From 3c26e5449edd6a3ebd602c8b1c6233089ab516d1 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sat, 26 Sep 2026 11:11:22 -0500
Subject: [PATCH 1/9] wip(web): limited-key sign-in, vault and in-browser
 identity creation

Vault: AES-256-GCM under a passkey PRF (HKDF) or Argon2id (64 MiB, t=3) in IndexedDB, AAD-bound to network+identity, unlocked only in module memory with a 12 h auto-lock; the plaintext localStorage keystore is removed and legacy entries purged. Sign-in sheet: unlock, App Connect (verified on chain), create identity (mnemonic, 3-word quiz, deposit QR, asset lock ported from mint-identity and byte-identical to it, IdentityCreate carrying the limited key), import file or phrase (master key signs one IdentityUpdate registering a HIGH key bound to the dash-forge group with budget and expiry), Advanced raw key for this tab only. Settings shows the key's budget and expiry, renew, lock and forget.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 forge-web/app/settings/page.tsx               |  16 +-
 forge-web/components/app-header.tsx           |   6 +-
 .../components/auth/create-identity-flow.tsx  | 234 +++++++++
 .../components/auth/protection-fields.tsx     |  83 ++++
 .../components/auth/wallet-connect-flow.tsx   | 100 ++++
 forge-web/components/keys-panel.tsx           |  79 +++
 forge-web/components/login-modal.tsx          | 455 ++++++++++++++----
 forge-web/components/ui/qr.tsx                |  21 +
 forge-web/contexts/auth-context.tsx           |  78 ++-
 forge-web/lib/auth/app-connect.ts             | 191 ++++++++
 forge-web/lib/auth/asset-lock.ts              | 338 +++++++++++++
 forge-web/lib/auth/auth-v2.test.ts            | 197 ++++++++
 forge-web/lib/auth/controller.ts              | 306 +++++++-----
 forge-web/lib/auth/create-identity.ts         | 213 ++++++++
 forge-web/lib/auth/hd.ts                      | 112 +++++
 forge-web/lib/auth/identity-file.ts           |  49 ++
 forge-web/lib/auth/index.ts                   |  29 +-
 forge-web/lib/auth/keystore.ts                | 101 ----
 forge-web/lib/auth/limited-key.ts             | 193 ++++++++
 forge-web/lib/auth/vault.ts                   | 347 +++++++++++++
 forge-web/package.json                        |   2 +
 forge-web/pnpm-lock.yaml                      |  27 +-
 22 files changed, 2812 insertions(+), 365 deletions(-)
 create mode 100644 forge-web/components/auth/create-identity-flow.tsx
 create mode 100644 forge-web/components/auth/protection-fields.tsx
 create mode 100644 forge-web/components/auth/wallet-connect-flow.tsx
 create mode 100644 forge-web/components/keys-panel.tsx
 create mode 100644 forge-web/components/ui/qr.tsx
 create mode 100644 forge-web/lib/auth/app-connect.ts
 create mode 100644 forge-web/lib/auth/asset-lock.ts
 create mode 100644 forge-web/lib/auth/auth-v2.test.ts
 create mode 100644 forge-web/lib/auth/create-identity.ts
 create mode 100644 forge-web/lib/auth/hd.ts
 delete mode 100644 forge-web/lib/auth/keystore.ts
 create mode 100644 forge-web/lib/auth/limited-key.ts
 create mode 100644 forge-web/lib/auth/vault.ts

diff --git a/forge-web/app/settings/page.tsx b/forge-web/app/settings/page.tsx
index 5b172af52..1bc51e426 100644
--- a/forge-web/app/settings/page.tsx
+++ b/forge-web/app/settings/page.tsx
@@ -3,7 +3,7 @@
 /** `/settings` — account settings: identity, network, balance, the local spend ledger, sign out. */
 
 import Link from 'next/link'
-import { LogOut, Wallet } from 'lucide-react'
+import { Wallet } from 'lucide-react'
 import { AppShell } from '@/components/app-shell'
 import { Button } from '@/components/ui/button'
 import { EmptyState } from '@/components/ui/states'
@@ -13,11 +13,12 @@ import { useAuth } from '@/contexts/auth-context'
 import { useUiStore } from '@/hooks/use-ui-store'
 import { NetworkBadge } from '@/components/ui/network-badge'
 import { SpendPanel } from '@/components/spend-panel'
+import { KeysPanel } from '@/components/keys-panel'
 import { creditsToDash } from '@/lib/sdk'
 import { balanceToDash, dashToUsd } from '@/lib/view/format'
 
 export default function SettingsPage(): JSX.Element {
-  const { identity, balance, logout } = useAuth()
+  const { identity, balance } = useAuth()
   const openLogin = useUiStore((s) => s.openLogin)
   const openTopUp = useUiStore((s) => s.openTopUp)
 
@@ -70,15 +71,8 @@ export default function SettingsPage(): JSX.Element {
         </section>
 
         <section className="rounded-lg border border-anvil-200 p-4 dark:border-anvil-800">
-          <div className="flex items-center justify-between">
-            <div>
-              <div className="text-dense font-medium">Sign out</div>
-              <p className="text-[12px] text-anvil-500 dark:text-anvil-400">Wipes your signing key from the browser keystore on this device.</p>
-            </div>
-            <Button variant="danger" onClick={logout}>
-              <LogOut className="h-3.5 w-3.5" aria-hidden /> Sign out
-            </Button>
-          </div>
+          <h2 className="mb-3 text-dense font-medium text-anvil-500 dark:text-anvil-400">This browser&apos;s key</h2>
+          <KeysPanel />
         </section>
 
         <p className="text-center text-[12px] text-anvil-400">
diff --git a/forge-web/components/app-header.tsx b/forge-web/components/app-header.tsx
index 4fae7fdd1..c62c12064 100644
--- a/forge-web/components/app-header.tsx
+++ b/forge-web/components/app-header.tsx
@@ -90,7 +90,7 @@ function AccountMenu({
 }: {
   identity: string
   balance: string | null
-  onLogout: () => void
+  onLogout: (forget?: boolean) => void
 }): JSX.Element {
   const [open, setOpen] = useState(false)
   const ref = useRef<HTMLDivElement>(null)
@@ -151,11 +151,11 @@ function AccountMenu({
             role="menuitem"
             onClick={() => {
               setOpen(false)
-              onLogout()
+              onLogout(false)
             }}
             className="flex w-full items-center gap-2 rounded-md px-3 py-2 text-left text-dense text-danger hover:bg-danger/5"
           >
-            <LogOut className="h-3.5 w-3.5" aria-hidden /> Sign out
+            <LogOut className="h-3.5 w-3.5" aria-hidden /> Lock &amp; sign out
           </button>
         </div>
       ) : null}
diff --git a/forge-web/components/auth/create-identity-flow.tsx b/forge-web/components/auth/create-identity-flow.tsx
new file mode 100644
index 000000000..805c3ef4a
--- /dev/null
+++ b/forge-web/components/auth/create-identity-flow.tsx
@@ -0,0 +1,234 @@
+'use client'
+
+/**
+ * "Create a new identity" (`ux-dx-spec.md` §2.2 tile 2, §2.5):
+ *   1. twelve words, shown once, with the honest backup warning;
+ *   2. a quiz on three of them (the flow does not continue until they match);
+ *   3. how to protect this browser's key (passkey / passphrase);
+ *   4. the deposit QR + address (any Dash wallet; the faucet on dev networks), watched through
+ *      the block explorer; then the asset lock, its proof, and one IdentityCreate that also
+ *      registers this browser's limited key.
+ * A closed tab resumes from step 4 once the same words are typed in again.
+ */
+
+import { useEffect, useMemo, useState } from 'react'
+import { AlertTriangle, Check, Loader2 } from 'lucide-react'
+import { useAuth } from '@/contexts/auth-context'
+import { Button } from '@/components/ui/button'
+import { Field, Input, Textarea } from '@/components/ui/input'
+import { Qr } from '@/components/ui/qr'
+import { useProtection } from '@/components/auth/protection-fields'
+import { faucetUrl } from '@/components/top-up-sheet'
+import { ACTIVE_NETWORK, DEFAULT_NETWORK } from '@/lib/constants'
+import { errorMessage } from '@/lib/utils'
+
+type Step = 'words' | 'quiz' | 'protect' | 'fund' | 'resume'
+
+const STAGE_TEXT: Readonly<Record<string, string>> = {
+  'waiting-deposit': 'Watching for your deposit…',
+  locking: 'Locking the deposit for Platform…',
+  proving: 'Waiting for the lock to be provable…',
+  registering: 'Registering your identity…',
+  verifying: 'Checking your browser key on Platform…',
+}
+
+export function CreateIdentityFlow({ onDone }: { onDone: () => void }): JSX.Element {
+  const { adoptLimitedKey } = useAuth()
+  const [step, setStep] = useState<Step>('words')
+  const [mnemonic, setMnemonic] = useState<string | null>(null)
+  const [positions, setPositions] = useState<number[]>([])
+  const [answers, setAnswers] = useState<string[]>(['', '', ''])
+  const [address, setAddress] = useState<string | null>(null)
+  const [stage, setStage] = useState<string | null>(null)
+  const [seen, setSeen] = useState(0)
+  const [error, setError] = useState<string | null>(null)
+  const [resumeWords, setResumeWords] = useState('')
+  const { fields, protection, problem } = useProtection('new identity')
+  const words = useMemo(() => mnemonic?.split(' ') ?? [], [mnemonic])
+
+  useEffect(() => {
+    let cancelled = false
+    void (async () => {
+      const { readCreationJournal } = await import('@/lib/auth/create-identity')
+      const j = await readCreationJournal(DEFAULT_NETWORK)
+      if (cancelled) return
+      if (j) {
+        setAddress(j.depositAddress)
+        setStep('resume')
+        return
+      }
+      const { newMnemonic, quizPositions } = await import('@/lib/auth/hd')
+      const m = await newMnemonic()
+      if (cancelled) return
+      setMnemonic(m)
+      setPositions(quizPositions(12, 3))
+    })()
+    return () => {
+      cancelled = true
+    }
+  }, [])
+
+  // Forget the words when the flow closes.
+  useEffect(() => () => setMnemonic(null), [])
+
+  const quizOk = positions.length === 3 && positions.every((p, i) => (answers[i] ?? '').trim().toLowerCase() === words[p])
+
+  const run = async (m: string): Promise<void> => {
+    if (!protection) return
+    setError(null)
+    const controller = new AbortController()
+    try {
+      const { evoSdkService } = await import('@/lib/sdk')
+      const { createIdentityFromMnemonic, depositAddressOf, MIN_DEPOSIT_DUFFS } = await import('@/lib/auth/create-identity')
+      const v2 = ACTIVE_NETWORK.v2
+      if (!v2) throw new Error('forge-v2 is not deployed here')
+      setAddress(await depositAddressOf(m, DEFAULT_NETWORK))
+      setStep('fund')
+      const { identityId, key } = await createIdentityFromMnemonic(evoSdkService.getSdk(), {
+        network: DEFAULT_NETWORK,
+        mnemonic: m,
+        group: v2.group,
+        minDepositDuffs: MIN_DEPOSIT_DUFFS,
+        signal: controller.signal,
+        onStage: (s, detail) => setStage(detail ?? STAGE_TEXT[s] ?? s),
+        onDeposit: setSeen,
+      })
+      await adoptLimitedKey(identityId, key, protection)
+      setMnemonic(null)
+      onDone()
+    } catch (e) {
+      setError(errorMessage(e))
+    }
+  }
+
+  if (step === 'resume') {
+    return (
+      <div className="space-y-3">
+        <p className="text-dense">
+          An identity creation is in progress on this device (deposit address <span className="font-mono">{address}</span>). Type
+          your 12 words to finish it.
+        </p>
+        <Field label="Your 12 words" htmlFor="resume-words">
+          <Textarea id="resume-words" value={resumeWords} onChange={(e) => setResumeWords(e.target.value)} className="min-h-[72px] font-mono" spellCheck={false} autoComplete="off" />
+        </Field>
+        {fields}
+        <Button variant="primary" className="w-full" disabled={resumeWords.trim().split(/\s+/).length < 12 || protection === null} onClick={() => run(resumeWords)}>
+          Continue
+        </Button>
+        {stage ? <p className="text-dense text-anvil-500">{stage}</p> : null}
+        {error ? <p role="alert" className="text-dense text-danger">{error}</p> : null}
+      </div>
+    )
+  }
+
+  if (step === 'words') {
+    return (
+      <div className="space-y-3">
+        <p className="text-dense font-medium">Write these 12 words down, in order, on paper.</p>
+        {words.length === 0 ? (
+          <Loader2 className="h-5 w-5 animate-spin text-anvil-400" aria-label="Generating" />
+        ) : (
+          <ol data-testid="mnemonic-words" className="grid grid-cols-3 gap-1.5 rounded-md border border-anvil-200 p-3 font-mono text-dense dark:border-anvil-800">
+            {words.map((w, i) => (
+              <li key={i}>
+                <span className="text-anvil-400">{i + 1}.</span> <span data-word={i}>{w}</span>
+              </li>
+            ))}
+          </ol>
+        )}
+        <div className="flex gap-2 rounded-md border border-caution/40 bg-caution/5 px-3 py-2 text-dense text-caution">
+          <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0" aria-hidden />
+          <span>
+            The 12 words are the identity. Lose them and nobody can recover it. Keep them offline; Forge only ever keeps a limited
+            key in this browser.
+          </span>
+        </div>
+        <Button variant="primary" className="w-full" disabled={words.length === 0} onClick={() => setStep('quiz')}>
+          I wrote them down
+        </Button>
+      </div>
+    )
+  }
+
+  if (step === 'quiz') {
+    return (
+      <div className="space-y-3">
+        <p className="text-dense">Check your backup: type these words.</p>
+        {positions.map((p, i) => (
+          <Field key={p} label={`Word ${p + 1}`} htmlFor={`quiz-${p}`}>
+            <Input
+              id={`quiz-${p}`}
+              value={answers[i] ?? ''}
+              autoComplete="off"
+              spellCheck={false}
+              onChange={(e) => setAnswers((a) => a.map((x, j) => (j === i ? e.target.value : x)))}
+            />
+          </Field>
+        ))}
+        <div className="flex gap-2">
+          <Button variant="ghost" onClick={() => setStep('words')}>
+            Show words again
+          </Button>
+          <Button variant="primary" className="flex-1" disabled={!quizOk} onClick={() => setStep('protect')}>
+            Continue
+          </Button>
+        </div>
+      </div>
+    )
+  }
+
+  if (step === 'protect') {
+    return (
+      <div className="space-y-3">
+        {fields}
+        <Button variant="primary" className="w-full" disabled={protection === null || mnemonic === null} onClick={() => mnemonic && run(mnemonic)}>
+          Continue to funding
+        </Button>
+        {problem ? <p className="text-[12px] text-anvil-500">{problem}</p> : null}
+      </div>
+    )
+  }
+
+  const faucet = faucetUrl()
+  return (
+    <div className="space-y-3" data-testid="fund-step">
+      <p className="text-dense">
+        Send at least <span className="font-mono">0.02 DASH</span> (0.05 suggested) to this address from any Dash wallet. It becomes your
+        Platform credits: ~0.0005 DASH per issue or push.
+      </p>
+      {address ? <Qr value={address} label={`Deposit address ${address}`} /> : null}
+      {address ? <span data-testid="deposit-address" className="sr-only">{address}</span> : null}
+      {faucet ? (
+        <a href={faucet} target="_blank" rel="noreferrer noopener" className="block text-center text-dense text-forge-600 underline dark:text-forge-400">
+          Get test DASH from the {ACTIVE_NETWORK.key} faucet
+        </a>
+      ) : null}
+      <div className="flex items-center gap-2 text-dense text-anvil-600 dark:text-anvil-300" aria-live="polite">
+        {error ? null : <Loader2 className="h-4 w-4 animate-spin" aria-hidden />}
+        <span data-testid="create-stage">{stage ?? STAGE_TEXT['waiting-deposit']}</span>
+        {seen > 0 ? (
+          <span className="inline-flex items-center gap-1 text-verify">
+            <Check className="h-3.5 w-3.5" aria-hidden /> {(seen / 1e8).toFixed(4)} DASH seen
+          </span>
+        ) : null}
+      </div>
+      <p className="text-[12px] text-anvil-500 dark:text-anvil-400">
+        To see your deposit this page asks a Dash block explorer ({new URL(coreHost()).host}). It can delay you but cannot take funds or
+        keys. On {ACTIVE_NETWORK.key} the lock is proven once a block chain-locks it, which can take a few minutes.
+      </p>
+      {error ? (
+        <div role="alert" className="rounded-md border border-danger/30 bg-danger/5 px-3 py-2 text-dense text-danger break-words">
+          {error} — your deposit is safe; reopen this sheet to resume.
+        </div>
+      ) : null}
+    </div>
+  )
+}
+
+function coreHost(): string {
+  return ACTIVE_NETWORK.network === 'devnet'
+    ? `https://insight.${ACTIVE_NETWORK.devnetName}.networks.dash.org`
+    : ACTIVE_NETWORK.network === 'testnet'
+      ? 'https://insight.testnet.networks.dash.org'
+      : 'https://insight.dash.org'
+}
diff --git a/forge-web/components/auth/protection-fields.tsx b/forge-web/components/auth/protection-fields.tsx
new file mode 100644
index 000000000..7a66beb64
--- /dev/null
+++ b/forge-web/components/auth/protection-fields.tsx
@@ -0,0 +1,83 @@
+'use client'
+
+/**
+ * How this browser's limited key is protected at rest (`ux-dx-spec.md` §2.3): a passkey (PRF)
+ * when the browser supports it, a passphrase (Argon2id) otherwise — or both. Produces the
+ * {@link Protection} the vault seals with. A passkey is enrolled on demand, so the ceremony
+ * runs only when the user asks for it.
+ */
+
+import { useState } from 'react'
+import { Fingerprint, KeyRound } from 'lucide-react'
+import { enrollPasskey, MIN_PASSPHRASE, passkeysAvailable, type Protection } from '@/lib/auth'
+import { Button } from '@/components/ui/button'
+import { Field, Input } from '@/components/ui/input'
+import { errorMessage } from '@/lib/utils'
+
+export function useProtection(identityLabel: string): {
+  readonly fields: JSX.Element
+  /** The protection, or null with `problem` set when not ready. */
+  readonly protection: Protection | null
+  readonly problem: string | null
+} {
+  const [passphrase, setPassphrase] = useState('')
+  const [confirm, setConfirm] = useState('')
+  const [passkey, setPasskey] = useState<Protection['passkey'] | null>(null)
+  const [enrolling, setEnrolling] = useState(false)
+  const [passkeyError, setPasskeyError] = useState<string | null>(null)
+  const canPasskey = passkeysAvailable()
+
+  const enroll = async (): Promise<void> => {
+    setEnrolling(true)
+    setPasskeyError(null)
+    try {
+      const p = await enrollPasskey(identityLabel || 'dash-forge', `Dash Forge (${identityLabel.slice(0, 8) || 'identity'})`)
+      if (p === null) setPasskeyError("This passkey can't protect keys here (no PRF support). Use a passphrase.")
+      else setPasskey(p)
+    } catch (e) {
+      setPasskeyError(errorMessage(e, 'passkey setup was cancelled'))
+    } finally {
+      setEnrolling(false)
+    }
+  }
+
+  const passphraseSet = passphrase.length > 0
+  let problem: string | null = null
+  if (passphraseSet && passphrase.length < MIN_PASSPHRASE) problem = `Use at least ${MIN_PASSPHRASE} characters.`
+  else if (passphraseSet && passphrase !== confirm) problem = 'The passphrases do not match.'
+  else if (!passphraseSet && !passkey) problem = 'Protect the key with a passkey or a passphrase.'
+
+  const protection: Protection | null =
+    problem !== null ? null : { ...(passphraseSet ? { passphrase } : {}), ...(passkey ? { passkey } : {}) }
+
+  const fields = (
+    <div className="space-y-3 rounded-md border border-anvil-200 p-3 dark:border-anvil-800">
+      <p className="text-dense font-medium">Protect this browser&apos;s key</p>
+      {canPasskey ? (
+        <div className="flex flex-wrap items-center gap-2">
+          <Button type="button" variant={passkey ? 'subtle' : 'outline'} size="sm" onClick={enroll} loading={enrolling} disabled={passkey !== null}>
+            <Fingerprint className="h-3.5 w-3.5" aria-hidden /> {passkey ? 'Passkey added' : 'Use a passkey'}
+          </Button>
+          <span className="text-[12px] text-anvil-500 dark:text-anvil-400">Recommended: Touch ID, Windows Hello or a security key.</span>
+        </div>
+      ) : null}
+      {passkeyError ? <p className="text-[12px] text-caution">{passkeyError}</p> : null}
+      <Field
+        label={passkey ? 'Passphrase (optional backup)' : 'Passphrase'}
+        htmlFor="vault-passphrase"
+        hint="Encrypts the key on this device (Argon2id, 64 MiB). Never sent anywhere."
+      >
+        <Input id="vault-passphrase" type="password" autoComplete="new-password" value={passphrase} onChange={(e) => setPassphrase(e.target.value)} />
+      </Field>
+      {passphraseSet ? (
+        <Field label="Repeat passphrase" htmlFor="vault-passphrase-2">
+          <Input id="vault-passphrase-2" type="password" autoComplete="new-password" value={confirm} onChange={(e) => setConfirm(e.target.value)} />
+        </Field>
+      ) : null}
+      <p className="flex items-center gap-1 text-[12px] text-anvil-500 dark:text-anvil-400">
+        <KeyRound className="h-3 w-3" aria-hidden /> Locks itself after 12 hours or when you sign out.
+      </p>
+    </div>
+  )
+  return { fields, protection, problem }
+}
diff --git a/forge-web/components/auth/wallet-connect-flow.tsx b/forge-web/components/auth/wallet-connect-flow.tsx
new file mode 100644
index 000000000..125f3998b
--- /dev/null
+++ b/forge-web/components/auth/wallet-connect-flow.tsx
@@ -0,0 +1,100 @@
+'use client'
+
+/**
+ * "Use my Dash wallet" (`ux-dx-spec.md` §2.2 tile 1): shows the App Connect request as a QR
+ * and a deep link, waits for the wallet's `loginKeyResponse`, verifies the granted key on chain
+ * (live, HIGH, bound to the dash-forge group, budgeted, expiring), then stores it in the vault.
+ */
+
+import { useEffect, useRef, useState } from 'react'
+import { Loader2 } from 'lucide-react'
+import { useAuth } from '@/contexts/auth-context'
+import { Button } from '@/components/ui/button'
+import { Qr } from '@/components/ui/qr'
+import { useProtection } from '@/components/auth/protection-fields'
+import { ACTIVE_NETWORK, DEFAULT_NETWORK } from '@/lib/constants'
+import { BROWSER_KEY_DEFAULTS, type LimitedKey } from '@/lib/auth'
+import { errorMessage } from '@/lib/utils'
+
+export function WalletConnectFlow({ onDone }: { onDone: () => void }): JSX.Element {
+  const { adoptLimitedKey } = useAuth()
+  const [uri, setUri] = useState<string | null>(null)
+  const [pairing, setPairing] = useState('')
+  const [slow, setSlow] = useState(false)
+  const [granted, setGranted] = useState<{ identityId: string; key: LimitedKey } | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const { fields, protection, problem } = useProtection(granted?.identityId ?? '')
+  const abort = useRef<AbortController | null>(null)
+
+  useEffect(() => {
+    const controller = new AbortController()
+    abort.current = controller
+    const timer = setTimeout(() => setSlow(true), 3 * 60 * 1000)
+    void (async () => {
+      try {
+        const v2 = ACTIVE_NETWORK.v2
+        if (!v2) throw new Error('forge-v2 is not deployed here')
+        const { evoSdkService } = await import('@/lib/sdk')
+        const { newRequest, awaitWalletLogin } = await import('@/lib/auth/app-connect')
+        const req = newRequest(DEFAULT_NETWORK, v2.core)
+        setUri(req.uri)
+        setPairing(req.pairingCode)
+        const login = await awaitWalletLogin(evoSdkService.getSdk(), req, { network: DEFAULT_NETWORK, group: v2.group, signal: controller.signal })
+        setGranted({ identityId: login.identityId, key: { keyId: login.keyId, wif: login.wif, limits: login.limits } })
+      } catch (e) {
+        if (!controller.signal.aborted) setError(errorMessage(e))
+      }
+    })()
+    return () => {
+      controller.abort()
+      clearTimeout(timer)
+    }
+  }, [])
+
+  if (granted) {
+    return (
+      <div className="space-y-3">
+        <p className="text-dense">
+          Your wallet granted a key to <span className="font-mono">{granted.identityId.slice(0, 10)}…</span>, verified on Platform.
+        </p>
+        {fields}
+        <Button
+          variant="primary"
+          className="w-full"
+          disabled={protection === null}
+          onClick={async () => {
+            if (!protection) return
+            try {
+              await adoptLimitedKey(granted.identityId, granted.key, protection)
+              onDone()
+            } catch (e) {
+              setError(errorMessage(e))
+            }
+          }}
+        >
+          Finish signing in
+        </Button>
+        {problem ? <p className="text-[12px] text-anvil-500">{problem}</p> : null}
+        {error ? <p role="alert" className="text-dense text-danger">{error}</p> : null}
+      </div>
+    )
+  }
+
+  return (
+    <div className="space-y-3">
+      {uri ? <Qr value={uri} label="Wallet login request" size={200} /> : <Loader2 className="mx-auto h-5 w-5 animate-spin text-anvil-400" aria-hidden />}
+      {uri ? (
+        <a href={uri} className="block text-center text-dense text-forge-600 underline dark:text-forge-400">
+          Open in a wallet on this device
+        </a>
+      ) : null}
+      <p className="text-dense">
+        Approve in your wallet. Forge gets a key that can spend at most {BROWSER_KEY_DEFAULTS.budgetDash} DASH, only here, for{' '}
+        {BROWSER_KEY_DEFAULTS.days} days. Check the wallet shows code <span className="font-mono font-semibold">{pairing}</span>.
+      </p>
+      {slow ? <p className="text-dense text-caution">No response yet. Keep this tab open, or choose another method.</p> : null}
+      <p className="text-[12px] text-anvil-500 dark:text-anvil-400">Needs a wallet with Platform login (App Connect).</p>
+      {error ? <p role="alert" className="text-dense text-danger">{error}</p> : null}
+    </div>
+  )
+}
diff --git a/forge-web/components/keys-panel.tsx b/forge-web/components/keys-panel.tsx
new file mode 100644
index 000000000..b149c65a4
--- /dev/null
+++ b/forge-web/components/keys-panel.tsx
@@ -0,0 +1,79 @@
+'use client'
+
+/**
+ * Settings → This browser's key (`ux-dx-spec.md` §2.3): which key signs here, what is left of
+ * its budget, when it expires, and how to renew it. Renewal registers a fresh limited key (it
+ * needs the master key once: import the identity file or phrase again); raising an existing
+ * key's limits (`IdentityKeyLimitsUpdate`) is P1. Also: lock now, and sign out + forget.
+ */
+
+import { useState } from 'react'
+import { Lock, LogOut, RefreshCw } from 'lucide-react'
+import { useAuth } from '@/contexts/auth-context'
+import { useUiStore } from '@/hooks/use-ui-store'
+import { Button } from '@/components/ui/button'
+import { Field, Input } from '@/components/ui/input'
+import { creditsAsDash, formatDate } from '@/lib/view/format'
+
+export function KeysPanel(): JSX.Element {
+  const { keyLimits, storage, funds, logout } = useAuth()
+  const openLogin = useUiStore((s) => s.openLogin)
+  const [explorer, setExplorer] = useState(() =>
+    typeof window === 'undefined' ? '' : window.localStorage.getItem('forge:insight-url') ?? '',
+  )
+  const low = funds?.reason === 'key-budget' || funds?.reason === 'key-expiry'
+
+  return (
+    <div className="space-y-4 text-dense" data-testid="keys-panel">
+      {storage === 'session' ? (
+        <p className="rounded-md border border-danger/40 bg-danger/5 px-3 py-2 text-danger">
+          This tab signs with a pasted key that has no Forge limits. It is forgotten on reload.
+        </p>
+      ) : keyLimits ? (
+        <dl className="grid grid-cols-2 gap-2">
+          <dt className="text-anvil-500 dark:text-anvil-400">Budget left</dt>
+          <dd data-testid="key-budget" className="font-mono">
+            {keyLimits.remaining === null ? '—' : `${creditsAsDash(Number(keyLimits.remaining))} of ${creditsAsDash(Number(keyLimits.total ?? 0n))} DASH`}
+          </dd>
+          <dt className="text-anvil-500 dark:text-anvil-400">Expires</dt>
+          <dd data-testid="key-expiry">{keyLimits.expiresAt === null ? 'never' : formatDate(keyLimits.expiresAt)}</dd>
+          <dt className="text-anvil-500 dark:text-anvil-400">Scope</dt>
+          <dd>dash-forge contracts only</dd>
+        </dl>
+      ) : (
+        <p className="text-anvil-500 dark:text-anvil-400">This key has no budget or expiry.</p>
+      )}
+      {low ? (
+        <p className="text-caution">This browser&apos;s key is nearly used up. Renew it (uses your master key once).</p>
+      ) : null}
+      <div className="flex flex-wrap gap-2">
+        <Button variant="outline" size="sm" onClick={openLogin}>
+          <RefreshCw className="h-3.5 w-3.5" aria-hidden /> Renew key
+        </Button>
+        <Button variant="outline" size="sm" onClick={() => logout(false)}>
+          <Lock className="h-3.5 w-3.5" aria-hidden /> Lock
+        </Button>
+        <Button variant="danger" size="sm" onClick={() => logout(true)}>
+          <LogOut className="h-3.5 w-3.5" aria-hidden /> Sign out &amp; forget key
+        </Button>
+      </div>
+      <Field
+        label="Block explorer (used only to watch identity deposits)"
+        htmlFor="explorer-url"
+        hint="Insight API base URL. Leave empty for the network default. It can delay you but cannot take funds or keys."
+      >
+        <Input
+          id="explorer-url"
+          value={explorer}
+          placeholder="https://insight.dash.org/insight-api"
+          onChange={(e) => {
+            setExplorer(e.target.value)
+            const v = e.target.value.trim()
+            if (v === '') window.localStorage.removeItem('forge:insight-url')
+            else if (/^https:\/\//.test(v)) window.localStorage.setItem('forge:insight-url', v.replace(/\/+$/, ''))
+          }}
+        />
+      </Field>
+    </div>
+  )
+}
diff --git a/forge-web/components/login-modal.tsx b/forge-web/components/login-modal.tsx
index 77d62b2ef..6d8ac0b2a 100644
--- a/forge-web/components/login-modal.tsx
+++ b/forge-web/components/login-modal.tsx
@@ -1,164 +1,407 @@
 'use client'
 
 /**
- * Login modal — imports a bridge identity file OR a pasted WIF + identity id into the headless
- * {@link useAuth} session. The signing key is stored in the network keystore and never enters
- * React state (see AuthController). Read-only browsing works logged-out; this only gates writes.
+ * The sign-in sheet (`ux-dx-spec.md` §2.2). Three tiles plus an Advanced disclosure:
+ *
+ *   1. Use my Dash wallet — App Connect (shown only when the system contract exists here);
+ *   2. Create a new identity — mnemonic + backup quiz + deposit QR, registered with a limited
+ *      key inside the IdentityCreate;
+ *   3. Import an identity file (or mnemonic) — the master key signs one IdentityUpdate that
+ *      registers a limited key for this browser, and is not stored;
+ *   Advanced: paste a raw key (developer path; this tab only; red warning).
+ *
+ * When this device already holds an encrypted key, the sheet opens on "Unlock" instead.
+ * On a network without forge-v2 (no contract group to bind a key to, testnet today) only the
+ * v1 paths exist: the identity file signs with its HIGH/CRITICAL key for this tab.
  */
 
