string) => {
-      await controller.login(identityId, privateKey)
-    },
-    [controller],
+  const [vaults, setVaults] = useState<readonly VaultInfo[]>([])
+  const reloadVaults = useCallback(() => {
+    controller.storedVaults().then(setVaults, () => setVaults([]))
+  }, [controller])
+  useEffect(reloadVaults, [reloadVaults])
+
+  // Every sign-in path ends with a reload of the stored-key list, success or not: a key stored
+  // before a later step failed must show up in Unlock.
+  const withReload = useCallback(
+    <A extends unknown[]>(fn: (...args: A) => Promise<unknown>) =>
+      async (...args: A): Promise<void> => {
+        try {
+          await fn(...args)
+        } finally {
+          reloadVaults()
+        }
+      },
+    [reloadVaults],
   )
-
-  const loginWithIdentityFile = useCallback(
-    async (text: string) => {
-      await controller.loginWithIdentityFile(text)
-    },
-    [controller],
+  const actions = useMemo(
+    () => ({
+      importIdentity: withReload(controller.importIdentity.bind(controller)),
+      adoptLimitedKey: withReload(controller.adoptLimitedKey.bind(controller)),
+      unlock: withReload(controller.unlock.bind(controller)),
+      loginWithRawKey: withReload(controller.loginWithRawKey.bind(controller)),
+      refreshBalance: () => controller.refreshBalance(),
+      logout: () => controller.logout(),
+      forget: withReload(controller.forget.bind(controller)),
+      revokeStored: withReload(controller.revokeStored.bind(controller)),
+    }),
+    [controller, withReload],
   )
 
-  const refreshBalance = useCallback(async () => {
-    await controller.refreshBalance()
-  }, [controller])
-
-  const logout = useCallback(() => {
-    controller.logout()
-  }, [controller])
-
   const onSpend = useCallback(
     (event: SpendEvent) => {
       const refused = event.kind.startsWith('refused:')
@@ -138,12 +162,14 @@ export function AuthProvider({
       isLoading: state.isLoading,
       error: state.error,
       signer,
-      login,
-      loginWithIdentityFile,
-      refreshBalance,
-      logout,
+      storage: session?.storage ?? null,
+      limitedKeys: controller.supportsLimitedKeys(),
+      vaults,
+      reloadVaults,
+      controller,
+      ...actions,
     }),
-    [funds, keyLimits, login, loginWithIdentityFile, logout, refreshBalance, session, signer, state.error, state.isLoading],
+    [actions, controller, funds, keyLimits, reloadVaults, session, signer, state.error, state.isLoading, vaults],
   )
 
   return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>
diff --git a/forge-web/e2e/auth-write.spec.ts b/forge-web/e2e/auth-write.spec.ts
index 756868b04..5fb3dc8d3 100644
--- a/forge-web/e2e/auth-write.spec.ts
+++ b/forge-web/e2e/auth-write.spec.ts
@@ -35,6 +35,8 @@ test.describe('auth + write (opt-in via E2E_AUTH=1)', () => {
     // Open the login modal from the header sign-in affordance.
     await page.getByRole('button', { name: /sign in/i }).first().click()
     await expect(page.getByText(/Sign in to Dash Forge/i)).toBeVisible()
+    // Testnet has no Forge contract group, so the only tile is the v1 identity-file import.
+    await page.getByTestId('tile-import').click()
 
     // Upload the identity file straight into the (visually hidden) file input.
     await page.setInputFiles('input[type="file"]', IDENTITY_PATH)
diff --git a/forge-web/e2e/helpers.ts b/forge-web/e2e/helpers.ts
index 1c623bda2..0176d324a 100644
--- a/forge-web/e2e/helpers.ts
+++ b/forge-web/e2e/helpers.ts
@@ -1,6 +1,7 @@
 import AxeBuilder from '@axe-core/playwright'
-import { type Page, type ConsoleMessage } from '@playwright/test'
-import { mkdirSync } from 'node:fs'
+import { expect, type Browser, type Page, type ConsoleMessage } from '@playwright/test'
+import { homedir } from 'node:os'
+import { existsSync, mkdirSync } from 'node:fs'
 import { join } from 'node:path'
 
 /**
@@ -137,3 +138,66 @@ export async function runAxe(page: import('@playwright/test').Page, label: strin
 
   return seriousOrCritical
 }
+
+/** A devnet test identity file (~/.config/dash-forge/test-identities/devnet-<name>/). */
+export function idFile(name: string): string {
+  return join(homedir(), '.config/dash-forge/test-identities', `devnet-${E2E_DEVNET}`, `${name}.identity.json`)
+}
+
+export const PASSPHRASE = 'e2e passphrase for the vault'
+
+/**
+ * Where a signed-in browser's storage (the encrypted vault record in IndexedDB, nothing in
+ * plaintext) is kept between runs, per devnet identity, so the specs reuse one limited key
+ * per identity instead of registering a new one on every test (identities would otherwise
+ * accumulate keys without bound). Gitignored (e2e/.playwright/).
+ */
+function stateFile(name: string): string {
+  return join(__dirname, '.playwright', 'auth', `devnet-${E2E_DEVNET}-${name}.json`)
+}
+
+/** Import the identity file once: the master key registers a limited key for this browser. */
+export async function importIdentity(page: Page, name: string): Promise<void> {
+  await page.getByRole('button', { name: /^sign in$/i }).first().click()
+  await page.getByTestId('tile-import').click()
+  await page.setInputFiles('input[type="file"]', idFile(name))
+  await page.getByLabel('Passphrase', { exact: true }).fill(PASSPHRASE)
+  await page.getByLabel('Repeat passphrase').fill(PASSPHRASE)
+  await page.getByRole('button', { name: /create this browser's key/i }).click()
+  await expect(page.getByTestId('funds-pill')).toBeVisible({ timeout: 120_000 })
+}
+
+/**
+ * A browser context signed in as `name`. The first time, the identity file is imported (one
+ * new limited key); afterwards the saved vault is restored and unlocked with the passphrase.
+ * If the stored key stopped working (expired, disabled), it is imported again.
+ */
+export async function signedIn(browser: Browser, name: string, path = '/'): Promise<Page> {
+  const saved = stateFile(name)
+  const context = await browser.newContext(existsSync(saved) ? { storageState: saved } : {})
+  const page = await context.newPage()
+  await page.goto(path, { waitUntil: 'domcontentloaded' })
+  let reused = false
+  if (existsSync(saved)) {
+    try {
+      await unlock(page)
+      reused = true
+    } catch {
+      await page.keyboard.press('Escape')
+    }
+  }
+  if (!reused) {
+    await importIdentity(page, name)
+    mkdirSync(join(__dirname, '.playwright', 'auth'), { recursive: true, mode: 0o700 })
+    await context.storageState({ path: saved, indexedDB: true })
+  }
+  return page
+}
+
+/** After a reload: unlock the vault this context already holds. */
+export async function unlock(page: Page): Promise<void> {
+  await page.getByRole('button', { name: /^sign in$/i }).first().click()
+  await page.getByLabel('Passphrase', { exact: true }).fill(PASSPHRASE)
+  await page.getByRole('button', { name: /^unlock$/i }).click()
+  await expect(page.getByTestId('funds-pill')).toBeVisible({ timeout: 60_000 })
+}
diff --git a/forge-web/e2e/v2-auth.spec.ts b/forge-web/e2e/v2-auth.spec.ts
new file mode 100644
index 000000000..49651cfeb
--- /dev/null
+++ b/forge-web/e2e/v2-auth.spec.ts
@@ -0,0 +1,125 @@
+import { test, expect } from '@playwright/test'
+import { existsSync, readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { E2E_DEVNET, PASSPHRASE, idFile, importIdentity, shot, unlock } from './helpers'
+
+/**
+ * Limited-key sign-in, live on a devnet (real spend):
+ *
+ *   E2E_DEVNET=moutai E2E_WRITE=1 pnpm exec playwright test v2-auth.spec.ts
+ *
+ * a1. Import an identity file: the master key registers a limited key for this browser; the
+ *     spec then reads the identity from Platform itself and checks the key is live, HIGH,
+ *     bound to the dash-forge contract group, with the default budget (0.05 DASH) and expiry
+ *     (~90 days). The vault survives a reload and unlocks with the passphrase; nothing that
+ *     looks like a private key sits in localStorage.
+ * a2. Create an identity in the browser: words, quiz, passphrase, deposit address — which the
+ *     harness funds from the devnet faucet key (FORGE_DEVNET_FUNDING_KEY_FILE, a
+ *     dash-network-configs devnet YAML; tools/mint-identity `fundFromKey`) — then the asset
+ *     lock, its chain-lock proof and the IdentityCreate. Skipped without a funding key.
+ */
+
+test.skip(E2E_DEVNET === '' || process.env['E2E_WRITE'] !== '1', 'live devnet writes: set E2E_DEVNET=moutai E2E_WRITE=1')
+test.skip(!existsSync(idFile('CI-RUNNER')), 'devnet test identities not found')
+test.describe.configure({ mode: 'serial', timeout: 30 * 60_000 })
+
+const ROOT = resolve(__dirname, '../..')
+/** The group the app binds keys to: the one in the deployment file it is built with. */
+const GROUP: string = E2E_DEVNET
+  ? JSON.parse(readFileSync(join(ROOT, `forge-contracts/deployments/devnet-${E2E_DEVNET}.json`), 'utf8')).v2.forgeCore.contractGroupId
+  : ''
+
+/** Read an identity's keys straight from Platform (evo-sdk in Node), independent of the app. */
+async function onChainKeys(identityId: string): Promise<{ id: number; level: string; budget: bigint | null; expiresAt: number | null; bound: string | null; remaining: bigint | null }[]> {
+  const evo = await import(pathToFileURL(join(ROOT, 'forge-web/node_modules/@dashevo/evo-sdk/dist/evo-sdk.module.js')).href)
+  const dep = (await import(pathToFileURL(join(ROOT, `forge-contracts/deployments/devnet-${E2E_DEVNET}.json`)).href, { with: { type: 'json' } })).default
+  const sdk = new evo.EvoSDK({ network: 'devnet', trusted: true, devnetName: E2E_DEVNET, addresses: dep.dapiAddresses })
+  await sdk.connect()
+  const identity = await sdk.identities.fetch(identityId)
+  const keys = identity.publicKeys as { keyId: number; securityLevel: string; totalBudget?: bigint; expiresAt?: bigint; contractBounds?: { toJSON(): { id: string } } }[]
+  const budgets = await sdk.identities.keysRemainingBudgets(identityId, keys.map((k) => k.keyId))
+  return keys.map((k) => ({
+    id: k.keyId,
+    level: String(k.securityLevel).toUpperCase(),
+    budget: k.totalBudget ?? null,
+    expiresAt: k.expiresAt === undefined ? null : Number(k.expiresAt),
+    bound: k.contractBounds?.toJSON().id ?? null,
+    remaining: budgets.get(k.keyId) ?? null,
+  }))
+}
+
+test('a1. import once: a limited key lands on chain, the vault survives a reload', async ({ browser }) => {
+  const identityId = String(JSON.parse(readFileSync(idFile('CI-RUNNER'), 'utf8')).identityId)
+  const before = await onChainKeys(identityId)
+  const page = await (await browser.newContext()).newPage()
+  await page.goto('/settings/', { waitUntil: 'domcontentloaded' })
+  await importIdentity(page, 'CI-RUNNER')
+  await expect(page.getByTestId('key-budget')).toContainText('0.05 DASH', { timeout: 30_000 })
+  await shot(page, 'v2a-01-settings-key')
+
+  const after = await onChainKeys(identityId)
+  const added = after.filter((k) => !before.some((b) => b.id === k.id))
+  expect(added).toHaveLength(1)
+  const key = added[0]!
+  expect(key.level).toBe('HIGH')
+  expect(key.bound).toBe(GROUP)
+  expect(key.budget).toBe(5_000_000_000n)
+  expect(key.remaining).toBe(5_000_000_000n)
+  const days = ((key.expiresAt ?? 0) - Date.now()) / 86_400_000
+  expect(days).toBeGreaterThan(89)
+  expect(days).toBeLessThan(91)
+
+  // Nothing key-like is left in localStorage; the vault holds only ciphertext.
+  const ls = await page.evaluate(() => Object.entries(localStorage).map(([k, v]) => `${k}=${v}`).join('\n'))
+  expect(ls).not.toMatch(/forge_key_/)
+  expect(ls).not.toMatch(/\bc[1-9A-HJ-NP-Za-km-z]{51}\b/)
+
+  await page.reload({ waitUntil: 'domcontentloaded' })
+  await unlock(page)
+  await expect(page.getByTestId('funds-pill')).toBeVisible()
+})
+
+test('a2. create an identity in the browser, funded from the devnet key', async ({ browser }) => {
+  const keyFile = process.env['FORGE_DEVNET_FUNDING_KEY_FILE'] ?? ''
+  test.skip(keyFile === '' || !existsSync(keyFile), 'set FORGE_DEVNET_FUNDING_KEY_FILE to a devnet YAML with faucet_privkey')
+  const funding = await import(pathToFileURL(join(ROOT, 'tools/mint-identity/src/funding.mjs')).href)
+  const config = await import(pathToFileURL(join(ROOT, 'tools/mint-identity/src/config.mjs')).href)
+  const network = config.devnetConfig(E2E_DEVNET)
+
+  const context = await browser.newContext()
+  const page = await context.newPage()
+  await page.goto('/', { waitUntil: 'domcontentloaded' })
+  await page.getByRole('button', { name: /^sign in$/i }).first().click()
+  await page.getByTestId('tile-create').click()
+  const words = page.getByTestId('mnemonic-words')
+  await expect(words).toBeVisible({ timeout: 60_000 })
+  const list = await words.locator('[data-word]').allInnerTexts()
+  expect(list).toHaveLength(12)
+  await shot(page, 'v2a-02-words')
+  await page.getByRole('button', { name: /i wrote them down/i }).click()
+  for (const input of await page.getByLabel(/^Word \d+$/).all()) {
+    const n = Number((await input.getAttribute('id'))?.replace('quiz-', ''))
+    await input.fill(list[n] ?? '')
+  }
+  await page.getByRole('button', { name: /^continue$/i }).click()
+  await page.getByLabel('Passphrase', { exact: true }).fill(PASSPHRASE)
+  await page.getByLabel('Repeat passphrase').fill(PASSPHRASE)
+  await page.getByRole('button', { name: /continue to funding/i }).click()
+
+  const address = (await page.getByTestId('deposit-address').textContent({ timeout: 60_000 }))?.trim() ?? ''
+  expect(address).toMatch(/^y[1-9A-HJ-NP-Za-km-z]{33}$/)
+  await shot(page, 'v2a-03-deposit')
+  const fundingKey = funding.loadFundingKey(network, { keyFile })
+  const fundTx = await funding.fundFromKey(fundingKey, [{ address, duffs: 3_000_000 }], network, () => undefined)
+  test.info().annotations.push({ type: 'funding', description: `${fundTx} → ${address} (0.03 DASH)` })
+
+  // Chain-lock proofs on a devnet wait for a mined, chain-locked block: minutes.
+  await expect(page.getByTestId('funds-pill')).toBeVisible({ timeout: 25 * 60_000 })
+  await page.goto('/settings/', { waitUntil: 'domcontentloaded' })
+  await unlock(page)
+  await expect(page.getByTestId('key-budget')).toContainText('0.05 DASH', { timeout: 30_000 })
+  const identityId = await page.getByTestId('settings-identity').getAttribute('data-identity')
+  test.info().annotations.push({ type: 'identity', description: identityId ?? '' })
+  await shot(page, 'v2a-04-created')
+})
diff --git a/forge-web/e2e/v2-writes.spec.ts b/forge-web/e2e/v2-writes.spec.ts
index 14871b720..64afb7b9d 100644
--- a/forge-web/e2e/v2-writes.spec.ts
+++ b/forge-web/e2e/v2-writes.spec.ts
@@ -1,8 +1,6 @@
-import { test, expect, type Browser, type Page } from '@playwright/test'
+import { test, expect, type Page } from '@playwright/test'
 import { existsSync } from 'node:fs'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-import { E2E_DEVNET, shot } from './helpers'
+import { E2E_DEVNET, idFile, shot, signedIn, unlock } from './helpers'
 
 /**
  * forge-v2 WRITES, live on a devnet (real spend, a few thousandths of a DASH per run):
@@ -17,28 +15,15 @@ import { E2E_DEVNET, shot } from './helpers'
  * its cost preview, and the spend ledger in /settings records it.
  */
 
-const ID_DIR = join(homedir(), '.config/dash-forge/test-identities', `devnet-${E2E_DEVNET}`)
-const idFile = (name: string): string => join(ID_DIR, `${name}.identity.json`)
 const OWNER = '9r27eDsuXEqoMNymW1A2MKFrpBhzSkepVKwXrGzq9dUD'
 const COLLAB = '6jAyDGGcc6fgA7bsraQPriTAZ73Lkq5QgnenaRhqteHd'
 const REPO = `e2e-${Date.now().toString(36)}`
 const ISSUE_TITLE = `Browser-written issue ${REPO}`
 
 test.skip(E2E_DEVNET === '' || process.env['E2E_WRITE'] !== '1', 'live devnet writes: set E2E_DEVNET=moutai E2E_WRITE=1')
-test.skip(!existsSync(idFile('OWNER')), `test identities not found in ${ID_DIR}`)
+test.skip(!existsSync(idFile('OWNER')), 'devnet test identities not found')
 test.describe.configure({ mode: 'serial', timeout: 240_000 })
 
-/** A fresh browser context signed in as `name` (identity-file import). */
-async function signedIn(browser: Browser, name: string, path = '/'): Promise<Page> {
-  const context = await browser.newContext()
-  const page = await context.newPage()
-  await page.goto(path, { waitUntil: 'domcontentloaded' })
-  await page.getByRole('button', { name: /^sign in$/i }).first().click()
-  await page.setInputFiles('input[type="file"]', idFile(name))
-  await expect(page.getByTestId('funds-pill')).toBeVisible({ timeout: 90_000 })
-  return page
-}
-
 /** Confirm the open dialog: it must show a cost, then report success and close. */
 async function confirmWrite(page: Page, label: RegExp): Promise<void> {
   const dialog = page.getByRole('dialog')
@@ -121,8 +106,10 @@ test('w6. owner approves the fixture PR, then removes the writer', async ({ brow
   await confirmWrite(page, /submit review/i)
   await expect(page.getByRole('region', { name: 'Approvals' })).toBeVisible()
 
-  // A full navigation starts a new session (this PR keeps the old keystore): sign in again.
-  const settings = await signedIn(browser, 'OWNER', repoPath('settings'))
+  // A full navigation locks the key; the vault unlocks it again with the passphrase.
+  const settings = page
+  await settings.goto(repoPath('settings'), { waitUntil: 'domcontentloaded' })
+  await unlock(settings)
   await settings.getByRole('button', { name: /^remove$/i }).first().click()
   await confirmWrite(settings, /sign & remove/i)
   await expect(settings.getByText('WRITER', { exact: true })).toHaveCount(0, { timeout: 60_000 })
diff --git a/forge-web/hooks/use-ui-store.ts b/forge-web/hooks/use-ui-store.ts
index f3b53c877..4aed8fcc9 100644
--- a/forge-web/hooks/use-ui-store.ts
+++ b/forge-web/hooks/use-ui-store.ts
@@ -13,9 +13,14 @@ export interface TopUpReason {
   readonly shortfall?: bigint
 }
 