-import { useRef, useState } from 'react'
-import { KeyRound, Upload } from 'lucide-react'
+import { useEffect, useRef, useState } from 'react'
+import { ArrowLeft, Fingerprint, KeyRound, Lock, Plus, Upload, Wallet } from 'lucide-react'
 import { useAuth } from '@/contexts/auth-context'
 import { useUiStore } from '@/hooks/use-ui-store'
 import { Dialog } from '@/components/ui/dialog'
 import { Button } from '@/components/ui/button'
-import { Field, Input } from '@/components/ui/input'
+import { Field, Input, Textarea } from '@/components/ui/input'
+import { useProtection } from '@/components/auth/protection-fields'
+import { CreateIdentityFlow } from '@/components/auth/create-identity-flow'
+import { WalletConnectFlow } from '@/components/auth/wallet-connect-flow'
 import { ACTIVE_NETWORK } from '@/lib/constants'
-import { errorMessage } from '@/lib/utils'
+import { BROWSER_KEY_DEFAULTS, parseIdentityFileText } from '@/lib/auth'
+import { formatDate } from '@/lib/view/format'
+import { cn, errorMessage } from '@/lib/utils'
 
-type Tab = 'file' | 'key'
+type View = 'choose' | 'unlock' | 'import' | 'create' | 'wallet' | 'advanced'
 
 export function LoginModal(): JSX.Element {
   const open = useUiStore((s) => s.loginOpen)
   const close = useUiStore((s) => s.closeLogin)
-  const { login, loginWithIdentityFile, isLoading, error } = useAuth()
+  const { vaults, limitedKeys } = useAuth()
+  const [view, setView] = useState<View>('choose')
 
-  const [tab, setTab] = useState<Tab>('file')
+  useEffect(() => {
+    if (open) setView(vaults.length > 0 ? 'unlock' : 'choose')
+  }, [open, vaults.length])
+
+  const back = view === 'choose' || view === 'unlock' ? null : () => setView('choose')
+
+  return (
+    <Dialog
+      open={open}
+      onClose={close}
+      title="Sign in to Dash Forge"
+      description={
+        limitedKeys
+          ? `Forge signs with a limited key: at most ${BROWSER_KEY_DEFAULTS.budgetDash} DASH, only on Forge, for ${BROWSER_KEY_DEFAULTS.days} days.`
+          : `Your key signs writes on ${ACTIVE_NETWORK.key}. It stays in this tab, never sent anywhere.`
+      }
+      className="max-w-lg"
+    >
+      {back ? (
+        <button type="button" onClick={back} className="mb-3 inline-flex items-center gap-1 text-dense text-anvil-500 hover:text-anvil-800 dark:hover:text-anvil-100">
+          <ArrowLeft className="h-3.5 w-3.5" aria-hidden /> All options
+        </button>
+      ) : null}
+      {view === 'unlock' ? <UnlockView onDone={close} onOther={() => setView('choose')} /> : null}
+      {view === 'choose' ? <ChooseView onPick={setView} /> : null}
+      {view === 'import' ? (limitedKeys ? <ImportView onDone={close} /> : <V1FileView onDone={close} />) : null}
+      {view === 'create' ? <CreateIdentityFlow onDone={close} /> : null}
+      {view === 'wallet' ? <WalletConnectFlow onDone={close} /> : null}
+      {view === 'advanced' ? <AdvancedView onDone={close} /> : null}
+    </Dialog>
+  )
+}
+
+function Tile({ icon: Icon, title, body, onClick, testId }: { icon: typeof Wallet; title: string; body: string; onClick: () => void; testId: string }): JSX.Element {
+  return (
+    <button
+      type="button"
+      data-testid={testId}
+      onClick={onClick}
+      className="flex w-full items-start gap-3 rounded-lg border border-anvil-200 px-3 py-3 text-left transition-colors hover:border-forge-400 hover:bg-anvil-50 dark:border-anvil-750 dark:hover:bg-anvil-850"
+    >
+      <Icon className="mt-0.5 h-5 w-5 shrink-0 text-forge-500" aria-hidden />
+      <span>
+        <span className="block text-dense font-medium text-anvil-900 dark:text-anvil-50">{title}</span>
+        <span className="block text-[12px] text-anvil-500 dark:text-anvil-400">{body}</span>
+      </span>
+    </button>
+  )
+}
+
+function ChooseView({ onPick }: { onPick: (v: View) => void }): JSX.Element {
+  const { limitedKeys, walletAvailable } = useWalletAvailability()
+  const [advanced, setAdvanced] = useState(false)
+  return (
+    <div className="space-y-2">
+      {limitedKeys && walletAvailable ? (
+        <Tile testId="tile-wallet" icon={Wallet} title="Use my Dash wallet" body="Scan a QR with a wallet that supports Platform login. It grants Forge a limited key." onClick={() => onPick('wallet')} />
+      ) : null}
+      {limitedKeys ? (
+        <Tile testId="tile-create" icon={Plus} title="Create a new identity" body="12 words you write down, then fund it from any Dash wallet. ~0.0005 DASH per issue or push." onClick={() => onPick('create')} />
+      ) : null}
+      <Tile
+        testId="tile-import"
+        icon={Upload}
+        title={limitedKeys ? 'Import an identity file or recovery phrase' : 'Import an identity file'}
+        body={
+          limitedKeys
+            ? 'Your master key is used once, right now, to create a limited key for this browser. It is not stored.'
+            : 'The bridge / dg JSON export. Its signing key stays in this tab only.'
+        }
+        onClick={() => onPick('import')}
+      />
+      <div className="pt-2">
+        <button type="button" aria-expanded={advanced} onClick={() => setAdvanced((a) => !a)} className="text-[12px] text-anvil-500 underline hover:text-anvil-800 dark:hover:text-anvil-100">
+          Advanced
+        </button>
+        {advanced ? (
+          <div className="mt-2">
+            <Tile testId="tile-advanced" icon={KeyRound} title="Paste a private key" body="Developer path. The key is held in this tab only and is lost on reload." onClick={() => onPick('advanced')} />
+          </div>
+        ) : null}
+      </div>
+    </div>
+  )
+}
+
+/** Whether the App Connect tile applies here (protocol 14 + the system contract present). */
+function useWalletAvailability(): { limitedKeys: boolean; walletAvailable: boolean } {
+  const { limitedKeys } = useAuth()
+  const [walletAvailable, setAvailable] = useState(false)
+  useEffect(() => {
+    if (!limitedKeys) return
+    let cancelled = false
+    void (async () => {
+      const { evoSdkService } = await import('@/lib/sdk')
+      const { appConnectAvailable } = await import('@/lib/auth/app-connect')
+      if (!evoSdkService.isReady) return
+      const ok = await appConnectAvailable(evoSdkService.getSdk())
+      if (!cancelled) setAvailable(ok)
+    })()
+    return () => {
+      cancelled = true
+    }
+  }, [limitedKeys])
+  return { limitedKeys, walletAvailable }
+}
+
+function ErrorBox({ error }: { error: string | null }): JSX.Element | null {
+  if (!error) return null
+  return (
+    <div role="alert" className="mt-3 rounded-md border border-danger/30 bg-danger/5 px-3 py-2 text-dense text-danger break-words">
+      {error}
+    </div>
+  )
+}
+
+function UnlockView({ onDone, onOther }: { onDone: () => void; onOther: () => void }): JSX.Element {
+  const { vaults, unlock, logout, isLoading } = useAuth()
+  const [pick, setPick] = useState(0)
+  const [passphrase, setPassphrase] = useState('')
+  const [error, setError] = useState<string | null>(null)
+  const v = vaults[pick]
+  if (!v) return <p className="text-dense">No key is stored on this device.</p>
+  const go = async (method: { passphrase: string } | 'passkey'): Promise<void> => {
+    setError(null)
+    try {
+      await unlock(v.identityId, method)
+      setPassphrase('')
+      onDone()
+    } catch (e) {
+      setError(errorMessage(e))
+    }
+  }
+  return (
+    <div className="space-y-3">
+      <div className="flex items-center gap-2 text-dense">
+        <Lock className="h-4 w-4 text-anvil-400" aria-hidden />
+        This browser holds a key for{' '}
+        {vaults.length > 1 ? (
+          <select aria-label="Identity" value={pick} onChange={(e) => setPick(Number(e.target.value))} className="rounded border border-anvil-300 bg-transparent px-1 font-mono dark:border-anvil-700">
+            {vaults.map((x, i) => (
+              <option key={x.identityId} value={i}>
+                {x.identityId.slice(0, 10)}…
+              </option>
+            ))}
+          </select>
+        ) : (
+          <span className="font-mono">{v.identityId.slice(0, 10)}…</span>
+        )}
+      </div>
+      {v.methods.includes('passkey') ? (
+        <Button variant="primary" className="w-full" onClick={() => go('passkey')} loading={isLoading}>
+          <Fingerprint className="h-4 w-4" aria-hidden /> Unlock with passkey
+        </Button>
+      ) : null}
+      {v.methods.includes('passphrase') ? (
+        <form
+          className="space-y-2"
+          onSubmit={(e) => {
+            e.preventDefault()
+            void go({ passphrase })
+          }}
+        >
+          <Field label="Passphrase" htmlFor="unlock-passphrase">
+            <Input id="unlock-passphrase" type="password" autoComplete="current-password" value={passphrase} onChange={(e) => setPassphrase(e.target.value)} autoFocus />
+          </Field>
+          <Button type="submit" variant={v.methods.includes('passkey') ? 'outline' : 'primary'} className="w-full" loading={isLoading} disabled={passphrase === ''}>
+            Unlock
+          </Button>
+        </form>
+      ) : null}
+      <ErrorBox error={error} />
+      <div className="flex justify-between pt-1 text-[12px]">
+        <button type="button" onClick={onOther} className="text-anvil-500 underline">
+          Use another identity
+        </button>
+        <button type="button" onClick={() => logout(true)} className="text-danger underline">
+          Forget this key
+        </button>
+      </div>
+      <p className="text-[12px] text-anvil-500 dark:text-anvil-400">Stored {formatDate(v.createdAt)} · key #{v.keyId}</p>
+    </div>
+  )
+}
+
+function ImportView({ onDone }: { onDone: () => void }): JSX.Element {
+  const { importIdentity, isLoading } = useAuth()
+  const [mode, setMode] = useState<'file' | 'mnemonic'>('file')
+  const [fileText, setFileText] = useState<string | null>(null)
+  const [fileName, setFileName] = useState('')
+  const [fileIdentity, setFileIdentity] = useState('')
+  const [mnemonic, setMnemonic] = useState('')
   const [identityId, setIdentityId] = useState('')
-  const [privateKey, setPrivateKey] = useState('')
-  const [localError, setLocalError] = useState<string | null>(null)
+  const [error, setError] = useState<string | null>(null)
   const fileRef = useRef<HTMLInputElement>(null)
-
-  const shownError = localError ?? error
+  const who = mode === 'file' ? fileIdentity : identityId
+  const { fields, protection, problem } = useProtection(who)
 
   const onFile = async (file: File): Promise<void> => {
-    setLocalError(null)
+    setError(null)
+    const text = await file.text()
     try {
-      const text = await file.text()
-      await loginWithIdentityFile(text)
-      close()
-    } catch (e) {
-      setLocalError(errorMessage(e))
+      setFileIdentity(parseIdentityFileText(text).identityId)
+    } catch {
+      setFileIdentity('')
     }
+    setFileText(text)
+    setFileName(file.name)
   }
 
-  const onKeyLogin = async (): Promise<void> => {
-    setLocalError(null)
+  const ready = protection !== null && (mode === 'file' ? fileText !== null : mnemonic.trim() !== '' && identityId.trim() !== '')
+  const submit = async (): Promise<void> => {
+    if (!protection) return
+    setError(null)
     try {
-      await login(identityId.trim(), privateKey.trim())
-      close()
+      await importIdentity(mode === 'file' ? { fileText: fileText as string } : { mnemonic, identityId }, protection)
+      setFileText(null)
+      setMnemonic('')
+      onDone()
     } catch (e) {
-      setLocalError(errorMessage(e))
+      setError(errorMessage(e))
     }
   }
 
   return (
-    <Dialog
-      open={open}
-      onClose={close}
-      title="Sign in to Dash Forge"
-      description={`Your key signs writes on ${ACTIVE_NETWORK.key}. It stays in your browser — never sent anywhere.`}
-    >
-      <div className="mb-4 inline-flex rounded-md border border-anvil-200 p-0.5 dark:border-anvil-750">
-        <TabButton active={tab === 'file'} onClick={() => setTab('file')}>
-          <Upload className="h-3.5 w-3.5" aria-hidden /> Identity file
-        </TabButton>
-        <TabButton active={tab === 'key'} onClick={() => setTab('key')}>
-          <KeyRound className="h-3.5 w-3.5" aria-hidden /> Key + ID
-        </TabButton>
+    <div className="space-y-3">
+      <div role="tablist" className="inline-flex rounded-md border border-anvil-200 p-0.5 dark:border-anvil-750">
+        {(['file', 'mnemonic'] as const).map((m) => (
+          <button
+            key={m}
+            role="tab"
+            aria-selected={mode === m}
+            type="button"
+            onClick={() => setMode(m)}
+            className={cn('rounded px-3 py-1.5 text-dense font-medium', mode === m ? 'bg-forge-500/15 text-forge-600 dark:text-forge-400' : 'text-anvil-500')}
+          >
+            {m === 'file' ? 'Identity file' : 'Recovery phrase'}
+          </button>
+        ))}
       </div>
-
-      {tab === 'file' ? (
-        <div className="space-y-3">
+      {mode === 'file' ? (
+        <>
           <button
             type="button"
             onClick={() => fileRef.current?.click()}
-            className="flex w-full flex-col items-center justify-center gap-2 rounded-lg border border-dashed border-anvil-300 px-4 py-8 text-center transition-colors hover:border-forge-400 hover:bg-anvil-50 dark:border-anvil-700 dark:hover:bg-anvil-850"
+            className="flex w-full flex-col items-center gap-1 rounded-lg border border-dashed border-anvil-300 px-4 py-5 text-center hover:border-forge-400 dark:border-anvil-700"
           >
             <Upload className="h-5 w-5 text-forge-500" aria-hidden />
-            <span className="text-dense font-medium">Choose a bridge identity file</span>
-            <span className="text-[12px] text-anvil-500 dark:text-anvil-400">
-              The .json file exported from the Dash bridge
-            </span>
+            <span className="text-dense font-medium">{fileName || 'Choose an identity file (.json)'}</span>
+            {fileIdentity ? <span className="font-mono text-[12px] text-anvil-500">{fileIdentity}</span> : null}
           </button>
           <input
             ref={fileRef}
             type="file"
+            aria-label="Identity file"
             accept="application/json,.json,.txt"
             className="sr-only"
             onChange={(e) => {
               const f = e.target.files?.[0]
               if (f) void onFile(f)
+              e.target.value = ''
             }}
           />
-        </div>
+        </>
       ) : (
-        <div className="space-y-3">
-          <Field label="Identity ID" htmlFor="login-id" hint="Your base58 identity id.">
-            <Input
-              id="login-id"
-              value={identityId}
-              onChange={(e) => setIdentityId(e.target.value)}
-              placeholder="e.g. 5Dtb9k4wKf3Jpq3mR7nTgH2vQxYzA1BcD8eF6gH9jK"
-              className="font-mono"
-              autoComplete="off"
-              spellCheck={false}
-            />
+        <>
+          <Field label="Identity ID" htmlFor="import-id">
+            <Input id="import-id" value={identityId} onChange={(e) => setIdentityId(e.target.value)} className="font-mono" spellCheck={false} autoComplete="off" />
           </Field>
-          <Field label="Private key (WIF or hex)" htmlFor="login-key" hint="Held in your browser keystore only.">
-            <Input
-              id="login-key"
-              type="password"
-              value={privateKey}
-              onChange={(e) => setPrivateKey(e.target.value)}
-              placeholder="WIF or 64-char hex"
-              className="font-mono"
-              autoComplete="off"
-              spellCheck={false}
-            />
+          <Field label="Recovery phrase (12 or 24 words)" htmlFor="import-mnemonic" hint="Used once to derive the master key, then discarded.">
+            <Textarea id="import-mnemonic" value={mnemonic} onChange={(e) => setMnemonic(e.target.value)} className="min-h-[72px] font-mono" spellCheck={false} autoComplete="off" />
           </Field>
-          <Button
-            variant="primary"
-            className="w-full"
-            onClick={onKeyLogin}
-            loading={isLoading}
-            disabled={identityId.trim() === '' || privateKey.trim() === ''}
-          >
-            Sign in
-          </Button>
-        </div>
+        </>
       )}
+      {fields}
+      <p className="text-[12px] text-anvil-500 dark:text-anvil-400">
+        Registers a key that can spend at most {BROWSER_KEY_DEFAULTS.budgetDash} DASH, only on Forge, for {BROWSER_KEY_DEFAULTS.days} days (~0.0005 DASH, one master-key signature).
+      </p>
+      <Button variant="primary" className="w-full" onClick={submit} loading={isLoading} disabled={!ready}>
+        Create this browser&apos;s key
+      </Button>
+      {problem && (fileText !== null || mnemonic !== '') ? <p className="text-[12px] text-anvil-500">{problem}</p> : null}
+      <ErrorBox error={error} />
+    </div>
+  )
+}
 
-      {shownError ? (
-        <div className="mt-3 rounded-md border border-danger/30 bg-danger/5 px-3 py-2 text-dense text-danger break-words">
-          {shownError}
-        </div>
-      ) : null}
-    </Dialog>
+/** Networks without forge-v2 (testnet): an identity file's HIGH/CRITICAL key, this tab only. */
+function V1FileView({ onDone }: { onDone: () => void }): JSX.Element {
+  const { loginWithRawKey, isLoading } = useAuth()
+  const [error, setError] = useState<string | null>(null)
+  const fileRef = useRef<HTMLInputElement>(null)
+  const onFile = async (file: File): Promise<void> => {
+    setError(null)
+    try {
+      const parsed = parseIdentityFileText(await file.text())
+      await loginWithRawKey(parsed.identityId, parsed.signingKeyWif)
+      onDone()
+    } catch (e) {
+      setError(errorMessage(e))
+    }
+  }
+  return (
+    <div className="space-y-3">
+      <button
+        type="button"
+        onClick={() => fileRef.current?.click()}
+        disabled={isLoading}
+        className="flex w-full flex-col items-center gap-2 rounded-lg border border-dashed border-anvil-300 px-4 py-8 text-center hover:border-forge-400 dark:border-anvil-700"
+      >
+        <Upload className="h-5 w-5 text-forge-500" aria-hidden />
+        <span className="text-dense font-medium">Choose an identity file</span>
+      </button>
+      <input
+        ref={fileRef}
+        type="file"
+        aria-label="Identity file"
+        accept="application/json,.json,.txt"
+        className="sr-only"
+        onChange={(e) => {
+          const f = e.target.files?.[0]
+          if (f) void onFile(f)
+          e.target.value = ''
+        }}
+      />
+      <p className="text-[12px] text-anvil-500 dark:text-anvil-400">
+        {ACTIVE_NETWORK.key} has no Forge contract group yet, so there are no limited keys here: the file&apos;s signing key is held in this tab and forgotten on reload.
+      </p>
+      <ErrorBox error={error} />
+    </div>
   )
 }
 
-function TabButton({
-  active,
-  onClick,
-  children,
-}: {
-  active: boolean
-  onClick: () => void
-  children: React.ReactNode
-}): JSX.Element {
+function AdvancedView({ onDone }: { onDone: () => void }): JSX.Element {
+  const { loginWithRawKey, isLoading } = useAuth()
+  const [identityId, setIdentityId] = useState('')
+  const [key, setKey] = useState('')
+  const [error, setError] = useState<string | null>(null)
+  const submit = async (): Promise<void> => {
+    setError(null)
+    try {
+      await loginWithRawKey(identityId, key)
+      setKey('')
+      onDone()
+    } catch (e) {
+      setError(errorMessage(e))
+    }
+  }
   return (
-    <button
-      type="button"
-      onClick={onClick}
-      className={
-        'inline-flex items-center gap-1.5 rounded px-3 py-1.5 text-dense font-medium transition-colors ' +
-        (active
-          ? 'bg-forge-500/15 text-forge-600 dark:text-forge-400'
-          : 'text-anvil-500 hover:text-anvil-800 dark:text-anvil-400 dark:hover:text-anvil-100')
-      }
-    >
-      {children}
-    </button>
+    <div className="space-y-3">
+      <div role="note" className="rounded-md border border-danger/40 bg-danger/5 px-3 py-2 text-dense text-danger">
+        A pasted key has no limits Forge set: anything it can sign, this tab can sign. Never paste a master key. Prefer importing
+        your identity once so Forge gets a limited key instead.
+      </div>
+      <Field label="Identity ID" htmlFor="adv-id">
+        <Input id="adv-id" value={identityId} onChange={(e) => setIdentityId(e.target.value)} className="font-mono" spellCheck={false} autoComplete="off" />
+      </Field>
+      <Field label="Private key (WIF or hex)" htmlFor="adv-key" hint="HIGH or CRITICAL authentication key. Held in this tab only.">
+        <Input id="adv-key" type="password" value={key} onChange={(e) => setKey(e.target.value)} className="font-mono" spellCheck={false} autoComplete="off" />
+      </Field>
+      <Button variant="danger" className="w-full" onClick={submit} loading={isLoading} disabled={identityId.trim() === '' || key.trim() === ''}>
+        Sign in for this tab
+      </Button>
+      <ErrorBox error={error} />
+    </div>
   )
 }
diff --git a/forge-web/components/ui/qr.tsx b/forge-web/components/ui/qr.tsx
new file mode 100644
index 000000000..09c2d4590
--- /dev/null
+++ b/forge-web/components/ui/qr.tsx
@@ -0,0 +1,21 @@
+'use client'
+
+import { useMemo } from 'react'
+import encodeQR from 'qr'
+
+/** A QR code (SVG, quiet zone included) with its text beneath it (spec §10: QR carries text). */
+export function Qr({ value, label, size = 184 }: { value: string; label: string; size?: number }): JSX.Element {
+  const svg = useMemo(() => encodeQR(value, 'svg', { ecc: 'medium', border: 2 }), [value])
+  return (
+    <figure className="flex flex-col items-center gap-2">
+      <div
+        role="img"
+        aria-label={label}
+        className="rounded-md bg-white p-1 [&>svg]:h-full [&>svg]:w-full"
+        style={{ width: size, height: size }}
+        dangerouslySetInnerHTML={{ __html: svg }}
+      />
+      <figcaption className="max-w-full break-all text-center font-mono text-[12px] text-anvil-600 dark:text-anvil-300">{value}</figcaption>
+    </figure>
+  )
+}
diff --git a/forge-web/contexts/auth-context.tsx b/forge-web/contexts/auth-context.tsx
index 62fcb3b57..74c4d7dda 100644
--- a/forge-web/contexts/auth-context.tsx
+++ b/forge-web/contexts/auth-context.tsx
@@ -12,7 +12,7 @@
 import React, { createContext, useCallback, useContext, useEffect, useMemo, useState } from 'react'
 import type { EvoSDK } from '@dashevo/evo-sdk'
 
-import { AuthController, type AuthSession } from '../lib/auth'
+import { AuthController, type AuthSession, type LimitedKey, type LimitedKeyRequest, type Protection, type VaultInfo } from '../lib/auth'
 import { DEFAULT_NETWORK, NETWORKS, type Network } from '../lib/constants'
 import { evoSdkService, type SpendEvent, type WriteAuth } from '../lib/sdk'
 import { recordSpend } from '../lib/spend'
@@ -61,10 +61,26 @@ interface AuthContextValue {
   readonly error: string | null
   /** The key-free write signer for the WriteEngine, or null when logged out. */
   readonly signer: WriteAuth | null
-  login: (identityId: string, privateKey: string) => Promise<void>
-  loginWithIdentityFile: (text: string) => Promise<void>
+  /** How this session's key is held: a vault-stored limited key, or a tab-only raw key. */
+  readonly storage: AuthSession['storage'] | null
+  /** Whether this network supports limited keys (forge-v2, protocol 14). */
+  readonly limitedKeys: boolean
+  /** Keys stored (encrypted) on this device for this network. */
+  readonly vaults: readonly VaultInfo[]
+  /** The limited-key ceremony: import an identity file or a mnemonic once. */
+  importIdentity: (
+    input: { fileText: string } | { mnemonic: string; identityId: string },
+    protection: Protection,
+    request?: LimitedKeyRequest,
+  ) => Promise<void>
+  adoptLimitedKey: (identityId: string, key: LimitedKey, protection: Protection) => Promise<void>
+  unlock: (identityId: string, method: { passphrase: string } | 'passkey') => Promise<void>
+  /** Advanced: a pasted key, for this tab only. */
+  loginWithRawKey: (identityId: string, privateKey: string) => Promise<void>
   refreshBalance: () => Promise<void>
-  logout: () => void
+  /** Lock (keep the stored key) or sign out and forget this browser's key. */
+  logout: (forget?: boolean) => void
+  reloadVaults: () => void
 }
 
 const AuthContext = createContext<AuthContextValue | undefined>(undefined)
@@ -81,16 +97,35 @@ export function AuthProvider({
 
   useEffect(() => controller.subscribe(setState), [controller])
 
-  const login = useCallback(
-    async (identityId: string, privateKey: string) => {
-      await controller.login(identityId, privateKey)
+  const [vaults, setVaults] = useState<readonly VaultInfo[]>([])
+  const reloadVaults = useCallback(() => {
+    controller.storedVaults().then(setVaults, () => setVaults([]))
+  }, [controller])
+  useEffect(reloadVaults, [reloadVaults])
+
+  const importIdentity = useCallback<AuthContextValue['importIdentity']>(
+    async (input, protection, request) => {
+      await controller.importIdentity(input, protection, request)
+      reloadVaults()
+    },
+    [controller, reloadVaults],
+  )
+  const adoptLimitedKey = useCallback<AuthContextValue['adoptLimitedKey']>(
+    async (identityId, key, protection) => {
+      await controller.adoptLimitedKey(identityId, key, protection)
+      reloadVaults()
+    },
+    [controller, reloadVaults],
+  )
+  const unlock = useCallback<AuthContextValue['unlock']>(
+    async (identityId, method) => {
+      await controller.unlock(identityId, method)
     },
     [controller],
   )
-
-  const loginWithIdentityFile = useCallback(
-    async (text: string) => {
-      await controller.loginWithIdentityFile(text)
+  const loginWithRawKey = useCallback(
+    async (identityId: string, privateKey: string) => {
+      await controller.loginWithRawKey(identityId, privateKey)
     },
     [controller],
   )
@@ -99,9 +134,12 @@ export function AuthProvider({
     await controller.refreshBalance()
   }, [controller])
 
-  const logout = useCallback(() => {
-    controller.logout()
-  }, [controller])
+  const logout = useCallback(
+    (forget = false) => {
+      void controller.logout(forget).then(reloadVaults)
+    },
+    [controller, reloadVaults],
+  )
 
   const onSpend = useCallback(
     (event: SpendEvent) => {
@@ -138,12 +176,18 @@ export function AuthProvider({
       isLoading: state.isLoading,
       error: state.error,
       signer,
-      login,
-      loginWithIdentityFile,
+      storage: session?.storage ?? null,
+      limitedKeys: controller.supportsLimitedKeys(),
+      vaults,
+      importIdentity,
+      adoptLimitedKey,
+      unlock,
+      loginWithRawKey,
       refreshBalance,
       logout,
+      reloadVaults,
     }),
-    [funds, keyLimits, login, loginWithIdentityFile, logout, refreshBalance, session, signer, state.error, state.isLoading],
+    [adoptLimitedKey, controller, funds, importIdentity, keyLimits, loginWithRawKey, logout, refreshBalance, reloadVaults, session, signer, state.error, state.isLoading, unlock, vaults],
   )
 
   return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>
diff --git a/forge-web/lib/auth/app-connect.ts b/forge-web/lib/auth/app-connect.ts
new file mode 100644
index 000000000..9eacca2fe
--- /dev/null
+++ b/forge-web/lib/auth/app-connect.ts
@@ -0,0 +1,191 @@
+/**
+ * "Use my Dash wallet" (`ux-dx-spec.md` §2.2 tile 1): App Connect login, protocol 14.
+ *
+ * The app draws an ephemeral secp256k1 key and shows a `dash-key:` request (QR / deep link)
+ * naming the forge-core contract and the grant it wants. A wallet that approves registers a
+ * limited key on its identity and publishes a `loginKeyResponse` in the App Connect system
+ * contract, under its identity, keyed by `hash160(appEphemeralPub)`. The app polls for it,
+ * derives the shared secret (ECDH x → HKDF-SHA256, salt "dash:key-exchange:v1"), decrypts the
+ * 32-byte login key (AES-256-GCM), derives the auth key (HKDF(loginKey, identityId, "auth")),
+ * and then **verifies on chain** that a live key on the responder's identity is that key, with
+ * AUTHENTICATION/HIGH, the dash-forge group bound, and a budget and expiry — the response
+ * alone proves nothing about who answered (`app-connect.md`, "Approval and re-login" step 3).
+ *
+ * The crypto is the Yappr key-exchange envelope the Dash wallets already speak.
+ */
+
+import * as secp from '@noble/secp256k1'
+import { hkdf } from '@noble/hashes/hkdf.js'
+import { sha256 } from '@noble/hashes/sha2.js'
+
+import type { Network } from '../constants'
+import { base58Decode, base58Encode } from './base58'
+import { hash160 } from './asset-lock'
+import { encodeWif } from './wif'
+import { verifyLimitedKey } from './limited-key'
+import type { KeyLimits } from '../view/funds'
+
+/** The App Connect system contract (the same id on every network, protocol 14). */
+export const APP_CONNECT_CONTRACT_ID = 'H8F9mP1BM55TE1ShsxPZHzhyinaMdY9bMmP85mkDhcJJ'
+
+const enc = new TextEncoder()
+
+export interface AppConnectRequest {
+  /** The `dash-key:` URI to show as a QR and a deep link. */
+  readonly uri: string
+  /** Six digits the wallet shows too (pairing check). */
+  readonly pairingCode: string
+  readonly appEphemeralPubKeyHash: Uint8Array
+  /** Held only in memory; zeroed by {@link disposeRequest}. */
+  readonly appEphemeralPriv: Uint8Array
+}
+
+function networkTag(network: Network): string {
+  return network === 'mainnet' ? 'm' : network === 'testnet' ? 't' : 'd'
+}
+
+/**
+ * A fresh request for `contractId` (forge-core). The payload is the key-exchange request:
+ * version(1) ‖ appEphemeralPub(33) ‖ contractId(32) ‖ keyIndex(u32 LE) ‖ labelLen(1) ‖ label.
+ */
+export function newRequest(network: Network, contractId: string, label = 'Sign in to Dash Forge'): AppConnectRequest {
+  const priv = secp.utils.randomSecretKey()
+  const pub = secp.getPublicKey(priv, true)
+  const labelBytes = enc.encode(label).slice(0, 64)
+  const body = new Uint8Array(1 + 33 + 32 + 4 + 1 + labelBytes.length)
+  body[0] = 1
+  body.set(pub, 1)
+  body.set(base58Decode(contractId), 34)
+  body[70] = labelBytes.length
+  body.set(labelBytes, 71)
+  const pubHash = hash160(pub)
+  const digest = pubHash.slice(0, 4)
+  const code = (((digest[0] as number) << 24) | ((digest[1] as number) << 16) | ((digest[2] as number) << 8) | (digest[3] as number)) >>> 0
+  return {
+    uri: `dash-key:${base58Encode(body)}?n=${networkTag(network)}&v=1`,
+    pairingCode: String(code % 1_000_000).padStart(6, '0'),
+    appEphemeralPubKeyHash: pubHash,
+    appEphemeralPriv: priv,
+  }
+}
+
+export function disposeRequest(req: AppConnectRequest): void {
+  req.appEphemeralPriv.fill(0)
+}
+
+/** Decrypt a wallet response's payload into the 32-byte login key. */
+export async function openResponse(req: AppConnectRequest, walletEphemeralPub: Uint8Array, encryptedPayload: Uint8Array): Promise<Uint8Array> {
+  const shared = secp.getSharedSecret(req.appEphemeralPriv, walletEphemeralPub, true).slice(1, 33)
+  const key = hkdf(sha256, shared, enc.encode('dash:key-exchange:v1'), new Uint8Array(0), 32)
+  shared.fill(0)
+  const k = await crypto.subtle.importKey('raw', new Uint8Array(key), { name: 'AES-GCM' }, false, ['decrypt'])
+  key.fill(0)
+  const nonce = encryptedPayload.slice(0, 12)
+  const ct = encryptedPayload.slice(12)
+  const plain = new Uint8Array(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce }, k, ct))
+  if (plain.length < 32) throw new Error('the wallet response is malformed')
+  return plain.slice(0, 32)
+}
+
+/** The auth private key a login key stands for: HKDF(loginKey, identityId, "auth"). */
+export function authKeyFromLogin(loginKey: Uint8Array, identityId: string): Uint8Array {
+  return hkdf(sha256, loginKey, base58Decode(identityId), enc.encode('auth'), 32)
+}
+
+interface RawResponse {
+  toJSON(): { $ownerId: string; walletEphemeralPubKey: string; encryptedPayload: string }
+}
+
+function b64(s: string): Uint8Array {
+  const bin = atob(s)
+  return Uint8Array.from(bin, (c) => c.charCodeAt(0))
+}
+
+/** Whether the App Connect contract exists on this network (hide the tile otherwise). */
+export async function appConnectAvailable(sdk: import('@dashevo/evo-sdk').EvoSDK): Promise<boolean> {
+  try {
+    const c = await (sdk as unknown as { contracts: { fetch(id: string): Promise<unknown> } }).contracts.fetch(APP_CONNECT_CONTRACT_ID)
+    return c !== undefined && c !== null
+  } catch {
+    return false
+  }
+}
+
+/** The result of a completed wallet login. */
+export interface WalletLogin {
+  readonly identityId: string
+  readonly keyId: number
+  readonly wif: string
+  readonly limits: KeyLimits
+}
+
+/**
+ * Poll for responses to `req` until one decrypts to a key that is live on its responder's
+ * identity with the Forge bounds (then resolve), or the signal aborts. Responses that do not
+ * decrypt, or whose key is not verifiably a Forge browser key, are skipped.
+ */
+export async function awaitWalletLogin(
+  sdk: import('@dashevo/evo-sdk').EvoSDK,
+  req: AppConnectRequest,
+  params: { network: Network; group: string; signal?: AbortSignal; intervalMs?: number },
+): Promise<WalletLogin> {
+  const seen = new Set<string>()
+  const docs = (sdk as unknown as { documents: { query(q: unknown): Promise<Map<string, RawResponse | undefined>> } }).documents
+  for (;;) {
+    if (params.signal?.aborted) throw new DOMException('cancelled', 'AbortError')
+    let rows: Map<string, RawResponse | undefined> = new Map()
+    try {
+      rows = await docs.query({
+        dataContractId: APP_CONNECT_CONTRACT_ID,
+        documentTypeName: 'loginKeyResponse',
+        where: [['appEphemeralPubKeyHash', '==', btoa(String.fromCharCode(...req.appEphemeralPubKeyHash))]],
+        orderBy: [['appEphemeralPubKeyHash', 'asc']],
+        limit: 10,
+      })
+    } catch {
+      /* transient: poll again */
+    }
+    for (const raw of rows.values()) {
+      if (!raw) continue
+      const j = raw.toJSON()
+      if (seen.has(j.$ownerId)) continue
+      seen.add(j.$ownerId)
+      try {
+        const login = await openResponse(req, b64(j.walletEphemeralPubKey), b64(j.encryptedPayload))
+        const auth = authKeyFromLogin(login, j.$ownerId)
+        login.fill(0)
+        const wif = encodeWif(auth, params.network)
+        auth.fill(0)
+        const keyId = await findKeyId(sdk, j.$ownerId, wif, params.network)
+        if (keyId === null) continue
+        const limits = await verifyLimitedKey(sdk, j.$ownerId, keyId, params.group, params.network, wif)
+        disposeRequest(req)
+        return { identityId: j.$ownerId, keyId, wif, limits }
+      } catch {
+        /* not ours, or not a Forge-bounded key: keep waiting */
+      }
+    }
+    await new Promise((r) => setTimeout(r, params.intervalMs ?? 3000))
+  }
+}
+
+/** Which key on `identityId` the WIF controls (the wallet may register it as HASH160). */
+async function findKeyId(sdk: import('@dashevo/evo-sdk').EvoSDK, identityId: string, wif: string, network: Network): Promise<number | null> {
+  const { PrivateKey } = await import('@dashevo/evo-sdk')
+  const identity = await (sdk as unknown as { identities: { fetch(id: string): Promise<{ publicKeys: { keyId: number; validatePrivateKey(b: Uint8Array, n: string): boolean }[] } | undefined> } }).identities.fetch(identityId)
+  const pk = PrivateKey.fromWIF(wif)
+  const bytes = pk.toBytes()
+  pk.free()
+  try {
+    for (const k of identity?.publicKeys ?? []) {
+      try {
+        if (k.validatePrivateKey(bytes, network)) return k.keyId
+      } catch {
+        /* other key types */
+      }
+    }
+    return null
+  } finally {
+    bytes.fill(0)
+  }
+}
diff --git a/forge-web/lib/auth/asset-lock.ts b/forge-web/lib/auth/asset-lock.ts
new file mode 100644
index 000000000..13957fe34
--- /dev/null
+++ b/forge-web/lib/auth/asset-lock.ts
@@ -0,0 +1,338 @@
+/**
+ * Core-chain side of creating an identity in the browser (`ux-dx-spec.md` §2.2 tile 2), ported
+ * from `tools/mint-identity` (tx.mjs, lock.mjs, insight.mjs):
+ *
+ *   1. watch the deposit address through a block explorer (Insight; configurable) until funds
+ *      arrive;
+ *   2. build and sign a type-8 asset-lock transaction spending them to one credit output
+ *      controlled by the asset-lock key, and broadcast it;
+ *   3. prove the lock: an InstantSend lock where a public `getislocks` endpoint exists
+ *      (testnet), else a chain-lock proof once Platform's chain-locked Core height reaches the
+ *      transaction's block (devnets).
+ *
+ * The explorer can delay the user but not take funds or keys: it only sees the address and
+ * the signed transaction.
+ */
+
+import * as secp from '@noble/secp256k1'
+import { hmac } from '@noble/hashes/hmac.js'
+import { ripemd160 } from '@noble/hashes/legacy.js'
+import { sha256 } from '@noble/hashes/sha2.js'
+import { bytesToHex, concatBytes, hexToBytes } from '@noble/hashes/utils.js'
+
+import { ACTIVE_NETWORK, type Network } from '../constants'
+import { base58CheckDecode } from './base58'
+import { decodeWif } from './wif'
+
+// @noble/secp256k1 v3 needs sync hashes wired for sign/getPublicKey.
+secp.hashes.sha256 = sha256
+secp.hashes.hmacSha256 = (k, m) => hmac(sha256, k, m)
+
+/** Explorer + lock-proof endpoints per network. */
+export interface CoreEndpoints {
+  readonly insight: string
+  /** JSON-RPC with `getislocks` (InstantSend proof), or null to use chain-lock proofs. */
+  readonly islockRpc: string | null
+}
+
+/** The endpoints this build uses (Settings may override the explorer, spec §2.2). */
+export function coreEndpoints(network: Network = ACTIVE_NETWORK.network): CoreEndpoints {
+  const override = typeof window !== 'undefined' ? window.localStorage.getItem('forge:insight-url') : null
+  if (network === 'devnet') {
+    return { insight: override ?? `https://insight.${ACTIVE_NETWORK.devnetName}.networks.dash.org/insight-api`, islockRpc: null }
+  }
+  if (network === 'testnet') {
+    return { insight: override ?? 'https://insight.testnet.networks.dash.org/insight-api', islockRpc: 'https://trpc.digitalcash.dev' }
+  }
+  return { insight: override ?? 'https://insight.dash.org/insight-api', islockRpc: null }
+}
+
+// ---------------------------------------------------------------------------
+// Insight
+// ---------------------------------------------------------------------------
+
+export interface Utxo {
+  readonly txid: string
+  readonly vout: number
+  readonly satoshis: number
+  readonly scriptPubKey: string
+  readonly confirmations: number
+}
+
+async function getJson<T>(url: string, init?: RequestInit): Promise<T> {
+  const res = await fetch(url, init)
+  if (!res.ok) throw new Error(`${new URL(url).host}: HTTP ${res.status}`)
+  return (await res.json()) as T
+}
+
+export async function getUtxos(ep: CoreEndpoints, address: string): Promise<Utxo[]> {
+  const rows = await getJson<Utxo[]>(`${ep.insight}/addr/${address}/utxo`)
+  return rows.map((u) => ({ txid: u.txid, vout: u.vout, satoshis: u.satoshis, scriptPubKey: u.scriptPubKey, confirmations: u.confirmations ?? 0 }))
+}
+
+export async function getTxHeight(ep: CoreEndpoints, txid: string): Promise<number | null> {
+  const tx = await getJson<{ blockheight?: number }>(`${ep.insight}/tx/${txid}`)
+  return typeof tx.blockheight === 'number' && tx.blockheight >= 0 ? tx.blockheight : null
+}
+
+export async function broadcastTx(ep: CoreEndpoints, rawHex: string, txid: string): Promise<void> {
+  try {
+    await getJson(`${ep.insight}/tx/send`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ rawtx: rawHex }),
+    })
+  } catch (e) {
+    // A lost response can hide an accepted broadcast: never strand the deposit over it.
+    const known = await getJson(`${ep.insight}/tx/${txid}`).then(
+      () => true,
+      () => false,
+    )
+    if (!known) throw e
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Keys and addresses
+// ---------------------------------------------------------------------------
+
+export function hash160(b: Uint8Array): Uint8Array {
+  return ripemd160(sha256(b))
+}
+
+function hash256(b: Uint8Array): Uint8Array {
+  return sha256(sha256(b))
+}
+
+/** Private key bytes from a WIF (compressed keys only). */
+export function wifBytes(wif: string): Uint8Array {
+  const d = decodeWif(wif)
+  if (!d.compressed) throw new Error('uncompressed keys are not supported')
+  return d.privateKey
+}
+
+/** P2PKH address → its 20-byte pubkey hash. */
+function addressHash(address: string): Uint8Array {
+  return base58CheckDecode(address).slice(1)
+}
+
+// ---------------------------------------------------------------------------
+// Transactions (Dash special tx v3; type 8 = asset lock)
+// ---------------------------------------------------------------------------
+
+interface TxIn {
+  readonly txid: Uint8Array
+  readonly vout: number
+  scriptSig: Uint8Array
+}
+interface TxOut {
+  readonly value: bigint
+  readonly script: Uint8Array
+}
+interface Tx {
+  readonly type: number
+  vin: TxIn[]
+  readonly vout: TxOut[]
+  readonly payload: Uint8Array
+}
+
+function varint(n: number): Uint8Array {
+  if (n < 0xfd) return Uint8Array.of(n)
+  if (n <= 0xffff) return Uint8Array.of(0xfd, n & 0xff, n >> 8)
+  const b = new Uint8Array(5)
+  b[0] = 0xfe
+  new DataView(b.buffer).setUint32(1, n, true)
+  return b
+}
+function u32(n: number): Uint8Array {
+  const b = new Uint8Array(4)
+  new DataView(b.buffer).setUint32(0, n >>> 0, true)
+  return b
+}
+function i64(n: bigint): Uint8Array {
+  const b = new Uint8Array(8)
+  new DataView(b.buffer).setBigInt64(0, n, true)
+  return b
+}
+function withLen(b: Uint8Array): Uint8Array {
+  return concatBytes(varint(b.length), b)
+}
+function p2pkh(hash: Uint8Array): Uint8Array {
+  return concatBytes(Uint8Array.of(0x76, 0xa9, 0x14), hash, Uint8Array.of(0x88, 0xac))
+}
+function serOut(o: TxOut): Uint8Array {
+  return concatBytes(i64(o.value), withLen(o.script))
+}
+
+function serialize(tx: Tx): Uint8Array {
+  const parts: Uint8Array[] = [u32(3 | (tx.type << 16)), varint(tx.vin.length)]
+  for (const i of tx.vin) parts.push(i.txid, u32(i.vout), withLen(i.scriptSig), u32(0xffffffff))
+  parts.push(varint(tx.vout.length))
+  for (const o of tx.vout) parts.push(serOut(o))
+  parts.push(u32(0))
+  if (tx.type !== 0 && tx.payload.length > 0) parts.push(withLen(tx.payload))
+  return concatBytes(...parts)
+}
+
+export function txid(raw: Uint8Array): string {
+  return bytesToHex(hash256(raw).reverse())
+}
+
+function derSig(compact: Uint8Array): Uint8Array {
+  const int = (b: Uint8Array): Uint8Array => {
+    let i = 0
+    while (i < b.length - 1 && b[i] === 0) i++
+    let v = b.slice(i)
+    if ((v[0] as number) & 0x80) v = concatBytes(Uint8Array.of(0), v)
+    return concatBytes(Uint8Array.of(0x02, v.length), v)
+  }
+  const r = int(compact.slice(0, 32))
+  const s = int(compact.slice(32, 64))
+  return concatBytes(Uint8Array.of(0x30, r.length + s.length), r, s)
+}
+
+/** Sign every input (all P2PKH to the same key), SIGHASH_ALL. */
+function signAll(tx: Tx, utxos: readonly Utxo[], priv: Uint8Array): void {
+  const pub = secp.getPublicKey(priv, true)
+  const signed: Uint8Array[] = []
+  for (let i = 0; i < tx.vin.length; i++) {
+    const copy: Tx = { ...tx, vin: tx.vin.map((v, j) => ({ ...v, scriptSig: j === i ? hexToBytes((utxos[i] as Utxo).scriptPubKey) : new Uint8Array(0) })) }
+    const digest = hash256(concatBytes(serialize(copy), u32(1)))
+    const sig = secp.sign(digest, priv, { prehash: false, lowS: true })
+    const der = concatBytes(derSig(sig), Uint8Array.of(0x01))
+    signed.push(concatBytes(withLen(der), withLen(pub)))
+  }
+  tx.vin = tx.vin.map((v, i) => ({ ...v, scriptSig: signed[i] as Uint8Array }))
+}
+
+/** The fee an asset-lock transaction pays (duffs), per input. */
+const ASSET_LOCK_FEE_PER_INPUT = 1000
+
+/**
+ * Build and sign a type-8 asset lock spending `utxos` (all owned by `priv`) into one credit
+ * output controlled by that same key. Returns the raw transaction and its id.
+ */
+export function buildAssetLock(utxos: readonly Utxo[], priv: Uint8Array): { raw: Uint8Array; txid: string; lockedDuffs: number } {
+  if (utxos.length === 0) throw new Error('no funds to lock')
+  const total = utxos.reduce((s, u) => s + u.satoshis, 0)
+  const fee = ASSET_LOCK_FEE_PER_INPUT * utxos.length
+  const locked = total - fee
+  if (locked <= 0) throw new Error('deposit too small to cover the fee')
+  const pubHash = hash160(secp.getPublicKey(priv, true))
+  const payload = concatBytes(Uint8Array.of(1), varint(1), serOut({ value: BigInt(locked), script: p2pkh(pubHash) }))
+  const tx: Tx = {
+    type: 8,
+    vin: utxos.map((u) => ({ txid: hexToBytes(u.txid).reverse(), vout: u.vout, scriptSig: new Uint8Array(0) })),
+    vout: [{ value: BigInt(locked), script: Uint8Array.of(0x6a, 0x00) }],
+    payload,
+  }
+  signAll(tx, utxos, priv)
+  const raw = serialize(tx)
+  return { raw, txid: txid(raw), lockedDuffs: locked }
+}
+
+/** A plain P2PKH payment (the test harness funds a deposit address with it). */
+export function buildPayment(
+  utxos: readonly Utxo[],
+  priv: Uint8Array,
+  to: { address: string; duffs: number },
+  changeAddress: string,
+  fee = 2000,
+): { raw: Uint8Array; txid: string } {
+  const total = utxos.reduce((s, u) => s + u.satoshis, 0)
+  const change = total - to.duffs - fee
+  if (change < 0) throw new Error('insufficient funds')
+  const vout: TxOut[] = [{ value: BigInt(to.duffs), script: p2pkh(addressHash(to.address)) }]
+  if (change > 546) vout.push({ value: BigInt(change), script: p2pkh(addressHash(changeAddress)) })
+  const tx: Tx = {
+    type: 0,
+    vin: utxos.map((u) => ({ txid: hexToBytes(u.txid).reverse(), vout: u.vout, scriptSig: new Uint8Array(0) })),
+    vout,
+    payload: new Uint8Array(0),
+  }
+  signAll(tx, utxos, priv)
+  const raw = serialize(tx)
+  return { raw, txid: txid(raw) }
+}
+
+// ---------------------------------------------------------------------------
+// Lock proofs
+// ---------------------------------------------------------------------------
+
+export type LockProof =
+  | { readonly type: 'instant'; readonly txid: string; readonly raw: Uint8Array; readonly islock: Uint8Array }
+  | { readonly type: 'chain'; readonly txid: string; readonly height: number }
+
+async function fetchIslock(rpc: string, id: string): Promise<Uint8Array | null> {
+  const res = await fetch(rpc, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ method: 'getislocks', params: [[id]] }),
+  })
+  if (!res.ok) return null
+  const data = (await res.json()) as { result?: { txid?: string; hex?: string }[] }
+  const hit = data.result?.find((r) => r?.txid === id && r.hex)
+  return hit?.hex ? hexToBytes(hit.hex) : null
+}
+
+const sleep = (ms: number, signal?: AbortSignal): Promise<void> =>
+  new Promise((resolve, reject) => {
+    const t = setTimeout(resolve, ms)
+    signal?.addEventListener('abort', () => {
+      clearTimeout(t)
+      reject(new DOMException('cancelled', 'AbortError'))
+    })
+  })
+
+/**
+ * Wait until the asset lock is provable: an InstantSend lock where the network offers one
+ * (up to 90 s), else a chain-lock proof once the tx is mined and Platform's chain-locked Core
+ * height reaches it (`platformChainLockedHeight` is read from Platform status).
+ */
+export async function obtainLockProof(
+  ep: CoreEndpoints,
+  lock: { txid: string; raw: Uint8Array },
+  platformChainLockedHeight: () => Promise<number | null>,
+  opts: { signal?: AbortSignal; onStatus?: (s: string) => void; timeoutMs?: number } = {},
+): Promise<LockProof> {
+  const deadline = Date.now() + (opts.timeoutMs ?? 20 * 60 * 1000)
+  if (ep.islockRpc) {
+    opts.onStatus?.('Waiting for InstantSend…')
+    const until = Date.now() + 90_000
+    while (Date.now() < until) {
+      const islock = await fetchIslock(ep.islockRpc, lock.txid).catch(() => null)
+      if (islock) return { type: 'instant', txid: lock.txid, raw: lock.raw, islock }
+      await sleep(3000, opts.signal)
+    }
+  }
+  let height: number | null = null
+  while (Date.now() < deadline) {
+    if (height === null) {
+      opts.onStatus?.('Waiting for the deposit to be mined…')
+      height = await getTxHeight(ep, lock.txid).catch(() => null)
+    }
+    if (height !== null) {
+      opts.onStatus?.(`Mined at ${height}; waiting for Platform to chain-lock it…`)
+      const clh = await platformChainLockedHeight().catch(() => null)
+      if (clh !== null && clh >= height) return { type: 'chain', txid: lock.txid, height }
+    }
+    await sleep(5000, opts.signal)
+  }
+  throw new Error('timed out waiting for the asset lock to be provable; it is saved — try again later')
+}
+
+/** Wait until `address` holds at least `minDuffs` (polling the explorer). */
+export async function waitForDeposit(
+  ep: CoreEndpoints,
+  address: string,
+  minDuffs: number,
+  opts: { signal?: AbortSignal; onSeen?: (duffs: number) => void; intervalMs?: number } = {},
+): Promise<Utxo[]> {
+  for (;;) {
+    const utxos = await getUtxos(ep, address).catch(() => [] as Utxo[])
+    const total = utxos.reduce((s, u) => s + u.satoshis, 0)
+    opts.onSeen?.(total)
+    if (total >= minDuffs && utxos.length > 0) return utxos
+    await sleep(opts.intervalMs ?? 4000, opts.signal)
+  }
+}
diff --git a/forge-web/lib/auth/auth-v2.test.ts b/forge-web/lib/auth/auth-v2.test.ts
new file mode 100644
index 000000000..1cd8d0990
--- /dev/null
+++ b/forge-web/lib/auth/auth-v2.test.ts
@@ -0,0 +1,197 @@
+/**
+ * Limited-key sign-in, offline: the vault's encryption and unlock rules, the App Connect
+ * envelope, the asset-lock transaction, and the identity-file master-key extraction.
+ */
+
+import * as secp from '@noble/secp256k1'
+import { hkdf } from '@noble/hashes/hkdf.js'
+import { sha256 } from '@noble/hashes/sha2.js'
+import { bytesToHex } from '@noble/hashes/utils.js'
+import { beforeEach, describe, expect, it } from 'vitest'
+
+import { idbEntries, resetMemoryStores } from '../idb'
+import {
+  VaultLockedError,
+  forgetVault,
+  listVaults,
+  lockVault,
+  prfKey,
+  storeInVault,
+  unlockWithPassphrase,
+  unlockedSecret,
+} from './vault'
+import { authKeyFromLogin, newRequest, openResponse } from './app-connect'
+import { buildAssetLock, hash160, txid, type Utxo } from './asset-lock'
+import { masterMaterialFromFile } from './identity-file'
+import { base58Decode, base58Encode } from './base58'
+import { encodeWif } from './wif'
+import { purgeLegacyKeystore } from './controller'
+
+const ID = '9r27eDsuXEqoMNymW1A2MKFrpBhzSkepVKwXrGzq9dUD'
+const WIF = encodeWif(new Uint8Array(32).fill(7), 'devnet')
+const SECRET = { identityId: ID, keyId: 5, wif: WIF }
+
+describe('vault', () => {
+  beforeEach(() => {
+    resetMemoryStores()
+    lockVault()
+  })
+
+  it('never stores the key in plaintext', async () => {
+    await storeInVault('devnet', SECRET, { passphrase: 'correct horse battery' })
+    const rows = await idbEntries<Record<string, unknown>>('vault')
+    const dump = JSON.stringify(rows, (_k, v: unknown) => (v instanceof Uint8Array ? bytesToHex(v) : v))
+    expect(dump).not.toContain(WIF)
+    expect(dump).not.toContain(bytesToHex(new Uint8Array(32).fill(7)))
+    expect(dump).not.toContain('correct horse')
+  }, 30_000)
+
+  it('unlocks with the right passphrase only, and locks again', async () => {
+    await storeInVault('devnet', SECRET, { passphrase: 'correct horse battery' })
+    lockVault()
+    expect(unlockedSecret('devnet', ID)).toBeNull()
+    await expect(unlockWithPassphrase('devnet', ID, 'wrong passphrase!!')).rejects.toBeInstanceOf(VaultLockedError)
+    expect(await unlockWithPassphrase('devnet', ID, 'correct horse battery')).toEqual(SECRET)
+    expect(unlockedSecret('devnet', ID)?.wif).toBe(WIF)
+    expect(unlockedSecret('testnet', ID)).toBeNull()
+    lockVault()
+    expect(unlockedSecret('devnet', ID)).toBeNull()
+  }, 60_000)
+
+  it('refuses short passphrases and an unprotected vault', async () => {
+    await expect(storeInVault('devnet', SECRET, { passphrase: 'short' })).rejects.toThrow(/at least/)
+    await expect(storeInVault('devnet', SECRET, {})).rejects.toThrow(/passphrase or a passkey/)
+  })
+
+  it('binds a record to its network and identity (a copied record does not open)', async () => {
+    await storeInVault('devnet', SECRET, { passphrase: 'correct horse battery' })
+    const [[, record]] = (await idbEntries<Record<string, unknown>>('vault')) as [[string, Record<string, unknown>]]
+    const { idbPut } = await import('../idb')
+    const other = '6jAyDGGcc6fgA7bsraQPriTAZ73Lkq5QgnenaRhqteHd'
+    await idbPut('vault', `vault:devnet:${other}`, { ...record, identityId: other })
+    await expect(unlockWithPassphrase('devnet', other, 'correct horse battery')).rejects.toBeInstanceOf(VaultLockedError)
+  }, 60_000)
+
+  it('lists vaults without secrets and forgets them', async () => {
+    await storeInVault('devnet', SECRET, { passphrase: 'correct horse battery' })
+    expect(await listVaults('devnet')).toEqual([expect.objectContaining({ identityId: ID, keyId: 5, methods: ['passphrase'] })])
+    await forgetVault('devnet', ID)
+    expect(await listVaults('devnet')).toEqual([])
+  }, 30_000)
+
+  it('stretches a passkey PRF output per identity', () => {
+    const out = new Uint8Array(32).fill(1)
+    expect(bytesToHex(prfKey(out, 'devnet', ID))).not.toBe(bytesToHex(prfKey(out, 'devnet', 'other')))
+    expect(bytesToHex(prfKey(out, 'devnet', ID))).not.toBe(bytesToHex(out))
+  })
+
+  it('purges keys an earlier build left in localStorage', () => {
+    const store = new Map<string, string>([['forge_key_devnet_pk_x', WIF], ['theme', 'dark']])
+    const ls = {
+      get length() {
+        return store.size
+      },
+      key: (i: number) => [...store.keys()][i] ?? null,
+      removeItem: (k: string) => void store.delete(k),
+    }
+    ;(globalThis as { window?: unknown }).window = { localStorage: ls }
+    try {
+      purgeLegacyKeystore()
+    } finally {
+      delete (globalThis as { window?: unknown }).window
+    }
+    expect([...store.keys()]).toEqual(['theme'])
+  })
+})
+
+describe('App Connect envelope (Yappr key exchange)', () => {
+  it('builds a dash-key request that carries the ephemeral key and contract', () => {
+    const contract = 'GdZYaEntYPiW9dvUGCHyeqN7H7qEocbSkuj81n341i3L'
+    const req = newRequest('devnet', contract)
+    expect(req.uri).toMatch(/^dash-key:[1-9A-HJ-NP-Za-km-z]+\?n=d&v=1$/)
+    const body = base58Decode(req.uri.slice('dash-key:'.length, req.uri.indexOf('?')))
+    expect(body[0]).toBe(1)
+    const pub = body.slice(1, 34)
+    expect(bytesToHex(hash160(pub))).toBe(bytesToHex(req.appEphemeralPubKeyHash))
+    expect(base58Encode(body.slice(34, 66))).toBe(contract)
+    expect(req.pairingCode).toMatch(/^\d{6}$/)
+  })
+
+  it('opens what a wallet seals, and derives the auth key', async () => {
+    const req = newRequest('devnet', 'GdZYaEntYPiW9dvUGCHyeqN7H7qEocbSkuj81n341i3L')
+    const appPub = base58Decode(req.uri.slice(9, req.uri.indexOf('?'))).slice(1, 34)
+    // The wallet side (BrowserLoginKeyProtocol.seal).
+    const walletPriv = secp.utils.randomSecretKey()
+    const walletPub = secp.getPublicKey(walletPriv, true)
+    const sharedX = secp.getSharedSecret(walletPriv, appPub, true).slice(1, 33)
+    const aes = hkdf(sha256, sharedX, new TextEncoder().encode('dash:key-exchange:v1'), new Uint8Array(0), 32)
+    const loginKey = new Uint8Array(32).fill(9)
+    const iv = new Uint8Array(12).fill(3)
+    const k = await crypto.subtle.importKey('raw', aes, { name: 'AES-GCM' }, false, ['encrypt'])
+    const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, k, loginKey))
+    const payload = new Uint8Array([...iv, ...ct])
+    expect(payload.length).toBe(60)
+    expect(await openResponse(req, walletPub, payload)).toEqual(loginKey)
+    const expected = hkdf(sha256, loginKey, base58Decode(ID), new TextEncoder().encode('auth'), 32)
+    expect(authKeyFromLogin(loginKey, ID)).toEqual(expected)
+    // A tampered payload fails authentication.
+    payload[20] = (payload[20] as number) ^ 1
+    await expect(openResponse(req, walletPub, payload)).rejects.toBeTruthy()
+  })
+})
+
+describe('asset-lock transaction', () => {
+  it('locks the deposit minus the fee into one credit output with a valid signature', () => {
+    const priv = new Uint8Array(32).fill(5)
+    const pub = secp.getPublicKey(priv, true)
+    const script = `76a914${bytesToHex(hash160(pub))}88ac`
+    const utxo: Utxo = { txid: 'ab'.repeat(32), vout: 1, satoshis: 5_000_000, scriptPubKey: script, confirmations: 3 }
+    const lock = buildAssetLock([utxo], priv)
+    expect(lock.lockedDuffs).toBe(4_999_000)
+    expect(lock.txid).toBe(txid(lock.raw))
+    const hex = bytesToHex(lock.raw)
+    // version 3, type 8
+    expect(hex.startsWith('03000800')).toBe(true)
+    // OP_RETURN output of the locked amount, and the payload's P2PKH credit output
+    expect(hex).toContain('02' + '6a00')
+    expect(hex).toContain(`1976a914${bytesToHex(hash160(pub))}88ac`)
+    expect(hex).toContain(bytesToHex(pub))
+  })
+
+  it('is byte-identical to tools/mint-identity (the proven Node implementation)', () => {
+    const priv = new Uint8Array(32).fill(5)
+    const pub = secp.getPublicKey(priv, true)
+    const utxo: Utxo = { txid: 'ab'.repeat(32), vout: 1, satoshis: 5_000_000, scriptPubKey: `76a914${bytesToHex(hash160(pub))}88ac`, confirmations: 1 }
+    const lock = buildAssetLock([utxo], priv)
+    // mint-identity createAssetLockTransaction(utxo, pub, 1000n) + signTransaction, RFC 6979.
+    expect(bytesToHex(lock.raw)).toBe(
+      '0300080001abababababababababababababababababababababababababababababababab010000006b483045022100a82f838bc838daf2a4391b133acad5fff55d7daa849467b08cd9897799de565202207d0722d008d64ce8161db287a3bf03fb7b5591e61f2dec7bc125786837cf2b3c01210362c0a046dacce86ddd0343c6d3c7c79c2208ba0d9c9cf24a6d046d21d21f90f7ffffffff0158474c0000000000026a000000000024010158474c00000000001976a9149d695474a303ac6d74d1796d3752f07895918bd288ac',
+    )
+    expect(lock.txid).toBe('452aa5a12caf5b23d314ac9ae8ef129a283f9a4c72492cff1fc5bf9cfc6d4fff')
+  })
+
+  it('refuses a deposit that cannot pay its fee', () => {
+    const priv = new Uint8Array(32).fill(5)
+    expect(() => buildAssetLock([{ txid: 'ab'.repeat(32), vout: 0, satoshis: 900, scriptPubKey: '', confirmations: 1 }], priv)).toThrow()
+  })
+})
+
+describe('identity file → master material', () => {
+  it('takes the MASTER authentication key (and the mnemonic), nothing else', () => {
+    const file = JSON.stringify({
+      network: 'devnet-moutai',
+      identityId: ID,
+      mnemonic: 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about',
+      identityKeys: [
+        { id: 0, purpose: 'AUTHENTICATION', securityLevel: 'MASTER', keyType: 'ECDSA_SECP256K1', privateKeyWif: WIF },
+        { id: 1, purpose: 'AUTHENTICATION', securityLevel: 'HIGH', keyType: 'ECDSA_SECP256K1', privateKeyWif: encodeWif(new Uint8Array(32).fill(8), 'devnet') },
+      ],
+    })
+    const m = masterMaterialFromFile(file)
+    expect(m).toEqual({ identityId: ID, networkKey: 'devnet-moutai', masterWif: WIF, mnemonic: expect.stringContaining('abandon') })
+  })
+
+  it('refuses a file with neither a master key nor a mnemonic', () => {
+    expect(() => masterMaterialFromFile(JSON.stringify({ identityId: ID, identityKeys: [] }))).toThrow(/MASTER/)
+  })
+})
diff --git a/forge-web/lib/auth/controller.ts b/forge-web/lib/auth/controller.ts
index 676dc4527..87c4aa2f6 100644
--- a/forge-web/lib/auth/controller.ts
+++ b/forge-web/lib/auth/controller.ts
@@ -1,14 +1,19 @@
 /**
- * AuthController — the headless identity session for forge-web.
+ * AuthController — the headless identity session for forge-web (`ux-dx-spec.md` §2).
  *
- * Login imports a bridge-format identity file OR a pasted WIF + identity id, stores the signing
- * key in the network-scoped keystore (never in this object's observable state), verifies the key
- * against the on-chain identity, and exposes an observable `{ identity, balance }` snapshot plus a
- * {@link WriteAuth} the WriteEngine consumes. Password-vault / passkey wrapping of the stored key
- * is the documented follow-up; M3 is direct key login.
+ * A session is an identity plus the key this browser signs with. The key is one of:
+ *   - a PV14 **limited key** (the normal case): registered by importing an identity file or
+ *     mnemonic (the master key signs one IdentityUpdate and is dropped), created with a new
+ *     identity, or granted by a wallet through App Connect. It lives encrypted in the
+ *     {@link ./vault} and, unlocked, only in that module's memory;
+ *   - an **advanced raw key** pasted by a developer: held for this tab only (never stored),
+ *     with a warning in the UI.
  *
- * The controller never places a private key in its state or in any log line: the WIF lives only
- * in the keystore, and `getSigningKeyWif()` reads it on demand at signing time.
+ * The controller's observable state never carries key material. `writeAuth.getSigningKeyWif()`
+ * reads the unlocked key at signing time and throws once the vault is locked.
+ *
+ * Earlier builds stored WIFs in plain `localStorage` (`forge_key_*`); on construction every
+ * such entry is deleted.
  */
 
 import type { EvoSDK } from '@dashevo/evo-sdk'
@@ -19,18 +24,22 @@ import { errorMessage } from '../utils'
 import { WriteAuthError, findSigningKey, readIdentityBalance, type WriteAuth } from '../sdk/write'
 import type { KeyLimits } from '../view/funds'
 import { normalizeToWif } from './wif'
+import { identityFileMatchesNetwork, masterMaterialFromFile } from './identity-file'
+import { deriveMasterKey, isValidMnemonic } from './hd'
+import { readKeyLimits, registerLimitedKey, type LimitedKey, type LimitedKeyRequest } from './limited-key'
 import {
-  identityFileMatchesNetwork,
-  parseIdentityFileText,
-  type ParsedIdentityFile,
-} from './identity-file'
-import {
-  clearPrivateKey,
-  getPrivateKey,
-  hasPrivateKey,
-  storePrivateKey,
-  storedIdentityIds,
-} from './keystore'
+  forgetVault,
+  holdForSession,
+  listVaults,
+  lockVault,
+  storeInVault,
+  unlockWithPasskey,
+  unlockWithPassphrase,
+  unlockedSecret,
+  type Protection,
+  type VaultInfo,
+  type VaultSecret,
+} from './vault'
 