+/** A sign-in sheet view to open on directly (e.g. `import` to renew this browser's key). */
+export type LoginView = 'import' | 'create' | 'wallet'
+
 interface UiState {
   readonly loginOpen: boolean
-  openLogin: () => void
+  /** The view the sheet should open on, or null for its default (Unlock / the tiles). */
+  readonly loginView: LoginView | null
+  openLogin: (view?: LoginView) => void
   closeLogin: () => void
   readonly topUp: TopUpReason | null
   openTopUp: (reason?: TopUpReason) => void
@@ -24,8 +29,9 @@ interface UiState {
 
 export const useUiStore = create<UiState>((set) => ({
   loginOpen: false,
-  openLogin: () => set({ loginOpen: true }),
-  closeLogin: () => set({ loginOpen: false }),
+  loginView: null,
+  openLogin: (view) => set({ loginOpen: true, loginView: view ?? null }),
+  closeLogin: () => set({ loginOpen: false, loginView: null }),
   topUp: null,
   openTopUp: (reason = { blocker: 'balance' }) => set({ topUp: reason }),
   closeTopUp: () => set({ topUp: null }),
diff --git a/forge-web/lib/auth/app-connect.ts b/forge-web/lib/auth/app-connect.ts
new file mode 100644
index 000000000..507349ce3
--- /dev/null
+++ b/forge-web/lib/auth/app-connect.ts
@@ -0,0 +1,247 @@
+/**
+ * "Use my Dash wallet" (`ux-dx-spec.md` §2.2 tile 1): App Connect login, protocol 14.
+ *
+ * The app draws an ephemeral secp256k1 key and shows a `dash-key:` request (QR / deep link)
+ * naming the forge-core contract and the grant it wants. A wallet that approves registers a
+ * limited key on its identity and publishes a `loginKeyResponse` in the App Connect system
+ * contract, under its identity, keyed by `hash160(appEphemeralPub)`. The app polls for it,
+ * derives the shared secret (ECDH x → HKDF-SHA256, salt "dash:key-exchange:v1"), decrypts the
+ * 32-byte login key (AES-256-GCM), derives the auth key (HKDF(loginKey, identityId, "auth")),
+ * and then **verifies on chain** that a live key on the responder's identity is that key, with
+ * AUTHENTICATION/HIGH, the dash-forge group bound, and a budget and expiry.
+ *
+ * Who answered is NOT proven by the response (`app-connect.md`, step 3): anyone who saw the QR
+ * can answer from their own identity. So the flow shows the full identity id and DPNS name and
+ * asks the user to confirm it is theirs, and refuses outright when more than one identity
+ * answered validly. (The v1 response schema has no field for a wallet signature over the
+ * request; when one exists, verify it here.)
+ *
+ * The crypto is the Yappr key-exchange envelope the Dash wallets already speak.
+ */
+
+import * as secp from '@noble/secp256k1'
+import { hkdf } from '@noble/hashes/hkdf.js'
+import { sha256 } from '@noble/hashes/sha2.js'
+
+import type { Network } from '../constants'
+import { base58Decode, base58Encode } from './base58'
+import { hash160 } from './asset-lock'
+import { encodeWif } from './wif'
+import { verifyLimitedKey } from './limited-key'
+import type { KeyLimits } from '../view/funds'
+import { authSdk, sleep } from '../sdk/facade'
+
+/** The App Connect system contract (the same id on every network, protocol 14). */
+export const APP_CONNECT_CONTRACT_ID = 'H8F9mP1BM55TE1ShsxPZHzhyinaMdY9bMmP85mkDhcJJ'
+
+const enc = new TextEncoder()
+
+export interface AppConnectRequest {
+  /** The `dash-key:` URI to show as a QR and a deep link. */
+  readonly uri: string
+  /** Six digits the wallet shows too (pairing check). */
+  readonly pairingCode: string
+  readonly appEphemeralPubKeyHash: Uint8Array
+  /** Held only in memory; zeroed by {@link disposeRequest}. */
+  readonly appEphemeralPriv: Uint8Array
+}
+
+function networkTag(network: Network): string {
+  return network === 'mainnet' ? 'm' : network === 'testnet' ? 't' : 'd'
+}
+
+/**
+ * A fresh request. The payload is the key-exchange request: version(1) ‖ appEphemeralPub(33) ‖
+ * scope(32) ‖ keyIndex(u32 LE) ‖ labelLen(1) ‖ label. `scope` is the dash-forge **contract
+ * group** id: the key Forge accepts is bound to the group, not to one contract, so that is what
+ * the wallet must be asked for.
+ */
+export function newRequest(network: Network, groupId: string, label = 'Sign in to Dash Forge'): AppConnectRequest {
+  const priv = secp.utils.randomSecretKey()
+  const pub = secp.getPublicKey(priv, true)
+  const labelBytes = enc.encode(label).slice(0, 64)
+  const body = new Uint8Array(1 + 33 + 32 + 4 + 1 + labelBytes.length)
+  body[0] = 1
+  body.set(pub, 1)
+  body.set(base58Decode(groupId), 34)
+  body[70] = labelBytes.length
+  body.set(labelBytes, 71)
+  const pubHash = hash160(pub)
+  const digest = pubHash.slice(0, 4)
+  const code = (((digest[0] as number) << 24) | ((digest[1] as number) << 16) | ((digest[2] as number) << 8) | (digest[3] as number)) >>> 0
+  return {
+    uri: `dash-key:${base58Encode(body)}?n=${networkTag(network)}&v=1`,
+    pairingCode: String(code % 1_000_000).padStart(6, '0'),
+    appEphemeralPubKeyHash: pubHash,
+    appEphemeralPriv: priv,
+  }
+}
+
+export function disposeRequest(req: AppConnectRequest): void {
+  req.appEphemeralPriv.fill(0)
+}
+
+/** Decrypt a wallet response's payload into the 32-byte login key. */
+export async function openResponse(req: AppConnectRequest, walletEphemeralPub: Uint8Array, encryptedPayload: Uint8Array): Promise<Uint8Array> {
+  const shared = secp.getSharedSecret(req.appEphemeralPriv, walletEphemeralPub, true).slice(1, 33)
+  const key = hkdf(sha256, shared, enc.encode('dash:key-exchange:v1'), new Uint8Array(0), 32)
+  shared.fill(0)
+  const k = await crypto.subtle.importKey('raw', new Uint8Array(key), { name: 'AES-GCM' }, false, ['decrypt'])
+  key.fill(0)
+  const nonce = encryptedPayload.slice(0, 12)
+  const ct = encryptedPayload.slice(12)
+  const plain = new Uint8Array(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce }, k, ct))
+  if (plain.length < 32) throw new Error('the wallet response is malformed')
+  return plain.slice(0, 32)
+}
+
+/** The auth private key a login key stands for: HKDF(loginKey, identityId, "auth"). */
+export function authKeyFromLogin(loginKey: Uint8Array, identityId: string): Uint8Array {
+  return hkdf(sha256, loginKey, base58Decode(identityId), enc.encode('auth'), 32)
+}
+
+interface RawResponse {
+  toJSON(): { $ownerId: string; walletEphemeralPubKey: string; encryptedPayload: string }
+}
+
+/** Why a response was skipped: not for us (never retry), or not verifiable yet (retry). */
+class NotOurs extends Error {}
+
+function b64(s: string): Uint8Array {
+  const bin = atob(s)
+  return Uint8Array.from(bin, (c) => c.charCodeAt(0))
+}
+
+/** Whether the App Connect contract exists on this network (hide the tile otherwise). */
+export async function appConnectAvailable(sdk: import('@dashevo/evo-sdk').EvoSDK): Promise<boolean> {
+  try {
+    const c = await authSdk(sdk).contracts.fetch(APP_CONNECT_CONTRACT_ID)
+    return c !== undefined && c !== null
+  } catch {
+    return false
+  }
+}
+
+/** The result of a completed wallet login. */
+export interface WalletLogin {
+  readonly identityId: string
+  readonly keyId: number
+  readonly wif: string
+  readonly limits: KeyLimits
+}
+
+/**
+ * Poll for responses to `req` until one decrypts to a key that is live on its responder's
+ * identity with the Forge bounds (then resolve), or the signal aborts. Responses that do not
+ * decrypt, or whose key is not verifiably a Forge browser key, are skipped.
+ */
+/** More than one identity answered the request with a valid key: refuse (spec: pairing). */
+export class AmbiguousWalletLogin extends Error {
+  constructor(readonly identityIds: readonly string[]) {
+    super(`More than one identity answered this sign-in request (${identityIds.join(', ')}). Someone else saw the QR code. Start again and keep it private.`)
+    this.name = 'AmbiguousWalletLogin'
+  }
+}
+
+export async function awaitWalletLogin(
+  sdk: import('@dashevo/evo-sdk').EvoSDK,
+  req: AppConnectRequest,
+  params: { network: Network; group: string; signal?: AbortSignal; intervalMs?: number; settleMs?: number },
+): Promise<WalletLogin> {
+  // Owners whose response does not decrypt with our key are not answering us: skip them for
+  // good. A response that decrypts but whose key is not verifiable yet (the wallet published
+  // before its key update was visible, or a read failed) is retried on the next poll.
+  const notOurs = new Set<string>()
+  const valid = new Map<string, WalletLogin>()
+  let firstValidAt = 0
+  for (;;) {
+    if (params.signal?.aborted) throw new DOMException('cancelled', 'AbortError')
+    for (const j of await allResponses(sdk, req)) {
+      if (notOurs.has(j.$ownerId) || valid.has(j.$ownerId)) continue
+      try {
+        const wif = await decryptGrant(req, j, params.network)
+        const keyId = await findKeyId(sdk, j.$ownerId, wif, params.network)
+        if (keyId === null) continue
+        const limits = await verifyLimitedKey(sdk, j.$ownerId, keyId, params.group, params.network, wif)
+        valid.set(j.$ownerId, { identityId: j.$ownerId, keyId, wif, limits })
+        if (firstValidAt === 0) firstValidAt = Date.now()
+      } catch (e) {
+        if (e instanceof NotOurs) notOurs.add(j.$ownerId)
+      }
+    }
+    if (valid.size > 1) {
+      disposeRequest(req)
+      throw new AmbiguousWalletLogin([...valid.keys()])
+    }
+    // One valid answer: wait one more poll for a competing one before accepting it.
+    if (valid.size === 1 && Date.now() - firstValidAt >= (params.settleMs ?? 3000)) {
+      disposeRequest(req)
+      return [...valid.values()][0] as WalletLogin
+    }
+    await sleep(params.intervalMs ?? 3000, params.signal)
+  }
+}
+
+/** Every response to `req`, paged by `$ownerId` (junk replies cannot hide the real one). */
+async function allResponses(sdk: import('@dashevo/evo-sdk').EvoSDK, req: AppConnectRequest): Promise<ReturnType<RawResponse['toJSON']>[]> {
+  const hash = btoa(String.fromCharCode(...req.appEphemeralPubKeyHash))
+  const out: ReturnType<RawResponse['toJSON']>[] = []
+  let after: string | null = null
+  for (let page = 0; page < 20; page++) {
+    let rows: Map<string, unknown>
+    try {
+      rows = await authSdk(sdk).documents.query({
+        dataContractId: APP_CONNECT_CONTRACT_ID,
+        documentTypeName: 'loginKeyResponse',
+        where: [['appEphemeralPubKeyHash', '==', hash], ...(after ? [['$ownerId', '>', after]] : [])],
+        orderBy: [
+          ['appEphemeralPubKeyHash', 'asc'],
+          ['$ownerId', 'asc'],
+        ],
+        limit: 50,
+      })
+    } catch {
+      break
+    }
+    const batch = [...rows.values()].filter(Boolean).map((r) => (r as RawResponse).toJSON())
+    out.push(...batch)
+    if (batch.length < 50) break
+    after = batch[batch.length - 1]?.$ownerId ?? null
+  }
+  return out
+}
+
+async function decryptGrant(req: AppConnectRequest, j: ReturnType<RawResponse['toJSON']>, network: Network): Promise<string> {
+  let login: Uint8Array
+  try {
+    login = await openResponse(req, b64(j.walletEphemeralPubKey), b64(j.encryptedPayload))
+  } catch {
+    throw new NotOurs()
+  }
+  const auth = authKeyFromLogin(login, j.$ownerId)
+  login.fill(0)
+  const wif = encodeWif(auth, network)
+  auth.fill(0)
+  return wif
+}
+
+/** Which key on `identityId` the WIF controls (the wallet may register it as HASH160). */
+async function findKeyId(sdk: import('@dashevo/evo-sdk').EvoSDK, identityId: string, wif: string, network: Network): Promise<number | null> {
+  const { PrivateKey } = await import('@dashevo/evo-sdk')
+  const identity = await authSdk(sdk).identities.fetch(identityId)
+  const pk = PrivateKey.fromWIF(wif)
+  const bytes = pk.toBytes()
+  pk.free()
+  try {
+    for (const k of identity?.publicKeys ?? []) {
+      try {
+        if (k.validatePrivateKey(bytes, network)) return k.keyId
+      } catch {
+        /* other key types */
+      }
+    }
+    return null
+  } finally {
+    bytes.fill(0)
+  }
+}
diff --git a/forge-web/lib/auth/asset-lock.ts b/forge-web/lib/auth/asset-lock.ts
new file mode 100644
index 000000000..af7696589
--- /dev/null
+++ b/forge-web/lib/auth/asset-lock.ts
@@ -0,0 +1,417 @@
+/**
+ * Core-chain side of creating an identity in the browser (`ux-dx-spec.md` §2.2 tile 2), ported
+ * from `tools/mint-identity` (tx.mjs, lock.mjs, insight.mjs):
+ *
+ *   1. watch the deposit address through a block explorer (Insight; configurable) until funds
+ *      arrive;
+ *   2. build and sign a type-8 asset-lock transaction spending them to one credit output
+ *      controlled by the asset-lock key, and broadcast it;
+ *   3. prove the lock: an InstantSend lock where a public `getislocks` endpoint exists
+ *      (testnet), else a chain-lock proof once Platform's chain-locked Core height reaches the
+ *      transaction's block (devnets).
+ *
+ * The explorer is not trusted with amounts. It lists which outputs pay the deposit address,
+ * but every input is re-derived from its raw funding transaction — fetched, hashed and checked
+ * against the txid, then parsed for the output's value and script — before anything is
+ * signed. (The legacy sighash does not commit to input values: trusting the explorer's
+ * amounts would let a lying one turn the deposit into miner fees.) With that, an explorer can
+ * delay the user or hide funds, but not take them or learn a key.
+ *
+ * Broadcast goes to the explorer: the evo-sdk exposes no DAPI Core broadcast. A lying explorer
+ * can drop the transaction, which only delays; the signed bytes are journaled and re-sent.
+ */
+
+import * as secp from '@noble/secp256k1'
+import { hmac } from '@noble/hashes/hmac.js'
+import { ripemd160 } from '@noble/hashes/legacy.js'
+import { sha256 } from '@noble/hashes/sha2.js'
+import { bytesToHex, concatBytes, hexToBytes } from '@noble/hashes/utils.js'
+
+import { ACTIVE_NETWORK, type Network } from '../constants'
+import { sleep } from '../sdk/facade'
+import { base58CheckDecode } from './base58'
+import { decodeWif } from './wif'
+
+// @noble/secp256k1 v3 needs sync hashes wired for sign/getPublicKey.
+secp.hashes.sha256 = sha256
+secp.hashes.hmacSha256 = (k, m) => hmac(sha256, k, m)
+
+/** Explorer + lock-proof endpoints per network. */
+export interface CoreEndpoints {
+  readonly insight: string
+  /** JSON-RPC with `getislocks` (InstantSend proof), or null to use chain-lock proofs. */
+  readonly islockRpc: string | null
+}
+
+/** Where Settings stores a user-chosen block explorer (Insight API base URL). */
+export const INSIGHT_OVERRIDE_KEY = 'forge:insight-url'
+
+/** The endpoints this build uses (Settings may override the explorer, spec §2.2). */
+export function coreEndpoints(network: Network = ACTIVE_NETWORK.network): CoreEndpoints {
+  const override = typeof window !== 'undefined' ? window.localStorage.getItem(INSIGHT_OVERRIDE_KEY) : null
+  if (network === 'devnet') {
+    return { insight: override ?? `https://insight.${ACTIVE_NETWORK.devnetName}.networks.dash.org/insight-api`, islockRpc: null }
+  }
+  if (network === 'testnet') {
+    return { insight: override ?? 'https://insight.testnet.networks.dash.org/insight-api', islockRpc: 'https://trpc.digitalcash.dev' }
+  }
+  return { insight: override ?? 'https://insight.dash.org/insight-api', islockRpc: null }
+}
+
+// ---------------------------------------------------------------------------
+// Insight
+// ---------------------------------------------------------------------------
+
+export interface Utxo {
+  readonly txid: string
+  readonly vout: number
+  readonly satoshis: number
+  readonly scriptPubKey: string
+  readonly confirmations: number
+}
+
+async function getJson<T>(url: string, init?: RequestInit): Promise<T> {
+  const res = await fetch(url, init)
+  if (!res.ok) throw new Error(`${new URL(url).host}: HTTP ${res.status}`)
+  return (await res.json()) as T
+}
+
+export async function getUtxos(ep: CoreEndpoints, address: string): Promise<Utxo[]> {
+  const rows = await getJson<Utxo[]>(`${ep.insight}/addr/${address}/utxo`)
+  return rows.map((u) => ({ txid: u.txid, vout: u.vout, satoshis: u.satoshis, scriptPubKey: u.scriptPubKey, confirmations: u.confirmations ?? 0 }))
+}
+
+/** The value and script of each output of a raw transaction (Dash; special payload skipped). */
+export function parseOutputs(raw: Uint8Array): { value: bigint; script: Uint8Array }[] {
+  let at = 0
+  const need = (n: number): void => {
+    if (at + n > raw.length) throw new Error('truncated transaction')
+  }
+  const u8 = (): number => {
+    need(1)
+    return raw[at++] as number
+  }
+  const bytes = (n: number): Uint8Array => {
+    need(n)
+    const b = raw.slice(at, at + n)
+    at += n
+    return b
+  }
+  const varint = (): number => {
+    const first = u8()
+    if (first < 0xfd) return first
+    const b = bytes(first === 0xfd ? 2 : first === 0xfe ? 4 : 8)
+    let n = 0
+    for (let i = b.length - 1; i >= 0; i--) n = n * 256 + (b[i] as number)
+    return n
+  }
+  bytes(4) // version | type
+  const inputs = varint()
+  for (let i = 0; i < inputs; i++) {
+    bytes(36)
+    bytes(varint())
+    bytes(4)
+  }
+  const count = varint()
+  const out: { value: bigint; script: Uint8Array }[] = []
+  for (let i = 0; i < count; i++) {
+    const v = bytes(8)
+    let value = 0n
+    for (let j = 7; j >= 0; j--) value = value * 256n + BigInt(v[j] as number)
+    out.push({ value, script: bytes(varint()) })
+  }
+  return out
+}
+
+/**
+ * The deposit's spendable outputs, each proven from its raw funding transaction: the raw
+ * bytes must hash to the txid the explorer named, and the value and script come from those
+ * bytes. Outputs that do not pay `address`'s P2PKH script are dropped.
+ */
+export async function verifiedUtxos(ep: CoreEndpoints, address: string, listed: readonly Utxo[]): Promise<Utxo[]> {
+  const script = bytesToHex(p2pkh(addressHash(address)))
+  const out: Utxo[] = []
+  const rawCache = new Map<string, Uint8Array>()
+  for (const u of listed) {
+    let raw = rawCache.get(u.txid)
+    if (!raw) {
+      raw = hexToBytes((await getJson<{ rawtx: string }>(`${ep.insight}/rawtx/${u.txid}`)).rawtx)
+      if (txid(raw) !== u.txid) throw new Error(`the block explorer returned a transaction that is not ${u.txid}`)
+      rawCache.set(u.txid, raw)
+    }
+    const o = parseOutputs(raw)[u.vout]
+    if (!o || bytesToHex(o.script) !== script) continue
+    if (o.value > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error('deposit output too large')
+    out.push({ ...u, satoshis: Number(o.value), scriptPubKey: script })
+  }
+  return out
+}
+
+export async function getTxHeight(ep: CoreEndpoints, txid: string): Promise<number | null> {
+  const tx = await getJson<{ blockheight?: number }>(`${ep.insight}/tx/${txid}`)
+  return typeof tx.blockheight === 'number' && tx.blockheight >= 0 ? tx.blockheight : null
+}
+
+export async function broadcastTx(ep: CoreEndpoints, rawHex: string, txid: string): Promise<void> {
+  try {
+    await getJson(`${ep.insight}/tx/send`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ rawtx: rawHex }),
+    })
+  } catch (e) {
+    // A lost response can hide an accepted broadcast: never strand the deposit over it.
+    const known = await getJson(`${ep.insight}/tx/${txid}`).then(
+      () => true,
+      () => false,
+    )
+    if (!known) throw e
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Keys and addresses
+// ---------------------------------------------------------------------------
+
+export function hash160(b: Uint8Array): Uint8Array {
+  return ripemd160(sha256(b))
+}
+
+function hash256(b: Uint8Array): Uint8Array {
+  return sha256(sha256(b))
+}
+
+/** Private key bytes from a WIF (compressed keys only). */
+export function wifBytes(wif: string): Uint8Array {
+  const d = decodeWif(wif)
+  if (!d.compressed) throw new Error('uncompressed keys are not supported')
+  return d.privateKey
+}
+
+/** P2PKH address → its 20-byte pubkey hash. */
+function addressHash(address: string): Uint8Array {
+  return base58CheckDecode(address).slice(1)
+}
+
+// ---------------------------------------------------------------------------
+// Transactions (Dash special tx v3; type 8 = asset lock)
+// ---------------------------------------------------------------------------
+
+interface TxIn {
+  readonly txid: Uint8Array
+  readonly vout: number
+  scriptSig: Uint8Array
+}
+interface TxOut {
+  readonly value: bigint
+  readonly script: Uint8Array
+}
+interface Tx {
+  readonly type: number
+  vin: TxIn[]
+  readonly vout: TxOut[]
+  readonly payload: Uint8Array
+}
+
+function varint(n: number): Uint8Array {
+  if (n < 0xfd) return Uint8Array.of(n)
+  if (n <= 0xffff) return Uint8Array.of(0xfd, n & 0xff, n >> 8)
+  const b = new Uint8Array(5)
+  b[0] = 0xfe
+  new DataView(b.buffer).setUint32(1, n, true)
+  return b
+}
+function u32(n: number): Uint8Array {
+  const b = new Uint8Array(4)
+  new DataView(b.buffer).setUint32(0, n >>> 0, true)
+  return b
+}
+function i64(n: bigint): Uint8Array {
+  const b = new Uint8Array(8)
+  new DataView(b.buffer).setBigInt64(0, n, true)
+  return b
+}
+function withLen(b: Uint8Array): Uint8Array {
+  return concatBytes(varint(b.length), b)
+}
+function p2pkh(hash: Uint8Array): Uint8Array {
+  return concatBytes(Uint8Array.of(0x76, 0xa9, 0x14), hash, Uint8Array.of(0x88, 0xac))
+}
+function serOut(o: TxOut): Uint8Array {
+  return concatBytes(i64(o.value), withLen(o.script))
+}
+
+function serialize(tx: Tx): Uint8Array {
+  const parts: Uint8Array[] = [u32(3 | (tx.type << 16)), varint(tx.vin.length)]
+  for (const i of tx.vin) parts.push(i.txid, u32(i.vout), withLen(i.scriptSig), u32(0xffffffff))
+  parts.push(varint(tx.vout.length))
+  for (const o of tx.vout) parts.push(serOut(o))
+  parts.push(u32(0))
+  if (tx.type !== 0 && tx.payload.length > 0) parts.push(withLen(tx.payload))
+  return concatBytes(...parts)
+}
+
+export function txid(raw: Uint8Array): string {
+  return bytesToHex(hash256(raw).reverse())
+}
+
+function derSig(compact: Uint8Array): Uint8Array {
+  const int = (b: Uint8Array): Uint8Array => {
+    let i = 0
+    while (i < b.length - 1 && b[i] === 0) i++
+    let v = b.slice(i)
+    if ((v[0] as number) & 0x80) v = concatBytes(Uint8Array.of(0), v)
+    return concatBytes(Uint8Array.of(0x02, v.length), v)
+  }