 /** The public (key-free) session snapshot. */
 export interface AuthSession {
@@ -40,6 +49,10 @@ export interface AuthSession {
   readonly network: Network
   /** The signing key's budget and expiry, when it is a PV14 limited key. */
   readonly keyLimits?: KeyLimits | null
+  /** The signing key's id on the identity. */
+  readonly keyId?: number
+  /** `vault`: a stored limited key; `session`: a tab-only key (advanced raw key). */
+  readonly storage: 'vault' | 'session'
 }
 
 /** Observable controller state. Never carries private-key material. */
@@ -49,27 +62,27 @@ export interface AuthState {
   readonly error: string | null
 }
 
-interface IdentitiesFetchFacade {
-  fetch(identityId: string): Promise<
-    | {
-        readonly publicKeys: {
-          keyId: number
-          purposeNumber: number
-          securityLevelNumber: number
-          validatePrivateKey(bytes: Uint8Array, network: string): boolean
-        }[]
-        readonly balance: bigint
-        getPublicKeyById(keyId: number): unknown
-      }
-    | undefined
-  >
-}
-
 type Listener = (state: AuthState) => void
 
 /** How the SDK is obtained — injected so the controller stays testable and SSR-safe. */
 export type SdkProvider = () => Promise<EvoSDK>
 
+/** Delete keys an earlier build left in plain localStorage. */
+export function purgeLegacyKeystore(): void {
+  if (typeof window === 'undefined') return
+  try {
+    const s = window.localStorage
+    const doomed: string[] = []
+    for (let i = 0; i < s.length; i++) {
+      const k = s.key(i)
+      if (k?.startsWith('forge_key_')) doomed.push(k)
+    }
+    for (const k of doomed) s.removeItem(k)
+  } catch {
+    /* storage disabled */
+  }
+}
+
 export class AuthController {
   private state: AuthState = { session: null, isLoading: false, error: null }
   private readonly listeners = new Set<Listener>()
@@ -77,14 +90,14 @@ export class AuthController {
   constructor(
     private readonly getSdk: SdkProvider,
     private readonly network: Network = DEFAULT_NETWORK,
-  ) {}
+  ) {
+    purgeLegacyKeystore()
+  }
 
-  /** Current state snapshot. */
   getState(): AuthState {
     return this.state
   }
 
-  /** Subscribe to state changes; returns an unsubscribe fn. */
   subscribe(listener: Listener): () => void {
     this.listeners.add(listener)
     return () => {
@@ -97,10 +110,21 @@ export class AuthController {
     for (const l of this.listeners) l(this.state)
   }
 
+  /** The dash-forge contract group this network's keys are bound to. */
+  private group(): string {
+    const v2 = NETWORKS[this.network].v2
+    if (!v2) throw new Error(`forge-v2 is not deployed on ${NETWORKS[this.network].key}: limited keys need its contract group`)
+    return v2.group
+  }
+
+  /** Whether this network supports limited keys (protocol 14 + a forge-v2 group). */
+  supportsLimitedKeys(): boolean {
+    return NETWORKS[this.network].v2 !== null
+  }
+
   /**
-   * A {@link WriteAuth} bound to the current session. The WriteEngine calls
-   * `getSigningKeyWif()` at signing time, which reads the keystore — throwing a
-   * {@link WriteAuthError} (never returning null) if the key is absent.
+   * A {@link WriteAuth} bound to the current session. `getSigningKeyWif()` reads the unlocked
+   * key at signing time, throwing a {@link WriteAuthError} when the vault has locked.
    */
   get writeAuth(): WriteAuth | null {
     const session = this.state.session
@@ -111,99 +135,159 @@ export class AuthController {
       identityId,
       network,
       getSigningKeyWif(): string {
-        const wif = getPrivateKey(network, identityId)
-        if (!wif) {
-          throw new WriteAuthError(
-            `no stored signing key for ${identityId} on ${network} — please log in again`,
-          )
-        }
-        return wif
+        const secret = unlockedSecret(network, identityId)
+        if (!secret) throw new WriteAuthError('this browser is locked — unlock it to sign')
+        return secret.wif
       },
     }
   }
 
-  /** Whether a signing key is stored for the given identity on this network. */
-  hasStoredKey(identityId: string): boolean {
-    return hasPrivateKey(this.network, identityId)
+  /** Vaults stored on this device for this network (for the unlock chooser). */
+  storedVaults(): Promise<VaultInfo[]> {
+    return listVaults(this.network)
   }
 
-  /** Identity ids with a stored key on this network (for a "resume session" chooser). */
-  storedIdentities(): string[] {
-    return storedIdentityIds(this.network)
-  }
-
-  /**
-   * Log in with an identity id + a private key (WIF or hex). The key is normalized to a
-   * network WIF, verified against the on-chain identity's AUTHENTICATION keys, stored, and the
-   * balance loaded. Rejects a key that does not control any usable key on the identity.
-   */
-  async login(identityId: string, privateKey: string): Promise<AuthSession> {
+  private async run<T>(fn: () => Promise<T>): Promise<T> {
     this.setState({ isLoading: true, error: null })
     try {
-      const wif = normalizeToWif(privateKey, this.network)
-      const sdk = await this.getSdk()
-      const identity = await (sdk as unknown as { identities: IdentitiesFetchFacade }).identities.fetch(
-        identityId,
-      )
-      if (!identity) {
-        throw new WriteAuthError(`identity ${identityId} not found on ${this.network}`)
-      }
-      // Require the WIF to control at least one usable (CRITICAL/HIGH) AUTHENTICATION key.
-      const match = await findSigningKey(identity, wif, this.network, 3)
-      if (!match) {
-        throw new WriteAuthError(
-          'the provided key does not match any usable AUTHENTICATION key on this identity',
-        )
-      }
-      storePrivateKey(this.network, identityId, wif)
-      const balance = await readIdentityBalance(sdk, identityId)
-      const session: AuthSession = {
-        identityId,
-        balance: balance.toString(),
-        network: this.network,
-      }
-      this.setState({ session, isLoading: false, error: null })
-      return session
+      const v = await fn()
+      this.setState({ isLoading: false })
+      return v
     } catch (e) {
-      const message = errorMessage(e)
-      this.setState({ isLoading: false, error: message })
+      this.setState({ isLoading: false, error: errorMessage(e) })
       throw e
     }
   }
 
-  /** Log in from bridge-format identity-file text (JSON). Extracts id + signing key, then logs in. */
-  async loginWithIdentityFile(text: string): Promise<AuthSession> {
-    let parsed: ParsedIdentityFile
-    try {
-      parsed = parseIdentityFileText(text)
-    } catch (e) {
-      const message = errorMessage(e)
-      this.setState({ error: message })
-      throw e
-    }
-    // Compare full keys so a devnet-paloma identity is refused by a devnet-moutai build.
-    const buildKey = NETWORKS[this.network].key
-    if (!identityFileMatchesNetwork(parsed.networkKey, buildKey)) {
-      const message = `identity file is for ${parsed.networkKey}, but this app is on ${buildKey}`
-      this.setState({ error: message })
-      throw new Error(message)
+  /** Open a session for an unlocked secret: re-verify the key on chain, load balance + limits. */
+  private async open(secret: VaultSecret, storage: AuthSession['storage']): Promise<AuthSession> {
+    const sdk = await this.getSdk()
+    const identity = await (sdk as unknown as { identities: { fetch(id: string): Promise<Parameters<typeof findSigningKey>[0] | undefined> } }).identities.fetch(secret.identityId)
+    if (!identity) throw new WriteAuthError(`identity ${secret.identityId} not found on ${this.network}`)
+    const match = await findSigningKey(identity, secret.wif, this.network, 3)
+    if (!match) throw new WriteAuthError('this key is no longer usable on the identity (disabled or expired) — sign in again')
+    const [balance, keyLimits] = await Promise.all([
+      readIdentityBalance(sdk, secret.identityId),
+      readKeyLimits(sdk, secret.identityId, match.keyId).catch(() => null),
+    ])
+    const session: AuthSession = {
+      identityId: secret.identityId,
+      balance: balance.toString(),
+      network: this.network,
+      keyLimits,
+      keyId: match.keyId,
+      storage,
     }
-    return this.login(parsed.identityId, parsed.signingKeyWif)
+    this.setState({ session })
+    return session
+  }
+
+  /** Store a freshly registered limited key in the vault and open its session. */
+  private async adopt(identityId: string, key: LimitedKey, protection: Protection): Promise<AuthSession> {
+    const secret: VaultSecret = { identityId, keyId: key.keyId, wif: key.wif }
+    await storeInVault(this.network, secret, protection)
+    return this.open(secret, 'vault')
+  }
+
+  /**
+   * Import an identity file or mnemonic once: its master key signs one IdentityUpdate that
+   * registers a limited key for this browser, and is then dropped. Only the limited key is
+   * kept, encrypted under `protection`.
+   */
+  async importIdentity(
+    input: { fileText: string } | { mnemonic: string; identityId: string },
+    protection: Protection,
+    request?: LimitedKeyRequest,
+  ): Promise<AuthSession> {
+    return this.run(async () => {
+      let identityId: string
+      let masterWif: string | null
+      if ('fileText' in input) {
+        const m = masterMaterialFromFile(input.fileText)
+        const buildKey = NETWORKS[this.network].key
+        if (!identityFileMatchesNetwork(m.networkKey, buildKey)) {
+          throw new Error(`identity file is for ${m.networkKey}, but this app is on ${buildKey}`)
+        }
+        identityId = m.identityId
+        masterWif = m.masterWif ?? (m.mnemonic ? (await deriveMasterKey(m.mnemonic, this.network)).wif : null)
+      } else {
+        if (!(await isValidMnemonic(input.mnemonic))) throw new Error('those words are not a valid recovery phrase')
+        identityId = input.identityId.trim()
+        masterWif = (await deriveMasterKey(input.mnemonic, this.network)).wif
+      }
+      if (!masterWif) throw new Error('no master key found')
+      const sdk = await this.getSdk()
+      const key = await registerLimitedKey(sdk, {
+        network: this.network,
+        identityId,
+        masterWif,
+        group: this.group(),
+        ...(request ? { request } : {}),
+      })
+      masterWif = null
+      return this.adopt(identityId, key, protection)
+    })
   }
 
-  /** Refresh the current session's credit balance. */
+  /** Adopt a limited key obtained elsewhere (identity creation, App Connect). */
+  async adoptLimitedKey(identityId: string, key: LimitedKey, protection: Protection): Promise<AuthSession> {
+    return this.run(() => this.adopt(identityId, key, protection))
+  }
+
+  /** Unlock a stored vault and open its session. */
+  async unlock(identityId: string, method: { passphrase: string } | 'passkey'): Promise<AuthSession> {
+    return this.run(async () => {
+      const secret =
+        method === 'passkey'
+          ? await unlockWithPasskey(this.network, identityId)
+          : await unlockWithPassphrase(this.network, identityId, method.passphrase)
+      return this.open(secret, 'vault')
+    })
+  }
+
+  /**
+   * Advanced: sign with a pasted private key for this tab only (never stored). The key must
+   * control a HIGH or CRITICAL authentication key of the identity; MASTER keys are refused.
+   */
+  async loginWithRawKey(identityId: string, privateKey: string): Promise<AuthSession> {
+    return this.run(async () => {
+      const wif = normalizeToWif(privateKey, this.network)
+      const sdk = await this.getSdk()
+      const identity = await (sdk as unknown as { identities: { fetch(id: string): Promise<Parameters<typeof findSigningKey>[0] | undefined> } }).identities.fetch(identityId.trim())
+      if (!identity) throw new WriteAuthError(`identity ${identityId} not found on ${this.network}`)
+      const match = await findSigningKey(identity, wif, this.network, 3)
+      if (!match) throw new WriteAuthError('that key does not control a usable (HIGH or CRITICAL) authentication key of this identity')
+      const secret: VaultSecret = { identityId: identityId.trim(), keyId: match.keyId, wif }
+      holdForSession(this.network, secret)
+      return this.open(secret, 'session')
+    })
+  }
+
+  /** Refresh the balance and the key's remaining budget. */
   async refreshBalance(): Promise<void> {
     const session = this.state.session
     if (!session) return
     const sdk = await this.getSdk()
-    const balance = await readIdentityBalance(sdk, session.identityId)
-    this.setState({ session: { ...session, balance: balance.toString() } })
+    const [balance, keyLimits] = await Promise.all([
+      readIdentityBalance(sdk, session.identityId),
+      session.keyId === undefined ? Promise.resolve(null) : readKeyLimits(sdk, session.identityId, session.keyId).catch(() => session.keyLimits ?? null),
+    ])
+    const current = this.state.session
+    if (current?.identityId !== session.identityId) return
+    this.setState({ session: { ...current, balance: balance.toString(), keyLimits } })
+  }
+
+  /** Lock: forget the unlocked key (the stored vault stays; unlock to continue). */
+  lock(): void {
+    lockVault()
+    this.setState({ session: null, error: null })
   }
 
-  /** Log out: forget the session and wipe the stored signing key for this identity. */
-  logout(): void {
+  /** Sign out and forget this browser's key entirely. */
+  async logout(forget = false): Promise<void> {
     const session = this.state.session
-    if (session) clearPrivateKey(this.network, session.identityId)
+    lockVault()
+    if (forget && session) await forgetVault(this.network, session.identityId)
     this.setState({ session: null, error: null })
   }
 }
diff --git a/forge-web/lib/auth/create-identity.ts b/forge-web/lib/auth/create-identity.ts
new file mode 100644
index 000000000..a197feabd
--- /dev/null
+++ b/forge-web/lib/auth/create-identity.ts
@@ -0,0 +1,213 @@
+/**
+ * Create a Platform identity in the browser (`ux-dx-spec.md` §2.2 tile 2).
+ *
+ * The flow, journaled in IndexedDB so a closed tab resumes rather than stranding the deposit:
+ *   1. a fresh 12-word mnemonic; the user proves they wrote it down (three words);
+ *   2. the deposit address (the mnemonic's BIP-44 asset-lock key) and QR; funds arrive from
+ *      any wallet (or the faucet on dev networks);
+ *   3. the asset lock is built, broadcast and proven (InstantSend or chain lock);
+ *   4. one IdentityCreate registers the canonical key set (MASTER, HIGH, CRITICAL auth,
+ *      CRITICAL transfer, MEDIUM encryption; DIP-13 from the mnemonic, so `dg` and the bridge
+ *      open the same identity) **plus** this browser's limited key (key 5: HIGH, bound to the
+ *      dash-forge contract group, budget + expiry), so no second signature is needed.
+ *
+ * The journal keeps only public facts between steps (the deposit address, the asset-lock
+ * txid, the identity id): nothing secret. A resumed flow re-derives every key from the
+ * mnemonic, which the user types again (they have it written down; step 1 made sure).
+ */
+
+import type { EvoSDK } from '@dashevo/evo-sdk'
+
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js'
+
+import type { Network } from '../constants'
+import { idbDelete, idbGet, idbPut } from '../idb'
+import {
+  broadcastTx,
+  buildAssetLock,
+  coreEndpoints,
+  obtainLockProof,
+  waitForDeposit,
+  wifBytes,
+  type CoreEndpoints,
+  type LockProof,
+} from './asset-lock'
+import { CANONICAL_KEYS, assetLockKeyPath, deriveAt, identityKeyPath, normalizeMnemonic } from './hd'
+import { defaultLimits, verifyLimitedKey, type LimitedKey, type LimitedKeyRequest } from './limited-key'
+
+/** Minimum deposit (spec §2.2: 0.02 DASH; the asset-lock floor is 0.003). */
+export const MIN_DEPOSIT_DUFFS = 2_000_000
+export const DEFAULT_DEPOSIT_DUFFS = 5_000_000
+
+/** A pending creation: public facts only (no keys, no mnemonic). */
+export interface CreationJournal {
+  readonly network: Network
+  readonly depositAddress: string
+  readonly identityId: string | null
+  readonly lockTxid: string | null
+  readonly startedAt: number
+}
+
+function journalKey(network: Network): string {
+  return `create-identity:${network}`
+}
+
+export function readCreationJournal(network: Network): Promise<CreationJournal | undefined> {
+  return idbGet<CreationJournal>('journal', journalKey(network))
+}
+
+export function clearCreationJournal(network: Network): Promise<void> {
+  return idbDelete('journal', journalKey(network))
+}
+
+/** The deposit address a mnemonic funds (its BIP-44 asset-lock key). */
+export async function depositAddressOf(mnemonic: string, network: Network): Promise<string> {
+  return (await deriveAt(mnemonic, assetLockKeyPath(network), network)).address
+}
+
+interface StatusFacade {
+  system: { status(): Promise<{ toJSON(): { chain?: { coreChainLockedHeight?: number } } }> }
+}
+
+async function platformClh(sdk: EvoSDK): Promise<number | null> {
+  const s = await (sdk as unknown as StatusFacade).system.status()
+  const h = s.toJSON()?.chain?.coreChainLockedHeight
+  return typeof h === 'number' ? h : null
+}
+
+export type CreateStage = 'waiting-deposit' | 'locking' | 'proving' | 'registering' | 'verifying'
+
+/**
+ * Run (or resume) the creation from the funded deposit onward. Resolves with the new identity
+ * id and this browser's limited key. `mnemonic` never leaves this function's scope except as
+ * derived keys inside the WASM signer, which is freed before returning.
+ */
+export async function createIdentityFromMnemonic(
+  sdk: EvoSDK,
+  params: {
+    readonly network: Network
+    readonly mnemonic: string
+    readonly group: string
+    readonly minDepositDuffs?: number
+    readonly limits?: LimitedKeyRequest
+    readonly endpoints?: CoreEndpoints
+    readonly signal?: AbortSignal
+    readonly onStage?: (stage: CreateStage, detail?: string) => void
+    readonly onDeposit?: (duffs: number) => void
+  },
+): Promise<{ identityId: string; key: LimitedKey }> {
+  const { network, group } = params
+  const mnemonic = normalizeMnemonic(params.mnemonic)
+  const ep = params.endpoints ?? coreEndpoints(network)
+  const evo = await import('@dashevo/evo-sdk')
+  const { AssetLockProof, OutPoint, Identity, IdentityPublicKey, IdentitySigner, PrivateKey, ContractBounds } = evo
+
+  const lockKey = await deriveAt(mnemonic, assetLockKeyPath(network), network)
+  const journal = (await readCreationJournal(network)) ?? {
+    network,
+    depositAddress: lockKey.address,
+    identityId: null,
+    lockTxid: null,
+    startedAt: Date.now(),
+  }
+  if (journal.depositAddress !== lockKey.address) throw new Error('these words do not match the deposit in progress')
+  await idbPut('journal', journalKey(network), journal)
+
+  // 1-3: deposit → asset lock → proof (resumes from a broadcast lock).
+  let lockTxid = journal.lockTxid
+  let lockRaw: Uint8Array | null = null
+  if (lockTxid === null) {
+    params.onStage?.('waiting-deposit')
+    const utxos = await waitForDeposit(ep, lockKey.address, params.minDepositDuffs ?? MIN_DEPOSIT_DUFFS, {
+      signal: params.signal,
+      onSeen: params.onDeposit,
+    })
+    params.onStage?.('locking')
+    const priv = wifBytes(lockKey.wif)
+    const lock = buildAssetLock(utxos, priv)
+    priv.fill(0)
+    await broadcastTx(ep, bytesToHex(lock.raw), lock.txid)
+    lockTxid = lock.txid
+    lockRaw = lock.raw
+    await idbPut('journal', journalKey(network), { ...journal, lockTxid })
+  }
+  params.onStage?.('proving')
+  if (lockRaw === null) lockRaw = await fetchRaw(ep, lockTxid)
+  const proof: LockProof = await obtainLockProof(ep, { txid: lockTxid, raw: lockRaw }, () => platformClh(sdk), {
+    signal: params.signal,
+    onStatus: (s) => params.onStage?.('proving', s),
+  })
+
+  const assetLockProof =
+    proof.type === 'instant'
+      ? AssetLockProof.createInstantAssetLockProof(proof.islock, proof.raw, 0)
+      : AssetLockProof.createChainAssetLockProof(proof.height, new OutPoint(proof.txid, 0))
+  const identityId = assetLockProof.createIdentityId().toBase58()
+  await idbPut('journal', journalKey(network), { ...journal, lockTxid, identityId })
+
+  // 4: IdentityCreate with the canonical keys + this browser's limited key.
+  params.onStage?.('registering')
+  const limits = params.limits ?? defaultLimits()
+  const identity = new Identity(identityId)
+  const signer = new IdentitySigner()
+  const browserKey = PrivateKey.fromBytes(crypto.getRandomValues(new Uint8Array(32)), network === 'mainnet' ? 'mainnet' : 'testnet')
+  const assetLockPrivateKey = PrivateKey.fromWIF(lockKey.wif)
+  const browserKeyId = CANONICAL_KEYS.length
+  try {
+    for (const k of CANONICAL_KEYS) {
+      const d = await deriveAt(mnemonic, identityKeyPath(network, k.id), network)
+      identity.addPublicKey(
+        new IdentityPublicKey({
+          keyId: k.id,
+          purpose: k.purpose.toLowerCase() as 'authentication',
+          securityLevel: k.level.toLowerCase() as 'high',
+          keyType: 'ecdsa_secp256k1',
+          isReadOnly: false,
+          data: hexToBytes(d.publicKeyHex),
+        }),
+      )
+      signer.addKeyFromWif(d.wif)
+    }
+    identity.addPublicKey(
+      new IdentityPublicKey({
+        keyId: browserKeyId,
+        purpose: 'authentication',
+        securityLevel: 'high',
+        keyType: 'ecdsa_secp256k1',
+        isReadOnly: false,
+        data: browserKey.getPublicKey().toBytes(),
+        contractBounds: ContractBounds.ContractGroup(group),
+        totalBudget: limits.budgetCredits,
+        expiresAt: BigInt(limits.expiresAt),
+      }),
+    )
+    signer.addKey(browserKey)
+    const existing = await (sdk as unknown as { identities: { balance(id: string): Promise<bigint | undefined> } }).identities
+      .balance(identityId)
+      .catch(() => undefined)
+    if (existing === undefined) {
+      await (sdk as unknown as { identities: { create(o: unknown): Promise<void> } }).identities.create({
+        identity,
+        assetLockProof,
+        assetLockPrivateKey,
+        signer,
+      })
+    }
+  } finally {
+    signer.free()
+    assetLockPrivateKey.free()
+  }
+  const wif = browserKey.toWIF()
+  browserKey.free()
+
+  params.onStage?.('verifying')
+  const verified = await verifyLimitedKey(sdk, identityId, browserKeyId, group, network, wif)
+  await clearCreationJournal(network)
+  return { identityId, key: { keyId: browserKeyId, wif, limits: verified } }
+}
+
+async function fetchRaw(ep: CoreEndpoints, id: string): Promise<Uint8Array> {
+  const res = await fetch(`${ep.insight}/rawtx/${id}`)
+  if (!res.ok) throw new Error(`could not refetch asset lock ${id}`)
+  return hexToBytes(((await res.json()) as { rawtx: string }).rawtx)
+}
diff --git a/forge-web/lib/auth/hd.ts b/forge-web/lib/auth/hd.ts
new file mode 100644
index 000000000..f5bdc71dd
--- /dev/null
+++ b/forge-web/lib/auth/hd.ts
@@ -0,0 +1,112 @@
+/**
+ * Mnemonic → keys, the paths `tools/mint-identity` (and the Dash bridge) use, so an identity
+ * created here opens in the CLI and vice versa:
+ *
+ *   identity keys (DIP-13): m/9'/<coin>'/5'/0'/0'/<identityIndex>'/<keyIndex>'
+ *   asset-lock key (BIP-44): m/44'/<coin>'/0'/0/0
+ *
+ * coin type 5 on mainnet, 1 elsewhere. The canonical key set (key id = index) is MASTER,
+ * HIGH, CRITICAL authentication, CRITICAL transfer, MEDIUM encryption.
+ *
+ * Derivation runs in the evo-sdk WASM (`wallet.deriveKeyFromSeedWithPath`); verified against
+ * mint-identity's @scure/bip32 output for the moutai fixture identities.
+ */
+
+import type { Network } from '../constants'
+
+export type KeyPurpose = 'AUTHENTICATION' | 'TRANSFER' | 'ENCRYPTION'
+export type KeyLevel = 'MASTER' | 'CRITICAL' | 'HIGH' | 'MEDIUM'
+
+/** The canonical identity key set, by key id. */
+export const CANONICAL_KEYS: readonly { id: number; purpose: KeyPurpose; level: KeyLevel }[] = [
+  { id: 0, purpose: 'AUTHENTICATION', level: 'MASTER' },
+  { id: 1, purpose: 'AUTHENTICATION', level: 'HIGH' },
+  { id: 2, purpose: 'AUTHENTICATION', level: 'CRITICAL' },
+  { id: 3, purpose: 'TRANSFER', level: 'CRITICAL' },
+  { id: 4, purpose: 'ENCRYPTION', level: 'MEDIUM' },
+]
+
+export interface DerivedKey {
+  readonly wif: string
+  /** Compressed public key, hex. */
+  readonly publicKeyHex: string
+  /** P2PKH address. */
+  readonly address: string
+}
+
+function coin(network: Network): number {
+  return network === 'mainnet' ? 5 : 1
+}
+
+function wasmNetwork(network: Network): string {
+  return network === 'mainnet' ? 'mainnet' : 'testnet'
+}
+
+export function identityKeyPath(network: Network, keyIndex: number, identityIndex = 0): string {
+  return `m/9'/${coin(network)}'/5'/0'/0'/${identityIndex}'/${keyIndex}'`
+}
+
+export function assetLockKeyPath(network: Network): string {
+  return `m/44'/${coin(network)}'/0'/0/0`
+}
+
+interface WalletFacade {
+  deriveKeyFromSeedWithPath(p: { mnemonic: string; path: string; network: string }): Promise<{
+    toJSON(): { privateKeyWif: string; publicKey: string; address: string }
+    free(): void
+  }>
+  generateMnemonic(p?: { wordCount?: number }): Promise<string>
+  validateMnemonic(m: string): Promise<boolean>
+}
+
+async function wallet(): Promise<WalletFacade> {
+  const evo = await import('@dashevo/evo-sdk')
+  await evo.EvoSDK.getLatestVersionNumber()
+  return (evo as unknown as { wallet: WalletFacade }).wallet
+}
+
+/** Derive one key from a mnemonic at `path`. */
+export async function deriveAt(mnemonic: string, path: string, network: Network): Promise<DerivedKey> {
+  const info = await (await wallet()).deriveKeyFromSeedWithPath({ mnemonic: normalizeMnemonic(mnemonic), path, network: wasmNetwork(network) })
+  const j = info.toJSON()
+  info.free()
+  return { wif: j.privateKeyWif, publicKeyHex: j.publicKey, address: j.address }
+}
+
+/** The identity's master key (key id 0) from its mnemonic. */
+export function deriveMasterKey(mnemonic: string, network: Network): Promise<DerivedKey> {
+  return deriveAt(mnemonic, identityKeyPath(network, 0), network)
+}
+
+/** A fresh 12-word English mnemonic (128 bits of entropy). */
+export async function newMnemonic(): Promise<string> {
+  return (await wallet()).generateMnemonic({ wordCount: 12 })
+}
+
+/** Whether `m` is a valid BIP-39 mnemonic (checksum included). */
+export async function isValidMnemonic(m: string): Promise<boolean> {
+  try {
+    return await (await wallet()).validateMnemonic(normalizeMnemonic(m))
+  } catch {
+    return false
+  }
+}
+
+/** Lowercase, single-spaced. */
+export function normalizeMnemonic(m: string): string {
+  return m.trim().toLowerCase().split(/\s+/).join(' ')
+}
+
+/**
+ * Three distinct word positions (0-based) the backup quiz asks for, chosen at random.
+ * `count` words total.
+ */
+export function quizPositions(count = 12, ask = 3): number[] {
+  const picked = new Set<number>()
+  const r = new Uint32Array(1)
+  while (picked.size < ask) {
+    crypto.getRandomValues(r)
+    picked.add((r[0] as number) % count)
+  }
+  return [...picked].sort((a, b) => a - b)
+}
diff --git a/forge-web/lib/auth/identity-file.ts b/forge-web/lib/auth/identity-file.ts
index 61170717e..609e72bbd 100644
--- a/forge-web/lib/auth/identity-file.ts
+++ b/forge-web/lib/auth/identity-file.ts
@@ -123,6 +123,55 @@ export function parseIdentityFile(json: unknown): ParsedIdentityFile {
   return { identityId, network, networkKey, signingKeyWif: best.wif, securityLevel: best.level }
 }
 