+  const r = int(compact.slice(0, 32))
+  const s = int(compact.slice(32, 64))
+  return concatBytes(Uint8Array.of(0x30, r.length + s.length), r, s)
+}
+
+/** Sign every input (all P2PKH to the same key), SIGHASH_ALL. */
+function signAll(tx: Tx, utxos: readonly Utxo[], priv: Uint8Array): void {
+  const pub = secp.getPublicKey(priv, true)
+  const signed: Uint8Array[] = []
+  for (let i = 0; i < tx.vin.length; i++) {
+    const copy: Tx = { ...tx, vin: tx.vin.map((v, j) => ({ ...v, scriptSig: j === i ? hexToBytes((utxos[i] as Utxo).scriptPubKey) : new Uint8Array(0) })) }
+    const digest = hash256(concatBytes(serialize(copy), u32(1)))
+    const sig = secp.sign(digest, priv, { prehash: false, lowS: true })
+    const der = concatBytes(derSig(sig), Uint8Array.of(0x01))
+    signed.push(concatBytes(withLen(der), withLen(pub)))
+  }
+  tx.vin = tx.vin.map((v, i) => ({ ...v, scriptSig: signed[i] as Uint8Array }))
+}
+
+/** The fee an asset-lock transaction pays (duffs), per input. */
+const ASSET_LOCK_FEE_PER_INPUT = 1000
+
+/**
+ * Build and sign a type-8 asset lock spending `utxos` (all owned by `priv`) into one credit
+ * output controlled by that same key. Returns the raw transaction and its id.
+ */
+export function buildAssetLock(utxos: readonly Utxo[], priv: Uint8Array): { raw: Uint8Array; txid: string; lockedDuffs: number } {
+  if (utxos.length === 0) throw new Error('no funds to lock')
+  const total = utxos.reduce((s, u) => s + u.satoshis, 0)
+  const fee = ASSET_LOCK_FEE_PER_INPUT * utxos.length
+  const locked = total - fee
+  if (locked <= 0) throw new Error('deposit too small to cover the fee')
+  // Every input's script must be the lock key's own P2PKH (verifiedUtxos checked the values).
+  const own = bytesToHex(p2pkh(hash160(secp.getPublicKey(priv, true))))
+  if (utxos.some((u) => u.scriptPubKey !== own)) throw new Error('an input is not paid to the deposit key')
+  if (locked + fee !== total) throw new Error('asset-lock fee mismatch')
+  const pubHash = hash160(secp.getPublicKey(priv, true))
+  const payload = concatBytes(Uint8Array.of(1), varint(1), serOut({ value: BigInt(locked), script: p2pkh(pubHash) }))
+  const tx: Tx = {
+    type: 8,
+    vin: utxos.map((u) => ({ txid: hexToBytes(u.txid).reverse(), vout: u.vout, scriptSig: new Uint8Array(0) })),
+    vout: [{ value: BigInt(locked), script: Uint8Array.of(0x6a, 0x00) }],
+    payload,
+  }
+  signAll(tx, utxos, priv)
+  const raw = serialize(tx)
+  return { raw, txid: txid(raw), lockedDuffs: locked }
+}
+
+/** A plain P2PKH payment (the test harness funds a deposit address with it). */
+export function buildPayment(
+  utxos: readonly Utxo[],
+  priv: Uint8Array,
+  to: { address: string; duffs: number },
+  changeAddress: string,
+  fee = 2000,
+): { raw: Uint8Array; txid: string } {
+  const total = utxos.reduce((s, u) => s + u.satoshis, 0)
+  const change = total - to.duffs - fee
+  if (change < 0) throw new Error('insufficient funds')
+  const vout: TxOut[] = [{ value: BigInt(to.duffs), script: p2pkh(addressHash(to.address)) }]
+  if (change > 546) vout.push({ value: BigInt(change), script: p2pkh(addressHash(changeAddress)) })
+  const tx: Tx = {
+    type: 0,
+    vin: utxos.map((u) => ({ txid: hexToBytes(u.txid).reverse(), vout: u.vout, scriptSig: new Uint8Array(0) })),
+    vout,
+    payload: new Uint8Array(0),
+  }
+  signAll(tx, utxos, priv)
+  const raw = serialize(tx)
+  return { raw, txid: txid(raw) }
+}
+
+// ---------------------------------------------------------------------------
+// Lock proofs
+// ---------------------------------------------------------------------------
+
+export type LockProof =
+  | { readonly type: 'instant'; readonly txid: string; readonly raw: Uint8Array; readonly islock: Uint8Array }
+  | { readonly type: 'chain'; readonly txid: string; readonly height: number }
+
+async function fetchIslock(rpc: string, id: string): Promise<Uint8Array | null> {
+  const res = await fetch(rpc, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ method: 'getislocks', params: [[id]] }),
+  })
+  if (!res.ok) return null
+  const data = (await res.json()) as { result?: { txid?: string; hex?: string }[] }
+  const hit = data.result?.find((r) => r?.txid === id && r.hex)
+  return hit?.hex ? hexToBytes(hit.hex) : null
+}
+
+/**
+ * Wait until the asset lock is provable: an InstantSend lock where the network offers one
+ * (up to 90 s), else a chain-lock proof once the tx is mined and Platform's chain-locked Core
+ * height reaches it (`platformChainLockedHeight` is read from Platform status).
+ */
+export async function obtainLockProof(
+  ep: CoreEndpoints,
+  lock: { txid: string; raw: Uint8Array },
+  platformChainLockedHeight: () => Promise<number | null>,
+  opts: { signal?: AbortSignal; onStatus?: (s: string) => void; timeoutMs?: number } = {},
+): Promise<LockProof> {
+  const deadline = Date.now() + (opts.timeoutMs ?? 20 * 60 * 1000)
+  if (ep.islockRpc) {
+    opts.onStatus?.('Waiting for InstantSend…')
+    const until = Date.now() + 90_000
+    while (Date.now() < until) {
+      const islock = await fetchIslock(ep.islockRpc, lock.txid).catch(() => null)
+      if (islock) return { type: 'instant', txid: lock.txid, raw: lock.raw, islock }
+      await sleep(3000, opts.signal)
+    }
+  }
+  let height: number | null = null
+  while (Date.now() < deadline) {
+    if (height === null) {
+      opts.onStatus?.('Waiting for the deposit to be mined…')
+      height = await getTxHeight(ep, lock.txid).catch(() => null)
+    }
+    if (height !== null) {
+      opts.onStatus?.(`Mined at ${height}; waiting for Platform to chain-lock it…`)
+      const clh = await platformChainLockedHeight().catch(() => null)
+      if (clh !== null && clh >= height) return { type: 'chain', txid: lock.txid, height }
+    }
+    await sleep(5000, opts.signal)
+  }
+  throw new Error('timed out waiting for the asset lock to be provable; it is saved — try again later')
+}
+
+/** Wait until `address` holds at least `minDuffs` (polling the explorer). */
+export async function waitForDeposit(
+  ep: CoreEndpoints,
+  address: string,
+  minDuffs: number,
+  opts: { signal?: AbortSignal; onSeen?: (duffs: number) => void; intervalMs?: number } = {},
+): Promise<Utxo[]> {
+  for (;;) {
+    const listed = await getUtxos(ep, address).catch(() => [] as Utxo[])
+    const claimed = listed.reduce((s, u) => s + u.satoshis, 0)
+    if (claimed >= minDuffs && listed.length > 0) {
+      // The explorer says it is there: prove each output from its raw transaction.
+      const utxos = await verifiedUtxos(ep, address, listed)
+      const total = utxos.reduce((s, u) => s + u.satoshis, 0)
+      opts.onSeen?.(total)
+      if (total >= minDuffs) return utxos
+    } else {
+      opts.onSeen?.(claimed)
+    }
+    await sleep(opts.intervalMs ?? 4000, opts.signal)
+  }
+}
diff --git a/forge-web/lib/auth/auth-v2.test.ts b/forge-web/lib/auth/auth-v2.test.ts
new file mode 100644
index 000000000..ba2733562
--- /dev/null
+++ b/forge-web/lib/auth/auth-v2.test.ts
@@ -0,0 +1,257 @@
+/**
+ * Limited-key sign-in, offline: the vault's encryption and unlock rules, the App Connect
+ * envelope, the asset-lock transaction, and the identity-file master-key extraction.
+ */
+
+import * as secp from '@noble/secp256k1'
+import { hkdf } from '@noble/hashes/hkdf.js'
+import { sha256 } from '@noble/hashes/sha2.js'
+import { bytesToHex } from '@noble/hashes/utils.js'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { idbEntries, resetMemoryStores } from '../idb'
+import {
+  VaultLockedError,
+  forgetVault,
+  listVaults,
+  lockVault,
+  prfKey,
+  sharedOriginProblem,
+  storeInVault,
+  unlockWithPassphrase,
+  unlockedSecret,
+} from './vault'
+import { authKeyFromLogin, newRequest, openResponse } from './app-connect'
+import { buildAssetLock, buildPayment, hash160, txid, verifiedUtxos, type Utxo } from './asset-lock'
+import { masterMaterialFromFile } from './identity-file'
+import { base58CheckEncode, base58Decode, base58Encode } from './base58'
+import { encodeWif } from './wif'
+import { purgeLegacyKeystore } from './controller'
+
+const ID = '9r27eDsuXEqoMNymW1A2MKFrpBhzSkepVKwXrGzq9dUD'
+const WIF = encodeWif(new Uint8Array(32).fill(7), 'devnet')
+const SECRET = { identityId: ID, keyId: 5, wif: WIF }
+
+describe('vault', () => {
+  beforeEach(() => {
+    resetMemoryStores()
+    lockVault()
+  })
+
+  it('never stores the key in plaintext', async () => {
+    await storeInVault('devnet', SECRET, { passphrase: 'correct horse battery' })
+    const rows = await idbEntries<Record<string, unknown>>('vault')
+    const dump = JSON.stringify(rows, (_k, v: unknown) => (v instanceof Uint8Array ? bytesToHex(v) : v))
+    expect(dump).not.toContain(WIF)
+    expect(dump).not.toContain(bytesToHex(new Uint8Array(32).fill(7)))
+    expect(dump).not.toContain('correct horse')
+  }, 30_000)
+
+  it('unlocks with the right passphrase only, and locks again', async () => {
+    await storeInVault('devnet', SECRET, { passphrase: 'correct horse battery' })
+    lockVault()
+    expect(unlockedSecret('devnet', ID)).toBeNull()
+    await expect(unlockWithPassphrase('devnet', ID, 'wrong passphrase!!')).rejects.toBeInstanceOf(VaultLockedError)
+    expect(await unlockWithPassphrase('devnet', ID, 'correct horse battery')).toEqual(SECRET)
+    expect(unlockedSecret('devnet', ID)?.wif).toBe(WIF)
+    expect(unlockedSecret('testnet', ID)).toBeNull()
+    lockVault()
+    expect(unlockedSecret('devnet', ID)).toBeNull()
+  }, 60_000)
+
+  it('refuses short passphrases and an unprotected vault', async () => {
+    await expect(storeInVault('devnet', SECRET, { passphrase: 'short' })).rejects.toThrow(/at least/)
+    await expect(storeInVault('devnet', SECRET, {})).rejects.toThrow(/passphrase or a passkey/)
+  })
+
+  it('binds a record to its network and identity (a copied record does not open)', async () => {
+    await storeInVault('devnet', SECRET, { passphrase: 'correct horse battery' })
+    const [[, record]] = (await idbEntries<Record<string, unknown>>('vault')) as [[string, Record<string, unknown>]]
+    const { idbPut } = await import('../idb')
+    const other = '6jAyDGGcc6fgA7bsraQPriTAZ73Lkq5QgnenaRhqteHd'
+    await idbPut('vault', `vault:devnet:${other}`, { ...record, identityId: other })
+    await expect(unlockWithPassphrase('devnet', other, 'correct horse battery')).rejects.toBeInstanceOf(VaultLockedError)
+  }, 60_000)
+
+  it('lists vaults without secrets and forgets them', async () => {
+    await storeInVault('devnet', SECRET, { passphrase: 'correct horse battery' })
+    expect(await listVaults('devnet')).toEqual([expect.objectContaining({ identityId: ID, keyId: 5, methods: ['passphrase'] })])
+    await forgetVault('devnet', ID)
+    expect(await listVaults('devnet')).toEqual([])
+  }, 30_000)
+
+  it('refuses shared origins (Pages project sites, IPFS path gateways) but not dedicated ones', () => {
+    expect(sharedOriginProblem({ hostname: 'pastapastapasta.github.io', pathname: '/dash-forge/' })).toMatch(/dedicated origin/)
+    expect(sharedOriginProblem({ hostname: 'ipfs.io', pathname: '/ipfs/bafy/' })).toMatch(/dedicated origin/)
+    expect(sharedOriginProblem({ hostname: 'gw.example', pathname: '/ipns/forge.eth/' })).toMatch(/dedicated origin/)
+    expect(sharedOriginProblem({ hostname: 'forge.dashhq.org', pathname: '/' })).toBeNull()
+    expect(sharedOriginProblem({ hostname: 'bafy.ipfs.dweb.link', pathname: '/' })).toBeNull()
+    expect(sharedOriginProblem({ hostname: '127.0.0.1', pathname: '/settings/' })).toBeNull()
+  })
+
+  it('stretches a passkey PRF output per identity', () => {
+    const out = new Uint8Array(32).fill(1)
+    expect(bytesToHex(prfKey(out, 'devnet', ID))).not.toBe(bytesToHex(prfKey(out, 'devnet', 'other')))
+    expect(bytesToHex(prfKey(out, 'devnet', ID))).not.toBe(bytesToHex(out))
+  })
+
+  it('purges keys an earlier build left in localStorage', () => {
+    const store = new Map<string, string>([['forge_key_devnet_pk_x', WIF], ['theme', 'dark']])
+    const ls = {
+      get length() {
+        return store.size
+      },
+      key: (i: number) => [...store.keys()][i] ?? null,
+      removeItem: (k: string) => void store.delete(k),
+    }
+    ;(globalThis as { window?: unknown }).window = { localStorage: ls }
+    try {
+      purgeLegacyKeystore()
+    } finally {
+      delete (globalThis as { window?: unknown }).window
+    }
+    expect([...store.keys()]).toEqual(['theme'])
+  })
+})
+
+describe('App Connect envelope (Yappr key exchange)', () => {
+  it('builds a dash-key request that carries the ephemeral key and contract', () => {
+    const contract = 'GM7ozWV1MNuAxyMnrf4JngAyGSDickvLznGi72WMp8EL'
+    const req = newRequest('devnet', contract)
+    expect(req.uri).toMatch(/^dash-key:[1-9A-HJ-NP-Za-km-z]+\?n=d&v=1$/)
+    const body = base58Decode(req.uri.slice('dash-key:'.length, req.uri.indexOf('?')))
+    expect(body[0]).toBe(1)
+    const pub = body.slice(1, 34)
+    expect(bytesToHex(hash160(pub))).toBe(bytesToHex(req.appEphemeralPubKeyHash))
+    expect(base58Encode(body.slice(34, 66))).toBe(contract)
+    expect(req.pairingCode).toMatch(/^\d{6}$/)
+  })
+
+  it('opens what a wallet seals, and derives the auth key', async () => {
+    const req = newRequest('devnet', 'GM7ozWV1MNuAxyMnrf4JngAyGSDickvLznGi72WMp8EL')
+    const appPub = base58Decode(req.uri.slice(9, req.uri.indexOf('?'))).slice(1, 34)
+    // The wallet side (BrowserLoginKeyProtocol.seal).
+    const walletPriv = secp.utils.randomSecretKey()
+    const walletPub = secp.getPublicKey(walletPriv, true)
+    const sharedX = secp.getSharedSecret(walletPriv, appPub, true).slice(1, 33)
+    const aes = hkdf(sha256, sharedX, new TextEncoder().encode('dash:key-exchange:v1'), new Uint8Array(0), 32)
+    const loginKey = new Uint8Array(32).fill(9)
+    const iv = new Uint8Array(12).fill(3)
+    const k = await crypto.subtle.importKey('raw', aes, { name: 'AES-GCM' }, false, ['encrypt'])
+    const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, k, loginKey))
+    const payload = new Uint8Array([...iv, ...ct])
+    expect(payload.length).toBe(60)
+    expect(await openResponse(req, walletPub, payload)).toEqual(loginKey)
+    const expected = hkdf(sha256, loginKey, base58Decode(ID), new TextEncoder().encode('auth'), 32)
+    expect(authKeyFromLogin(loginKey, ID)).toEqual(expected)
+    // A tampered payload fails authentication.
+    payload[20] = (payload[20] as number) ^ 1
+    await expect(openResponse(req, walletPub, payload)).rejects.toBeTruthy()
+  })
+})
+
+describe('asset-lock transaction', () => {
+  afterEach(() => vi.unstubAllGlobals())
+
+  it('locks the deposit minus the fee into one credit output with a valid signature', () => {
+    const priv = new Uint8Array(32).fill(5)
+    const pub = secp.getPublicKey(priv, true)
+    const script = `76a914${bytesToHex(hash160(pub))}88ac`
+    const utxo: Utxo = { txid: 'ab'.repeat(32), vout: 1, satoshis: 5_000_000, scriptPubKey: script, confirmations: 3 }
+    const lock = buildAssetLock([utxo], priv)
+    expect(lock.lockedDuffs).toBe(4_999_000)
+    expect(lock.txid).toBe(txid(lock.raw))
+    const hex = bytesToHex(lock.raw)
+    // version 3, type 8
+    expect(hex.startsWith('03000800')).toBe(true)
+    // OP_RETURN output of the locked amount, and the payload's P2PKH credit output
+    expect(hex).toContain('02' + '6a00')
+    expect(hex).toContain(`1976a914${bytesToHex(hash160(pub))}88ac`)
+    expect(hex).toContain(bytesToHex(pub))
+  })
+
+  it('is byte-identical to tools/mint-identity (the proven Node implementation)', () => {
+    const priv = new Uint8Array(32).fill(5)
+    const pub = secp.getPublicKey(priv, true)
+    const utxo: Utxo = { txid: 'ab'.repeat(32), vout: 1, satoshis: 5_000_000, scriptPubKey: `76a914${bytesToHex(hash160(pub))}88ac`, confirmations: 1 }
+    const lock = buildAssetLock([utxo], priv)
+    // mint-identity createAssetLockTransaction(utxo, pub, 1000n) + signTransaction, RFC 6979.
+    expect(bytesToHex(lock.raw)).toBe(
+      '0300080001abababababababababababababababababababababababababababababababab010000006b483045022100a82f838bc838daf2a4391b133acad5fff55d7daa849467b08cd9897799de565202207d0722d008d64ce8161db287a3bf03fb7b5591e61f2dec7bc125786837cf2b3c01210362c0a046dacce86ddd0343c6d3c7c79c2208ba0d9c9cf24a6d046d21d21f90f7ffffffff0158474c0000000000026a000000000024010158474c00000000001976a9149d695474a303ac6d74d1796d3752f07895918bd288ac',
+    )
+    expect(lock.txid).toBe('452aa5a12caf5b23d314ac9ae8ef129a283f9a4c72492cff1fc5bf9cfc6d4fff')
+  })
+
+  describe('a lying block explorer', () => {
+    const priv = new Uint8Array(32).fill(5)
+    const pub = secp.getPublicKey(priv, true)
+    const script = `76a914${bytesToHex(hash160(pub))}88ac`
+    const address = base58CheckEncode(new Uint8Array([140, ...hash160(pub)]))
+    // A funding transaction paying 5 DASH to the deposit address (built with the same code).
+    const funding = buildPayment(
+      [{ txid: 'cd'.repeat(32), vout: 0, satoshis: 600_000_000, scriptPubKey: script, confirmations: 9 }],
+      priv,
+      { address, duffs: 500_000_000 },
+      address,
+    )
+    const ep = { insight: 'https://explorer.invalid', islockRpc: null }
+    const serve = (rawtx: Uint8Array): void => {
+      vi.stubGlobal('fetch', async (url: string) => ({ ok: true, json: async () => ({ rawtx: bytesToHex(rawtx) }), url }))
+    }
+
+    it('cannot make the lock burn the deposit by under-reporting its value', async () => {
+      serve(funding.raw)
+      const listed: Utxo[] = [{ txid: funding.txid, vout: 0, satoshis: 2_000_000, scriptPubKey: script, confirmations: 1 }]
+      const utxos = await verifiedUtxos(ep, address, listed)
+      expect(utxos[0]?.satoshis).toBe(500_000_000)
+      const lock = buildAssetLock(utxos, priv)
+      expect(lock.lockedDuffs).toBe(500_000_000 - 1000)
+    })
+
+    it('rejects a raw transaction that does not hash to the listed txid', async () => {
+      serve(funding.raw)
+      const listed: Utxo[] = [{ txid: 'ee'.repeat(32), vout: 0, satoshis: 500_000_000, scriptPubKey: script, confirmations: 1 }]
+      await expect(verifiedUtxos(ep, address, listed)).rejects.toThrow(/not ee/)
+    })
+
+    it('drops outputs that do not pay the deposit address', async () => {
+      serve(funding.raw)
+      const listed: Utxo[] = [{ txid: funding.txid, vout: 1, satoshis: 500_000_000, scriptPubKey: script, confirmations: 1 }]
+      // Output 1 is the change back to the same address in this fixture: still ours.
+      expect((await verifiedUtxos(ep, address, listed)).length).toBe(1)
+      const other: Utxo[] = [{ txid: funding.txid, vout: 7, satoshis: 1, scriptPubKey: script, confirmations: 1 }]
+      expect(await verifiedUtxos(ep, address, other)).toEqual([])
+    })
+
+    it('refuses to sign inputs whose script is not the deposit key', () => {
+      expect(() => buildAssetLock([{ txid: 'ab'.repeat(32), vout: 0, satoshis: 5_000_000, scriptPubKey: '76a914' + '00'.repeat(20) + '88ac', confirmations: 1 }], priv)).toThrow(
+        /not paid to the deposit key/,
+      )
+    })
+  })
+
+  it('refuses a deposit that cannot pay its fee', () => {
+    const priv = new Uint8Array(32).fill(5)
+    expect(() => buildAssetLock([{ txid: 'ab'.repeat(32), vout: 0, satoshis: 900, scriptPubKey: '', confirmations: 1 }], priv)).toThrow()
+  })
+})
+
+describe('identity file → master material', () => {
+  it('takes the MASTER authentication key (and the mnemonic), nothing else', () => {
+    const file = JSON.stringify({
+      network: 'devnet-moutai',
+      identityId: ID,
+      mnemonic: 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about',
+      identityKeys: [
+        { id: 0, purpose: 'AUTHENTICATION', securityLevel: 'MASTER', keyType: 'ECDSA_SECP256K1', privateKeyWif: WIF },
+        { id: 1, purpose: 'AUTHENTICATION', securityLevel: 'HIGH', keyType: 'ECDSA_SECP256K1', privateKeyWif: encodeWif(new Uint8Array(32).fill(8), 'devnet') },
+      ],
+    })
+    const m = masterMaterialFromFile(file)
+    expect(m).toEqual({ identityId: ID, networkKey: 'devnet-moutai', masterWif: WIF, mnemonic: expect.stringContaining('abandon') })
+  })
+
+  it('refuses a file with neither a master key nor a mnemonic', () => {
+    expect(() => masterMaterialFromFile(JSON.stringify({ identityId: ID, identityKeys: [] }))).toThrow(/MASTER/)
+  })
+})
diff --git a/forge-web/lib/auth/controller.ts b/forge-web/lib/auth/controller.ts
index 676dc4527..f5d075df2 100644
--- a/forge-web/lib/auth/controller.ts
+++ b/forge-web/lib/auth/controller.ts
@@ -1,14 +1,19 @@
 /**
- * AuthController — the headless identity session for forge-web.
+ * AuthController — the headless identity session for forge-web (`ux-dx-spec.md` §2).
  *
- * Login imports a bridge-format identity file OR a pasted WIF + identity id, stores the signing
- * key in the network-scoped keystore (never in this object's observable state), verifies the key
- * against the on-chain identity, and exposes an observable `{ identity, balance }` snapshot plus a
- * {@link WriteAuth} the WriteEngine consumes. Password-vault / passkey wrapping of the stored key
- * is the documented follow-up; M3 is direct key login.
+ * A session is an identity plus the key this browser signs with. The key is one of:
+ *   - a PV14 **limited key** (the normal case): registered by importing an identity file or
+ *     mnemonic (the master key signs one IdentityUpdate and is not retained), created with a new
+ *     identity, or granted by a wallet through App Connect. It lives encrypted in the
+ *     {@link ./vault} and, unlocked, only in that module's memory;
+ *   - an **advanced raw key** pasted by a developer: held for this tab only (never stored),
+ *     with a warning in the UI.
  *
- * The controller never places a private key in its state or in any log line: the WIF lives only
- * in the keystore, and `getSigningKeyWif()` reads it on demand at signing time.
+ * The controller's observable state never carries key material. `writeAuth.getSigningKeyWif()`
+ * reads the unlocked key at signing time and throws once the vault is locked.
+ *
+ * Earlier builds stored WIFs in plain `localStorage` (`forge_key_*`); on construction every
+ * such entry is deleted.
  */
 
 import type { EvoSDK } from '@dashevo/evo-sdk'
@@ -16,21 +21,29 @@ import type { EvoSDK } from '@dashevo/evo-sdk'
 import type { Network } from '../constants'
 import { DEFAULT_NETWORK, NETWORKS } from '../constants'
 import { errorMessage } from '../utils'
-import { WriteAuthError, findSigningKey, readIdentityBalance, type WriteAuth } from '../sdk/write'
+import { SECURITY_LEVEL, WriteAuthError, findSigningKey, readIdentityBalance, type WriteAuth } from '../sdk/write'
+import { authSdk } from '../sdk/facade'
 import type { KeyLimits } from '../view/funds'
 import { normalizeToWif } from './wif'
+import { identityFileMatchesNetwork, masterMaterialFromFile } from './identity-file'
+import { deriveMasterKey, isValidMnemonic } from './hd'
+import { readKeyLimits, registerLimitedKey, revokeLimitedKey, type LimitedKey, type LimitedKeyRequest } from './limited-key'
 import {
-  identityFileMatchesNetwork,
-  parseIdentityFileText,
-  type ParsedIdentityFile,
-} from './identity-file'
-import {
-  clearPrivateKey,
-  getPrivateKey,
-  hasPrivateKey,
-  storePrivateKey,
-  storedIdentityIds,
-} from './keystore'
+  VaultLockedError,
+  forgetVault,
+  holdForSession,
+  listVaults,
+  lockVault,
+  onVaultLock,
+  clearSignedWrites,
+  storeInVault,
+  unlockWithPasskey,
+  unlockWithPassphrase,
+  unlockedSecret,
+  type Protection,
+  type VaultInfo,
+  type VaultSecret,
+} from './vault'
 
 /** The public (key-free) session snapshot. */
 export interface AuthSession {
@@ -40,6 +53,10 @@ export interface AuthSession {
   readonly network: Network
   /** The signing key's budget and expiry, when it is a PV14 limited key. */
   readonly keyLimits?: KeyLimits | null
+  /** The signing key's id on the identity. */
+  readonly keyId?: number
+  /** `vault`: a stored limited key; `session`: a tab-only key (advanced raw key). */
+  readonly storage: 'vault' | 'session'
 }
 
 /** Observable controller state. Never carries private-key material. */
@@ -49,27 +66,27 @@ export interface AuthState {
   readonly error: string | null
 }
 
-interface IdentitiesFetchFacade {
-  fetch(identityId: string): Promise<
-    | {
-        readonly publicKeys: {
-          keyId: number
-          purposeNumber: number
-          securityLevelNumber: number
-          validatePrivateKey(bytes: Uint8Array, network: string): boolean
-        }[]
-        readonly balance: bigint
-        getPublicKeyById(keyId: number): unknown
-      }
-    | undefined
-  >
-}
-
 type Listener = (state: AuthState) => void
 
 /** How the SDK is obtained — injected so the controller stays testable and SSR-safe. */
 export type SdkProvider = () => Promise<EvoSDK>
 
+/** Delete keys an earlier build left in plain localStorage. */
+export function purgeLegacyKeystore(): void {
+  if (typeof window === 'undefined') return
+  try {
+    const s = window.localStorage
+    const doomed: string[] = []
+    for (let i = 0; i < s.length; i++) {
+      const k = s.key(i)
+      if (k?.startsWith('forge_key_')) doomed.push(k)
+    }
+    for (const k of doomed) s.removeItem(k)
+  } catch {
+    /* storage disabled */
+  }
+}
+
 export class AuthController {
   private state: AuthState = { session: null, isLoading: false, error: null }
   private readonly listeners = new Set<Listener>()
@@ -77,14 +94,21 @@ export class AuthController {
   constructor(
     private readonly getSdk: SdkProvider,
     private readonly network: Network = DEFAULT_NETWORK,
-  ) {}
+  ) {
+    purgeLegacyKeystore()
+    // The 12-hour auto-lock ends the session too, so the UI offers Unlock instead of a
+    // signed-in header whose every write fails.
+    onVaultLock(() => {
+      if (this.state.session?.storage === 'vault' || this.state.session?.storage === 'session') {
+        this.setState({ session: null })
+      }
+    })
+  }
 
-  /** Current state snapshot. */
   getState(): AuthState {
     return this.state
   }
 
-  /** Subscribe to state changes; returns an unsubscribe fn. */
   subscribe(listener: Listener): () => void {
     this.listeners.add(listener)
     return () => {
@@ -97,10 +121,27 @@ export class AuthController {
     for (const l of this.listeners) l(this.state)
   }
 
+  /** The dash-forge contract group this network's keys are bound to. */
+  private group(): string {
+    const v2 = NETWORKS[this.network].v2
+    if (!v2) throw new Error(`forge-v2 is not deployed on ${NETWORKS[this.network].key}: limited keys need its contract group`)
+    return v2.group
+  }
+
+  /** forge-core and forge-collab, which the group must hold. */
+  forgeContracts(): readonly string[] {
+    const v2 = NETWORKS[this.network].v2
+    return v2 ? [v2.core, v2.collab] : []
+  }
+
+  /** Whether this network supports limited keys (protocol 14 + a forge-v2 group). */
+  supportsLimitedKeys(): boolean {
+    return NETWORKS[this.network].v2 !== null
+  }
+
   /**
-   * A {@link WriteAuth} bound to the current session. The WriteEngine calls
-   * `getSigningKeyWif()` at signing time, which reads the keystore — throwing a
-   * {@link WriteAuthError} (never returning null) if the key is absent.
+   * A {@link WriteAuth} bound to the current session. `getSigningKeyWif()` reads the unlocked
+   * key at signing time, throwing a {@link WriteAuthError} when the vault has locked.
    */
   get writeAuth(): WriteAuth | null {
     const session = this.state.session
@@ -111,99 +152,251 @@ export class AuthController {
       identityId,
       network,
       getSigningKeyWif(): string {
-        const wif = getPrivateKey(network, identityId)
-        if (!wif) {
-          throw new WriteAuthError(
-            `no stored signing key for ${identityId} on ${network} — please log in again`,
-          )
-        }
-        return wif
+        const secret = unlockedSecret(network, identityId)
+        if (!secret) throw new WriteAuthError('this browser is locked — unlock it to sign')
+        return secret.wif
       },
     }
   }
 
-  /** Whether a signing key is stored for the given identity on this network. */
-  hasStoredKey(identityId: string): boolean {
-    return hasPrivateKey(this.network, identityId)
+  /** Vaults stored on this device for this network (for the unlock chooser). */
+  storedVaults(): Promise<VaultInfo[]> {
+    return listVaults(this.network)
   }
 
-  /** Identity ids with a stored key on this network (for a "resume session" chooser). */
-  storedIdentities(): string[] {
-    return storedIdentityIds(this.network)
+  private async run<T>(fn: () => Promise<T>): Promise<T> {
+    this.setState({ isLoading: true, error: null })
+    try {
+      const v = await fn()
+      this.setState({ isLoading: false })
+      return v
+    } catch (e) {
+      this.setState({ isLoading: false, error: errorMessage(e) })
+      throw e
+    }
   }
 