+/** What the import ceremony needs from an identity file: its id, network and master key. */
+export interface MasterMaterial {
+  readonly identityId: string
+  readonly networkKey: string | null
+  /** The identity's MASTER key (WIF), used once to register a limited key. */
+  readonly masterWif: string | null
+  /** The file's mnemonic, when it carries one (the master key can be derived from it). */
+  readonly mnemonic: string | null
+}
+
+/**
+ * Extract the master key (or a mnemonic to derive it) from a bridge-format identity file.
+ * Nothing else is kept: the other keys in the file are never used by the browser.
+ */
+export function masterMaterialFromFile(text: string): MasterMaterial {
+  let json: unknown
+  try {
+    json = JSON.parse(text)
+  } catch (e) {
+    throw new Error(`identity file is not valid JSON: ${(e as Error).message}`)
+  }
+  if (json === null || typeof json !== 'object') throw new Error('identity file must be a JSON object')
+  const obj = json as Record<string, unknown>
+  const identityId = asString(obj['identityId']) ?? asString(obj['id'])
+  if (identityId === null) throw new Error('identity file is missing "identityId"')
+  const network = normalizeNetwork(obj['network'])
+  const networkKey = network === null ? null : (obj['network'] as string)
+  const rawKeys = obj['identityKeys'] ?? obj['keys']
+  let masterWif: string | null = null
+  if (Array.isArray(rawKeys)) {
+    for (const raw of rawKeys as RawKey[]) {
+      if (asString(raw.purpose)?.toUpperCase() !== 'AUTHENTICATION') continue
+      if (asString(raw.securityLevel)?.toUpperCase() !== 'MASTER') continue
+      const keyType = asString(raw.keyType)
+      if (keyType !== null && !WIF_SIGNABLE_KEY_TYPES.has(keyType.toUpperCase())) continue
+      const wif = asString(raw.privateKeyWif) ?? asString(raw.privateKey)
+      if (wif !== null && isLikelyWif(wif)) {
+        masterWif = wif
+        break
+      }
+    }
+  }
+  const mnemonic = asString(obj['mnemonic'])
+  if (masterWif === null && mnemonic === null) {
+    throw new Error('identity file has neither a MASTER authentication key nor a mnemonic')
+  }
+  return { identityId, networkKey, masterWif, mnemonic }
+}
+
 /** Parse identity-file text (JSON string) with a friendly error on malformed JSON. */
 export function parseIdentityFileText(text: string): ParsedIdentityFile {
   let json: unknown
diff --git a/forge-web/lib/auth/index.ts b/forge-web/lib/auth/index.ts
index bad3a48a5..ad3895891 100644
--- a/forge-web/lib/auth/index.ts
+++ b/forge-web/lib/auth/index.ts
@@ -1,10 +1,10 @@
 /**
  * Auth — headless identity login + secure key storage for forge-web.
  *
- * M3 shape: private-key / identity-file login with the signing key held in a network-scoped
- * browser keystore and used only at signing time (never in React state or logs). The exposed
- * {@link AuthController} yields a {@link WriteAuth} the WriteEngine consumes. Password-vault /
- * passkey-PRF wrapping of the stored key is the documented follow-up.
+ * Limited-key sign-in (`ux-dx-spec.md` §2): a PV14 key bound to the dash-forge contract group,
+ * with a budget and an expiry, held encrypted in the vault (passkey PRF or Argon2id) and used
+ * only at signing time (never in React state or logs). The {@link AuthController} yields a
+ * {@link WriteAuth} the WriteEngine consumes.
  */
 
 export {
@@ -27,20 +27,27 @@ export {
   type ParsedPrivateKey,
 } from './wif'
 export {
-  clearAllPrivateKeys,
-  clearPrivateKey,
-  getPrivateKey,
-  hasPrivateKey,
-  storePrivateKey,
-  storedIdentityIds,
-} from './keystore'
+  AUTO_LOCK_MS,
+  ARGON2_PARAMS,
+  MIN_PASSPHRASE,
+  VaultLockedError,
+  enrollPasskey,
+  listVaults,
+  passkeysAvailable,
+  type Protection,
+  type VaultInfo,
+} from './vault'
+export { BROWSER_KEY_DEFAULTS, defaultLimits, type LimitedKey, type LimitedKeyRequest } from './limited-key'
 export {
+  masterMaterialFromFile,
   parseIdentityFile,
   parseIdentityFileText,
+  type MasterMaterial,
   type ParsedIdentityFile,
 } from './identity-file'
 export {
   AuthController,
+  purgeLegacyKeystore,
   type AuthSession,
   type AuthState,
   type SdkProvider,
diff --git a/forge-web/lib/auth/keystore.ts b/forge-web/lib/auth/keystore.ts
deleted file mode 100644
index bf389d712..000000000
--- a/forge-web/lib/auth/keystore.ts
+++ /dev/null
@@ -1,101 +0,0 @@
-/**
- * Network-scoped in-browser key storage — the forge-web analogue of yappr's `secure-storage`.
- *
- * Private keys (WIF) are held in `localStorage` under a `forge_key_<network>_pk_<identityId>`
- * key so testnet and mainnet material never collide. Keys are **never** placed in React state
- * or logged; only this module and the signer read them, and only in the browser. All access is
- * SSR-guarded (`typeof window`) so the Next static-export prerender never touches storage.
- *
- * This is the M3 shape: WIF at rest in `localStorage`. Password-vault / passkey-PRF wrapping
- * (encrypting these at rest behind a user secret) is the documented follow-up — the storage
- * surface here is intentionally the same one those wrappers would slot in front of.
- */
-
-import type { Network } from '../constants'
-
-const PREFIX = 'forge_key_'
-
-function storage(): Storage | null {
-  if (typeof window === 'undefined') return null
-  try {
-    return window.localStorage
-  } catch {
-    return null
-  }
-}
-
-function pkKey(network: Network, identityId: string): string {
-  return `${PREFIX}${network}_pk_${identityId}`
-}
-
-/** Persist an identity's signing key (WIF) for a network. No-op outside the browser. */
-export function storePrivateKey(network: Network, identityId: string, wif: string): void {
-  const s = storage()
-  if (!s) return
-  try {
-    s.setItem(pkKey(network, identityId), wif)
-  } catch {
-    // Storage full / disabled — treat as absent; the caller re-prompts on the next write.
-  }
-}
-
-/** Read an identity's stored signing key (WIF), or null if none / not in a browser. */
-export function getPrivateKey(network: Network, identityId: string): string | null {
-  const s = storage()
-  if (!s) return null
-  try {
-    return s.getItem(pkKey(network, identityId))
-  } catch {
-    return null
-  }
-}
-
-/** Whether an identity has a stored signing key on this network. */
-export function hasPrivateKey(network: Network, identityId: string): boolean {
-  return getPrivateKey(network, identityId) !== null
-}
-
-/** Forget one identity's stored signing key on this network. */
-export function clearPrivateKey(network: Network, identityId: string): void {
-  const s = storage()
-  if (!s) return
-  try {
-    s.removeItem(pkKey(network, identityId))
-  } catch {
-    // Ignore.
-  }
-}
-
-/** Forget every stored key on this network (full logout / device wipe). */
-export function clearAllPrivateKeys(network: Network): void {
-  const s = storage()
-  if (!s) return
-  try {
-    const scope = `${PREFIX}${network}_pk_`
-    const toRemove: string[] = []
-    for (let i = 0; i < s.length; i++) {
-      const k = s.key(i)
-      if (k && k.startsWith(scope)) toRemove.push(k)
-    }
-    for (const k of toRemove) s.removeItem(k)
-  } catch {
-    // Ignore.
-  }
-}
-
-/** The identity ids that currently have a stored key on this network. */
-export function storedIdentityIds(network: Network): string[] {
-  const s = storage()
-  if (!s) return []
-  const scope = `${PREFIX}${network}_pk_`
-  const ids: string[] = []
-  try {
-    for (let i = 0; i < s.length; i++) {
-      const k = s.key(i)
-      if (k && k.startsWith(scope)) ids.push(k.slice(scope.length))
-    }
-  } catch {
-    return []
-  }
-  return ids
-}
diff --git a/forge-web/lib/auth/limited-key.ts b/forge-web/lib/auth/limited-key.ts
new file mode 100644
index 000000000..52787dcca
--- /dev/null
+++ b/forge-web/lib/auth/limited-key.ts
@@ -0,0 +1,193 @@
+/**
+ * PV14 limited keys (`ux-dx-spec.md` §2.1; platform `authentication-key-limits.md`,
+ * `contract-bound-authentication-keys.md`).
+ *
+ * A browser signs with an AUTHENTICATION / HIGH key that is:
+ *   - bound to the `dash-forge` contract group (`contractBounds: contractGroup`) — it can sign
+ *     only Batch transitions on forge-core and forge-collab; an identity update, a credit
+ *     transfer or a write to any other contract is refused at consensus;
+ *   - budgeted (`totalBudget`, default 0.05 DASH) — it can take at most that from the identity;
+ *   - expiring (`expiresAt`, default 90 days).
+ *
+ * The master key signs the one IdentityUpdate that registers it (and the new key signs its own
+ * proof of possession), then is dropped: the WASM signer holding it is freed and the caller's
+ * copy is not retained here.
+ */
+
+import type { EvoSDK } from '@dashevo/evo-sdk'
+
+import type { Network } from '../constants'
+import { CREDITS_PER_DASH } from '../sdk/cost'
+import type { KeyLimits } from '../view/funds'
+
+/** Browser key defaults (spec §2.1). */
+export const BROWSER_KEY_DEFAULTS = { budgetDash: 0.05, days: 90 } as const
+const DAY_MS = 24 * 60 * 60 * 1000
+
+export interface LimitedKeyRequest {
+  readonly budgetCredits: bigint
+  readonly expiresAt: number
+}
+
+/** The default request: 0.05 DASH for 90 days from `now`. */
+export function defaultLimits(now = Date.now()): LimitedKeyRequest {
+  return {
+    budgetCredits: BigInt(Math.round(BROWSER_KEY_DEFAULTS.budgetDash * CREDITS_PER_DASH)),
+    expiresAt: now + BROWSER_KEY_DEFAULTS.days * DAY_MS,
+  }
+}
+
+/** A registered limited key: its id and private key (WIF). */
+export interface LimitedKey {
+  readonly keyId: number
+  readonly wif: string
+  readonly limits: KeyLimits
+}
+
+interface WasmKey {
+  readonly keyId: number
+  readonly purposeNumber: number
+  readonly securityLevelNumber: number
+  readonly disabledAt?: bigint
+  readonly totalBudget?: bigint
+  readonly expiresAt?: bigint
+  readonly contractBounds?: { toJSON(): { $type: string; id: string } }
+  validatePrivateKey(bytes: Uint8Array, network: string): boolean
+}
+interface WasmIdentity {
+  readonly publicKeys: WasmKey[]
+  readonly balance: bigint
+}
+interface IdentitiesFacade {
+  fetch(id: string): Promise<WasmIdentity | undefined>
+  update(options: unknown): Promise<void>
+  keysRemainingBudgets(id: string, keyIds: number[]): Promise<Map<number, bigint | null>>
+}
+
+function identities(sdk: EvoSDK): IdentitiesFacade {
+  return (sdk as unknown as { identities: IdentitiesFacade }).identities
+}
+
+/**
+ * Register a limited key on `identityId`, signed once by `masterWif`. Generates the new key
+ * in the WASM (never exposed until returned), registers it, verifies on chain that it landed
+ * with exactly the requested bounds, budget and expiry, and returns it.
+ */
+export async function registerLimitedKey(
+  sdk: EvoSDK,
+  params: {
+    readonly network: Network
+    readonly identityId: string
+    readonly masterWif: string
+    readonly group: string
+    readonly request?: LimitedKeyRequest
+  },
+): Promise<LimitedKey> {
+  const { IdentityPublicKeyInCreation, ContractBounds, IdentitySigner, PrivateKey } = await import('@dashevo/evo-sdk')
+  const request = params.request ?? defaultLimits()
+  const identity = await identities(sdk).fetch(params.identityId)
+  if (!identity) throw new Error(`identity ${params.identityId} not found on ${params.network}`)
+
+  // The master key must be one of this identity's MASTER keys; say so plainly rather than
+  // letting consensus refuse an update signed by the wrong key.
+  const master = PrivateKey.fromWIF(params.masterWif)
+  const masterBytes = master.toBytes()
+  const isMaster = identity.publicKeys.some(
+    (k) => k.securityLevelNumber === 0 && k.disabledAt === undefined && safeValidate(k, masterBytes, params.network),
+  )
+  masterBytes.fill(0)
+  if (!isMaster) {
+    master.free()
+    throw new Error("that key is not this identity's master key")
+  }
+
+  const fresh = PrivateKey.fromBytes(crypto.getRandomValues(new Uint8Array(32)), params.network === 'mainnet' ? 'mainnet' : 'testnet')
+  const keyId = Math.max(...identity.publicKeys.map((k) => k.keyId)) + 1
+  const signer = new IdentitySigner()
+  try {
+    signer.addKey(master)
+    signer.addKey(fresh)
+    const key = new IdentityPublicKeyInCreation({
+      keyId,
+      purpose: 'authentication',
+      securityLevel: 'high',
+      keyType: 'ecdsa_secp256k1',
+      data: fresh.getPublicKey().toBytes(),
+      contractBounds: ContractBounds.ContractGroup(params.group),
+      totalBudget: request.budgetCredits,
+      expiresAt: BigInt(request.expiresAt),
+    })
+    await identities(sdk).update({ identity, addPublicKeys: [key], signer })
+  } finally {
+    signer.free()
+    master.free()
+  }
+  const wif = fresh.toWIF()
+  fresh.free()
+  const limits = await verifyLimitedKey(sdk, params.identityId, keyId, params.group, params.network, wif)
+  return { keyId, wif, limits }
+}
+
+function safeValidate(k: WasmKey, bytes: Uint8Array, network: Network): boolean {
+  try {
+    return k.validatePrivateKey(bytes, network)
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Read a key back from the chain and check it is what a Forge browser key must be: live,
+ * AUTHENTICATION / HIGH, bound to `group`, with a budget and an expiry, and (when `wif` is
+ * given) controlled by that private key. Returns its limits (remaining budget included).
+ */
+export async function verifyLimitedKey(
+  sdk: EvoSDK,
+  identityId: string,
+  keyId: number,
+  group: string,
+  network: Network,
+  wif?: string,
+): Promise<KeyLimits> {
+  const identity = await identities(sdk).fetch(identityId)
+  const k = identity?.publicKeys.find((x) => x.keyId === keyId)
+  if (!k) throw new Error(`key ${keyId} is not on identity ${identityId}`)
+  if (k.disabledAt !== undefined) throw new Error(`key ${keyId} is disabled`)
+  if (k.purposeNumber !== 0 || k.securityLevelNumber !== 2) throw new Error(`key ${keyId} is not an AUTHENTICATION/HIGH key`)
+  const bounds = k.contractBounds?.toJSON()
+  if (bounds?.$type !== 'contractGroup' || bounds.id !== group) {
+    throw new Error(`key ${keyId} is not bound to the dash-forge contract group`)
+  }
+  if (k.totalBudget === undefined || k.expiresAt === undefined) throw new Error(`key ${keyId} has no budget or expiry`)
+  if (wif !== undefined) {
+    const { PrivateKey } = await import('@dashevo/evo-sdk')
+    const pk = PrivateKey.fromWIF(wif)
+    const bytes = pk.toBytes()
+    const ok = safeValidate(k, bytes, network)
+    bytes.fill(0)
+    pk.free()
+    if (!ok) throw new Error(`the stored private key does not control key ${keyId}`)
+  }
+  const remaining = await readRemainingBudget(sdk, identityId, keyId)
+  return { remaining, total: k.totalBudget, expiresAt: Number(k.expiresAt) }
+}
+
+/** What is left of a key's budget (null when it has none). */
+export async function readRemainingBudget(sdk: EvoSDK, identityId: string, keyId: number): Promise<bigint | null> {
+  const map = await identities(sdk).keysRemainingBudgets(identityId, [keyId])
+  return map.get(keyId) ?? null
+}
+
+/** The limits of a key already on the identity (for a session resumed from the vault). */
+export async function readKeyLimits(sdk: EvoSDK, identityId: string, keyId: number): Promise<KeyLimits | null> {
+  const identity = await identities(sdk).fetch(identityId)
+  const k = identity?.publicKeys.find((x) => x.keyId === keyId)
+  if (!k) return null
+  if (k.totalBudget === undefined && k.expiresAt === undefined) return null
+  const remaining = k.totalBudget === undefined ? null : await readRemainingBudget(sdk, identityId, keyId)
+  return {
+    remaining,
+    total: k.totalBudget ?? null,
+    expiresAt: k.expiresAt === undefined ? null : Number(k.expiresAt),
+  }
+}
diff --git a/forge-web/lib/auth/vault.ts b/forge-web/lib/auth/vault.ts
new file mode 100644
index 000000000..dfd57fa18
--- /dev/null
+++ b/forge-web/lib/auth/vault.ts
@@ -0,0 +1,347 @@
+/**
+ * The browser vault (`ux-dx-spec.md` §2.3): this browser's limited signing key, encrypted at
+ * rest, unlocked for the session.
+ *
+ * - What it holds: one record per (network, identity) — the identity id, the limited key's id
+ *   and its private key. Never a master key: the import and create flows discard it before
+ *   anything reaches here.
+ * - At rest: IndexedDB (`vault` store), the secret sealed with AES-256-GCM under a random
+ *   256-bit data key. The data key is itself wrapped (AES-GCM) by one or both of:
+ *     - a passkey: WebAuthn `prf` extension output (evaluated with a random 32-byte salt stored
+ *       beside it), stretched with HKDF-SHA256 to a key-wrapping key;
+ *     - a passphrase: Argon2id(passphrase, 16-byte salt, m = 64 MiB, t = 3, p = 1) → 32 bytes.
+ *   The AES-GCM additional data binds each ciphertext to its network, identity and slot, so a
+ *   record cannot be replayed under another identity.
+ * - In memory: the unlocked record lives only in this module (never React state, never
+ *   localStorage), for at most {@link AUTO_LOCK_MS} (12 h) or until {@link lockVault}.
+ *
+ * Per-origin by construction: IndexedDB and WebAuthn (`rpId` = this host) are origin-scoped.
+ */
+
+import { argon2idAsync } from '@noble/hashes/argon2.js'
+import { hkdf } from '@noble/hashes/hkdf.js'
+import { sha256 } from '@noble/hashes/sha2.js'
+
+import type { Network } from '../constants'
+import { idbDelete, idbEntries, idbGet, idbPut } from '../idb'
+
+/** Unlocked vaults lock themselves after this long (spec §2.3). */
+export const AUTO_LOCK_MS = 12 * 60 * 60 * 1000
+
+/** Argon2id parameters (spec §2.3: m = 64 MiB, t = 3). */
+export const ARGON2_PARAMS = { m: 64 * 1024, t: 3, p: 1, dkLen: 32 } as const
+
+/** The minimum passphrase length the vault accepts. */
+export const MIN_PASSPHRASE = 10
+
+/** What the vault protects. */
+export interface VaultSecret {
+  readonly identityId: string
+  /** The limited key's id on the identity. */
+  readonly keyId: number
+  /** The limited key's private key, WIF. */
+  readonly wif: string
+}
+
+/** A key-wrapping slot: the data key encrypted under one unlock method. */
+type Slot =
+  | {
+      readonly kind: 'passkey'
+      readonly credentialId: Uint8Array
+      readonly prfSalt: Uint8Array
+      readonly iv: Uint8Array
+      readonly wrapped: Uint8Array
+    }
+  | {
+      readonly kind: 'passphrase'
+      readonly salt: Uint8Array
+      readonly params: typeof ARGON2_PARAMS
+      readonly iv: Uint8Array
+      readonly wrapped: Uint8Array
+    }
+
+/** The stored (encrypted) vault record. */
+interface VaultRecord {
+  readonly version: 1
+  readonly network: Network
+  readonly identityId: string
+  readonly keyId: number
+  readonly createdAt: number
+  readonly iv: Uint8Array
+  readonly ciphertext: Uint8Array
+  readonly slots: readonly Slot[]
+}
+
+/** What the UI may know about a stored vault (no secrets). */
+export interface VaultInfo {
+  readonly identityId: string
+  readonly keyId: number
+  readonly createdAt: number
+  readonly methods: readonly ('passkey' | 'passphrase')[]
+}
+
+const enc = new TextEncoder()
+
+function key(network: Network, identityId: string): string {
+  return `vault:${network}:${identityId}`
+}
+
+function aad(network: Network, identityId: string, slot: string): Uint8Array {
+  return enc.encode(`dash-forge vault v1|${network}|${identityId}|${slot}`)
+}
+
+function random(n: number): Uint8Array {
+  return crypto.getRandomValues(new Uint8Array(n))
+}
+
+/** A copy backed by its own ArrayBuffer (what WebCrypto's BufferSource wants). */
+function buf(b: Uint8Array): Uint8Array<ArrayBuffer> {
+  return new Uint8Array(b)
+}
+
+async function aesKey(raw: Uint8Array, usage: KeyUsage[]): Promise<CryptoKey> {
+  return crypto.subtle.importKey('raw', buf(raw), { name: 'AES-GCM' }, false, usage)
+}
+
+async function seal(keyBytes: Uint8Array, plaintext: Uint8Array, ad: Uint8Array): Promise<{ iv: Uint8Array; ct: Uint8Array }> {
+  const iv = random(12)
+  const k = await aesKey(keyBytes, ['encrypt'])
+  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv: buf(iv), additionalData: buf(ad) }, k, buf(plaintext)))
+  return { iv, ct }
+}
+
+async function open(keyBytes: Uint8Array, iv: Uint8Array, ct: Uint8Array, ad: Uint8Array): Promise<Uint8Array> {
+  const k = await aesKey(keyBytes, ['decrypt'])
+  try {
+    return new Uint8Array(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: buf(iv), additionalData: buf(ad) }, k, buf(ct)))
+  } catch {
+    throw new VaultLockedError('wrong passphrase or passkey')
+  }
+}
+
+/** The vault could not be opened (wrong secret, no record, or locked). */
+export class VaultLockedError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'VaultLockedError'
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Unlock methods → key-wrapping key
+// ---------------------------------------------------------------------------
+
+/** Argon2id(passphrase) → 32-byte wrapping key. ~1.5 s in a browser at 64 MiB. */
+export async function passphraseKey(passphrase: string, salt: Uint8Array, params = ARGON2_PARAMS): Promise<Uint8Array> {
+  return argon2idAsync(enc.encode(passphrase.normalize('NFKC')), salt, params)
+}
+
+/** A PRF output (32 bytes) → wrapping key. HKDF so the raw PRF output is never used as a key. */
+export function prfKey(prfOutput: Uint8Array, network: Network, identityId: string): Uint8Array {
+  return hkdf(sha256, prfOutput, enc.encode('dash-forge vault prf v1'), enc.encode(`${network}|${identityId}`), 32)
+}
+
+interface PrfExtensionResults {
+  prf?: { enabled?: boolean; results?: { first?: ArrayBuffer } }
+}
+
+function rpId(): string {
+  return window.location.hostname
+}
+
+/** Whether this browser can do WebAuthn at all (PRF support is only known after a ceremony). */
+export function passkeysAvailable(): boolean {
+  return typeof window !== 'undefined' && typeof window.PublicKeyCredential !== 'undefined' && window.isSecureContext
+}
+
+/**
+ * Create a passkey for the vault and evaluate its PRF. Returns null when the authenticator
+ * does not support `prf` (the caller falls back to a passphrase). Some authenticators only
+ * report `prf.enabled` at creation and need a get() to produce output; both are handled.
+ */
+export async function enrollPasskey(identityId: string, label: string): Promise<{ credentialId: Uint8Array; prfSalt: Uint8Array; output: Uint8Array } | null> {
+  const prfSalt = random(32)
+  const cred = (await navigator.credentials.create({
+    publicKey: {
+      rp: { id: rpId(), name: 'Dash Forge' },
+      user: { id: buf(sha256(enc.encode(identityId))), name: label, displayName: label },
+      challenge: buf(random(32)),
+      pubKeyCredParams: [
+        { type: 'public-key', alg: -7 },
+        { type: 'public-key', alg: -257 },
+      ],
+      authenticatorSelection: { residentKey: 'preferred', userVerification: 'required' },
+      extensions: { prf: { eval: { first: buf(prfSalt) } } } as AuthenticationExtensionsClientInputs,
+    },
+  })) as PublicKeyCredential | null
+  if (!cred) return null
+  const ext = cred.getClientExtensionResults() as PrfExtensionResults
+  const credentialId = new Uint8Array(cred.rawId)
+  let first = ext.prf?.results?.first
+  if (!first) {
+    if (ext.prf?.enabled !== true) return null
+    first = (await evaluatePasskey(credentialId, prfSalt)) ?? undefined
+    if (!first) return null
+  }
+  return { credentialId, prfSalt, output: new Uint8Array(first) }
+}
+
+/** Evaluate the PRF of an enrolled passkey (a user-verified assertion). */
+async function evaluatePasskey(credentialId: Uint8Array, prfSalt: Uint8Array): Promise<ArrayBuffer | null> {
+  const assertion = (await navigator.credentials.get({
+    publicKey: {
+      rpId: rpId(),
+      challenge: buf(random(32)),
+      allowCredentials: [{ type: 'public-key', id: buf(credentialId) }],
+      userVerification: 'required',
+      extensions: { prf: { eval: { first: buf(prfSalt) } } } as AuthenticationExtensionsClientInputs,
+    },
+  })) as PublicKeyCredential | null
+  const ext = assertion?.getClientExtensionResults() as PrfExtensionResults | undefined
+  return ext?.prf?.results?.first ?? null
+}
+
+// ---------------------------------------------------------------------------
+// Store / unlock / lock
+// ---------------------------------------------------------------------------
+
+/** How to protect a new vault: a passphrase, a passkey PRF output, or both. */
+export interface Protection {
+  readonly passphrase?: string
+  readonly passkey?: { credentialId: Uint8Array; prfSalt: Uint8Array; output: Uint8Array }
+}
+
+/**
+ * Seal `secret` into the vault for `network`, replacing any earlier record for its identity,
+ * and keep it unlocked for this session. At least one protection is required.
+ */
+export async function storeInVault(network: Network, secret: VaultSecret, protection: Protection): Promise<void> {
+  if (!protection.passphrase && !protection.passkey) throw new Error('the vault needs a passphrase or a passkey')
+  if (protection.passphrase !== undefined && protection.passphrase.length < MIN_PASSPHRASE) {
+    throw new Error(`use a passphrase of at least ${MIN_PASSPHRASE} characters`)
+  }
+  const { identityId } = secret
+  const dataKey = random(32)
+  try {
+    const body = await seal(dataKey, enc.encode(JSON.stringify(secret)), aad(network, identityId, 'body'))
+    const slots: Slot[] = []
+    if (protection.passkey) {
+      const kek = prfKey(protection.passkey.output, network, identityId)
+      const w = await seal(kek, dataKey, aad(network, identityId, 'passkey'))
+      kek.fill(0)
+      slots.push({ kind: 'passkey', credentialId: protection.passkey.credentialId, prfSalt: protection.passkey.prfSalt, iv: w.iv, wrapped: w.ct })
+    }
+    if (protection.passphrase) {
+      const salt = random(16)
+      const kek = await passphraseKey(protection.passphrase, salt)
+      const w = await seal(kek, dataKey, aad(network, identityId, 'passphrase'))
+      kek.fill(0)
+      slots.push({ kind: 'passphrase', salt, params: ARGON2_PARAMS, iv: w.iv, wrapped: w.ct })
+    }
+    const record: VaultRecord = {
+      version: 1,
+      network,
+      identityId,
+      keyId: secret.keyId,
+      createdAt: Date.now(),
+      iv: body.iv,
+      ciphertext: body.ct,
+      slots,
+    }
+    await idbPut('vault', key(network, identityId), record)
+  } finally {
+    dataKey.fill(0)
+  }
+  setUnlocked(network, secret)
+}
+
+/** The vaults stored for `network` (no secrets). */
+export async function listVaults(network: Network): Promise<VaultInfo[]> {
+  const rows = await idbEntries<VaultRecord>('vault', `vault:${network}:`)
+  return rows.map(([, r]) => ({
+    identityId: r.identityId,
+    keyId: r.keyId,
+    createdAt: r.createdAt,
+    methods: r.slots.map((s) => s.kind),
+  }))
+}
+
+async function unwrapWith(network: Network, record: VaultRecord, kek: Uint8Array, slot: Slot): Promise<VaultSecret> {
+  const dataKey = await open(kek, slot.iv, slot.wrapped, aad(network, record.identityId, slot.kind))
+  try {
+    const body = await open(dataKey, record.iv, record.ciphertext, aad(network, record.identityId, 'body'))
+    const secret = JSON.parse(new TextDecoder().decode(body)) as VaultSecret
+    body.fill(0)
+    if (secret.identityId !== record.identityId) throw new VaultLockedError('vault record does not match its identity')
+    return secret
+  } finally {
+    dataKey.fill(0)
+    kek.fill(0)
+  }
+}
+
+/** Unlock with a passphrase. Throws {@link VaultLockedError} on a wrong one. */
+export async function unlockWithPassphrase(network: Network, identityId: string, passphrase: string): Promise<VaultSecret> {
+  const record = await idbGet<VaultRecord>('vault', key(network, identityId))
+  const slot = record?.slots.find((s) => s.kind === 'passphrase')
+  if (!record || !slot || slot.kind !== 'passphrase') throw new VaultLockedError('no passphrase-protected key for this identity here')
+  const secret = await unwrapWith(network, record, await passphraseKey(passphrase, slot.salt, slot.params), slot)
+  setUnlocked(network, secret)
+  return secret
+}
+
+/** Unlock with the enrolled passkey (a WebAuthn assertion with the PRF extension). */
+export async function unlockWithPasskey(network: Network, identityId: string): Promise<VaultSecret> {
+  const record = await idbGet<VaultRecord>('vault', key(network, identityId))
+  const slot = record?.slots.find((s) => s.kind === 'passkey')
+  if (!record || !slot || slot.kind !== 'passkey') throw new VaultLockedError('no passkey-protected key for this identity here')
+  const output = await evaluatePasskey(slot.credentialId, slot.prfSalt)
+  if (!output) throw new VaultLockedError('the passkey did not return its PRF output')
+  const raw = new Uint8Array(output)
+  const kek = prfKey(raw, network, identityId)
+  raw.fill(0)
+  const secret = await unwrapWith(network, record, kek, slot)
+  setUnlocked(network, secret)
+  return secret
+}
+
+/** Delete the stored vault for an identity (sign out and forget this browser). */
+export async function forgetVault(network: Network, identityId: string): Promise<void> {
+  lockVault()
+  await idbDelete('vault', key(network, identityId))
+}
+
+// The unlocked secret: module memory only.
+let unlocked: { network: Network; secret: VaultSecret; at: number } | null = null
+let lockTimer: ReturnType<typeof setTimeout> | null = null
+
+function setUnlocked(network: Network, secret: VaultSecret): void {
+  unlocked = { network, secret, at: Date.now() }
+  if (lockTimer) clearTimeout(lockTimer)
+  lockTimer = setTimeout(lockVault, AUTO_LOCK_MS)
+}
+
+/**
+ * Hold a secret for this session without storing it (the "Advanced: raw key" path: tab-scoped
+ * unless the user opts into the vault).
+ */
+export function holdForSession(network: Network, secret: VaultSecret): void {
+  setUnlocked(network, secret)
+}
+
+/** The unlocked secret for (network, identity), or null when locked or expired. */
+export function unlockedSecret(network: Network, identityId: string): VaultSecret | null {
+  if (!unlocked || unlocked.network !== network || unlocked.secret.identityId !== identityId) return null
+  if (Date.now() - unlocked.at > AUTO_LOCK_MS) {
+    lockVault()
+    return null
+  }
+  return unlocked.secret
+}
+
+/** Forget the unlocked secret (sign-out, auto-lock). The stored record stays. */
+export function lockVault(): void {
+  unlocked = null
+  if (lockTimer) clearTimeout(lockTimer)
+  lockTimer = null
+}
diff --git a/forge-web/package.json b/forge-web/package.json
index 624ab75c7..f26ce336b 100644
--- a/forge-web/package.json
+++ b/forge-web/package.json
@@ -13,6 +13,7 @@
   "dependencies": {
     "@dashevo/evo-sdk": "4.2.0-beta.4",
     "@noble/hashes": "^2.2.0",
+    "@noble/secp256k1": "^3.2.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "fflate": "^0.8.3",
@@ -21,6 +22,7 @@
     "next": "14.2.25",
     "next-themes": "^0.4.6",
     "pako": "^3.0.1",
+    "qr": "^0.7.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "tailwind-merge": "^2.5.5",
diff --git a/forge-web/pnpm-lock.yaml b/forge-web/pnpm-lock.yaml
index b742d4057..d4302d8bc 100644
--- a/forge-web/pnpm-lock.yaml
+++ b/forge-web/pnpm-lock.yaml
@@ -14,6 +14,9 @@ importers:
       '@noble/hashes':
         specifier: ^2.2.0
         version: 2.2.0
+      '@noble/secp256k1':
+        specifier: ^3.2.0
+        version: 3.2.0
       class-variance-authority:
         specifier: ^0.7.1
         version: 0.7.1
@@ -38,6 +41,9 @@ importers:
       pako:
         specifier: ^3.0.1
         version: 3.0.1
+      qr:
+        specifier: ^0.7.0
+        version: 0.7.0
       react:
         specifier: ^18.3.1
         version: 18.3.1
@@ -388,6 +394,9 @@ packages:
     resolution: {integrity: sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==}
     engines: {node: '>= 20.19.0'}
 