   /**
-   * Log in with an identity id + a private key (WIF or hex). The key is normalized to a
-   * network WIF, verified against the on-chain identity's AUTHENTICATION keys, stored, and the
-   * balance loaded. Rejects a key that does not control any usable key on the identity.
+   * Open a session for an unlocked secret: re-verify the key on chain, load balance + limits.
+   * On failure the unlocked key is dropped again, so no key sits in memory without a session.
    */
-  async login(identityId: string, privateKey: string): Promise<AuthSession> {
-    this.setState({ isLoading: true, error: null })
+  private async open(secret: VaultSecret, storage: AuthSession['storage'], knownLimits?: KeyLimits): Promise<AuthSession> {
     try {
-      const wif = normalizeToWif(privateKey, this.network)
       const sdk = await this.getSdk()
-      const identity = await (sdk as unknown as { identities: IdentitiesFetchFacade }).identities.fetch(
-        identityId,
-      )
-      if (!identity) {
-        throw new WriteAuthError(`identity ${identityId} not found on ${this.network}`)
-      }
-      // Require the WIF to control at least one usable (CRITICAL/HIGH) AUTHENTICATION key.
-      const match = await findSigningKey(identity, wif, this.network, 3)
-      if (!match) {
-        throw new WriteAuthError(
-          'the provided key does not match any usable AUTHENTICATION key on this identity',
-        )
+      const identity = await authSdk(sdk).identities.fetch(secret.identityId)
+      if (!identity) throw new WriteAuthError(`identity ${secret.identityId} not found on ${this.network}`)
+      const match = await findSigningKey(identity, secret.wif, this.network, SECURITY_LEVEL.HIGH)
+      if (!match) throw new KeyNotUsableError()
+      // A vault key is a limited key: bound to a group that no longer holds the forge contracts
+      // (they were re-registered), it would open a session whose every write is refused.
+      if (storage === 'vault') {
+        const bounds = identity.publicKeys.find((k) => k.keyId === match.keyId)?.contractBounds?.toJSON()
+        if (bounds?.$type === 'contractGroup' && bounds.id !== this.group()) {
+          throw new KeyNotUsableError("this browser's key is bound to an old dash-forge contract group — renew it")
+        }
       }
-      storePrivateKey(this.network, identityId, wif)
-      const balance = await readIdentityBalance(sdk, identityId)
+      const keyLimits = knownLimits ?? (await readKeyLimits(sdk, secret.identityId, match.keyId).catch(() => null))
       const session: AuthSession = {
-        identityId,
-        balance: balance.toString(),
+        identityId: secret.identityId,
+        balance: identity.balance.toString(),
         network: this.network,
+        keyLimits,
+        keyId: match.keyId,
+        storage,
       }
-      this.setState({ session, isLoading: false, error: null })
+      this.setState({ session })
       return session
     } catch (e) {
-      const message = errorMessage(e)
-      this.setState({ isLoading: false, error: message })
+      lockVault()
       throw e
     }
   }
 
-  /** Log in from bridge-format identity-file text (JSON). Extracts id + signing key, then logs in. */
-  async loginWithIdentityFile(text: string): Promise<AuthSession> {
-    let parsed: ParsedIdentityFile
+  /**
+   * Store a freshly registered limited key in the vault and open its session. If the key is
+   * stored but the session cannot open yet (a read failed), say so: the key is safe and
+   * unlocking will continue.
+   */
+  private async adopt(identityId: string, key: LimitedKey, protection: Protection): Promise<AuthSession> {
+    const secret: VaultSecret = { identityId, keyId: key.keyId, wif: key.wif }
+    await storeInVault(this.network, secret, protection)
     try {
-      parsed = parseIdentityFileText(text)
+      return await this.open(secret, 'vault', key.limits)
     } catch (e) {
-      const message = errorMessage(e)
-      this.setState({ error: message })
-      throw e
+      throw new Error(`Key saved on this device, but signing in did not finish (${errorMessage(e)}). Unlock to continue.`)
     }
-    // Compare full keys so a devnet-paloma identity is refused by a devnet-moutai build.
+  }
+
+  /**
+   * Store a key in the vault before it is registered on chain (identity creation). It stays
+   * unlocked for the {@link openStored} that follows; a failed run calls {@link logout}.
+   */
+  async persistKey(secret: VaultSecret, protection: Protection): Promise<void> {
+    await storeInVault(this.network, secret, protection)
+  }
+
+  /**
+   * Import an identity file or mnemonic once: its master key signs one IdentityUpdate that
+   * registers a limited key for this browser (disabling the key this device held for it
+   * before, when renewing), and is not retained. Only the limited key is kept, encrypted under
+   * `protection`.
+   */
+  async importIdentity(
+    input: { fileText: string } | { mnemonic: string; identityId: string },
+    protection: Protection,
+    request?: LimitedKeyRequest,
+  ): Promise<AuthSession> {
+    return this.run(async () => {
+      let identityId: string
+      let masterWif: string | null
+      if ('fileText' in input) {
+        const m = masterMaterialFromFile(input.fileText)
+        this.checkFileNetwork(m.networkKey)
+        identityId = m.identityId
+        masterWif = m.masterWif ?? (m.mnemonic ? (await deriveMasterKey(m.mnemonic, this.network)).wif : null)
+      } else {
+        if (!(await isValidMnemonic(input.mnemonic))) throw new Error('those words are not a valid recovery phrase')
+        identityId = input.identityId.trim()
+        masterWif = (await deriveMasterKey(input.mnemonic, this.network)).wif
+      }
+      if (!masterWif) throw new Error('no master key found')
+      const previous = (await listVaults(this.network)).find((v) => v.identityId === identityId)
+      const sdk = await this.getSdk()
+      const key = await registerLimitedKey(sdk, {
+        network: this.network,
+        identityId,
+        masterWif,
+        group: this.group(),
+        ...(previous ? { replaceKeyId: previous.keyId } : {}),
+        contracts: this.forgeContracts(),
+        ...(request ? { request } : {}),
+      })
+      masterWif = null
+      return this.adopt(identityId, key, protection)
+    })
+  }
+
+  /** Refuse an identity file made for another network (a testnet key on a devnet build). */
+  checkFileNetwork(networkKey: string | null): void {
     const buildKey = NETWORKS[this.network].key
-    if (!identityFileMatchesNetwork(parsed.networkKey, buildKey)) {
-      const message = `identity file is for ${parsed.networkKey}, but this app is on ${buildKey}`
-      this.setState({ error: message })
-      throw new Error(message)
+    if (!identityFileMatchesNetwork(networkKey, buildKey)) {
+      throw new Error(`identity file is for ${networkKey}, but this app is on ${buildKey}`)
     }
-    return this.login(parsed.identityId, parsed.signingKeyWif)
   }
 
-  /** Refresh the current session's credit balance. */
+  /** Adopt a limited key obtained elsewhere (identity creation, App Connect). */
+  async adoptLimitedKey(identityId: string, key: LimitedKey, protection: Protection): Promise<AuthSession> {
+    return this.run(() => this.adopt(identityId, key, protection))
+  }
+
+  /** Open the session of a key already in the vault and unlocked (identity creation). */
+  async openStored(identityId: string, method: { passphrase: string } | 'passkey' | null, limits?: KeyLimits): Promise<AuthSession> {
+    return this.run(async () => {
+      const secret =
+        unlockedSecret(this.network, identityId) ??
+        (method === 'passkey'
+          ? await unlockWithPasskey(this.network, identityId)
+          : method !== null
+            ? await unlockWithPassphrase(this.network, identityId, method.passphrase)
+            : null)
+      if (!secret) throw new VaultLockedError('unlock to continue')
+      return this.open(secret, 'vault', limits)
+    })
+  }
+
+  /** Unlock a stored vault and open its session. */
+  async unlock(identityId: string, method: { passphrase: string } | 'passkey'): Promise<AuthSession> {
+    return this.run(async () => {
+      const secret =
+        method === 'passkey'
+          ? await unlockWithPasskey(this.network, identityId)
+          : await unlockWithPassphrase(this.network, identityId, method.passphrase)
+      return this.open(secret, 'vault')
+    })
+  }
+
+  /**
+   * Advanced: sign with a pasted private key for this tab only (never stored). The key must
+   * control a HIGH or CRITICAL authentication key of the identity; MASTER keys are refused.
+   */
+  async loginWithRawKey(identityId: string, privateKey: string): Promise<AuthSession> {
+    return this.run(async () => {
+      const wif = normalizeToWif(privateKey, this.network)
+      const secret: VaultSecret = { identityId: identityId.trim(), keyId: -1, wif }
+      // HIGH or CRITICAL only (the sheet says so): findSigningKey with CRITICAL..HIGH.
+      const sdk = await this.getSdk()
+      const identity = await authSdk(sdk).identities.fetch(secret.identityId)
+      if (!identity || !(await findSigningKey(identity, wif, this.network, SECURITY_LEVEL.HIGH))) {
+        throw new WriteAuthError('that key does not control a usable (HIGH or CRITICAL) authentication key of this identity')
+      }
+      holdForSession(this.network, secret)
+      try {
+        return await this.open(secret, 'session')
+      } catch (e) {
+        if (e instanceof KeyNotUsableError) {
+          throw new WriteAuthError('that key does not control a usable (HIGH or CRITICAL) authentication key of this identity')
+        }
+        throw e
+      }
+    })
+  }
+
+  /** Refresh the balance and the key's remaining budget. */
   async refreshBalance(): Promise<void> {
     const session = this.state.session
     if (!session) return
     const sdk = await this.getSdk()
-    const balance = await readIdentityBalance(sdk, session.identityId)
-    this.setState({ session: { ...session, balance: balance.toString() } })
+    const [balance, keyLimits] = await Promise.all([
+      readIdentityBalance(sdk, session.identityId),
+      session.keyId === undefined ? Promise.resolve(null) : readKeyLimits(sdk, session.identityId, session.keyId).catch(() => session.keyLimits ?? null),
+    ])
+    const current = this.state.session
+    if (current?.identityId !== session.identityId) return
+    this.setState({ session: { ...current, balance: balance.toString(), keyLimits } })
   }
 
-  /** Log out: forget the session and wipe the stored signing key for this identity. */
+  /** Lock (keep the stored key; unlock to continue). The session ends with it. */
   logout(): void {
-    const session = this.state.session
-    if (session) clearPrivateKey(this.network, session.identityId)
+    lockVault()
+    clearSignedWrites()
     this.setState({ session: null, error: null })
   }
+
+  /**
+   * Disable this device's key for `identityId` on chain (the identity file or phrase supplies
+   * the master key, used once), then forget it here. Forgetting alone does not revoke.
+   */
+  async revokeStored(identityId: string, input: { fileText: string } | { mnemonic: string }): Promise<void> {
+    return this.run(async () => {
+      const stored = (await listVaults(this.network)).find((v) => v.identityId === identityId)
+      if (!stored) throw new Error('no key for this identity is stored here')
+      let masterWif: string | null
+      if ('fileText' in input) {
+        const m = masterMaterialFromFile(input.fileText)
+        if (m.identityId !== identityId) throw new Error('that identity file is for another identity')
+        this.checkFileNetwork(m.networkKey)
+        masterWif = m.masterWif ?? (m.mnemonic ? (await deriveMasterKey(m.mnemonic, this.network)).wif : null)
+      } else {
+        masterWif = (await deriveMasterKey(input.mnemonic, this.network)).wif
+      }
+      if (!masterWif) throw new Error('no master key found')
+      await revokeLimitedKey(await this.getSdk(), { network: this.network, identityId, masterWif, keyId: stored.keyId })
+      masterWif = null
+      await this.forget(identityId)
+    })
+  }
+
+  /** Delete the stored key of `identityId` from this device (ending its session if open). */
+  async forget(identityId: string): Promise<void> {
+    if (this.state.session?.identityId === identityId) this.logout()
+    await forgetVault(this.network, identityId)
+  }
+}
+
+/** The key opened no longer controls a usable key on the identity (disabled, expired, wrong). */
+export class KeyNotUsableError extends WriteAuthError {
+  constructor(message = "this browser's key is no longer usable on the identity (disabled or expired) — renew it") {
+    super(message)
+    this.name = 'KeyNotUsableError'
+  }
 }
diff --git a/forge-web/lib/auth/create-identity.ts b/forge-web/lib/auth/create-identity.ts
new file mode 100644
index 000000000..a17288b30
--- /dev/null
+++ b/forge-web/lib/auth/create-identity.ts
@@ -0,0 +1,225 @@
+/**
+ * Create a Platform identity in the browser (`ux-dx-spec.md` §2.2 tile 2).
+ *
+ * The flow, journaled in IndexedDB so a closed tab resumes rather than stranding the deposit:
+ *   1. a fresh 12-word mnemonic; the user proves they wrote it down (three words);
+ *   2. the deposit address (the mnemonic's BIP-44 asset-lock key) and QR; funds arrive from
+ *      any wallet (or the faucet on dev networks);
+ *   3. the asset lock is built, saved to the journal, broadcast, and proven (InstantSend or
+ *      chain lock);
+ *   4. this browser's limited key is generated and **stored in the vault first**, then one
+ *      IdentityCreate registers the canonical key set (MASTER, HIGH, CRITICAL auth, CRITICAL
+ *      transfer, MEDIUM encryption; DIP-13 from the mnemonic, so `dg` and the bridge open the
+ *      same identity) plus that key (key 5: HIGH, bound to the dash-forge contract group,
+ *      budget + expiry), so no second signature is needed.
+ *
+ * The journal keeps only public facts (the deposit address, the signed asset-lock transaction
+ * and its txid, the identity id). A resumed flow re-derives every key from the mnemonic, which
+ * the user types again. If the identity already exists on resume (created, but the tab closed
+ * before the key was confirmed), the mnemonic's master key registers a fresh limited key. The
+ * caller clears the journal only once the key is adopted.
+ */
+
+import type { EvoSDK } from '@dashevo/evo-sdk'
+
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js'
+
+import type { Network } from '../constants'
+import { idbDelete, idbGet, idbPut } from '../idb'
+import { authSdk } from '../sdk/facade'
+import {
+  broadcastTx,
+  buildAssetLock,
+  coreEndpoints,
+  getUtxos,
+  obtainLockProof,
+  waitForDeposit,
+  wifBytes,
+  type CoreEndpoints,
+  type LockProof,
+} from './asset-lock'
+import { CANONICAL_KEYS, assetLockKeyPath, deriveAt, deriveMasterKey, identityKeyPath, normalizeMnemonic } from './hd'
+import { assertGroupHolds, defaultLimits, registerLimitedKey, verifyLimitedKey, type LimitedKey, type LimitedKeyRequest } from './limited-key'
+
+/** Minimum deposit (spec §2.2: 0.02 DASH; the asset-lock floor is 0.003). */
+export const MIN_DEPOSIT_DUFFS = 2_000_000
+
+/** A pending creation: public facts only (no keys, no mnemonic). */
+export interface CreationJournal {
+  readonly network: Network
+  readonly depositAddress: string
+  readonly identityId: string | null
+  readonly lockTxid: string | null
+  /** The signed asset-lock transaction, saved before it is broadcast (hex). */
+  readonly lockRaw: string | null
+  readonly startedAt: number
+}
+
+function journalKey(network: Network): string {
+  return `create-identity:${network}`
+}
+
+export function readCreationJournal(network: Network): Promise<CreationJournal | undefined> {
+  return idbGet<CreationJournal>('journal', journalKey(network))
+}
+
+export function clearCreationJournal(network: Network): Promise<void> {
+  return idbDelete('journal', journalKey(network))
+}
+
+/** What an unfinished creation's deposit address holds (duffs), to warn before discarding. */
+export async function depositBalance(network: Network, address: string, endpoints = coreEndpoints(network)): Promise<number> {
+  const utxos = await getUtxos(endpoints, address)
+  return utxos.reduce((s, u) => s + u.satoshis, 0)
+}
+
+/** The deposit address a mnemonic funds (its BIP-44 asset-lock key). */
+export async function depositAddressOf(mnemonic: string, network: Network): Promise<string> {
+  return (await deriveAt(mnemonic, assetLockKeyPath(network), network)).address
+}
+
+async function platformClh(sdk: EvoSDK): Promise<number | null> {
+  const h = (await authSdk(sdk).system.status()).toJSON()?.chain?.coreChainLockedHeight
+  return typeof h === 'number' ? h : null
+}
+
+export type CreateStage = 'waiting-deposit' | 'locking' | 'proving' | 'registering' | 'verifying'
+
+/** The browser key's id on a created identity: right after the canonical five. */
+export const BROWSER_KEY_ID = CANONICAL_KEYS.length
+
+/**
+ * Run (or resume) the creation from the funded deposit onward. Resolves with the new identity
+ * id and this browser's limited key. `persistKey` is called with the key before it is
+ * registered on chain (store it in the vault there), so a tab closed mid-create can never
+ * leave a registered key that nobody holds.
+ */
+export async function createIdentityFromMnemonic(
+  sdk: EvoSDK,
+  params: {
+    readonly network: Network
+    readonly mnemonic: string
+    readonly group: string
+    /** forge-core and forge-collab: the group must hold them on chain before a key binds to it. */
+    readonly contracts: readonly string[]
+    readonly persistKey: (identityId: string, key: { keyId: number; wif: string }) => Promise<void>
+    readonly minDepositDuffs?: number
+    readonly limits?: LimitedKeyRequest
+    readonly endpoints?: CoreEndpoints
+    readonly signal?: AbortSignal
+    readonly onStage?: (stage: CreateStage, detail?: string) => void
+    readonly onDeposit?: (duffs: number) => void
+  },
+): Promise<{ identityId: string; key: LimitedKey }> {
+  const { network, group } = params
+  await assertGroupHolds(sdk, group, params.contracts)
+  const mnemonic = normalizeMnemonic(params.mnemonic)
+  const ep = params.endpoints ?? coreEndpoints(network)
+  const { AssetLockProof, OutPoint, Identity, IdentityPublicKey, IdentitySigner, PrivateKey, ContractBounds } = await import('@dashevo/evo-sdk')
+
+  const lockKey = await deriveAt(mnemonic, assetLockKeyPath(network), network)
+  let journal: CreationJournal = (await readCreationJournal(network)) ?? {
+    network,
+    depositAddress: lockKey.address,
+    identityId: null,
+    lockTxid: null,
+    lockRaw: null,
+    startedAt: Date.now(),
+  }
+  if (journal.depositAddress !== lockKey.address) throw new Error('these words do not match the deposit in progress')
+  const save = async (patch: Partial<CreationJournal>): Promise<void> => {
+    journal = { ...journal, ...patch }
+    await idbPut('journal', journalKey(network), journal)
+  }
+  await save({})
+
+  // 1-3: deposit → asset lock (saved before broadcast) → proof.
+  if (journal.lockTxid === null || journal.lockRaw === null) {
+    params.onStage?.('waiting-deposit')
+    const utxos = await waitForDeposit(ep, lockKey.address, params.minDepositDuffs ?? MIN_DEPOSIT_DUFFS, {
+      signal: params.signal,
+      onSeen: params.onDeposit,
+    })
+    params.onStage?.('locking')
+    const priv = wifBytes(lockKey.wif)
+    const lock = buildAssetLock(utxos, priv)
+    priv.fill(0)
+    await save({ lockTxid: lock.txid, lockRaw: bytesToHex(lock.raw) })
+  }
+  const lockTxid = journal.lockTxid as string
+  const lockRaw = hexToBytes(journal.lockRaw as string)
+  // Idempotent: re-sending an accepted transaction is a no-op the explorer tolerates.
+  await broadcastTx(ep, bytesToHex(lockRaw), lockTxid)
+  params.onStage?.('proving')
+  const proof: LockProof = await obtainLockProof(ep, { txid: lockTxid, raw: lockRaw }, () => platformClh(sdk), {
+    signal: params.signal,
+    onStatus: (s) => params.onStage?.('proving', s),
+  })
+  const assetLockProof =
+    proof.type === 'instant'
+      ? AssetLockProof.createInstantAssetLockProof(proof.islock, proof.raw, 0)
+      : AssetLockProof.createChainAssetLockProof(proof.height, new OutPoint(proof.txid, 0))
+  const identityId = assetLockProof.createIdentityId().toBase58()
+  await save({ identityId })
+
+  const limits = params.limits ?? defaultLimits()
+  const exists = (await authSdk(sdk).identities.balance(identityId).catch(() => undefined)) !== undefined
+  if (exists) {
+    // Created by an earlier run whose browser key was lost: the master key renews it.
+    params.onStage?.('registering', 'The identity exists; registering a key for this browser…')
+    const master = await deriveMasterKey(mnemonic, network)
+    // The earlier run's key 5 may be live (its vault copy is locked or gone): disable it in
+    // the same update, so no key nobody holds stays live.
+    const key = await registerLimitedKey(sdk, { network, identityId, masterWif: master.wif, group, request: limits, replaceKeyId: BROWSER_KEY_ID })
+    await params.persistKey(identityId, key)
+    return { identityId, key }
+  }
+
+  // 4: the browser key goes to the vault first, then IdentityCreate registers it.
+  params.onStage?.('registering')
+  const browserKey = PrivateKey.fromBytes(crypto.getRandomValues(new Uint8Array(32)), network === 'mainnet' ? 'mainnet' : 'testnet')
+  const wif = browserKey.toWIF()
+  await params.persistKey(identityId, { keyId: BROWSER_KEY_ID, wif })
+  const identity = new Identity(identityId)
+  const signer = new IdentitySigner()
+  const assetLockPrivateKey = PrivateKey.fromWIF(lockKey.wif)
+  try {
+    for (const k of CANONICAL_KEYS) {
+      const d = await deriveAt(mnemonic, identityKeyPath(network, k.id), network)
+      identity.addPublicKey(
+        new IdentityPublicKey({
+          keyId: k.id,
+          purpose: k.purpose.toLowerCase() as 'authentication',
+          securityLevel: k.level.toLowerCase() as 'high',
+          keyType: 'ecdsa_secp256k1',
+          isReadOnly: false,
+          data: hexToBytes(d.publicKeyHex),
+        }),
+      )
+      signer.addKeyFromWif(d.wif)
+    }
+    identity.addPublicKey(
+      new IdentityPublicKey({
+        keyId: BROWSER_KEY_ID,
+        purpose: 'authentication',
+        securityLevel: 'high',
+        keyType: 'ecdsa_secp256k1',
+        isReadOnly: false,
+        data: browserKey.getPublicKey().toBytes(),
+        contractBounds: ContractBounds.ContractGroup(group),
+        totalBudget: limits.budgetCredits,
+        expiresAt: BigInt(limits.expiresAt),
+      }),
+    )
+    signer.addKey(browserKey)
+    await authSdk(sdk).identities.create({ identity, assetLockProof, assetLockPrivateKey, signer })
+  } finally {
+    signer.free()
+    assetLockPrivateKey.free()
+    browserKey.free()
+  }
+
+  params.onStage?.('verifying')
+  const verified = await verifyLimitedKey(sdk, identityId, BROWSER_KEY_ID, group, network, wif, limits)
+  return { identityId, key: { keyId: BROWSER_KEY_ID, wif, limits: verified } }
+}
diff --git a/forge-web/lib/auth/hd.ts b/forge-web/lib/auth/hd.ts
new file mode 100644
index 000000000..f5bdc71dd
--- /dev/null
+++ b/forge-web/lib/auth/hd.ts
@@ -0,0 +1,112 @@
+/**
+ * Mnemonic → keys, the paths `tools/mint-identity` (and the Dash bridge) use, so an identity
+ * created here opens in the CLI and vice versa:
+ *
+ *   identity keys (DIP-13): m/9'/<coin>'/5'/0'/0'/<identityIndex>'/<keyIndex>'
+ *   asset-lock key (BIP-44): m/44'/<coin>'/0'/0/0
+ *
+ * coin type 5 on mainnet, 1 elsewhere. The canonical key set (key id = index) is MASTER,
+ * HIGH, CRITICAL authentication, CRITICAL transfer, MEDIUM encryption.
+ *
+ * Derivation runs in the evo-sdk WASM (`wallet.deriveKeyFromSeedWithPath`); verified against
+ * mint-identity's @scure/bip32 output for the moutai fixture identities.
+ */
+
+import type { Network } from '../constants'
+
+export type KeyPurpose = 'AUTHENTICATION' | 'TRANSFER' | 'ENCRYPTION'
+export type KeyLevel = 'MASTER' | 'CRITICAL' | 'HIGH' | 'MEDIUM'
+
+/** The canonical identity key set, by key id. */
+export const CANONICAL_KEYS: readonly { id: number; purpose: KeyPurpose; level: KeyLevel }[] = [
+  { id: 0, purpose: 'AUTHENTICATION', level: 'MASTER' },
+  { id: 1, purpose: 'AUTHENTICATION', level: 'HIGH' },
+  { id: 2, purpose: 'AUTHENTICATION', level: 'CRITICAL' },
+  { id: 3, purpose: 'TRANSFER', level: 'CRITICAL' },
+  { id: 4, purpose: 'ENCRYPTION', level: 'MEDIUM' },
+]
+
+export interface DerivedKey {
+  readonly wif: string
+  /** Compressed public key, hex. */
+  readonly publicKeyHex: string
+  /** P2PKH address. */
+  readonly address: string
+}
+
+function coin(network: Network): number {
+  return network === 'mainnet' ? 5 : 1
+}
+
+function wasmNetwork(network: Network): string {
+  return network === 'mainnet' ? 'mainnet' : 'testnet'
+}
+
+export function identityKeyPath(network: Network, keyIndex: number, identityIndex = 0): string {
+  return `m/9'/${coin(network)}'/5'/0'/0'/${identityIndex}'/${keyIndex}'`
+}
+
+export function assetLockKeyPath(network: Network): string {
+  return `m/44'/${coin(network)}'/0'/0/0`
+}
+
+interface WalletFacade {
+  deriveKeyFromSeedWithPath(p: { mnemonic: string; path: string; network: string }): Promise<{
+    toJSON(): { privateKeyWif: string; publicKey: string; address: string }
+    free(): void
+  }>
+  generateMnemonic(p?: { wordCount?: number }): Promise<string>
+  validateMnemonic(m: string): Promise<boolean>
+}
+
+async function wallet(): Promise<WalletFacade> {
+  const evo = await import('@dashevo/evo-sdk')
+  await evo.EvoSDK.getLatestVersionNumber()
+  return (evo as unknown as { wallet: WalletFacade }).wallet
+}
+
+/** Derive one key from a mnemonic at `path`. */
+export async function deriveAt(mnemonic: string, path: string, network: Network): Promise<DerivedKey> {
+  const info = await (await wallet()).deriveKeyFromSeedWithPath({ mnemonic: normalizeMnemonic(mnemonic), path, network: wasmNetwork(network) })
+  const j = info.toJSON()
+  info.free()
+  return { wif: j.privateKeyWif, publicKeyHex: j.publicKey, address: j.address }
+}
+
+/** The identity's master key (key id 0) from its mnemonic. */
+export function deriveMasterKey(mnemonic: string, network: Network): Promise<DerivedKey> {
+  return deriveAt(mnemonic, identityKeyPath(network, 0), network)
+}
+
+/** A fresh 12-word English mnemonic (128 bits of entropy). */
+export async function newMnemonic(): Promise<string> {
+  return (await wallet()).generateMnemonic({ wordCount: 12 })
+}
+
+/** Whether `m` is a valid BIP-39 mnemonic (checksum included). */
+export async function isValidMnemonic(m: string): Promise<boolean> {
+  try {
+    return await (await wallet()).validateMnemonic(normalizeMnemonic(m))
+  } catch {
+    return false
+  }
+}
+
+/** Lowercase, single-spaced. */
+export function normalizeMnemonic(m: string): string {
+  return m.trim().toLowerCase().split(/\s+/).join(' ')
+}
+
+/**
+ * Three distinct word positions (0-based) the backup quiz asks for, chosen at random.
+ * `count` words total.
+ */
+export function quizPositions(count = 12, ask = 3): number[] {
+  const picked = new Set<number>()
+  const r = new Uint32Array(1)
+  while (picked.size < ask) {
+    crypto.getRandomValues(r)
+    picked.add((r[0] as number) % count)
+  }
+  return [...picked].sort((a, b) => a - b)
+}
diff --git a/forge-web/lib/auth/identity-file.ts b/forge-web/lib/auth/identity-file.ts
index 61170717e..54eec6d55 100644
--- a/forge-web/lib/auth/identity-file.ts
+++ b/forge-web/lib/auth/identity-file.ts
@@ -77,11 +77,8 @@ function levelRank(level: string): number {
  */
 const WIF_SIGNABLE_KEY_TYPES = new Set(['ECDSA_SECP256K1', 'ECDSA_HASH160'])
 