+  '@noble/secp256k1@3.2.0':
+    resolution: {integrity: sha512-Z3ZAWOTxJ0EuTuZTi7Y69iK7GgrLHh8sgm45lVDhg/b3Nk1TpAiKhick2KkZisHuupeepSkyIydN/J459SdX1w==}
+
   '@nodelib/fs.scandir@2.1.5':
     resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
     engines: {node: '>= 8'}
@@ -1939,6 +1948,10 @@ packages:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
 
+  qr@0.7.0:
+    resolution: {integrity: sha512-/VrrACmOAwZVipuRITwfEwOL5oAMEHH5PTmBWaGtlTom2Thxaa+rhmna4zU9PRN2uLw2wdccbkHOLGZb1Q9SdA==}
+    engines: {node: '>= 20.19.0'}
+
   queue-microtask@1.2.3:
     resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
 
@@ -2607,6 +2620,8 @@ snapshots:
 
   '@noble/hashes@2.2.0': {}
 
+  '@noble/secp256k1@3.2.0': {}
+
   '@nodelib/fs.scandir@2.1.5':
     dependencies:
       '@nodelib/fs.stat': 2.0.5
@@ -3397,7 +3412,7 @@ snapshots:
       '@typescript-eslint/parser': 7.18.0(eslint@8.57.1)(typescript@5.9.3)
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1)
+      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1)
       eslint-plugin-import: 2.32.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
       eslint-plugin-jsx-a11y: 6.10.2(eslint@8.57.1)
       eslint-plugin-react: 7.37.5(eslint@8.57.1)
@@ -3417,7 +3432,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1):
+  eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1):
     dependencies:
       '@nolyfill/is-core-module': 1.0.39
       debug: 4.4.3
@@ -3432,14 +3447,14 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.14.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1):
+  eslint-module-utils@2.14.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1))(eslint@8.57.1):
     dependencies:
       debug: 3.2.7
     optionalDependencies:
       '@typescript-eslint/parser': 7.18.0(eslint@8.57.1)(typescript@5.9.3)
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1)
+      eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1)
     transitivePeerDependencies:
       - supports-color
 
@@ -3454,7 +3469,7 @@ snapshots:
       doctrine: 2.1.0
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.10
-      eslint-module-utils: 2.14.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
+      eslint-module-utils: 2.14.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@7.18.0(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1))(eslint@8.57.1))(eslint@8.57.1)
       hasown: 2.0.4
       is-core-module: 2.16.2
       is-glob: 4.0.3
@@ -4252,6 +4267,8 @@ snapshots:
 
   punycode@2.3.1: {}
 
+  qr@0.7.0: {}
+
   queue-microtask@1.2.3: {}
 
   react-dom@18.3.1(react@18.3.1):

From 78755903ae6675bc44c15de455f7b9836d47bc91 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sat, 26 Sep 2026 11:14:29 -0500
Subject: [PATCH 2/9] test(web): live limited-key sign-in and identity creation
 on moutai

v2-auth.spec.ts: a1 imports an identity file and checks from Node that the new key is live, HIGH, bound to the dash-forge group with a 0.05 DASH budget and a ~90-day expiry, that localStorage holds no key, and that the vault unlocks after a reload. a2 creates an identity in the browser, funding the deposit from the devnet faucet key through mint-identity's fundFromKey. The write specs now sign in through the import ceremony.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 forge-web/app/settings/page.tsx |   2 +-
 forge-web/e2e/helpers.ts        |  36 +++++++++-
 forge-web/e2e/v2-auth.spec.ts   | 120 ++++++++++++++++++++++++++++++++
 forge-web/e2e/v2-writes.spec.ts |  27 ++-----
 4 files changed, 163 insertions(+), 22 deletions(-)
 create mode 100644 forge-web/e2e/v2-auth.spec.ts

diff --git a/forge-web/app/settings/page.tsx b/forge-web/app/settings/page.tsx
index 1bc51e426..daab454be 100644
--- a/forge-web/app/settings/page.tsx
+++ b/forge-web/app/settings/page.tsx
@@ -50,7 +50,7 @@ export default function SettingsPage(): JSX.Element {
           </div>
           <div className="mt-3 flex items-center justify-between gap-3 border-t border-anvil-100 pt-3 dark:border-anvil-850">
             <span className="text-dense text-anvil-500 dark:text-anvil-400">Identity ID</span>
-            <Oid value={identity} chars={12} label="identity id" />
+            <span data-testid="settings-identity" data-identity={identity}><Oid value={identity} chars={12} label="identity id" /></span>
           </div>
         </section>
 
diff --git a/forge-web/e2e/helpers.ts b/forge-web/e2e/helpers.ts
index 1c623bda2..b10627018 100644
--- a/forge-web/e2e/helpers.ts
+++ b/forge-web/e2e/helpers.ts
@@ -1,5 +1,6 @@
 import AxeBuilder from '@axe-core/playwright'
-import { type Page, type ConsoleMessage } from '@playwright/test'
+import { expect, type Browser, type Page, type ConsoleMessage } from '@playwright/test'
+import { homedir } from 'node:os'
 import { mkdirSync } from 'node:fs'
 import { join } from 'node:path'
 
@@ -137,3 +138,36 @@ export async function runAxe(page: import('@playwright/test').Page, label: strin
 
   return seriousOrCritical
 }
+
+/** A devnet test identity file (~/.config/dash-forge/test-identities/devnet-<name>/). */
+export function idFile(name: string): string {
+  return join(homedir(), '.config/dash-forge/test-identities', `devnet-${E2E_DEVNET}`, `${name}.identity.json`)
+}
+
+export const PASSPHRASE = 'e2e passphrase for the vault'
+
+/**
+ * A fresh browser context signed in as `name`: the identity file is imported once — its master
+ * key registers a limited key for this browser, which the vault keeps under a passphrase.
+ */
+export async function signedIn(browser: Browser, name: string, path = '/'): Promise<Page> {
+  const context = await browser.newContext()
+  const page = await context.newPage()
+  await page.goto(path, { waitUntil: 'domcontentloaded' })
+  await page.getByRole('button', { name: /^sign in$/i }).first().click()
+  await page.getByTestId('tile-import').click()
+  await page.setInputFiles('input[type="file"]', idFile(name))
+  await page.getByLabel('Passphrase', { exact: true }).fill(PASSPHRASE)
+  await page.getByLabel('Repeat passphrase').fill(PASSPHRASE)
+  await page.getByRole('button', { name: /create this browser's key/i }).click()
+  await expect(page.getByTestId('funds-pill')).toBeVisible({ timeout: 120_000 })
+  return page
+}
+
+/** After a reload: unlock the vault this context already holds. */
+export async function unlock(page: Page): Promise<void> {
+  await page.getByRole('button', { name: /^sign in$/i }).first().click()
+  await page.getByLabel('Passphrase', { exact: true }).fill(PASSPHRASE)
+  await page.getByRole('button', { name: /^unlock$/i }).click()
+  await expect(page.getByTestId('funds-pill')).toBeVisible({ timeout: 60_000 })
+}
diff --git a/forge-web/e2e/v2-auth.spec.ts b/forge-web/e2e/v2-auth.spec.ts
new file mode 100644
index 000000000..aaff9bca0
--- /dev/null
+++ b/forge-web/e2e/v2-auth.spec.ts
@@ -0,0 +1,120 @@
+import { test, expect } from '@playwright/test'
+import { existsSync, readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { E2E_DEVNET, PASSPHRASE, idFile, shot, signedIn, unlock } from './helpers'
+
+/**
+ * Limited-key sign-in, live on a devnet (real spend):
+ *
+ *   E2E_DEVNET=moutai E2E_WRITE=1 pnpm exec playwright test v2-auth.spec.ts
+ *
+ * a1. Import an identity file: the master key registers a limited key for this browser; the
+ *     spec then reads the identity from Platform itself and checks the key is live, HIGH,
+ *     bound to the dash-forge contract group, with the default budget (0.05 DASH) and expiry
+ *     (~90 days). The vault survives a reload and unlocks with the passphrase; nothing that
+ *     looks like a private key sits in localStorage.
+ * a2. Create an identity in the browser: words, quiz, passphrase, deposit address — which the
+ *     harness funds from the devnet faucet key (FORGE_DEVNET_FUNDING_KEY_FILE, a
+ *     dash-network-configs devnet YAML; tools/mint-identity `fundFromKey`) — then the asset
+ *     lock, its chain-lock proof and the IdentityCreate. Skipped without a funding key.
+ */
+
+test.skip(E2E_DEVNET === '' || process.env['E2E_WRITE'] !== '1', 'live devnet writes: set E2E_DEVNET=moutai E2E_WRITE=1')
+test.skip(!existsSync(idFile('CI-RUNNER')), 'devnet test identities not found')
+test.describe.configure({ mode: 'serial', timeout: 30 * 60_000 })
+
+const ROOT = resolve(__dirname, '../..')
+const GROUP = '23iVLZABbVQ5a4heSa6GLVbVqSWr74JTSESSMTEYNd6o'
+
+/** Read an identity's keys straight from Platform (evo-sdk in Node), independent of the app. */
+async function onChainKeys(identityId: string): Promise<{ id: number; level: string; budget: bigint | null; expiresAt: number | null; bound: string | null; remaining: bigint | null }[]> {
+  const evo = await import(pathToFileURL(join(ROOT, 'forge-web/node_modules/@dashevo/evo-sdk/dist/evo-sdk.module.js')).href)
+  const dep = (await import(pathToFileURL(join(ROOT, `forge-contracts/deployments/devnet-${E2E_DEVNET}.json`)).href, { with: { type: 'json' } })).default
+  const sdk = new evo.EvoSDK({ network: 'devnet', trusted: true, devnetName: E2E_DEVNET, addresses: dep.dapiAddresses })
+  await sdk.connect()
+  const identity = await sdk.identities.fetch(identityId)
+  const keys = identity.publicKeys as { keyId: number; securityLevel: string; totalBudget?: bigint; expiresAt?: bigint; contractBounds?: { toJSON(): { id: string } } }[]
+  const budgets = await sdk.identities.keysRemainingBudgets(identityId, keys.map((k) => k.keyId))
+  return keys.map((k) => ({
+    id: k.keyId,
+    level: String(k.securityLevel).toUpperCase(),
+    budget: k.totalBudget ?? null,
+    expiresAt: k.expiresAt === undefined ? null : Number(k.expiresAt),
+    bound: k.contractBounds?.toJSON().id ?? null,
+    remaining: budgets.get(k.keyId) ?? null,
+  }))
+}
+
+test('a1. import once: a limited key lands on chain, the vault survives a reload', async ({ browser }) => {
+  const identityId = String(JSON.parse(readFileSync(idFile('CI-RUNNER'), 'utf8')).identityId)
+  const before = await onChainKeys(identityId)
+  const page = await signedIn(browser, 'CI-RUNNER', '/settings/')
+  await expect(page.getByTestId('key-budget')).toContainText('0.05 DASH', { timeout: 30_000 })
+  await shot(page, 'v2a-01-settings-key')
+
+  const after = await onChainKeys(identityId)
+  const added = after.filter((k) => !before.some((b) => b.id === k.id))
+  expect(added).toHaveLength(1)
+  const key = added[0]!
+  expect(key.level).toBe('HIGH')
+  expect(key.bound).toBe(GROUP)
+  expect(key.budget).toBe(5_000_000_000n)
+  expect(key.remaining).toBe(5_000_000_000n)
+  const days = ((key.expiresAt ?? 0) - Date.now()) / 86_400_000
+  expect(days).toBeGreaterThan(89)
+  expect(days).toBeLessThan(91)
+
+  // Nothing key-like is left in localStorage; the vault holds only ciphertext.
+  const ls = await page.evaluate(() => Object.entries(localStorage).map(([k, v]) => `${k}=${v}`).join('\n'))
+  expect(ls).not.toMatch(/forge_key_/)
+  expect(ls).not.toMatch(/\bc[1-9A-HJ-NP-Za-km-z]{51}\b/)
+
+  await page.reload({ waitUntil: 'domcontentloaded' })
+  await unlock(page)
+  await expect(page.getByTestId('funds-pill')).toBeVisible()
+})
+
+test('a2. create an identity in the browser, funded from the devnet key', async ({ browser }) => {
+  const keyFile = process.env['FORGE_DEVNET_FUNDING_KEY_FILE'] ?? ''
+  test.skip(keyFile === '' || !existsSync(keyFile), 'set FORGE_DEVNET_FUNDING_KEY_FILE to a devnet YAML with faucet_privkey')
+  const funding = await import(pathToFileURL(join(ROOT, 'tools/mint-identity/src/funding.mjs')).href)
+  const config = await import(pathToFileURL(join(ROOT, 'tools/mint-identity/src/config.mjs')).href)
+  const network = config.devnetConfig(E2E_DEVNET)
+
+  const context = await browser.newContext()
+  const page = await context.newPage()
+  await page.goto('/', { waitUntil: 'domcontentloaded' })
+  await page.getByRole('button', { name: /^sign in$/i }).first().click()
+  await page.getByTestId('tile-create').click()
+  const words = page.getByTestId('mnemonic-words')
+  await expect(words).toBeVisible({ timeout: 60_000 })
+  const list = await words.locator('[data-word]').allInnerTexts()
+  expect(list).toHaveLength(12)
+  await shot(page, 'v2a-02-words')
+  await page.getByRole('button', { name: /i wrote them down/i }).click()
+  for (const input of await page.getByLabel(/^Word \d+$/).all()) {
+    const n = Number((await input.getAttribute('id'))?.replace('quiz-', ''))
+    await input.fill(list[n] ?? '')
+  }
+  await page.getByRole('button', { name: /^continue$/i }).click()
+  await page.getByLabel('Passphrase', { exact: true }).fill(PASSPHRASE)
+  await page.getByLabel('Repeat passphrase').fill(PASSPHRASE)
+  await page.getByRole('button', { name: /continue to funding/i }).click()
+
+  const address = (await page.getByTestId('deposit-address').textContent({ timeout: 60_000 }))?.trim() ?? ''
+  expect(address).toMatch(/^y[1-9A-HJ-NP-Za-km-z]{33}$/)
+  await shot(page, 'v2a-03-deposit')
+  const fundingKey = funding.loadFundingKey(network, { keyFile })
+  const fundTx = await funding.fundFromKey(fundingKey, [{ address, duffs: 3_000_000 }], network, () => undefined)
+  test.info().annotations.push({ type: 'funding', description: `${fundTx} → ${address} (0.03 DASH)` })
+
+  // Chain-lock proofs on a devnet wait for a mined, chain-locked block: minutes.
+  await expect(page.getByTestId('funds-pill')).toBeVisible({ timeout: 25 * 60_000 })
+  await page.goto('/settings/', { waitUntil: 'domcontentloaded' })
+  await unlock(page)
+  await expect(page.getByTestId('key-budget')).toContainText('0.05 DASH', { timeout: 30_000 })
+  const identityId = await page.getByTestId('settings-identity').getAttribute('data-identity')
+  test.info().annotations.push({ type: 'identity', description: identityId ?? '' })
+  await shot(page, 'v2a-04-created')
+})
diff --git a/forge-web/e2e/v2-writes.spec.ts b/forge-web/e2e/v2-writes.spec.ts
index 14871b720..64afb7b9d 100644
--- a/forge-web/e2e/v2-writes.spec.ts
+++ b/forge-web/e2e/v2-writes.spec.ts
@@ -1,8 +1,6 @@
-import { test, expect, type Browser, type Page } from '@playwright/test'
+import { test, expect, type Page } from '@playwright/test'
 import { existsSync } from 'node:fs'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-import { E2E_DEVNET, shot } from './helpers'
+import { E2E_DEVNET, idFile, shot, signedIn, unlock } from './helpers'
 
 /**
  * forge-v2 WRITES, live on a devnet (real spend, a few thousandths of a DASH per run):
@@ -17,28 +15,15 @@ import { E2E_DEVNET, shot } from './helpers'
  * its cost preview, and the spend ledger in /settings records it.
  */
 
-const ID_DIR = join(homedir(), '.config/dash-forge/test-identities', `devnet-${E2E_DEVNET}`)
-const idFile = (name: string): string => join(ID_DIR, `${name}.identity.json`)
 const OWNER = '9r27eDsuXEqoMNymW1A2MKFrpBhzSkepVKwXrGzq9dUD'
 const COLLAB = '6jAyDGGcc6fgA7bsraQPriTAZ73Lkq5QgnenaRhqteHd'
 const REPO = `e2e-${Date.now().toString(36)}`
 const ISSUE_TITLE = `Browser-written issue ${REPO}`
 
 test.skip(E2E_DEVNET === '' || process.env['E2E_WRITE'] !== '1', 'live devnet writes: set E2E_DEVNET=moutai E2E_WRITE=1')
-test.skip(!existsSync(idFile('OWNER')), `test identities not found in ${ID_DIR}`)
+test.skip(!existsSync(idFile('OWNER')), 'devnet test identities not found')
 test.describe.configure({ mode: 'serial', timeout: 240_000 })
 
-/** A fresh browser context signed in as `name` (identity-file import). */
-async function signedIn(browser: Browser, name: string, path = '/'): Promise<Page> {
-  const context = await browser.newContext()
-  const page = await context.newPage()
-  await page.goto(path, { waitUntil: 'domcontentloaded' })
-  await page.getByRole('button', { name: /^sign in$/i }).first().click()
-  await page.setInputFiles('input[type="file"]', idFile(name))
-  await expect(page.getByTestId('funds-pill')).toBeVisible({ timeout: 90_000 })
-  return page
-}
-
 /** Confirm the open dialog: it must show a cost, then report success and close. */
 async function confirmWrite(page: Page, label: RegExp): Promise<void> {
   const dialog = page.getByRole('dialog')
@@ -121,8 +106,10 @@ test('w6. owner approves the fixture PR, then removes the writer', async ({ brow
   await confirmWrite(page, /submit review/i)
   await expect(page.getByRole('region', { name: 'Approvals' })).toBeVisible()
 
-  // A full navigation starts a new session (this PR keeps the old keystore): sign in again.
-  const settings = await signedIn(browser, 'OWNER', repoPath('settings'))
+  // A full navigation locks the key; the vault unlocks it again with the passphrase.
+  const settings = page
+  await settings.goto(repoPath('settings'), { waitUntil: 'domcontentloaded' })
+  await unlock(settings)
   await settings.getByRole('button', { name: /^remove$/i }).first().click()
   await confirmWrite(settings, /sign & remove/i)
   await expect(settings.getByText('WRITER', { exact: true })).toHaveCount(0, { timeout: 60_000 })

From 922329241993b10060f9fbf1b73e218f245db09c Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sat, 26 Sep 2026 11:28:39 -0500
Subject: [PATCH 3/9] fix(web): sign-in flows connect the SDK themselves

The create-identity and wallet flows can start before any page connected (from the landing page); they used getSdk() and failed with 'EvoSDK not initialized' after the deposit arrived. ensureSdk(network) connects on demand. Live on moutai the whole create flow now passes: words, quiz, passphrase, deposit funded from the devnet key, chain-lock proof, IdentityCreate with the limited key, in 4.3 minutes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 forge-web/components/auth/create-identity-flow.tsx |  4 ++--
 forge-web/components/auth/wallet-connect-flow.tsx  |  4 ++--
 forge-web/components/login-modal.tsx               |  7 +++----
 forge-web/contexts/auth-context.tsx                | 11 +----------
 forge-web/lib/sdk/index.ts                         |  2 +-
 forge-web/lib/sdk/service.ts                       | 13 +++++++++++++
 6 files changed, 22 insertions(+), 19 deletions(-)

diff --git a/forge-web/components/auth/create-identity-flow.tsx b/forge-web/components/auth/create-identity-flow.tsx
index 805c3ef4a..95c849504 100644
--- a/forge-web/components/auth/create-identity-flow.tsx
+++ b/forge-web/components/auth/create-identity-flow.tsx
@@ -78,13 +78,13 @@ export function CreateIdentityFlow({ onDone }: { onDone: () => void }): JSX.Elem
     setError(null)
     const controller = new AbortController()
     try {
-      const { evoSdkService } = await import('@/lib/sdk')
+      const { ensureSdk } = await import('@/lib/sdk')
       const { createIdentityFromMnemonic, depositAddressOf, MIN_DEPOSIT_DUFFS } = await import('@/lib/auth/create-identity')
       const v2 = ACTIVE_NETWORK.v2
       if (!v2) throw new Error('forge-v2 is not deployed here')
       setAddress(await depositAddressOf(m, DEFAULT_NETWORK))
       setStep('fund')
-      const { identityId, key } = await createIdentityFromMnemonic(evoSdkService.getSdk(), {
+      const { identityId, key } = await createIdentityFromMnemonic(await ensureSdk(DEFAULT_NETWORK), {
         network: DEFAULT_NETWORK,
         mnemonic: m,
         group: v2.group,
diff --git a/forge-web/components/auth/wallet-connect-flow.tsx b/forge-web/components/auth/wallet-connect-flow.tsx
index 125f3998b..4e1ce4596 100644
--- a/forge-web/components/auth/wallet-connect-flow.tsx
+++ b/forge-web/components/auth/wallet-connect-flow.tsx
@@ -34,12 +34,12 @@ export function WalletConnectFlow({ onDone }: { onDone: () => void }): JSX.Eleme
       try {
         const v2 = ACTIVE_NETWORK.v2
         if (!v2) throw new Error('forge-v2 is not deployed here')
-        const { evoSdkService } = await import('@/lib/sdk')
+        const { ensureSdk } = await import('@/lib/sdk')
         const { newRequest, awaitWalletLogin } = await import('@/lib/auth/app-connect')
         const req = newRequest(DEFAULT_NETWORK, v2.core)
         setUri(req.uri)
         setPairing(req.pairingCode)
-        const login = await awaitWalletLogin(evoSdkService.getSdk(), req, { network: DEFAULT_NETWORK, group: v2.group, signal: controller.signal })
+        const login = await awaitWalletLogin(await ensureSdk(DEFAULT_NETWORK), req, { network: DEFAULT_NETWORK, group: v2.group, signal: controller.signal })
         setGranted({ identityId: login.identityId, key: { keyId: login.keyId, wif: login.wif, limits: login.limits } })
       } catch (e) {
         if (!controller.signal.aborted) setError(errorMessage(e))
diff --git a/forge-web/components/login-modal.tsx b/forge-web/components/login-modal.tsx
index 6d8ac0b2a..7c0a7f78e 100644
--- a/forge-web/components/login-modal.tsx
+++ b/forge-web/components/login-modal.tsx
@@ -25,7 +25,7 @@ import { Field, Input, Textarea } from '@/components/ui/input'
 import { useProtection } from '@/components/auth/protection-fields'
 import { CreateIdentityFlow } from '@/components/auth/create-identity-flow'
 import { WalletConnectFlow } from '@/components/auth/wallet-connect-flow'
-import { ACTIVE_NETWORK } from '@/lib/constants'
+import { ACTIVE_NETWORK, DEFAULT_NETWORK } from '@/lib/constants'
 import { BROWSER_KEY_DEFAULTS, parseIdentityFileText } from '@/lib/auth'
 import { formatDate } from '@/lib/view/format'
 import { cn, errorMessage } from '@/lib/utils'
@@ -132,10 +132,9 @@ function useWalletAvailability(): { limitedKeys: boolean; walletAvailable: boole
     if (!limitedKeys) return
     let cancelled = false
     void (async () => {
-      const { evoSdkService } = await import('@/lib/sdk')
+      const { ensureSdk } = await import('@/lib/sdk')
       const { appConnectAvailable } = await import('@/lib/auth/app-connect')
-      if (!evoSdkService.isReady) return
-      const ok = await appConnectAvailable(evoSdkService.getSdk())
+      const ok = await appConnectAvailable(await ensureSdk(DEFAULT_NETWORK)).catch(() => false)
       if (!cancelled) setAvailable(ok)
     })()
     return () => {
diff --git a/forge-web/contexts/auth-context.tsx b/forge-web/contexts/auth-context.tsx
index 74c4d7dda..806736145 100644
--- a/forge-web/contexts/auth-context.tsx
+++ b/forge-web/contexts/auth-context.tsx
@@ -14,20 +14,11 @@ import type { EvoSDK } from '@dashevo/evo-sdk'
 
 import { AuthController, type AuthSession, type LimitedKey, type LimitedKeyRequest, type Protection, type VaultInfo } from '../lib/auth'
 import { DEFAULT_NETWORK, NETWORKS, type Network } from '../lib/constants'
-import { evoSdkService, type SpendEvent, type WriteAuth } from '../lib/sdk'
+import { ensureSdk, type SpendEvent, type WriteAuth } from '../lib/sdk'
 import { recordSpend } from '../lib/spend'
 import { fundsState, type FundsState, type KeyLimits } from '../lib/view/funds'
 import { toast } from '../hooks/use-toasts'
 
-async function ensureSdk(network: Network): Promise<EvoSDK> {
-  const { registryContractId, dpnsContractId, v2 } = NETWORKS[network]
-  const contractIds = [registryContractId, dpnsContractId, v2?.core, v2?.collab].filter(
-    (id): id is string => typeof id === 'string' && id.length > 0,
-  )
-  await evoSdkService.initialize({ network, contractIds, timeoutMs: 15000 })
-  return evoSdkService.getSdk()
-}
-
 /** A write kind (`create:issue`) → the toast title. */
 const SPEND_TITLES: Readonly<Record<string, string>> = {
   'create:repo': 'Repository created',
diff --git a/forge-web/lib/sdk/index.ts b/forge-web/lib/sdk/index.ts
index 02c298cd0..44cb5e2f2 100644
--- a/forge-web/lib/sdk/index.ts
+++ b/forge-web/lib/sdk/index.ts
@@ -6,7 +6,7 @@
  * completeness fallback (S0.8) that active-repo correctness depends on.
  */
 
-export { evoSdkService, type EvoSdkConfig } from './service'
+export { ensureSdk, evoSdkService, type EvoSdkConfig } from './service'
 export {
   ConsensusRefusal,
   DUPLICATE_UNIQUE_CODE,
diff --git a/forge-web/lib/sdk/service.ts b/forge-web/lib/sdk/service.ts
index 2050a65cb..c7f6825df 100644
--- a/forge-web/lib/sdk/service.ts
+++ b/forge-web/lib/sdk/service.ts
@@ -175,3 +175,16 @@ class EvoSdkService {
 
 /** The process-wide evo-sdk service singleton. */
 export const evoSdkService = new EvoSdkService()
+
+/**
+ * The connected SDK for `network`, connecting first if needed (the registry, DPNS and forge-v2
+ * contracts preloaded). Flows that start before any page has connected (sign-in) use this.
+ */
+export async function ensureSdk(network: Network): Promise<EvoSDK> {
+  const { registryContractId, dpnsContractId, v2 } = NETWORKS[network]
+  const contractIds = [registryContractId, dpnsContractId, v2?.core, v2?.collab].filter(
+    (id): id is string => typeof id === 'string' && id.length > 0,
+  )
+  await evoSdkService.initialize({ network, contractIds, timeoutMs: 15000 })
+  return evoSdkService.getSdk()
+}

From 3328743e332b62f4dd4dea1d55ce711d08815d82 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sat, 26 Sep 2026 11:55:21 -0500
Subject: [PATCH 4/9] fix(web): address the sign-in correctness review

Identity creation stores the browser key in the vault before IdentityCreate, saves the signed asset lock before broadcasting it, re-registers a key from the mnemonic when the identity already exists, and clears the journal only after the session opens; unfinished creations can be discarded (with a warning if the deposit holds funds); one run at a time, aborted on unmount; a wrong phrase is caught before any QR. Passkeys get a random user id. Forget acts on the selected key with a confirmation; the auto-lock ends the session; Renew opens Import directly; a key stored but not opened says so; wallet responses that fail verification are retried. Renewal disables the previous key in the same update; the sheet offers Unlock for an identity already stored; the file network check is back. One typed SDK facade and shared sheet pieces. e2e reuses one stored key per identity instead of registering a key per test.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 forge-web/app/login/page.tsx                  |   2 +-
 forge-web/app/new/page.tsx                    |   2 +-
 forge-web/app/settings/page.tsx               |   2 +-
 forge-web/components/app-header.tsx           |   2 +-
 .../components/auth/create-identity-flow.tsx  | 199 +++++++++-----
 .../components/auth/protection-fields.tsx     |  14 +-
 .../components/auth/wallet-connect-flow.tsx   |  34 ++-
 forge-web/components/keys-panel.tsx           |  25 +-
 forge-web/components/login-modal.tsx          | 260 +++++++++++-------
 forge-web/components/top-up-sheet.tsx         |  21 +-
 forge-web/contexts/auth-context.tsx           |  76 +++--
 forge-web/e2e/helpers.ts                      |  44 ++-
 forge-web/e2e/v2-auth.spec.ts                 |   6 +-
 forge-web/hooks/use-ui-store.ts               |  12 +-
 forge-web/lib/auth/app-connect.ts             |  49 ++--
 forge-web/lib/auth/asset-lock.ts              |  15 +-
 forge-web/lib/auth/controller.ts              | 148 +++++++---
 forge-web/lib/auth/create-identity.ts         | 131 +++++----
 forge-web/lib/auth/identity-file.ts           |  47 ++--
 forge-web/lib/auth/limited-key.ts             |  53 ++--
 forge-web/lib/auth/vault.ts                   |  19 +-
 forge-web/lib/sdk/facade.ts                   |  67 +++++
 22 files changed, 784 insertions(+), 444 deletions(-)
 create mode 100644 forge-web/lib/sdk/facade.ts

diff --git a/forge-web/app/login/page.tsx b/forge-web/app/login/page.tsx
index dd24c5765..e229bc828 100644
--- a/forge-web/app/login/page.tsx
+++ b/forge-web/app/login/page.tsx
@@ -38,7 +38,7 @@ export default function LoginPage(): JSX.Element {
           icon={KeyRound}
           title="Sign in to Dash Forge"
           body="Import an identity file or paste a key + id. Read-only browsing works without signing in."
-          action={<Button variant="primary" onClick={openLogin}>Open sign-in</Button>}
+          action={<Button variant="primary" onClick={() => openLogin()}>Open sign-in</Button>}
         />
       )}
     </AppShell>
diff --git a/forge-web/app/new/page.tsx b/forge-web/app/new/page.tsx
index bfa9a8196..c3c51af0a 100644
--- a/forge-web/app/new/page.tsx
+++ b/forge-web/app/new/page.tsx
@@ -141,7 +141,7 @@ export default function NewRepoPage(): JSX.Element {
           icon={Lock}
           title="Sign in to forge a repo"
           body="Creating a repo writes three small documents signed by your identity."
-          action={<Button variant="primary" onClick={openLogin}>Sign in</Button>}
+          action={<Button variant="primary" onClick={() => openLogin()}>Sign in</Button>}
         />
       </AppShell>
     )
diff --git a/forge-web/app/settings/page.tsx b/forge-web/app/settings/page.tsx
index daab454be..a8f17feb1 100644
--- a/forge-web/app/settings/page.tsx
+++ b/forge-web/app/settings/page.tsx
@@ -29,7 +29,7 @@ export default function SettingsPage(): JSX.Element {
           icon={Wallet}
           title="Not signed in"
           body="Sign in to see your balance and account settings."
-          action={<Button variant="primary" onClick={openLogin}>Sign in</Button>}
+          action={<Button variant="primary" onClick={() => openLogin()}>Sign in</Button>}
         />
       </AppShell>
     )
diff --git a/forge-web/components/app-header.tsx b/forge-web/components/app-header.tsx
index c62c12064..ffbd4c902 100644
--- a/forge-web/components/app-header.tsx
+++ b/forge-web/components/app-header.tsx
@@ -73,7 +73,7 @@ export function AppHeader(): JSX.Element {
               <AccountMenu identity={identity} balance={balance} onLogout={logout} />
             </>
           ) : (
-            <Button variant="primary" size="sm" onClick={openLogin}>
+            <Button variant="primary" size="sm" onClick={() => openLogin()}>
               Sign in
             </Button>
           )}
diff --git a/forge-web/components/auth/create-identity-flow.tsx b/forge-web/components/auth/create-identity-flow.tsx
index 95c849504..08250f548 100644
--- a/forge-web/components/auth/create-identity-flow.tsx
+++ b/forge-web/components/auth/create-identity-flow.tsx
@@ -7,24 +7,42 @@
  *   3. how to protect this browser's key (passkey / passphrase);
  *   4. the deposit QR + address (any Dash wallet; the faucet on dev networks), watched through
  *      the block explorer; then the asset lock, its proof, and one IdentityCreate that also
- *      registers this browser's limited key.
- * A closed tab resumes from step 4 once the same words are typed in again.
+ *      registers this browser's limited key — stored in the vault before it is registered.
+ * A closed tab resumes from step 4 once the same words are typed in again; an unfinished
+ * creation can be discarded (after a warning when its deposit address holds funds).
+ *
+ * One run at a time: the run's AbortController lives in a ref, is aborted when the sheet
+ * unmounts, and the buttons are disabled while a run is active.
  */
 