-/**
- * Parse a bridge-format identity JSON. Throws a descriptive error if it lacks an identity id
- * or any usable AUTHENTICATION signing key.
- */
-export function parseIdentityFile(json: unknown): ParsedIdentityFile {
+/** The header every identity file carries: its id, network and raw key list. */
+function fileHeader(json: unknown): { obj: Record<string, unknown>; identityId: string; network: Network | null; networkKey: string | null; rawKeys: unknown } {
   if (json === null || typeof json !== 'object') {
     throw new Error('identity file must be a JSON object')
   }
@@ -92,8 +89,24 @@ export function parseIdentityFile(json: unknown): ParsedIdentityFile {
   }
   const network = normalizeNetwork(obj['network'])
   const networkKey = network === null ? null : (obj['network'] as string)
+  return { obj, identityId, network, networkKey, rawKeys: obj['identityKeys'] ?? obj['keys'] }
+}
+
+function parseJson(text: string): unknown {
+  try {
+    return JSON.parse(text)
+  } catch (e) {
+    throw new Error(`identity file is not valid JSON: ${(e as Error).message}`)
+  }
+}
+
+/**
+ * Parse a bridge-format identity JSON. Throws a descriptive error if it lacks an identity id
+ * or any usable AUTHENTICATION signing key.
+ */
+export function parseIdentityFile(json: unknown): ParsedIdentityFile {
+  const { identityId, network, networkKey, rawKeys } = fileHeader(json)
 
-  const rawKeys = obj['identityKeys'] ?? obj['keys']
   if (!Array.isArray(rawKeys)) {
     throw new Error('identity file is missing an "identityKeys" array')
   }
@@ -123,13 +136,44 @@ export function parseIdentityFile(json: unknown): ParsedIdentityFile {
   return { identityId, network, networkKey, signingKeyWif: best.wif, securityLevel: best.level }
 }
 
+/** What the import ceremony needs from an identity file: its id, network and master key. */
+export interface MasterMaterial {
+  readonly identityId: string
+  readonly networkKey: string | null
+  /** The identity's MASTER key (WIF), used once to register a limited key. */
+  readonly masterWif: string | null
+  /** The file's mnemonic, when it carries one (the master key can be derived from it). */
+  readonly mnemonic: string | null
+}
+
+/**
+ * Extract the master key (or a mnemonic to derive it) from a bridge-format identity file.
+ * Nothing else is kept: the other keys in the file are never used by the browser.
+ */
+export function masterMaterialFromFile(text: string): MasterMaterial {
+  const { obj, identityId, networkKey, rawKeys } = fileHeader(parseJson(text))
+  let masterWif: string | null = null
+  if (Array.isArray(rawKeys)) {
+    for (const raw of rawKeys as RawKey[]) {
+      if (asString(raw.purpose)?.toUpperCase() !== 'AUTHENTICATION') continue
+      if (asString(raw.securityLevel)?.toUpperCase() !== 'MASTER') continue
+      const keyType = asString(raw.keyType)
+      if (keyType !== null && !WIF_SIGNABLE_KEY_TYPES.has(keyType.toUpperCase())) continue
+      const wif = asString(raw.privateKeyWif) ?? asString(raw.privateKey)
+      if (wif !== null && isLikelyWif(wif)) {
+        masterWif = wif
+        break
+      }
+    }
+  }
+  const mnemonic = asString(obj['mnemonic'])
+  if (masterWif === null && mnemonic === null) {
+    throw new Error('identity file has neither a MASTER authentication key nor a mnemonic')
+  }
+  return { identityId, networkKey, masterWif, mnemonic }
+}
+
 /** Parse identity-file text (JSON string) with a friendly error on malformed JSON. */
 export function parseIdentityFileText(text: string): ParsedIdentityFile {
-  let json: unknown
-  try {
-    json = JSON.parse(text)
-  } catch (e) {
-    throw new Error(`identity file is not valid JSON: ${(e as Error).message}`)
-  }
-  return parseIdentityFile(json)
+  return parseIdentityFile(parseJson(text))
 }
diff --git a/forge-web/lib/auth/index.ts b/forge-web/lib/auth/index.ts
index bad3a48a5..ad3895891 100644
--- a/forge-web/lib/auth/index.ts
+++ b/forge-web/lib/auth/index.ts
@@ -1,10 +1,10 @@
 /**
  * Auth — headless identity login + secure key storage for forge-web.
  *
- * M3 shape: private-key / identity-file login with the signing key held in a network-scoped
- * browser keystore and used only at signing time (never in React state or logs). The exposed
- * {@link AuthController} yields a {@link WriteAuth} the WriteEngine consumes. Password-vault /
- * passkey-PRF wrapping of the stored key is the documented follow-up.
+ * Limited-key sign-in (`ux-dx-spec.md` §2): a PV14 key bound to the dash-forge contract group,
+ * with a budget and an expiry, held encrypted in the vault (passkey PRF or Argon2id) and used
+ * only at signing time (never in React state or logs). The {@link AuthController} yields a
+ * {@link WriteAuth} the WriteEngine consumes.
  */
 