-import { useEffect, useMemo, useState } from 'react'
+import { useEffect, useMemo, useRef, useState } from 'react'
 import { AlertTriangle, Check, Loader2 } from 'lucide-react'
 import { useAuth } from '@/contexts/auth-context'
 import { Button } from '@/components/ui/button'
 import { Field, Input, Textarea } from '@/components/ui/input'
 import { Qr } from '@/components/ui/qr'
-import { useProtection } from '@/components/auth/protection-fields'
+import { ErrorBox, useProtection } from '@/components/auth/protection-fields'
 import { faucetUrl } from '@/components/top-up-sheet'
-import { ACTIVE_NETWORK, DEFAULT_NETWORK } from '@/lib/constants'
+import { ACTIVE_NETWORK } from '@/lib/constants'
+import { ensureSdk } from '@/lib/sdk'
+import { isAbort } from '@/lib/sdk/facade'
+import { coreEndpoints } from '@/lib/auth/asset-lock'
+import {
+  clearCreationJournal,
+  createIdentityFromMnemonic,
+  depositAddressOf,
+  depositBalance,
+  readCreationJournal,
+  MIN_DEPOSIT_DUFFS,
+  type CreateStage,
+  type CreationJournal,
+} from '@/lib/auth/create-identity'
+import { isValidMnemonic, newMnemonic, normalizeMnemonic, quizPositions } from '@/lib/auth/hd'
 import { errorMessage } from '@/lib/utils'
 
-type Step = 'words' | 'quiz' | 'protect' | 'fund' | 'resume'
+type Step = 'loading' | 'words' | 'quiz' | 'protect' | 'fund' | 'resume'
 
-const STAGE_TEXT: Readonly<Record<string, string>> = {
+const STAGE_TEXT: Readonly<Record<CreateStage, string>> = {
   'waiting-deposit': 'Watching for your deposit…',
   locking: 'Locking the deposit for Platform…',
   proving: 'Waiting for the lock to be provable…',
@@ -33,74 +51,128 @@ const STAGE_TEXT: Readonly<Record<string, string>> = {
 }
 
 export function CreateIdentityFlow({ onDone }: { onDone: () => void }): JSX.Element {
-  const { adoptLimitedKey } = useAuth()
-  const [step, setStep] = useState<Step>('words')
+  const { controller, reloadVaults } = useAuth()
+  const network = ACTIVE_NETWORK.network
+  const [step, setStep] = useState<Step>('loading')
   const [mnemonic, setMnemonic] = useState<string | null>(null)
   const [positions, setPositions] = useState<number[]>([])
   const [answers, setAnswers] = useState<string[]>(['', '', ''])
+  const [journal, setJournal] = useState<CreationJournal | null>(null)
   const [address, setAddress] = useState<string | null>(null)
   const [stage, setStage] = useState<string | null>(null)
   const [seen, setSeen] = useState(0)
   const [error, setError] = useState<string | null>(null)
+  const [running, setRunning] = useState(false)
   const [resumeWords, setResumeWords] = useState('')
-  const { fields, protection, problem } = useProtection('new identity')
+  const [discardWarning, setDiscardWarning] = useState<string | null>(null)
+  const { fields, protection, problem } = useProtection()
   const words = useMemo(() => mnemonic?.split(' ') ?? [], [mnemonic])
+  const run = useRef<AbortController | null>(null)
 
   useEffect(() => {
     let cancelled = false
     void (async () => {
-      const { readCreationJournal } = await import('@/lib/auth/create-identity')
-      const j = await readCreationJournal(DEFAULT_NETWORK)
+      const j = await readCreationJournal(network)
       if (cancelled) return
       if (j) {
+        setJournal(j)
         setAddress(j.depositAddress)
         setStep('resume')
         return
       }
-      const { newMnemonic, quizPositions } = await import('@/lib/auth/hd')
       const m = await newMnemonic()
       if (cancelled) return
       setMnemonic(m)
       setPositions(quizPositions(12, 3))
+      setStep('words')
     })()
     return () => {
       cancelled = true
+      run.current?.abort()
     }
-  }, [])
-
-  // Forget the words when the flow closes.
-  useEffect(() => () => setMnemonic(null), [])
+  }, [network])
 
   const quizOk = positions.length === 3 && positions.every((p, i) => (answers[i] ?? '').trim().toLowerCase() === words[p])
 
-  const run = async (m: string): Promise<void> => {
-    if (!protection) return
+  const start = async (phrase: string): Promise<void> => {
+    if (!protection || running) return
     setError(null)
-    const controller = new AbortController()
+    const m = normalizeMnemonic(phrase)
+    if (!(await isValidMnemonic(m))) {
+      setError('Those words are not a valid recovery phrase.')
+      return
+    }
+    const deposit = await depositAddressOf(m, network)
+    if (journal && journal.depositAddress !== deposit) {
+      setError('These words do not match the creation in progress on this device.')
+      return
+    }
+    const v2 = ACTIVE_NETWORK.v2
+    if (!v2) {
+      setError('forge-v2 is not deployed here.')
+      return
+    }
+    const controllerRun = new AbortController()
+    run.current = controllerRun
+    setRunning(true)
+    setAddress(deposit)
+    setStep('fund')
+    setResumeWords('')
     try {
-      const { ensureSdk } = await import('@/lib/sdk')
-      const { createIdentityFromMnemonic, depositAddressOf, MIN_DEPOSIT_DUFFS } = await import('@/lib/auth/create-identity')
-      const v2 = ACTIVE_NETWORK.v2
-      if (!v2) throw new Error('forge-v2 is not deployed here')
-      setAddress(await depositAddressOf(m, DEFAULT_NETWORK))
-      setStep('fund')
-      const { identityId, key } = await createIdentityFromMnemonic(await ensureSdk(DEFAULT_NETWORK), {
-        network: DEFAULT_NETWORK,
+      const sdk = await ensureSdk(network)
+      const { identityId, key } = await createIdentityFromMnemonic(sdk, {
+        network,
         mnemonic: m,
         group: v2.group,
         minDepositDuffs: MIN_DEPOSIT_DUFFS,
-        signal: controller.signal,
-        onStage: (s, detail) => setStage(detail ?? STAGE_TEXT[s] ?? s),
+        signal: controllerRun.signal,
+        persistKey: (id, k) => controller.persistKey({ identityId: id, keyId: k.keyId, wif: k.wif }, protection),
+        onStage: (s, detail) => setStage(detail ?? STAGE_TEXT[s]),
         onDeposit: setSeen,
       })
-      await adoptLimitedKey(identityId, key, protection)
+      reloadVaults()
+      await controller.openStored(identityId, null, key.limits)
+      await clearCreationJournal(network)
       setMnemonic(null)
       onDone()
     } catch (e) {
-      setError(errorMessage(e))
+      // Never leave an unlocked key in memory without a session.
+      controller.logout()
+      if (!isAbort(e)) setError(errorMessage(e))
+      reloadVaults()
+    } finally {
+      if (run.current === controllerRun) run.current = null
+      setRunning(false)
     }
   }
 
+  const discard = async (): Promise<void> => {
+    if (!journal) return
+    if (discardWarning === null) {
+      const held = await depositBalance(network, journal.depositAddress).catch(() => -1)
+      if (held !== 0) {
+        setDiscardWarning(
+          held > 0
+            ? `The deposit address still holds ${(held / 1e8).toFixed(4)} DASH. Discarding forgets this creation; only your 12 words can recover those funds. Discard anyway?`
+            : "Couldn't check the deposit address for funds. If you sent any, only your 12 words can recover them. Discard anyway?",
+        )
+        return
+      }
+    }
+    run.current?.abort()
+    await clearCreationJournal(network)
+    setJournal(null)
+    setDiscardWarning(null)
+    setResumeWords('')
+    const m = await newMnemonic()
+    setMnemonic(m)
+    setPositions(quizPositions(12, 3))
+    setAnswers(['', '', ''])
+    setStep('words')
+  }
+
+  if (step === 'loading') return <Loader2 className="h-5 w-5 animate-spin text-anvil-400" aria-label="Loading" />
+
   if (step === 'resume') {
     return (
       <div className="space-y-3">
@@ -112,11 +184,20 @@ export function CreateIdentityFlow({ onDone }: { onDone: () => void }): JSX.Elem
           <Textarea id="resume-words" value={resumeWords} onChange={(e) => setResumeWords(e.target.value)} className="min-h-[72px] font-mono" spellCheck={false} autoComplete="off" />
         </Field>
         {fields}
-        <Button variant="primary" className="w-full" disabled={resumeWords.trim().split(/\s+/).length < 12 || protection === null} onClick={() => run(resumeWords)}>
+        <Button
+          variant="primary"
+          className="w-full"
+          loading={running}
+          disabled={running || resumeWords.trim().split(/\s+/).length < 12 || protection === null}
+          onClick={() => start(resumeWords)}
+        >
           Continue
         </Button>
-        {stage ? <p className="text-dense text-anvil-500">{stage}</p> : null}
-        {error ? <p role="alert" className="text-dense text-danger">{error}</p> : null}
+        {discardWarning ? <p className="text-dense text-caution">{discardWarning}</p> : null}
+        <Button variant="ghost" size="sm" disabled={running} onClick={discard}>
+          {discardWarning ? 'Discard anyway' : 'Discard this creation'}
+        </Button>
+        <ErrorBox error={error} />
       </div>
     )
   }
@@ -125,17 +206,13 @@ export function CreateIdentityFlow({ onDone }: { onDone: () => void }): JSX.Elem
     return (
       <div className="space-y-3">
         <p className="text-dense font-medium">Write these 12 words down, in order, on paper.</p>
-        {words.length === 0 ? (
-          <Loader2 className="h-5 w-5 animate-spin text-anvil-400" aria-label="Generating" />
-        ) : (
-          <ol data-testid="mnemonic-words" className="grid grid-cols-3 gap-1.5 rounded-md border border-anvil-200 p-3 font-mono text-dense dark:border-anvil-800">
-            {words.map((w, i) => (
-              <li key={i}>
-                <span className="text-anvil-400">{i + 1}.</span> <span data-word={i}>{w}</span>
-              </li>
-            ))}
-          </ol>
-        )}
+        <ol data-testid="mnemonic-words" className="grid grid-cols-3 gap-1.5 rounded-md border border-anvil-200 p-3 font-mono text-dense dark:border-anvil-800">
+          {words.map((w, i) => (
+            <li key={i}>
+              <span className="text-anvil-400">{i + 1}.</span> <span data-word={i}>{w}</span>
+            </li>
+          ))}
+        </ol>
         <div className="flex gap-2 rounded-md border border-caution/40 bg-caution/5 px-3 py-2 text-dense text-caution">
           <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0" aria-hidden />
           <span>
@@ -181,10 +258,17 @@ export function CreateIdentityFlow({ onDone }: { onDone: () => void }): JSX.Elem
     return (
       <div className="space-y-3">
         {fields}
-        <Button variant="primary" className="w-full" disabled={protection === null || mnemonic === null} onClick={() => mnemonic && run(mnemonic)}>
+        <Button
+          variant="primary"
+          className="w-full"
+          loading={running}
+          disabled={running || protection === null || mnemonic === null}
+          onClick={() => mnemonic && start(mnemonic)}
+        >
           Continue to funding
         </Button>
         {problem ? <p className="text-[12px] text-anvil-500">{problem}</p> : null}
+        <ErrorBox error={error} />
       </div>
     )
   }
@@ -204,7 +288,7 @@ export function CreateIdentityFlow({ onDone }: { onDone: () => void }): JSX.Elem
         </a>
       ) : null}
       <div className="flex items-center gap-2 text-dense text-anvil-600 dark:text-anvil-300" aria-live="polite">
-        {error ? null : <Loader2 className="h-4 w-4 animate-spin" aria-hidden />}
+        {running ? <Loader2 className="h-4 w-4 animate-spin" aria-hidden /> : null}
         <span data-testid="create-stage">{stage ?? STAGE_TEXT['waiting-deposit']}</span>
         {seen > 0 ? (
           <span className="inline-flex items-center gap-1 text-verify">
@@ -213,22 +297,11 @@ export function CreateIdentityFlow({ onDone }: { onDone: () => void }): JSX.Elem
         ) : null}
       </div>
       <p className="text-[12px] text-anvil-500 dark:text-anvil-400">
-        To see your deposit this page asks a Dash block explorer ({new URL(coreHost()).host}). It can delay you but cannot take funds or
-        keys. On {ACTIVE_NETWORK.key} the lock is proven once a block chain-locks it, which can take a few minutes.
+        To see your deposit this page asks a Dash block explorer ({new URL(coreEndpoints(network).insight).host}, changeable in
+        Settings). It can delay you but cannot take funds or keys. On {ACTIVE_NETWORK.key} the lock is proven once a block
+        chain-locks it, which can take a few minutes.
       </p>
-      {error ? (
-        <div role="alert" className="rounded-md border border-danger/30 bg-danger/5 px-3 py-2 text-dense text-danger break-words">
-          {error} — your deposit is safe; reopen this sheet to resume.
-        </div>
-      ) : null}
+      {error ? <ErrorBox error={`${error} — your deposit is recorded on this device; reopen this sheet and type your 12 words to resume.`} /> : null}
     </div>
   )
 }
-
-function coreHost(): string {
-  return ACTIVE_NETWORK.network === 'devnet'
-    ? `https://insight.${ACTIVE_NETWORK.devnetName}.networks.dash.org`
-    : ACTIVE_NETWORK.network === 'testnet'
-      ? 'https://insight.testnet.networks.dash.org'
-      : 'https://insight.dash.org'
-}
diff --git a/forge-web/components/auth/protection-fields.tsx b/forge-web/components/auth/protection-fields.tsx
index 7a66beb64..43e2f6a77 100644
--- a/forge-web/components/auth/protection-fields.tsx
+++ b/forge-web/components/auth/protection-fields.tsx
@@ -14,7 +14,7 @@ import { Button } from '@/components/ui/button'
 import { Field, Input } from '@/components/ui/input'
 import { errorMessage } from '@/lib/utils'
 
-export function useProtection(identityLabel: string): {
+export function useProtection(): {
   readonly fields: JSX.Element
   /** The protection, or null with `problem` set when not ready. */
   readonly protection: Protection | null
@@ -31,7 +31,7 @@ export function useProtection(identityLabel: string): {
     setEnrolling(true)
     setPasskeyError(null)
     try {
-      const p = await enrollPasskey(identityLabel || 'dash-forge', `Dash Forge (${identityLabel.slice(0, 8) || 'identity'})`)
+      const p = await enrollPasskey(`Dash Forge (${new Date().toISOString().slice(0, 10)})`)
       if (p === null) setPasskeyError("This passkey can't protect keys here (no PRF support). Use a passphrase.")
       else setPasskey(p)
     } catch (e) {
@@ -81,3 +81,13 @@ export function useProtection(identityLabel: string): {
   )
   return { fields, protection, problem }
 }
+
+/** An error line in the sign-in sheet (alert role, wraps long SDK messages). */
+export function ErrorBox({ error }: { error: string | null }): JSX.Element | null {
+  if (!error) return null
+  return (
+    <div role="alert" className="mt-3 rounded-md border border-danger/30 bg-danger/5 px-3 py-2 text-dense text-danger break-words">
+      {error}
+    </div>
+  )
+}
diff --git a/forge-web/components/auth/wallet-connect-flow.tsx b/forge-web/components/auth/wallet-connect-flow.tsx
index 4e1ce4596..ca9ca1f9c 100644
--- a/forge-web/components/auth/wallet-connect-flow.tsx
+++ b/forge-web/components/auth/wallet-connect-flow.tsx
@@ -6,43 +6,46 @@
  * (live, HIGH, bound to the dash-forge group, budgeted, expiring), then stores it in the vault.
  */
 
-import { useEffect, useRef, useState } from 'react'
+import { useEffect, useState } from 'react'
 import { Loader2 } from 'lucide-react'
 import { useAuth } from '@/contexts/auth-context'
 import { Button } from '@/components/ui/button'
 import { Qr } from '@/components/ui/qr'
-import { useProtection } from '@/components/auth/protection-fields'
-import { ACTIVE_NETWORK, DEFAULT_NETWORK } from '@/lib/constants'
+import { ErrorBox, useProtection } from '@/components/auth/protection-fields'
+import { ACTIVE_NETWORK } from '@/lib/constants'
 import { BROWSER_KEY_DEFAULTS, type LimitedKey } from '@/lib/auth'
+import { awaitWalletLogin, newRequest } from '@/lib/auth/app-connect'
+import { ensureSdk } from '@/lib/sdk'
+import { isAbort } from '@/lib/sdk/facade'
 import { errorMessage } from '@/lib/utils'
 
 export function WalletConnectFlow({ onDone }: { onDone: () => void }): JSX.Element {
-  const { adoptLimitedKey } = useAuth()
+  const { adoptLimitedKey, isLoading } = useAuth()
   const [uri, setUri] = useState<string | null>(null)
   const [pairing, setPairing] = useState('')
   const [slow, setSlow] = useState(false)
   const [granted, setGranted] = useState<{ identityId: string; key: LimitedKey } | null>(null)
   const [error, setError] = useState<string | null>(null)
-  const { fields, protection, problem } = useProtection(granted?.identityId ?? '')
-  const abort = useRef<AbortController | null>(null)
+  const { fields, protection, problem } = useProtection()
 
   useEffect(() => {
     const controller = new AbortController()
-    abort.current = controller
     const timer = setTimeout(() => setSlow(true), 3 * 60 * 1000)
     void (async () => {
       try {
         const v2 = ACTIVE_NETWORK.v2
         if (!v2) throw new Error('forge-v2 is not deployed here')
-        const { ensureSdk } = await import('@/lib/sdk')
-        const { newRequest, awaitWalletLogin } = await import('@/lib/auth/app-connect')
-        const req = newRequest(DEFAULT_NETWORK, v2.core)
+        const req = newRequest(ACTIVE_NETWORK.network, v2.core)
         setUri(req.uri)
         setPairing(req.pairingCode)
-        const login = await awaitWalletLogin(await ensureSdk(DEFAULT_NETWORK), req, { network: DEFAULT_NETWORK, group: v2.group, signal: controller.signal })
+        const login = await awaitWalletLogin(await ensureSdk(ACTIVE_NETWORK.network), req, {
+          network: ACTIVE_NETWORK.network,
+          group: v2.group,
+          signal: controller.signal,
+        })
         setGranted({ identityId: login.identityId, key: { keyId: login.keyId, wif: login.wif, limits: login.limits } })
       } catch (e) {
-        if (!controller.signal.aborted) setError(errorMessage(e))
+        if (!isAbort(e)) setError(errorMessage(e))
       }
     })()
     return () => {
@@ -61,7 +64,8 @@ export function WalletConnectFlow({ onDone }: { onDone: () => void }): JSX.Eleme
         <Button
           variant="primary"
           className="w-full"
-          disabled={protection === null}
+          loading={isLoading}
+          disabled={protection === null || isLoading}
           onClick={async () => {
             if (!protection) return
             try {
@@ -75,7 +79,7 @@ export function WalletConnectFlow({ onDone }: { onDone: () => void }): JSX.Eleme
           Finish signing in
         </Button>
         {problem ? <p className="text-[12px] text-anvil-500">{problem}</p> : null}
-        {error ? <p role="alert" className="text-dense text-danger">{error}</p> : null}
+        <ErrorBox error={error} />
       </div>
     )
   }
@@ -94,7 +98,7 @@ export function WalletConnectFlow({ onDone }: { onDone: () => void }): JSX.Eleme
       </p>
       {slow ? <p className="text-dense text-caution">No response yet. Keep this tab open, or choose another method.</p> : null}
       <p className="text-[12px] text-anvil-500 dark:text-anvil-400">Needs a wallet with Platform login (App Connect).</p>
-      {error ? <p role="alert" className="text-dense text-danger">{error}</p> : null}
+      <ErrorBox error={error} />
     </div>
   )
 }
diff --git a/forge-web/components/keys-panel.tsx b/forge-web/components/keys-panel.tsx
index b149c65a4..46340c512 100644
--- a/forge-web/components/keys-panel.tsx
+++ b/forge-web/components/keys-panel.tsx
@@ -14,12 +14,17 @@ import { useUiStore } from '@/hooks/use-ui-store'
 import { Button } from '@/components/ui/button'
 import { Field, Input } from '@/components/ui/input'
 import { creditsAsDash, formatDate } from '@/lib/view/format'
+import { INSIGHT_OVERRIDE_KEY } from '@/lib/auth/asset-lock'
+
+/** Shown before deleting a stored key: for a wallet-granted key this is the only copy. */
+export const FORGET_CONFIRM =
+  "Delete this browser's key? You will need your identity file, recovery phrase or wallet to sign in again here. Its budget stays on the identity until it expires."
 
 export function KeysPanel(): JSX.Element {
-  const { keyLimits, storage, funds, logout } = useAuth()
+  const { identity, keyLimits, storage, funds, logout, forget } = useAuth()
   const openLogin = useUiStore((s) => s.openLogin)
   const [explorer, setExplorer] = useState(() =>
-    typeof window === 'undefined' ? '' : window.localStorage.getItem('forge:insight-url') ?? '',
+    typeof window === 'undefined' ? '' : window.localStorage.getItem(INSIGHT_OVERRIDE_KEY) ?? '',
   )
   const low = funds?.reason === 'key-budget' || funds?.reason === 'key-expiry'
 
@@ -47,13 +52,19 @@ export function KeysPanel(): JSX.Element {
         <p className="text-caution">This browser&apos;s key is nearly used up. Renew it (uses your master key once).</p>
       ) : null}
       <div className="flex flex-wrap gap-2">
-        <Button variant="outline" size="sm" onClick={openLogin}>
+        <Button variant="outline" size="sm" onClick={() => openLogin('import')}>
           <RefreshCw className="h-3.5 w-3.5" aria-hidden /> Renew key
         </Button>
-        <Button variant="outline" size="sm" onClick={() => logout(false)}>
+        <Button variant="outline" size="sm" onClick={() => logout()}>
           <Lock className="h-3.5 w-3.5" aria-hidden /> Lock
         </Button>
-        <Button variant="danger" size="sm" onClick={() => logout(true)}>
+        <Button
+          variant="danger"
+          size="sm"
+          onClick={() => {
+            if (identity && window.confirm(FORGET_CONFIRM)) void forget(identity)
+          }}
+        >
           <LogOut className="h-3.5 w-3.5" aria-hidden /> Sign out &amp; forget key
         </Button>
       </div>
@@ -69,8 +80,8 @@ export function KeysPanel(): JSX.Element {
           onChange={(e) => {
             setExplorer(e.target.value)
             const v = e.target.value.trim()
-            if (v === '') window.localStorage.removeItem('forge:insight-url')
-            else if (/^https:\/\//.test(v)) window.localStorage.setItem('forge:insight-url', v.replace(/\/+$/, ''))
+            if (v === '') window.localStorage.removeItem(INSIGHT_OVERRIDE_KEY)
+            else if (/^https:\/\//.test(v)) window.localStorage.setItem(INSIGHT_OVERRIDE_KEY, v.replace(/\/+$/, ''))
           }}
         />
       </Field>
diff --git a/forge-web/components/login-modal.tsx b/forge-web/components/login-modal.tsx
index 7c0a7f78e..e0d21bc9c 100644
--- a/forge-web/components/login-modal.tsx
+++ b/forge-web/components/login-modal.tsx
@@ -10,60 +10,92 @@
  *      registers a limited key for this browser, and is not stored;
  *   Advanced: paste a raw key (developer path; this tab only; red warning).
  *
- * When this device already holds an encrypted key, the sheet opens on "Unlock" instead.
- * On a network without forge-v2 (no contract group to bind a key to, testnet today) only the
- * v1 paths exist: the identity file signs with its HIGH/CRITICAL key for this tab.
+ * When this device already holds an encrypted key, the sheet opens on "Unlock" instead
+ * (callers can open it on a view directly: Renew opens Import). On a network without forge-v2
+ * (no contract group to bind a key to, testnet today) only the v1 path exists: the identity
+ * file signs with its HIGH/CRITICAL key for this tab.
  */
 
 import { useEffect, useRef, useState } from 'react'
 import { ArrowLeft, Fingerprint, KeyRound, Lock, Plus, Upload, Wallet } from 'lucide-react'
 import { useAuth } from '@/contexts/auth-context'
-import { useUiStore } from '@/hooks/use-ui-store'
+import { useUiStore, type LoginView } from '@/hooks/use-ui-store'
 import { Dialog } from '@/components/ui/dialog'
 import { Button } from '@/components/ui/button'
 import { Field, Input, Textarea } from '@/components/ui/input'
-import { useProtection } from '@/components/auth/protection-fields'
+import { ErrorBox, useProtection } from '@/components/auth/protection-fields'
 import { CreateIdentityFlow } from '@/components/auth/create-identity-flow'
 import { WalletConnectFlow } from '@/components/auth/wallet-connect-flow'
-import { ACTIVE_NETWORK, DEFAULT_NETWORK } from '@/lib/constants'
-import { BROWSER_KEY_DEFAULTS, parseIdentityFileText } from '@/lib/auth'
+import { FORGET_CONFIRM } from '@/components/keys-panel'
+import { ACTIVE_NETWORK } from '@/lib/constants'
+import { BROWSER_KEY_DEFAULTS, masterMaterialFromFile, parseIdentityFileText } from '@/lib/auth'
+import { appConnectAvailable } from '@/lib/auth/app-connect'
+import { ensureSdk } from '@/lib/sdk'
 import { formatDate } from '@/lib/view/format'
 import { cn, errorMessage } from '@/lib/utils'
 
-type View = 'choose' | 'unlock' | 'import' | 'create' | 'wallet' | 'advanced'
+type View = 'choose' | 'unlock' | 'advanced' | LoginView
 
 export function LoginModal(): JSX.Element {
   const open = useUiStore((s) => s.loginOpen)
+  const requested = useUiStore((s) => s.loginView)
   const close = useUiStore((s) => s.closeLogin)
   const { vaults, limitedKeys } = useAuth()
   const [view, setView] = useState<View>('choose')
+  const [unlockFor, setUnlockFor] = useState<string | null>(null)
+  const hasVault = vaults.length > 0
 
+  // Pick the view when the sheet opens. If the stored-key list arrives after it opened (the
+  // /login route opens it on load), move from the untouched tile list to Unlock — never
+  // away from a flow the user already started.
+  const opened = useRef<{ hasVault: boolean } | null>(null)
   useEffect(() => {
-    if (open) setView(vaults.length > 0 ? 'unlock' : 'choose')
-  }, [open, vaults.length])
+    if (!open) {
+      opened.current = null
+      return
+    }
+    if (opened.current === null) {
+      opened.current = { hasVault }
+      setView(requested ?? (hasVault ? 'unlock' : 'choose'))
+      setUnlockFor(null)
+      return
+    }
+    if (!opened.current.hasVault && hasVault && requested === null) {
+      opened.current = { hasVault }
+      setView((v) => (v === 'choose' ? 'unlock' : v))
+    }
+  }, [open, requested, hasVault])
 
   const back = view === 'choose' || view === 'unlock' ? null : () => setView('choose')
+  const description =
+    view === 'advanced'
+      ? 'A pasted key signs for this tab only, with whatever power it has.'
+      : limitedKeys
+        ? `Forge signs with a limited key: at most ${BROWSER_KEY_DEFAULTS.budgetDash} DASH, only on Forge, for ${BROWSER_KEY_DEFAULTS.days} days.`
+        : `Your key signs writes on ${ACTIVE_NETWORK.key}. It stays in this tab, never sent anywhere.`
 
   return (
-    <Dialog
-      open={open}
-      onClose={close}
-      title="Sign in to Dash Forge"
-      description={
-        limitedKeys
-          ? `Forge signs with a limited key: at most ${BROWSER_KEY_DEFAULTS.budgetDash} DASH, only on Forge, for ${BROWSER_KEY_DEFAULTS.days} days.`
-          : `Your key signs writes on ${ACTIVE_NETWORK.key}. It stays in this tab, never sent anywhere.`
-      }
-      className="max-w-lg"
-    >
+    <Dialog open={open} onClose={close} title="Sign in to Dash Forge" description={description} className="max-w-lg">
       {back ? (
         <button type="button" onClick={back} className="mb-3 inline-flex items-center gap-1 text-dense text-anvil-500 hover:text-anvil-800 dark:hover:text-anvil-100">
           <ArrowLeft className="h-3.5 w-3.5" aria-hidden /> All options
         </button>
       ) : null}
-      {view === 'unlock' ? <UnlockView onDone={close} onOther={() => setView('choose')} /> : null}
+      {view === 'unlock' ? <UnlockView initial={unlockFor} onDone={close} onOther={() => setView('choose')} onRenew={() => setView('import')} /> : null}
       {view === 'choose' ? <ChooseView onPick={setView} /> : null}
-      {view === 'import' ? (limitedKeys ? <ImportView onDone={close} /> : <V1FileView onDone={close} />) : null}
+      {view === 'import' ? (
+        limitedKeys ? (
+          <ImportView
+            onDone={close}
+            onStored={(id) => {
+              setUnlockFor(id)
+              setView('unlock')
+            }}
+          />
+        ) : (
+          <V1FileView onDone={close} />
+        )
+      ) : null}
       {view === 'create' ? <CreateIdentityFlow onDone={close} /> : null}
       {view === 'wallet' ? <WalletConnectFlow onDone={close} /> : null}
       {view === 'advanced' ? <AdvancedView onDone={close} /> : null}
@@ -89,7 +121,8 @@ function Tile({ icon: Icon, title, body, onClick, testId }: { icon: typeof Walle
 }
 
 function ChooseView({ onPick }: { onPick: (v: View) => void }): JSX.Element {
-  const { limitedKeys, walletAvailable } = useWalletAvailability()
+  const { limitedKeys } = useAuth()
+  const walletAvailable = useWalletAvailability(limitedKeys)
   const [advanced, setAdvanced] = useState(false)
   return (
     <div className="space-y-2">
@@ -125,42 +158,73 @@ function ChooseView({ onPick }: { onPick: (v: View) => void }): JSX.Element {
 }
 
 /** Whether the App Connect tile applies here (protocol 14 + the system contract present). */
-function useWalletAvailability(): { limitedKeys: boolean; walletAvailable: boolean } {
-  const { limitedKeys } = useAuth()
-  const [walletAvailable, setAvailable] = useState(false)
+function useWalletAvailability(limitedKeys: boolean): boolean {
+  const [available, setAvailable] = useState(false)
   useEffect(() => {
     if (!limitedKeys) return
     let cancelled = false
-    void (async () => {
-      const { ensureSdk } = await import('@/lib/sdk')
-      const { appConnectAvailable } = await import('@/lib/auth/app-connect')
-      const ok = await appConnectAvailable(await ensureSdk(DEFAULT_NETWORK)).catch(() => false)
-      if (!cancelled) setAvailable(ok)
-    })()
+    ensureSdk(ACTIVE_NETWORK.network)
+      .then(appConnectAvailable)
+      .then(
+        (ok) => !cancelled && setAvailable(ok),
+        () => undefined,
+      )
     return () => {
       cancelled = true
     }
   }, [limitedKeys])
-  return { limitedKeys, walletAvailable }
+  return available
 }
 