 export {
@@ -27,20 +27,27 @@ export {
   type ParsedPrivateKey,
 } from './wif'
 export {
-  clearAllPrivateKeys,
-  clearPrivateKey,
-  getPrivateKey,
-  hasPrivateKey,
-  storePrivateKey,
-  storedIdentityIds,
-} from './keystore'
+  AUTO_LOCK_MS,
+  ARGON2_PARAMS,
+  MIN_PASSPHRASE,
+  VaultLockedError,
+  enrollPasskey,
+  listVaults,
+  passkeysAvailable,
+  type Protection,
+  type VaultInfo,
+} from './vault'
+export { BROWSER_KEY_DEFAULTS, defaultLimits, type LimitedKey, type LimitedKeyRequest } from './limited-key'
 export {
+  masterMaterialFromFile,
   parseIdentityFile,
   parseIdentityFileText,
+  type MasterMaterial,
   type ParsedIdentityFile,
 } from './identity-file'
 export {
   AuthController,
+  purgeLegacyKeystore,
   type AuthSession,
   type AuthState,
   type SdkProvider,
diff --git a/forge-web/lib/auth/keystore.ts b/forge-web/lib/auth/keystore.ts
deleted file mode 100644
index bf389d712..000000000
--- a/forge-web/lib/auth/keystore.ts
+++ /dev/null
@@ -1,101 +0,0 @@
-/**
- * Network-scoped in-browser key storage — the forge-web analogue of yappr's `secure-storage`.
- *
- * Private keys (WIF) are held in `localStorage` under a `forge_key_<network>_pk_<identityId>`
- * key so testnet and mainnet material never collide. Keys are **never** placed in React state
- * or logged; only this module and the signer read them, and only in the browser. All access is
- * SSR-guarded (`typeof window`) so the Next static-export prerender never touches storage.
- *
- * This is the M3 shape: WIF at rest in `localStorage`. Password-vault / passkey-PRF wrapping
- * (encrypting these at rest behind a user secret) is the documented follow-up — the storage
- * surface here is intentionally the same one those wrappers would slot in front of.
- */
-
-import type { Network } from '../constants'
-
-const PREFIX = 'forge_key_'
-
-function storage(): Storage | null {
-  if (typeof window === 'undefined') return null
-  try {
-    return window.localStorage
-  } catch {
-    return null
-  }
-}
-
-function pkKey(network: Network, identityId: string): string {
-  return `${PREFIX}${network}_pk_${identityId}`
-}
-
-/** Persist an identity's signing key (WIF) for a network. No-op outside the browser. */
-export function storePrivateKey(network: Network, identityId: string, wif: string): void {
-  const s = storage()
-  if (!s) return
-  try {
-    s.setItem(pkKey(network, identityId), wif)
-  } catch {
-    // Storage full / disabled — treat as absent; the caller re-prompts on the next write.
-  }
-}
-
-/** Read an identity's stored signing key (WIF), or null if none / not in a browser. */
-export function getPrivateKey(network: Network, identityId: string): string | null {
-  const s = storage()
-  if (!s) return null
-  try {
-    return s.getItem(pkKey(network, identityId))
-  } catch {
-    return null
-  }
-}
-
-/** Whether an identity has a stored signing key on this network. */
-export function hasPrivateKey(network: Network, identityId: string): boolean {
-  return getPrivateKey(network, identityId) !== null
-}
-
-/** Forget one identity's stored signing key on this network. */
-export function clearPrivateKey(network: Network, identityId: string): void {
-  const s = storage()
-  if (!s) return
-  try {
-    s.removeItem(pkKey(network, identityId))
-  } catch {
-    // Ignore.
-  }
-}
-
-/** Forget every stored key on this network (full logout / device wipe). */
-export function clearAllPrivateKeys(network: Network): void {
-  const s = storage()
-  if (!s) return
-  try {
-    const scope = `${PREFIX}${network}_pk_`
-    const toRemove: string[] = []
-    for (let i = 0; i < s.length; i++) {
-      const k = s.key(i)
-      if (k && k.startsWith(scope)) toRemove.push(k)
-    }
-    for (const k of toRemove) s.removeItem(k)
-  } catch {
-    // Ignore.
-  }
-}
-
-/** The identity ids that currently have a stored key on this network. */
-export function storedIdentityIds(network: Network): string[] {
-  const s = storage()
-  if (!s) return []
-  const scope = `${PREFIX}${network}_pk_`
-  const ids: string[] = []
-  try {
-    for (let i = 0; i < s.length; i++) {
-      const k = s.key(i)
-      if (k && k.startsWith(scope)) ids.push(k.slice(scope.length))
-    }
-  } catch {
-    return []
-  }
-  return ids
-}
diff --git a/forge-web/lib/auth/limited-key.ts b/forge-web/lib/auth/limited-key.ts
new file mode 100644
index 000000000..9ba300904
--- /dev/null
+++ b/forge-web/lib/auth/limited-key.ts
@@ -0,0 +1,251 @@
+/**
+ * PV14 limited keys (`ux-dx-spec.md` §2.1; platform `authentication-key-limits.md`,
+ * `contract-bound-authentication-keys.md`).
+ *
+ * A browser signs with an AUTHENTICATION / HIGH key that is:
+ *   - bound to the `dash-forge` contract group (`contractBounds: contractGroup`) — it can sign
+ *     only Batch transitions on forge-core and forge-collab; an identity update, a credit
+ *     transfer or a write to any other contract is refused at consensus;
+ *   - budgeted (`totalBudget`, default 0.05 DASH) — it can take at most that from the identity;
+ *   - expiring (`expiresAt`, default 90 days).
+ *
+ * The master key signs the one IdentityUpdate that registers it (and the new key signs its own
+ * proof of possession) and is not retained: the WASM objects holding it are freed (which
+ * releases, but does not zero, their memory) and no reference to the WIF is kept. JS strings
+ * cannot be zeroed; the design minimizes how long they live.
+ */
+
+import type { EvoSDK } from '@dashevo/evo-sdk'
+
+import type { Network } from '../constants'
+import { CREDITS_PER_DASH } from '../sdk/cost'
+import { authSdk, type WasmKey } from '../sdk/facade'
+import type { KeyLimits } from '../view/funds'
+import { retryWhileMissing } from '../view/retry'
+
+/** Browser key defaults (spec §2.1). */
+export const BROWSER_KEY_DEFAULTS = { budgetDash: 0.05, days: 90 } as const
+const DAY_MS = 24 * 60 * 60 * 1000
+
+export interface LimitedKeyRequest {
+  readonly budgetCredits: bigint
+  readonly expiresAt: number
+}
+
+/** The default request: 0.05 DASH for 90 days from `now`. */
+export function defaultLimits(now = Date.now()): LimitedKeyRequest {
+  return {
+    budgetCredits: BigInt(Math.round(BROWSER_KEY_DEFAULTS.budgetDash * CREDITS_PER_DASH)),
+    expiresAt: now + BROWSER_KEY_DEFAULTS.days * DAY_MS,
+  }
+}
+
+/** A registered limited key: its id and private key (WIF). */
+export interface LimitedKey {
+  readonly keyId: number
+  readonly wif: string
+  readonly limits: KeyLimits
+}
+
+/**
+ * Register a limited key on `identityId`, signed once by `masterWif`. Generates the new key
+ * in the WASM (not retained beyond the returned WIF), registers it, verifies on chain that it
+ * landed with the group bound, the requested budget and expiry, and returns it. The group is
+ * first checked on chain to hold forge-core and forge-collab.
+ *
+ * `replaceKeyId`: a renewal disables this browser's previous limited key in the same update,
+ * so renewing never leaves a live key nobody holds. Only a live group-bound HIGH key is
+ * disabled; anything else named is ignored.
+ */
+export async function registerLimitedKey(
+  sdk: EvoSDK,
+  params: {
+    readonly network: Network
+    readonly identityId: string
+    readonly masterWif: string
+    readonly group: string
+    readonly request?: LimitedKeyRequest
+    readonly replaceKeyId?: number
+    /** The contracts the group must hold (forge-core, forge-collab), checked on chain first. */
+    readonly contracts?: readonly string[]
+  },
+): Promise<LimitedKey> {
+  const { IdentityPublicKeyInCreation, ContractBounds, IdentitySigner, PrivateKey } = await import('@dashevo/evo-sdk')
+  const request = params.request ?? defaultLimits()
+  if (params.contracts) await assertGroupHolds(sdk, params.group, params.contracts)
+  const identity = await authSdk(sdk).identities.fetch(params.identityId)
+  if (!identity) throw new Error(`identity ${params.identityId} not found on ${params.network}`)
+
+  // The master key must be one of this identity's MASTER keys; say so plainly rather than
+  // letting consensus refuse an update signed by the wrong key.
+  const master = PrivateKey.fromWIF(params.masterWif)
+  const masterBytes = master.toBytes()
+  const isMaster = identity.publicKeys.some(
+    (k) => k.securityLevelNumber === 0 && k.disabledAt === undefined && safeValidate(k, masterBytes, params.network),
+  )
+  masterBytes.fill(0)
+  if (!isMaster) {
+    master.free()
+    throw new Error("that key is not this identity's master key")
+  }
+
+  const fresh = PrivateKey.fromBytes(crypto.getRandomValues(new Uint8Array(32)), params.network === 'mainnet' ? 'mainnet' : 'testnet')
+  const keyId = Math.max(...identity.publicKeys.map((k) => k.keyId)) + 1
+  const signer = new IdentitySigner()
+  try {
+    signer.addKey(master)
+    signer.addKey(fresh)
+    const key = new IdentityPublicKeyInCreation({
+      keyId,
+      purpose: 'authentication',
+      securityLevel: 'high',
+      keyType: 'ecdsa_secp256k1',
+      data: fresh.getPublicKey().toBytes(),
+      contractBounds: ContractBounds.ContractGroup(params.group),
+      totalBudget: request.budgetCredits,
+      expiresAt: BigInt(request.expiresAt),
+    })
+    const old = identity.publicKeys.find((k) => k.keyId === params.replaceKeyId)
+    const disable = old && old.disabledAt === undefined && isForgeBrowserKey(old) ? [old.keyId] : []
+    try {
+      await authSdk(sdk).identities.update({ identity, addPublicKeys: [key], ...(disable.length ? { disablePublicKeys: disable } : {}), signer })
+    } catch (e) {
+      // Two tabs registering at once both pick max+1; the second is refused.
+      if (/revision|duplicate|already exists|key id/i.test(String((e as { message?: unknown })?.message ?? e))) {
+        throw new Error('another key was registered on this identity at the same moment; try again')
+      }
+      throw e
+    }
+  } finally {
+    signer.free()
+    master.free()
+  }
+  const wif = fresh.toWIF()
+  fresh.free()
+  const limits = await verifyLimitedKey(sdk, params.identityId, keyId, params.group, params.network, wif, request)
+  return { keyId, wif, limits }
+}
+
+function safeValidate(k: WasmKey, bytes: Uint8Array, network: Network): boolean {
+  try {
+    return k.validatePrivateKey(bytes, network)
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Read a key back from the chain and check it is what a Forge browser key must be: live,
+ * AUTHENTICATION / HIGH, bound to `group`, with a budget and an expiry, and (when `wif` is
+ * given) controlled by that private key. Returns its limits (remaining budget included).
+ */
+export async function verifyLimitedKey(
+  sdk: EvoSDK,
+  identityId: string,
+  keyId: number,
+  group: string,
+  network: Network,
+  wif?: string,
+  request?: LimitedKeyRequest,
+): Promise<KeyLimits> {
+  // Called right after registering: a node a block behind does not show the key yet.
+  const k = await retryWhileMissing(async () => {
+    const identity = await authSdk(sdk).identities.fetch(identityId)
+    return identity?.publicKeys.find((x) => x.keyId === keyId) ?? null
+  }, 6)
+  if (!k) throw new Error(`key ${keyId} is not on identity ${identityId}`)
+  if (k.disabledAt !== undefined) throw new Error(`key ${keyId} is disabled`)
+  if (k.purposeNumber !== 0 || k.securityLevelNumber !== 2) throw new Error(`key ${keyId} is not an AUTHENTICATION/HIGH key`)
+  const bounds = k.contractBounds?.toJSON()
+  if (bounds?.$type !== 'contractGroup' || bounds.id !== group) {
+    throw new Error(`key ${keyId} is not bound to the dash-forge contract group`)
+  }
+  if (k.totalBudget === undefined || k.expiresAt === undefined) throw new Error(`key ${keyId} has no budget or expiry`)
+  if (Number(k.expiresAt) <= Date.now()) throw new Error(`key ${keyId} has expired`)
+  if (request) {
+    if (k.totalBudget !== request.budgetCredits) throw new Error(`key ${keyId} has a different budget than requested`)
+    if (Number(k.expiresAt) !== request.expiresAt) throw new Error(`key ${keyId} has a different expiry than requested`)
+  }
+  if (wif !== undefined) {
+    const { PrivateKey } = await import('@dashevo/evo-sdk')
+    const pk = PrivateKey.fromWIF(wif)
+    const bytes = pk.toBytes()
+    const ok = safeValidate(k, bytes, network)
+    bytes.fill(0)
+    pk.free()
+    if (!ok) throw new Error(`the stored private key does not control key ${keyId}`)
+  }
+  const remaining = await readRemainingBudget(sdk, identityId, keyId)
+  if (remaining !== null && remaining <= 0n) throw new Error(`key ${keyId} has no budget left`)
+  return { remaining, total: k.totalBudget, expiresAt: Number(k.expiresAt) }
+}
+
+/** What is left of a key's budget (null when it has none). */
+export async function readRemainingBudget(sdk: EvoSDK, identityId: string, keyId: number): Promise<bigint | null> {
+  const map = await authSdk(sdk).identities.keysRemainingBudgets(identityId, [keyId])
+  return map.get(keyId) ?? null
+}
+
+/** The limits of a key already on the identity (for a session resumed from the vault). */
+export async function readKeyLimits(sdk: EvoSDK, identityId: string, keyId: number): Promise<KeyLimits | null> {
+  const identity = await authSdk(sdk).identities.fetch(identityId)
+  const k = identity?.publicKeys.find((x) => x.keyId === keyId)
+  if (!k) return null
+  if (k.totalBudget === undefined && k.expiresAt === undefined) return null
+  const remaining = k.totalBudget === undefined ? null : await readRemainingBudget(sdk, identityId, keyId)
+  return {
+    remaining,
+    total: k.totalBudget ?? null,
+    expiresAt: k.expiresAt === undefined ? null : Number(k.expiresAt),
+  }
+}
+
+/**
+ * Refuse to bind a key to a group the chain does not show holding the forge contracts. The
+ * group id comes from the bundled deployment file; this checks it against state. (Its owner
+ * can add contracts later, which widens every group-bound key: see docs/guides/identity-and-keys.md.)
+ */
+export async function assertGroupHolds(sdk: EvoSDK, group: string, contracts: readonly string[]): Promise<void> {
+  const facade = (sdk as unknown as { contractGroups: { forContract(id: string): Promise<{ toJSON?(): { contract: string[] }; contract?: string[] }> } }).contractGroups
+  for (const id of contracts) {
+    const m = await facade.forContract(id)
+    const groups = (m.toJSON ? m.toJSON() : m).contract ?? []
+    if (!groups.includes(group)) throw new Error(`contract ${id} is not in the dash-forge group on chain; refusing to bind a key to it`)
+  }
+}
+
+/**
+ * A key Forge may renew over or revoke: HIGH, bound to a contract group, with a budget. Any
+ * group, not just the current one, so a key left on an old group by a contract
+ * re-registration can still be disabled.
+ */
+function isForgeBrowserKey(k: WasmKey): boolean {
+  return k.securityLevelNumber === 2 && k.contractBounds?.toJSON().$type === 'contractGroup' && k.totalBudget !== undefined
+}
+
+/**
+ * Disable `keyId` on chain (an IdentityUpdate signed by the master key, used once and not
+ * retained). Only a group-bound HIGH key — a Forge browser key — may be disabled this way.
+ */
+export async function revokeLimitedKey(
+  sdk: EvoSDK,
+  params: { readonly network: Network; readonly identityId: string; readonly masterWif: string; readonly keyId: number },
+): Promise<void> {
+  const { IdentitySigner, PrivateKey } = await import('@dashevo/evo-sdk')
+  const identity = await authSdk(sdk).identities.fetch(params.identityId)
+  const k = identity?.publicKeys.find((x) => x.keyId === params.keyId)
+  if (!identity || !k) throw new Error(`key ${params.keyId} is not on identity ${params.identityId}`)
+  if (k.disabledAt !== undefined) return
+  if (!isForgeBrowserKey(k)) {
+    throw new Error(`key ${params.keyId} is not a Forge browser key; refusing to disable it here`)
+  }
+  const master = PrivateKey.fromWIF(params.masterWif)
+  const signer = new IdentitySigner()
+  try {
+    signer.addKey(master)
+    await authSdk(sdk).identities.update({ identity, disablePublicKeys: [params.keyId], signer })
+  } finally {
+    signer.free()
+    master.free()
+  }
+}
diff --git a/forge-web/lib/auth/vault.ts b/forge-web/lib/auth/vault.ts
new file mode 100644
index 000000000..64c1fc018
--- /dev/null
+++ b/forge-web/lib/auth/vault.ts
@@ -0,0 +1,406 @@
+/**
+ * The browser vault (`ux-dx-spec.md` §2.3): this browser's limited signing key, encrypted at
+ * rest, unlocked for the session.
+ *
+ * - What it holds: one record per (network, identity) — the identity id, the limited key's id
+ *   and its private key. Never a master key: the import and create flows do not retain it past
+ *   anything reaches here.
+ * - At rest: IndexedDB (`vault` store), the secret sealed with AES-256-GCM under a random
+ *   256-bit data key. The data key is itself wrapped (AES-GCM) by one or both of:
+ *     - a passkey: WebAuthn `prf` extension output (evaluated with a random 32-byte salt stored
+ *       beside it), stretched with HKDF-SHA256 to a key-wrapping key;
+ *     - a passphrase: Argon2id(passphrase, 16-byte salt, m = 64 MiB, t = 3, p = 1) → 32 bytes.
+ *   The AES-GCM additional data binds each ciphertext to its network, identity and slot, so a
+ *   record cannot be replayed under another identity.
+ * - In memory: the unlocked record lives only in this module (never React state, never
+ *   localStorage), for at most {@link AUTO_LOCK_MS} (12 h) or until {@link lockVault}.
+ *
+ * Per-origin by construction: IndexedDB and WebAuthn (`rpId` = this host) are origin-scoped.
+ */
+
+import { argon2idAsync } from '@noble/hashes/argon2.js'
+import { hkdf } from '@noble/hashes/hkdf.js'
+import { sha256 } from '@noble/hashes/sha2.js'
+
+import type { Network } from '../constants'
+import { idbDelete, idbEntries, idbGet, idbPut } from '../idb'
+
+/** Unlocked vaults lock themselves after this long (spec §2.3). */
+export const AUTO_LOCK_MS = 12 * 60 * 60 * 1000
+
+/** Argon2id parameters (spec §2.3: m = 64 MiB, t = 3). */
+export const ARGON2_PARAMS = { m: 64 * 1024, t: 3, p: 1, dkLen: 32 } as const
+
+/** The minimum passphrase length the vault accepts. */
+export const MIN_PASSPHRASE = 10
+
+/**
+ * Hosts where many sites share one origin — a GitHub Pages project site, an IPFS path gateway.
+ * Every co-hosted site could read this vault's records and ask the browser for the passkey's
+ * PRF output, so the vault refuses to run there. Browsing still works.
+ */
+const SHARED_ORIGIN_HOSTS = [/\.github\.io$/i, /^(ipfs\.io|dweb\.link|gateway\.pinata\.cloud|cloudflare-ipfs\.com|ipfs\.[^.]+\.[^.]+)$/i]
+
+/** Why signing in cannot happen on this origin, or null when it can. */
+export function sharedOriginProblem(location: { hostname: string; pathname: string } | null = typeof window === 'undefined' ? null : window.location): string | null {
+  if (location === null) return null
+  const pathGateway = /^\/ip[fn]s\//.test(location.pathname)
+  if (pathGateway || SHARED_ORIGIN_HOSTS.some((re) => re.test(location.hostname))) {
+    return 'Signing in needs a dedicated origin; use https://forge.dashhq.org or an IPFS subdomain gateway. Browsing works here.'
+  }
+  return null
+}
+
+function assertDedicatedOrigin(): void {
+  const problem = sharedOriginProblem()
+  if (problem) throw new VaultLockedError(problem)
+}
+
+/** What the vault protects. */
+export interface VaultSecret {
+  readonly identityId: string
+  /** The limited key's id on the identity. */
+  readonly keyId: number
+  /** The limited key's private key, WIF. */
+  readonly wif: string
+}
+
+/** A key-wrapping slot: the data key encrypted under one unlock method. */
+type Slot =
+  | {
+      readonly kind: 'passkey'
+      readonly credentialId: Uint8Array
+      readonly prfSalt: Uint8Array
+      readonly iv: Uint8Array
+      readonly wrapped: Uint8Array
+    }
+  | {
+      readonly kind: 'passphrase'
+      readonly salt: Uint8Array
+      readonly params: typeof ARGON2_PARAMS
+      readonly iv: Uint8Array
+      readonly wrapped: Uint8Array
+    }
+
+/** The stored (encrypted) vault record. */
+interface VaultRecord {
+  readonly version: 1
+  readonly network: Network
+  readonly identityId: string
+  readonly keyId: number
+  readonly createdAt: number
+  readonly iv: Uint8Array
+  readonly ciphertext: Uint8Array
+  readonly slots: readonly Slot[]
+}
+
+/** What the UI may know about a stored vault (no secrets). */
+export interface VaultInfo {
+  readonly identityId: string
+  readonly keyId: number
+  readonly createdAt: number
+  readonly methods: readonly ('passkey' | 'passphrase')[]
+}
+
+const enc = new TextEncoder()
+
+function key(network: Network, identityId: string): string {
+  return `vault:${network}:${identityId}`
+}
+
+function aad(network: Network, identityId: string, slot: string): Uint8Array {
+  return enc.encode(`dash-forge vault v1|${network}|${identityId}|${slot}`)
+}
+
+function random(n: number): Uint8Array {
+  return crypto.getRandomValues(new Uint8Array(n))
+}
+
+/** A copy backed by its own ArrayBuffer (what WebCrypto's BufferSource wants). */
+function buf(b: Uint8Array): Uint8Array<ArrayBuffer> {
+  return new Uint8Array(b)
+}
+
+async function aesKey(raw: Uint8Array, usage: KeyUsage[]): Promise<CryptoKey> {
+  return crypto.subtle.importKey('raw', buf(raw), { name: 'AES-GCM' }, false, usage)
+}
+
+async function seal(keyBytes: Uint8Array, plaintext: Uint8Array, ad: Uint8Array): Promise<{ iv: Uint8Array; ct: Uint8Array }> {
+  const iv = random(12)
+  const k = await aesKey(keyBytes, ['encrypt'])
+  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv: buf(iv), additionalData: buf(ad) }, k, buf(plaintext)))
+  return { iv, ct }
+}
+
+async function open(keyBytes: Uint8Array, iv: Uint8Array, ct: Uint8Array, ad: Uint8Array): Promise<Uint8Array> {
+  const k = await aesKey(keyBytes, ['decrypt'])
+  try {
+    return new Uint8Array(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: buf(iv), additionalData: buf(ad) }, k, buf(ct)))
+  } catch {
+    throw new VaultLockedError('wrong passphrase or passkey')
+  }
+}
+
+/** The vault could not be opened (wrong secret, no record, or locked). */
+export class VaultLockedError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'VaultLockedError'
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Unlock methods → key-wrapping key
+// ---------------------------------------------------------------------------
+
+/** Argon2id(passphrase) → 32-byte wrapping key. ~1.5 s in a browser at 64 MiB. */
+export async function passphraseKey(passphrase: string, salt: Uint8Array, params = ARGON2_PARAMS): Promise<Uint8Array> {
+  return argon2idAsync(enc.encode(passphrase.normalize('NFKC')), salt, params)
+}
+
+/** A PRF output (32 bytes) → wrapping key. HKDF so the raw PRF output is never used as a key. */
+export function prfKey(prfOutput: Uint8Array, network: Network, identityId: string): Uint8Array {
+  return hkdf(sha256, prfOutput, enc.encode('dash-forge vault prf v1'), enc.encode(`${network}|${identityId}`), 32)
+}
+
+interface PrfExtensionResults {
+  prf?: { enabled?: boolean; results?: { first?: ArrayBuffer } }
+}
+
+function rpId(): string {
+  return window.location.hostname
+}
+
+/** Whether this browser can do WebAuthn at all (PRF support is only known after a ceremony). */
+export function passkeysAvailable(): boolean {
+  return typeof window !== 'undefined' && typeof window.PublicKeyCredential !== 'undefined' && window.isSecureContext
+}
+
+/**
+ * Create a passkey for the vault and evaluate its PRF. Returns null when the authenticator
+ * does not support `prf` (the caller falls back to a passphrase). Some authenticators only
+ * report `prf.enabled` at creation and need a get() to produce output; both are handled.
+ *
+ * Every passkey gets a random WebAuthn `user.id`: platform authenticators replace a
+ * discoverable credential with the same (rpId, user.id), so a shared id would let a second
+ * identity's enrolment silently destroy the first identity's only unlock method.
+ */
+export async function enrollPasskey(label: string): Promise<{ credentialId: Uint8Array; prfSalt: Uint8Array; output: Uint8Array } | null> {
+  const prfSalt = random(32)
+  const cred = (await navigator.credentials.create({
+    publicKey: {
+      rp: { id: rpId(), name: 'Dash Forge' },
+      user: { id: buf(random(32)), name: label, displayName: label },
+      challenge: buf(random(32)),
+      pubKeyCredParams: [
+        { type: 'public-key', alg: -7 },
+        { type: 'public-key', alg: -257 },
+      ],
+      authenticatorSelection: { residentKey: 'preferred', userVerification: 'required' },
+      extensions: { prf: { eval: { first: buf(prfSalt) } } } as AuthenticationExtensionsClientInputs,
+    },
+  })) as PublicKeyCredential | null
+  if (!cred) return null
+  const ext = cred.getClientExtensionResults() as PrfExtensionResults
+  const credentialId = new Uint8Array(cred.rawId)
+  let first = ext.prf?.results?.first
+  if (!first) {
+    if (ext.prf?.enabled !== true) return null
+    first = (await evaluatePasskey(credentialId, prfSalt)) ?? undefined
+    if (!first) return null
+  }
+  return { credentialId, prfSalt, output: new Uint8Array(first) }
+}
+
+/** Evaluate the PRF of an enrolled passkey (a user-verified assertion). */
+async function evaluatePasskey(credentialId: Uint8Array, prfSalt: Uint8Array): Promise<ArrayBuffer | null> {
+  const assertion = (await navigator.credentials.get({
+    publicKey: {
+      rpId: rpId(),
+      challenge: buf(random(32)),
+      allowCredentials: [{ type: 'public-key', id: buf(credentialId) }],
+      userVerification: 'required',
+      extensions: { prf: { eval: { first: buf(prfSalt) } } } as AuthenticationExtensionsClientInputs,
+    },
+  })) as PublicKeyCredential | null
+  const ext = assertion?.getClientExtensionResults() as PrfExtensionResults | undefined
+  return ext?.prf?.results?.first ?? null
+}
+
+// ---------------------------------------------------------------------------
+// Store / unlock / lock
+// ---------------------------------------------------------------------------
+
+/** How to protect a new vault: a passphrase, a passkey PRF output, or both. */
+export interface Protection {
+  readonly passphrase?: string
+  readonly passkey?: { credentialId: Uint8Array; prfSalt: Uint8Array; output: Uint8Array }
+}
+
+/**
+ * Seal `secret` into the vault for `network`, replacing any earlier record for its identity,
+ * and keep it unlocked for this session. At least one protection is required.
+ */
+export async function storeInVault(network: Network, secret: VaultSecret, protection: Protection): Promise<void> {
+  assertDedicatedOrigin()
+  if (!protection.passphrase && !protection.passkey) throw new Error('the vault needs a passphrase or a passkey')
+  if (protection.passphrase !== undefined && protection.passphrase.length < MIN_PASSPHRASE) {
+    throw new Error(`use a passphrase of at least ${MIN_PASSPHRASE} characters`)
+  }
+  const { identityId } = secret
+  const dataKey = random(32)
+  try {
+    const body = await seal(dataKey, enc.encode(JSON.stringify(secret)), aad(network, identityId, 'body'))
+    const slots: Slot[] = []
+    if (protection.passkey) {
+      const kek = prfKey(protection.passkey.output, network, identityId)
+      const w = await seal(kek, dataKey, aad(network, identityId, 'passkey'))
+      kek.fill(0)
+      slots.push({ kind: 'passkey', credentialId: protection.passkey.credentialId, prfSalt: protection.passkey.prfSalt, iv: w.iv, wrapped: w.ct })
+    }
+    if (protection.passphrase) {
+      const salt = random(16)
+      const kek = await passphraseKey(protection.passphrase, salt)
+      const w = await seal(kek, dataKey, aad(network, identityId, 'passphrase'))
+      kek.fill(0)
+      slots.push({ kind: 'passphrase', salt, params: ARGON2_PARAMS, iv: w.iv, wrapped: w.ct })
+    }
+    const record: VaultRecord = {
+      version: 1,
+      network,
+      identityId,
+      keyId: secret.keyId,
+      createdAt: Date.now(),
+      iv: body.iv,
+      ciphertext: body.ct,
+      slots,
+    }
+    await idbPut('vault', key(network, identityId), record)
+  } finally {
+    dataKey.fill(0)
+  }
+  setUnlocked(network, secret)
+}
+
+/** The vaults stored for `network` (no secrets). */
+export async function listVaults(network: Network): Promise<VaultInfo[]> {
+  const rows = await idbEntries<VaultRecord>('vault', `vault:${network}:`)
+  return rows.map(([, r]) => ({
+    identityId: r.identityId,
+    keyId: r.keyId,
+    createdAt: r.createdAt,
+    methods: r.slots.map((s) => s.kind),
+  }))
+}
+
+async function unwrapWith(network: Network, record: VaultRecord, kek: Uint8Array, slot: Slot): Promise<VaultSecret> {
+  const dataKey = await open(kek, slot.iv, slot.wrapped, aad(network, record.identityId, slot.kind))
+  try {
+    const body = await open(dataKey, record.iv, record.ciphertext, aad(network, record.identityId, 'body'))
+    const secret = JSON.parse(new TextDecoder().decode(body)) as VaultSecret
+    body.fill(0)
+    if (secret.identityId !== record.identityId) throw new VaultLockedError('vault record does not match its identity')
+    return secret
+  } finally {
+    dataKey.fill(0)
+    kek.fill(0)
+  }
+}
+
+/** Unlock with a passphrase. Throws {@link VaultLockedError} on a wrong one. */
+export async function unlockWithPassphrase(network: Network, identityId: string, passphrase: string): Promise<VaultSecret> {
+  assertDedicatedOrigin()
+  const record = await idbGet<VaultRecord>('vault', key(network, identityId))
+  const slot = record?.slots.find((s) => s.kind === 'passphrase')
+  if (!record || !slot || slot.kind !== 'passphrase') throw new VaultLockedError('no passphrase-protected key for this identity here')
+  // The parameters are pinned, never read from the (unauthenticated) record: a tampered
+  // record cannot make unlock allocate gigabytes.
+  if (JSON.stringify(slot.params) !== JSON.stringify(ARGON2_PARAMS)) throw new VaultLockedError('this key was stored with unsupported settings')
+  const secret = await unwrapWith(network, record, await passphraseKey(passphrase, slot.salt), slot)
+  setUnlocked(network, secret)
+  return secret
+}
+
+/** Unlock with the enrolled passkey (a WebAuthn assertion with the PRF extension). */
+export async function unlockWithPasskey(network: Network, identityId: string): Promise<VaultSecret> {
+  assertDedicatedOrigin()
+  const record = await idbGet<VaultRecord>('vault', key(network, identityId))
+  const slot = record?.slots.find((s) => s.kind === 'passkey')
+  if (!record || !slot || slot.kind !== 'passkey') throw new VaultLockedError('no passkey-protected key for this identity here')
+  const output = await evaluatePasskey(slot.credentialId, slot.prfSalt)
+  if (!output) throw new VaultLockedError('the passkey did not return its PRF output')
+  const raw = new Uint8Array(output)
+  const kek = prfKey(raw, network, identityId)
+  raw.fill(0)
+  const secret = await unwrapWith(network, record, kek, slot)
+  setUnlocked(network, secret)
+  return secret
+}
+
+/** Delete the stored vault for an identity (sign out and forget this browser). */
+export async function forgetVault(network: Network, identityId: string): Promise<void> {
+  lockVault()
+  await idbDelete('vault', key(network, identityId))
+  clearSignedWrites()
+}
+
+/** Drop signed-but-unconfirmed writes this browser kept for retry (no keys; still, tidy up). */
+export function clearSignedWrites(): void {
+  if (typeof window === 'undefined') return
+  try {
+    const doomed: string[] = []
+    for (let i = 0; i < window.localStorage.length; i++) {
+      const k = window.localStorage.key(i)
+      if (k?.startsWith('forge:pending-st:')) doomed.push(k)
+    }
+    for (const k of doomed) window.localStorage.removeItem(k)
+  } catch {
+    /* storage disabled */
+  }
+}
+
+// The unlocked secret: module memory only.
+let unlocked: { network: Network; secret: VaultSecret; at: number } | null = null
+let lockTimer: ReturnType<typeof setTimeout> | null = null
+const lockListeners = new Set<() => void>()
+
+/** Be told when the vault locks (auto-lock, sign-out). Returns an unsubscribe function. */
+export function onVaultLock(listener: () => void): () => void {
+  lockListeners.add(listener)
+  return () => {
+    lockListeners.delete(listener)
+  }
+}
+
+function setUnlocked(network: Network, secret: VaultSecret): void {
+  unlocked = { network, secret, at: Date.now() }
+  if (lockTimer) clearTimeout(lockTimer)
+  lockTimer = setTimeout(lockVault, AUTO_LOCK_MS)
+}
+
+/**
+ * Hold a secret for this session without storing it (the "Advanced: raw key" path: tab-scoped
+ * unless the user opts into the vault).
+ */
+export function holdForSession(network: Network, secret: VaultSecret): void {
+  setUnlocked(network, secret)
+}
+
+/** The unlocked secret for (network, identity), or null when locked or expired. */
+export function unlockedSecret(network: Network, identityId: string): VaultSecret | null {
+  if (!unlocked || unlocked.network !== network || unlocked.secret.identityId !== identityId) return null
+  if (Date.now() - unlocked.at > AUTO_LOCK_MS) {
+    lockVault()
+    return null
+  }
+  return unlocked.secret
+}
+
+/** Forget the unlocked secret (sign-out, auto-lock). The stored record stays. */
+export function lockVault(): void {
+  const wasUnlocked = unlocked !== null
+  unlocked = null
+  if (lockTimer) clearTimeout(lockTimer)
+  lockTimer = null
+  if (wasUnlocked) for (const l of lockListeners) l()
+}
diff --git a/forge-web/lib/sdk/facade.ts b/forge-web/lib/sdk/facade.ts
new file mode 100644
index 000000000..da73cf878
--- /dev/null
+++ b/forge-web/lib/sdk/facade.ts
@@ -0,0 +1,67 @@
+/**
+ * One typed view of the evo-sdk facades the auth layer uses. The wasm-bindgen `.d.ts` types
+ * resolve loosely across builds; narrowing through these shapes in one place keeps every call
+ * site free of `as unknown as` casts.
+ */
+
+import type { EvoSDK } from '@dashevo/evo-sdk'
+
+/** An identity public key, as the auth layer reads it. */
+export interface WasmKey {
+  readonly keyId: number
+  readonly purposeNumber: number
+  readonly securityLevelNumber: number
+  readonly disabledAt?: bigint
+  readonly totalBudget?: bigint
+  readonly expiresAt?: bigint
+  readonly contractBounds?: { toJSON(): { $type: string; id: string } }
+  validatePrivateKey(bytes: Uint8Array, network: string): boolean
+}
+
+export interface WasmIdentity {
+  readonly publicKeys: WasmKey[]
+  readonly balance: bigint
+  getPublicKeyById(keyId: number): unknown
+}
+
+export interface AuthSdk {
+  identities: {
+    fetch(id: string): Promise<WasmIdentity | undefined>
+    balance(id: string): Promise<bigint | undefined>
+    update(options: unknown): Promise<void>
+    create(options: unknown): Promise<void>
+    keysRemainingBudgets(id: string, keyIds: number[]): Promise<Map<number, bigint | null>>
+  }
+  documents: { query(q: unknown): Promise<Map<string, unknown>> }
+  contracts: { fetch(id: string): Promise<unknown> }
+  system: { status(): Promise<{ toJSON(): { chain?: { coreChainLockedHeight?: number } } }> }
+}
+
+/** The typed facades of a connected SDK. */
+export function authSdk(sdk: EvoSDK): AuthSdk {
+  return sdk as unknown as AuthSdk
+}
+
+/** A sleep that ends early (rejecting with AbortError) when `signal` aborts. */
+export function sleep(ms: number, signal?: AbortSignal): Promise<void> {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new DOMException('cancelled', 'AbortError'))
+      return
+    }
+    const onAbort = (): void => {
+      clearTimeout(t)
+      reject(new DOMException('cancelled', 'AbortError'))
+    }
+    const t = setTimeout(() => {
+      signal?.removeEventListener('abort', onAbort)
+      resolve()
+    }, ms)
+    signal?.addEventListener('abort', onAbort, { once: true })
+  })
+}
+
+/** Whether `e` is the rejection of an aborted operation. */
+export function isAbort(e: unknown): boolean {
+  return e instanceof DOMException && e.name === 'AbortError'
+}
diff --git a/forge-web/lib/sdk/index.ts b/forge-web/lib/sdk/index.ts
index 02c298cd0..44cb5e2f2 100644
--- a/forge-web/lib/sdk/index.ts
+++ b/forge-web/lib/sdk/index.ts
@@ -6,7 +6,7 @@
  * completeness fallback (S0.8) that active-repo correctness depends on.
  */
 
-export { evoSdkService, type EvoSdkConfig } from './service'
+export { ensureSdk, evoSdkService, type EvoSdkConfig } from './service'
 export {
   ConsensusRefusal,
   DUPLICATE_UNIQUE_CODE,
diff --git a/forge-web/lib/sdk/service.ts b/forge-web/lib/sdk/service.ts
index 2050a65cb..c7f6825df 100644
--- a/forge-web/lib/sdk/service.ts
+++ b/forge-web/lib/sdk/service.ts
@@ -175,3 +175,16 @@ class EvoSdkService {
 
 /** The process-wide evo-sdk service singleton. */
 export const evoSdkService = new EvoSdkService()
+
+/**
+ * The connected SDK for `network`, connecting first if needed (the registry, DPNS and forge-v2
+ * contracts preloaded). Flows that start before any page has connected (sign-in) use this.
+ */
+export async function ensureSdk(network: Network): Promise<EvoSDK> {
+  const { registryContractId, dpnsContractId, v2 } = NETWORKS[network]
+  const contractIds = [registryContractId, dpnsContractId, v2?.core, v2?.collab].filter(
+    (id): id is string => typeof id === 'string' && id.length > 0,
+  )
+  await evoSdkService.initialize({ network, contractIds, timeoutMs: 15000 })
+  return evoSdkService.getSdk()
+}
diff --git a/forge-web/package.json b/forge-web/package.json
index 624ab75c7..f26ce336b 100644
--- a/forge-web/package.json
+++ b/forge-web/package.json
@@ -13,6 +13,7 @@
   "dependencies": {
     "@dashevo/evo-sdk": "4.2.0-beta.4",
     "@noble/hashes": "^2.2.0",
+    "@noble/secp256k1": "^3.2.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "fflate": "^0.8.3",
@@ -21,6 +22,7 @@
     "next": "14.2.25",
     "next-themes": "^0.4.6",
     "pako": "^3.0.1",
+    "qr": "^0.7.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "tailwind-merge": "^2.5.5",
diff --git a/forge-web/pnpm-lock.yaml b/forge-web/pnpm-lock.yaml
index b742d4057..d4302d8bc 100644
--- a/forge-web/pnpm-lock.yaml
+++ b/forge-web/pnpm-lock.yaml
@@ -14,6 +14,9 @@ importers:
       '@noble/hashes':
         specifier: ^2.2.0
         version: 2.2.0
+      '@noble/secp256k1':
+        specifier: ^3.2.0
+        version: 3.2.0
       class-variance-authority:
         specifier: ^0.7.1
         version: 0.7.1
@@ -38,6 +41,9 @@ importers:
       pako:
         specifier: ^3.0.1
         version: 3.0.1
+      qr:
+        specifier: ^0.7.0
+        version: 0.7.0
       react:
         specifier: ^18.3.1
         version: 18.3.1
@@ -388,6 +394,9 @@ packages:
     resolution: {integrity: sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==}
     engines: {node: '>= 20.19.0'}
 
+  '@noble/secp256k1@3.2.0':
+    resolution: {integrity: sha512-Z3ZAWOTxJ0EuTuZTi7Y69iK7GgrLHh8sgm45lVDhg/b3Nk1TpAiKhick2KkZisHuupeepSkyIydN/J459SdX1w==}
+
   '@nodelib/fs.scandir@2.1.5':
     resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
     engines: {node: '>= 8'}
@@ -1939,6 +1948,10 @@ packages:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
 
+  qr@0.7.0:
+    resolution: {integrity: sha512-/VrrACmOAwZVipuRITwfEwOL5oAMEHH5PTmBWaGtlTom2Thxaa+rhmna4zU9PRN2uLw2wdccbkHOLGZb1Q9SdA==}
+    engines: {node: '>= 20.19.0'}
+
   queue-microtask@1.2.3:
     resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
 
@@ -2607,6 +2620,8 @@ snapshots:
 
   '@noble/hashes@2.2.0': {}
 
+  '@noble/secp256k1@3.2.0': {}
+
   '@nodelib/fs.scandir@2.1.5':
     dependencies:
       '@nodelib/fs.stat': 2.0.5
@@ -3397,7 +3412,7 @@ snapshots:
       '@typescript-eslint/parser': 7.18.0(eslint@8.57.1)(typescript@5.9.3)
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1)
+      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1)
       eslint-plugin-import: 2.32.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
       eslint-plugin-jsx-a11y: 6.10.2(eslint@8.57.1)
       eslint-plugin-react: 7.37.5(eslint@8.57.1)
@@ -3417,7 +3432,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1):
+  eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1):
     dependencies:
       '@nolyfill/is-core-module': 1.0.39
       debug: 4.4.3
@@ -3432,14 +3447,14 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.14.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1):
+  eslint-module-utils@2.14.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1))(eslint@8.57.1):
     dependencies:
       debug: 3.2.7
     optionalDependencies:
       '@typescript-eslint/parser': 7.18.0(eslint@8.57.1)(typescript@5.9.3)
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1)
+      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1)
     transitivePeerDependencies:
       - supports-color
 
@@ -3454,7 +3469,7 @@ snapshots:
       doctrine: 2.1.0
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.10
-      eslint-module-utils: 2.14.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
+      eslint-module-utils: 2.14.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1))(eslint@8.57.1)
       hasown: 2.0.4
       is-core-module: 2.16.2
       is-glob: 4.0.3
@@ -4252,6 +4267,8 @@ snapshots:
 
   punycode@2.3.1: {}
 
+  qr@0.7.0: {}
+
   queue-microtask@1.2.3: {}
 
   react-dom@18.3.1(react@18.3.1):