-function ErrorBox({ error }: { error: string | null }): JSX.Element | null {
-  if (!error) return null
+/** A dashed "choose a file" button over a hidden file input. */
+function FilePicker({ label, detail, onFile, disabled }: { label: string; detail?: string; onFile: (f: File) => void; disabled?: boolean }): JSX.Element {
+  const ref = useRef<HTMLInputElement>(null)
   return (
-    <div role="alert" className="mt-3 rounded-md border border-danger/30 bg-danger/5 px-3 py-2 text-dense text-danger break-words">
-      {error}
-    </div>
+    <>
+      <button
+        type="button"
+        disabled={disabled}
+        onClick={() => ref.current?.click()}
+        className="flex w-full flex-col items-center gap-1 rounded-lg border border-dashed border-anvil-300 px-4 py-5 text-center hover:border-forge-400 dark:border-anvil-700"
+      >
+        <Upload className="h-5 w-5 text-forge-500" aria-hidden />
+        <span className="text-dense font-medium">{label}</span>
+        {detail ? <span className="font-mono text-[12px] text-anvil-500">{detail}</span> : null}
+      </button>
+      <input
+        ref={ref}
+        type="file"
+        aria-label="Identity file"
+        accept="application/json,.json,.txt"
+        className="sr-only"
+        onChange={(e) => {
+          const f = e.target.files?.[0]
+          if (f) onFile(f)
+          e.target.value = ''
+        }}
+      />
+    </>
   )
 }
 
-function UnlockView({ onDone, onOther }: { onDone: () => void; onOther: () => void }): JSX.Element {
-  const { vaults, unlock, logout, isLoading } = useAuth()
-  const [pick, setPick] = useState(0)
+function UnlockView({ initial, onDone, onOther, onRenew }: { initial: string | null; onDone: () => void; onOther: () => void; onRenew: () => void }): JSX.Element {
+  const { vaults, unlock, forget, isLoading } = useAuth()
+  const [pick, setPick] = useState(() => Math.max(0, vaults.findIndex((v) => v.identityId === initial)))
   const [passphrase, setPassphrase] = useState('')
   const [error, setError] = useState<string | null>(null)
-  const v = vaults[pick]
-  if (!v) return <p className="text-dense">No key is stored on this device.</p>
+  const v = vaults[pick] ?? vaults[0]
+  if (!v) {
+    return (
+      <div className="space-y-3">
+        <p className="text-dense">No key is stored on this device.</p>
+        <Button variant="primary" className="w-full" onClick={onOther}>
+          Sign-in options
+        </Button>
+      </div>
+    )
+  }
   const go = async (method: { passphrase: string } | 'passkey'): Promise<void> => {
+    if (isLoading) return
     setError(null)
     try {
       await unlock(v.identityId, method)
@@ -170,6 +234,7 @@ function UnlockView({ onDone, onOther }: { onDone: () => void; onOther: () => vo
       setError(errorMessage(e))
     }
   }
+  const expired = error !== null && /no longer usable|renew/i.test(error)
   return (
     <div className="space-y-3">
       <div className="flex items-center gap-2 text-dense">
@@ -188,7 +253,7 @@ function UnlockView({ onDone, onOther }: { onDone: () => void; onOther: () => vo
         )}
       </div>
       {v.methods.includes('passkey') ? (
-        <Button variant="primary" className="w-full" onClick={() => go('passkey')} loading={isLoading}>
+        <Button variant="primary" className="w-full" onClick={() => go('passkey')} loading={isLoading} disabled={isLoading}>
           <Fingerprint className="h-4 w-4" aria-hidden /> Unlock with passkey
         </Button>
       ) : null}
@@ -203,27 +268,40 @@ function UnlockView({ onDone, onOther }: { onDone: () => void; onOther: () => vo
           <Field label="Passphrase" htmlFor="unlock-passphrase">
             <Input id="unlock-passphrase" type="password" autoComplete="current-password" value={passphrase} onChange={(e) => setPassphrase(e.target.value)} autoFocus />
           </Field>
-          <Button type="submit" variant={v.methods.includes('passkey') ? 'outline' : 'primary'} className="w-full" loading={isLoading} disabled={passphrase === ''}>
+          <Button type="submit" variant={v.methods.includes('passkey') ? 'outline' : 'primary'} className="w-full" loading={isLoading} disabled={passphrase === '' || isLoading}>
             Unlock
           </Button>
         </form>
       ) : null}
       <ErrorBox error={error} />
+      {expired ? (
+        <Button variant="outline" className="w-full" onClick={onRenew}>
+          Renew this browser&apos;s key
+        </Button>
+      ) : null}
       <div className="flex justify-between pt-1 text-[12px]">
         <button type="button" onClick={onOther} className="text-anvil-500 underline">
-          Use another identity
+          Other sign-in options
         </button>
-        <button type="button" onClick={() => logout(true)} className="text-danger underline">
+        <button
+          type="button"
+          onClick={() => {
+            if (window.confirm(FORGET_CONFIRM)) void forget(v.identityId).then(() => setPick(0))
+          }}
+          className="text-danger underline"
+        >
           Forget this key
         </button>
       </div>
-      <p className="text-[12px] text-anvil-500 dark:text-anvil-400">Stored {formatDate(v.createdAt)} · key #{v.keyId}</p>
+      <p className="text-[12px] text-anvil-500 dark:text-anvil-400">
+        Stored {formatDate(v.createdAt)} · key #{v.keyId}
+      </p>
     </div>
   )
 }
 
-function ImportView({ onDone }: { onDone: () => void }): JSX.Element {
-  const { importIdentity, isLoading } = useAuth()
+function ImportView({ onDone, onStored }: { onDone: () => void; onStored: (identityId: string) => void }): JSX.Element {
+  const { importIdentity, isLoading, vaults, identity } = useAuth()
   const [mode, setMode] = useState<'file' | 'mnemonic'>('file')
   const [fileText, setFileText] = useState<string | null>(null)
   const [fileName, setFileName] = useState('')
@@ -231,25 +309,29 @@ function ImportView({ onDone }: { onDone: () => void }): JSX.Element {
   const [mnemonic, setMnemonic] = useState('')
   const [identityId, setIdentityId] = useState('')
   const [error, setError] = useState<string | null>(null)
-  const fileRef = useRef<HTMLInputElement>(null)
-  const who = mode === 'file' ? fileIdentity : identityId
-  const { fields, protection, problem } = useProtection(who)
+  const { fields, protection, problem } = useProtection()
+  const who = mode === 'file' ? fileIdentity : identityId.trim()
+  // Offer Unlock for a key this device already holds, unless this is a renewal of the
+  // signed-in identity (then the old key is disabled in the same update).
+  const alreadyStored = who !== '' && who !== identity && vaults.some((v) => v.identityId === who)
 
   const onFile = async (file: File): Promise<void> => {
     setError(null)
     const text = await file.text()
     try {
-      setFileIdentity(parseIdentityFileText(text).identityId)
-    } catch {
+      setFileIdentity(masterMaterialFromFile(text).identityId)
+    } catch (e) {
       setFileIdentity('')
+      setError(errorMessage(e))
+      return
     }
     setFileText(text)
     setFileName(file.name)
   }
 
-  const ready = protection !== null && (mode === 'file' ? fileText !== null : mnemonic.trim() !== '' && identityId.trim() !== '')
+  const ready = protection !== null && !isLoading && (mode === 'file' ? fileText !== null : mnemonic.trim() !== '' && identityId.trim() !== '')
   const submit = async (): Promise<void> => {
-    if (!protection) return
+    if (!protection || isLoading) return
     setError(null)
     try {
       await importIdentity(mode === 'file' ? { fileText: fileText as string } : { mnemonic, identityId }, protection)
@@ -278,29 +360,7 @@ function ImportView({ onDone }: { onDone: () => void }): JSX.Element {
         ))}
       </div>
       {mode === 'file' ? (
-        <>
-          <button
-            type="button"
-            onClick={() => fileRef.current?.click()}
-            className="flex w-full flex-col items-center gap-1 rounded-lg border border-dashed border-anvil-300 px-4 py-5 text-center hover:border-forge-400 dark:border-anvil-700"
-          >
-            <Upload className="h-5 w-5 text-forge-500" aria-hidden />
-            <span className="text-dense font-medium">{fileName || 'Choose an identity file (.json)'}</span>
-            {fileIdentity ? <span className="font-mono text-[12px] text-anvil-500">{fileIdentity}</span> : null}
-          </button>
-          <input
-            ref={fileRef}
-            type="file"
-            aria-label="Identity file"
-            accept="application/json,.json,.txt"
-            className="sr-only"
-            onChange={(e) => {
-              const f = e.target.files?.[0]
-              if (f) void onFile(f)
-              e.target.value = ''
-            }}
-          />
-        </>
+        <FilePicker label={fileName || 'Choose an identity file (.json)'} detail={fileIdentity || undefined} onFile={(f) => void onFile(f)} />
       ) : (
         <>
           <Field label="Identity ID" htmlFor="import-id">
@@ -311,6 +371,15 @@ function ImportView({ onDone }: { onDone: () => void }): JSX.Element {
           </Field>
         </>
       )}
+      {alreadyStored ? (
+        <div className="rounded-md border border-anvil-200 px-3 py-2 text-dense dark:border-anvil-800">
+          This device already holds a key for this identity.{' '}
+          <button type="button" className="text-forge-600 underline dark:text-forge-400" onClick={() => onStored(who)}>
+            Unlock it instead
+          </button>{' '}
+          or continue to replace it (the old key is disabled in the same update).
+        </div>
+      ) : null}
       {fields}
       <p className="text-[12px] text-anvil-500 dark:text-anvil-400">
         Registers a key that can spend at most {BROWSER_KEY_DEFAULTS.budgetDash} DASH, only on Forge, for {BROWSER_KEY_DEFAULTS.days} days (~0.0005 DASH, one master-key signature).
@@ -326,13 +395,13 @@ function ImportView({ onDone }: { onDone: () => void }): JSX.Element {
 
 /** Networks without forge-v2 (testnet): an identity file's HIGH/CRITICAL key, this tab only. */
 function V1FileView({ onDone }: { onDone: () => void }): JSX.Element {
-  const { loginWithRawKey, isLoading } = useAuth()
+  const { loginWithRawKey, isLoading, controller } = useAuth()
   const [error, setError] = useState<string | null>(null)
-  const fileRef = useRef<HTMLInputElement>(null)
   const onFile = async (file: File): Promise<void> => {
     setError(null)
     try {
       const parsed = parseIdentityFileText(await file.text())
+      controller.checkFileNetwork(parsed.networkKey)
       await loginWithRawKey(parsed.identityId, parsed.signingKeyWif)
       onDone()
     } catch (e) {
@@ -341,27 +410,7 @@ function V1FileView({ onDone }: { onDone: () => void }): JSX.Element {
   }
   return (
     <div className="space-y-3">
-      <button
-        type="button"
-        onClick={() => fileRef.current?.click()}
-        disabled={isLoading}
-        className="flex w-full flex-col items-center gap-2 rounded-lg border border-dashed border-anvil-300 px-4 py-8 text-center hover:border-forge-400 dark:border-anvil-700"
-      >
-        <Upload className="h-5 w-5 text-forge-500" aria-hidden />
-        <span className="text-dense font-medium">Choose an identity file</span>
-      </button>
-      <input
-        ref={fileRef}
-        type="file"
-        aria-label="Identity file"
-        accept="application/json,.json,.txt"
-        className="sr-only"
-        onChange={(e) => {
-          const f = e.target.files?.[0]
-          if (f) void onFile(f)
-          e.target.value = ''
-        }}
-      />
+      <FilePicker label="Choose an identity file" onFile={(f) => void onFile(f)} disabled={isLoading} />
       <p className="text-[12px] text-anvil-500 dark:text-anvil-400">
         {ACTIVE_NETWORK.key} has no Forge contract group yet, so there are no limited keys here: the file&apos;s signing key is held in this tab and forgotten on reload.
       </p>
@@ -376,6 +425,7 @@ function AdvancedView({ onDone }: { onDone: () => void }): JSX.Element {
   const [key, setKey] = useState('')
   const [error, setError] = useState<string | null>(null)
   const submit = async (): Promise<void> => {
+    if (isLoading) return
     setError(null)
     try {
       await loginWithRawKey(identityId, key)
@@ -397,7 +447,7 @@ function AdvancedView({ onDone }: { onDone: () => void }): JSX.Element {
       <Field label="Private key (WIF or hex)" htmlFor="adv-key" hint="HIGH or CRITICAL authentication key. Held in this tab only.">
         <Input id="adv-key" type="password" value={key} onChange={(e) => setKey(e.target.value)} className="font-mono" spellCheck={false} autoComplete="off" />
       </Field>
-      <Button variant="danger" className="w-full" onClick={submit} loading={isLoading} disabled={identityId.trim() === '' || key.trim() === ''}>
+      <Button variant="danger" className="w-full" onClick={submit} loading={isLoading} disabled={identityId.trim() === '' || key.trim() === '' || isLoading}>
         Sign in for this tab
       </Button>
       <ErrorBox error={error} />
diff --git a/forge-web/components/top-up-sheet.tsx b/forge-web/components/top-up-sheet.tsx
index 97e1d7732..0f688d734 100644
--- a/forge-web/components/top-up-sheet.tsx
+++ b/forge-web/components/top-up-sheet.tsx
@@ -12,6 +12,7 @@ import { ExternalLink } from 'lucide-react'
 import { useAuth } from '@/contexts/auth-context'
 import { useUiStore } from '@/hooks/use-ui-store'
 import { Dialog } from '@/components/ui/dialog'
+import { Button } from '@/components/ui/button'
 import { CopyRow } from '@/components/ui/copy-row'
 import { ACTIVE_NETWORK } from '@/lib/constants'
 import { creditsAsDash } from '@/lib/view/format'
@@ -27,6 +28,7 @@ export function faucetUrl(): string | null {
 export function TopUpSheet(): JSX.Element | null {
   const reason = useUiStore((s) => s.topUp)
   const close = useUiStore((s) => s.closeTopUp)
+  const openLogin = useUiStore((s) => s.openLogin)
   const { identity } = useAuth()
   if (reason === null || identity === null) return null
   const faucet = faucetUrl()
@@ -47,10 +49,21 @@ export function TopUpSheet(): JSX.Element | null {
     >
       <div className="space-y-3 text-dense">
         {keyProblem ? (
-          <p>
-            Sign in again with your identity file or mnemonic to register a fresh limited key for this browser.
-            Your master key is used once and not stored.
-          </p>
+          <>
+            <p>
+              Renew it with your identity file or recovery phrase: the master key registers a fresh limited key for this
+              browser, disables the old one, and is not stored.
+            </p>
+            <Button
+              variant="primary"
+              onClick={() => {
+                close()
+                openLogin('import')
+              }}
+            >
+              Renew key
+            </Button>
+          </>
         ) : (
           <>
             <p>
diff --git a/forge-web/contexts/auth-context.tsx b/forge-web/contexts/auth-context.tsx
index 806736145..fbcea4c1e 100644
--- a/forge-web/contexts/auth-context.tsx
+++ b/forge-web/contexts/auth-context.tsx
@@ -69,9 +69,13 @@ interface AuthContextValue {
   /** Advanced: a pasted key, for this tab only. */
   loginWithRawKey: (identityId: string, privateKey: string) => Promise<void>
   refreshBalance: () => Promise<void>
-  /** Lock (keep the stored key) or sign out and forget this browser's key. */
-  logout: (forget?: boolean) => void
+  /** Lock: end the session, keep the stored key (unlock to continue). */
+  logout: () => void
+  /** Delete the stored key of `identityId` from this device. */
+  forget: (identityId: string) => Promise<void>
   reloadVaults: () => void
+  /** The headless controller (identity creation stores its key before registering it). */
+  readonly controller: AuthController
 }
 
 const AuthContext = createContext<AuthContextValue | undefined>(undefined)
@@ -94,42 +98,30 @@ export function AuthProvider({
   }, [controller])
   useEffect(reloadVaults, [reloadVaults])
 
-  const importIdentity = useCallback<AuthContextValue['importIdentity']>(
-    async (input, protection, request) => {
-      await controller.importIdentity(input, protection, request)
-      reloadVaults()
-    },
-    [controller, reloadVaults],
-  )
-  const adoptLimitedKey = useCallback<AuthContextValue['adoptLimitedKey']>(
-    async (identityId, key, protection) => {
-      await controller.adoptLimitedKey(identityId, key, protection)
-      reloadVaults()
-    },
-    [controller, reloadVaults],
-  )
-  const unlock = useCallback<AuthContextValue['unlock']>(
-    async (identityId, method) => {
-      await controller.unlock(identityId, method)
-    },
-    [controller],
+  // Every sign-in path ends with a reload of the stored-key list, success or not: a key stored
+  // before a later step failed must show up in Unlock.
+  const withReload = useCallback(
+    <A extends unknown[]>(fn: (...args: A) => Promise<unknown>) =>
+      async (...args: A): Promise<void> => {
+        try {
+          await fn(...args)
+        } finally {
+          reloadVaults()
+        }
+      },
+    [reloadVaults],
   )
-  const loginWithRawKey = useCallback(
-    async (identityId: string, privateKey: string) => {
-      await controller.loginWithRawKey(identityId, privateKey)
-    },
-    [controller],
-  )
-
-  const refreshBalance = useCallback(async () => {
-    await controller.refreshBalance()
-  }, [controller])
-
-  const logout = useCallback(
-    (forget = false) => {
-      void controller.logout(forget).then(reloadVaults)
-    },
-    [controller, reloadVaults],
+  const actions = useMemo(
+    () => ({
+      importIdentity: withReload(controller.importIdentity.bind(controller)),
+      adoptLimitedKey: withReload(controller.adoptLimitedKey.bind(controller)),
+      unlock: withReload(controller.unlock.bind(controller)),
+      loginWithRawKey: withReload(controller.loginWithRawKey.bind(controller)),
+      refreshBalance: () => controller.refreshBalance(),
+      logout: () => controller.logout(),
+      forget: withReload(controller.forget.bind(controller)),
+    }),
+    [controller, withReload],
   )
 
   const onSpend = useCallback(
@@ -170,15 +162,11 @@ export function AuthProvider({
       storage: session?.storage ?? null,
       limitedKeys: controller.supportsLimitedKeys(),
       vaults,
-      importIdentity,
-      adoptLimitedKey,
-      unlock,
-      loginWithRawKey,
-      refreshBalance,
-      logout,
       reloadVaults,
+      controller,
+      ...actions,
     }),
-    [adoptLimitedKey, controller, funds, importIdentity, keyLimits, loginWithRawKey, logout, refreshBalance, reloadVaults, session, signer, state.error, state.isLoading, unlock, vaults],
+    [actions, controller, funds, keyLimits, reloadVaults, session, signer, state.error, state.isLoading, vaults],
   )
 
   return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>
diff --git a/forge-web/e2e/helpers.ts b/forge-web/e2e/helpers.ts
index b10627018..0176d324a 100644
--- a/forge-web/e2e/helpers.ts
+++ b/forge-web/e2e/helpers.ts
@@ -1,7 +1,7 @@
 import AxeBuilder from '@axe-core/playwright'
 import { expect, type Browser, type Page, type ConsoleMessage } from '@playwright/test'
 import { homedir } from 'node:os'
-import { mkdirSync } from 'node:fs'
+import { existsSync, mkdirSync } from 'node:fs'
 import { join } from 'node:path'
 
 /**
@@ -147,13 +147,17 @@ export function idFile(name: string): string {
 export const PASSPHRASE = 'e2e passphrase for the vault'
 
 /**
- * A fresh browser context signed in as `name`: the identity file is imported once — its master
- * key registers a limited key for this browser, which the vault keeps under a passphrase.
+ * Where a signed-in browser's storage (the encrypted vault record in IndexedDB, nothing in
+ * plaintext) is kept between runs, per devnet identity, so the specs reuse one limited key
+ * per identity instead of registering a new one on every test (identities would otherwise
+ * accumulate keys without bound). Gitignored (e2e/.playwright/).
  */
-export async function signedIn(browser: Browser, name: string, path = '/'): Promise<Page> {
-  const context = await browser.newContext()
-  const page = await context.newPage()
-  await page.goto(path, { waitUntil: 'domcontentloaded' })
+function stateFile(name: string): string {
+  return join(__dirname, '.playwright', 'auth', `devnet-${E2E_DEVNET}-${name}.json`)
+}
+
+/** Import the identity file once: the master key registers a limited key for this browser. */
+export async function importIdentity(page: Page, name: string): Promise<void> {
   await page.getByRole('button', { name: /^sign in$/i }).first().click()
   await page.getByTestId('tile-import').click()
   await page.setInputFiles('input[type="file"]', idFile(name))
@@ -161,6 +165,32 @@ export async function signedIn(browser: Browser, name: string, path = '/'): Prom
   await page.getByLabel('Repeat passphrase').fill(PASSPHRASE)
   await page.getByRole('button', { name: /create this browser's key/i }).click()
   await expect(page.getByTestId('funds-pill')).toBeVisible({ timeout: 120_000 })
+}
+
+/**
+ * A browser context signed in as `name`. The first time, the identity file is imported (one
+ * new limited key); afterwards the saved vault is restored and unlocked with the passphrase.
+ * If the stored key stopped working (expired, disabled), it is imported again.
+ */
+export async function signedIn(browser: Browser, name: string, path = '/'): Promise<Page> {
+  const saved = stateFile(name)
+  const context = await browser.newContext(existsSync(saved) ? { storageState: saved } : {})
+  const page = await context.newPage()
+  await page.goto(path, { waitUntil: 'domcontentloaded' })
+  let reused = false
+  if (existsSync(saved)) {
+    try {
+      await unlock(page)
+      reused = true
+    } catch {
+      await page.keyboard.press('Escape')
+    }
+  }
+  if (!reused) {
+    await importIdentity(page, name)
+    mkdirSync(join(__dirname, '.playwright', 'auth'), { recursive: true, mode: 0o700 })
+    await context.storageState({ path: saved, indexedDB: true })
+  }
   return page
 }
 
diff --git a/forge-web/e2e/v2-auth.spec.ts b/forge-web/e2e/v2-auth.spec.ts
index aaff9bca0..a6fcb8f2d 100644
--- a/forge-web/e2e/v2-auth.spec.ts
+++ b/forge-web/e2e/v2-auth.spec.ts
@@ -2,7 +2,7 @@ import { test, expect } from '@playwright/test'
 import { existsSync, readFileSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
-import { E2E_DEVNET, PASSPHRASE, idFile, shot, signedIn, unlock } from './helpers'
+import { E2E_DEVNET, PASSPHRASE, idFile, importIdentity, shot, unlock } from './helpers'
 
 /**
  * Limited-key sign-in, live on a devnet (real spend):
@@ -49,7 +49,9 @@ async function onChainKeys(identityId: string): Promise<{ id: number; level: str
 test('a1. import once: a limited key lands on chain, the vault survives a reload', async ({ browser }) => {
   const identityId = String(JSON.parse(readFileSync(idFile('CI-RUNNER'), 'utf8')).identityId)
   const before = await onChainKeys(identityId)
-  const page = await signedIn(browser, 'CI-RUNNER', '/settings/')
+  const page = await (await browser.newContext()).newPage()
+  await page.goto('/settings/', { waitUntil: 'domcontentloaded' })
+  await importIdentity(page, 'CI-RUNNER')
   await expect(page.getByTestId('key-budget')).toContainText('0.05 DASH', { timeout: 30_000 })
   await shot(page, 'v2a-01-settings-key')
 
diff --git a/forge-web/hooks/use-ui-store.ts b/forge-web/hooks/use-ui-store.ts
index f3b53c877..4aed8fcc9 100644
--- a/forge-web/hooks/use-ui-store.ts
+++ b/forge-web/hooks/use-ui-store.ts
@@ -13,9 +13,14 @@ export interface TopUpReason {
   readonly shortfall?: bigint
 }
 
+/** A sign-in sheet view to open on directly (e.g. `import` to renew this browser's key). */
+export type LoginView = 'import' | 'create' | 'wallet'
+
 interface UiState {
   readonly loginOpen: boolean
-  openLogin: () => void
+  /** The view the sheet should open on, or null for its default (Unlock / the tiles). */
+  readonly loginView: LoginView | null
+  openLogin: (view?: LoginView) => void
   closeLogin: () => void
   readonly topUp: TopUpReason | null
   openTopUp: (reason?: TopUpReason) => void
@@ -24,8 +29,9 @@ interface UiState {
 
 export const useUiStore = create<UiState>((set) => ({
   loginOpen: false,
-  openLogin: () => set({ loginOpen: true }),
-  closeLogin: () => set({ loginOpen: false }),
+  loginView: null,
+  openLogin: (view) => set({ loginOpen: true, loginView: view ?? null }),
+  closeLogin: () => set({ loginOpen: false, loginView: null }),
   topUp: null,
   openTopUp: (reason = { blocker: 'balance' }) => set({ topUp: reason }),
   closeTopUp: () => set({ topUp: null }),
diff --git a/forge-web/lib/auth/app-connect.ts b/forge-web/lib/auth/app-connect.ts
index 9eacca2fe..1474fba85 100644
--- a/forge-web/lib/auth/app-connect.ts
+++ b/forge-web/lib/auth/app-connect.ts
@@ -24,6 +24,7 @@ import { hash160 } from './asset-lock'
 import { encodeWif } from './wif'
 import { verifyLimitedKey } from './limited-key'
 import type { KeyLimits } from '../view/funds'
+import { authSdk, sleep } from '../sdk/facade'
 
 /** The App Connect system contract (the same id on every network, protocol 14). */
 export const APP_CONNECT_CONTRACT_ID = 'H8F9mP1BM55TE1ShsxPZHzhyinaMdY9bMmP85mkDhcJJ'
@@ -96,6 +97,9 @@ interface RawResponse {
   toJSON(): { $ownerId: string; walletEphemeralPubKey: string; encryptedPayload: string }
 }
 
+/** Why a response was skipped: not for us (never retry), or not verifiable yet (retry). */
+class NotOurs extends Error {}
+
 function b64(s: string): Uint8Array {
   const bin = atob(s)
   return Uint8Array.from(bin, (c) => c.charCodeAt(0))
@@ -104,7 +108,7 @@ function b64(s: string): Uint8Array {
 /** Whether the App Connect contract exists on this network (hide the tile otherwise). */
 export async function appConnectAvailable(sdk: import('@dashevo/evo-sdk').EvoSDK): Promise<boolean> {
   try {
-    const c = await (sdk as unknown as { contracts: { fetch(id: string): Promise<unknown> } }).contracts.fetch(APP_CONNECT_CONTRACT_ID)
+    const c = await authSdk(sdk).contracts.fetch(APP_CONNECT_CONTRACT_ID)
     return c !== undefined && c !== null
   } catch {
     return false
@@ -129,13 +133,15 @@ export async function awaitWalletLogin(
   req: AppConnectRequest,
   params: { network: Network; group: string; signal?: AbortSignal; intervalMs?: number },
 ): Promise<WalletLogin> {
-  const seen = new Set<string>()
-  const docs = (sdk as unknown as { documents: { query(q: unknown): Promise<Map<string, RawResponse | undefined>> } }).documents
+  // Owners whose response does not decrypt with our key are not answering us: skip them for
+  // good. A response that decrypts but whose key is not verifiable yet (the wallet published
+  // before its key update was visible, or a read failed) is retried on the next poll.
+  const notOurs = new Set<string>()
   for (;;) {
     if (params.signal?.aborted) throw new DOMException('cancelled', 'AbortError')
-    let rows: Map<string, RawResponse | undefined> = new Map()
+    let rows: Map<string, unknown> = new Map()
     try {
-      rows = await docs.query({
+      rows = await authSdk(sdk).documents.query({
         dataContractId: APP_CONNECT_CONTRACT_ID,
         documentTypeName: 'loginKeyResponse',
         where: [['appEphemeralPubKeyHash', '==', btoa(String.fromCharCode(...req.appEphemeralPubKeyHash))]],
@@ -147,32 +153,41 @@ export async function awaitWalletLogin(
     }
     for (const raw of rows.values()) {
       if (!raw) continue
-      const j = raw.toJSON()
-      if (seen.has(j.$ownerId)) continue
-      seen.add(j.$ownerId)
+      const j = (raw as RawResponse).toJSON()
+      if (notOurs.has(j.$ownerId)) continue
       try {
-        const login = await openResponse(req, b64(j.walletEphemeralPubKey), b64(j.encryptedPayload))
-        const auth = authKeyFromLogin(login, j.$ownerId)
-        login.fill(0)
-        const wif = encodeWif(auth, params.network)
-        auth.fill(0)
+        const wif = await decryptGrant(req, j, params.network)
         const keyId = await findKeyId(sdk, j.$ownerId, wif, params.network)
         if (keyId === null) continue
         const limits = await verifyLimitedKey(sdk, j.$ownerId, keyId, params.group, params.network, wif)
         disposeRequest(req)
         return { identityId: j.$ownerId, keyId, wif, limits }
-      } catch {
-        /* not ours, or not a Forge-bounded key: keep waiting */
+      } catch (e) {
+        if (e instanceof NotOurs) notOurs.add(j.$ownerId)
       }
     }
-    await new Promise((r) => setTimeout(r, params.intervalMs ?? 3000))
+    await sleep(params.intervalMs ?? 3000, params.signal)
+  }
+}
+
+async function decryptGrant(req: AppConnectRequest, j: ReturnType<RawResponse['toJSON']>, network: Network): Promise<string> {
+  let login: Uint8Array
+  try {
+    login = await openResponse(req, b64(j.walletEphemeralPubKey), b64(j.encryptedPayload))
+  } catch {
+    throw new NotOurs()
   }
+  const auth = authKeyFromLogin(login, j.$ownerId)
+  login.fill(0)
+  const wif = encodeWif(auth, network)
+  auth.fill(0)
+  return wif
 }
 
 /** Which key on `identityId` the WIF controls (the wallet may register it as HASH160). */
 async function findKeyId(sdk: import('@dashevo/evo-sdk').EvoSDK, identityId: string, wif: string, network: Network): Promise<number | null> {
   const { PrivateKey } = await import('@dashevo/evo-sdk')
-  const identity = await (sdk as unknown as { identities: { fetch(id: string): Promise<{ publicKeys: { keyId: number; validatePrivateKey(b: Uint8Array, n: string): boolean }[] } | undefined> } }).identities.fetch(identityId)
+  const identity = await authSdk(sdk).identities.fetch(identityId)
   const pk = PrivateKey.fromWIF(wif)
   const bytes = pk.toBytes()
   pk.free()
diff --git a/forge-web/lib/auth/asset-lock.ts b/forge-web/lib/auth/asset-lock.ts
index 13957fe34..3d76245c8 100644
--- a/forge-web/lib/auth/asset-lock.ts
+++ b/forge-web/lib/auth/asset-lock.ts
@@ -21,6 +21,7 @@ import { sha256 } from '@noble/hashes/sha2.js'
 import { bytesToHex, concatBytes, hexToBytes } from '@noble/hashes/utils.js'
 
 import { ACTIVE_NETWORK, type Network } from '../constants'
+import { sleep } from '../sdk/facade'
 import { base58CheckDecode } from './base58'
 import { decodeWif } from './wif'
 
@@ -35,9 +36,12 @@ export interface CoreEndpoints {
   readonly islockRpc: string | null
 }
 
+/** Where Settings stores a user-chosen block explorer (Insight API base URL). */
+export const INSIGHT_OVERRIDE_KEY = 'forge:insight-url'
+
 /** The endpoints this build uses (Settings may override the explorer, spec §2.2). */
 export function coreEndpoints(network: Network = ACTIVE_NETWORK.network): CoreEndpoints {
-  const override = typeof window !== 'undefined' ? window.localStorage.getItem('forge:insight-url') : null
+  const override = typeof window !== 'undefined' ? window.localStorage.getItem(INSIGHT_OVERRIDE_KEY) : null
   if (network === 'devnet') {
     return { insight: override ?? `https://insight.${ACTIVE_NETWORK.devnetName}.networks.dash.org/insight-api`, islockRpc: null }
   }
@@ -275,15 +279,6 @@ async function fetchIslock(rpc: string, id: string): Promise<Uint8Array | null>
   return hit?.hex ? hexToBytes(hit.hex) : null
 }
 
-const sleep = (ms: number, signal?: AbortSignal): Promise<void> =>
-  new Promise((resolve, reject) => {
-    const t = setTimeout(resolve, ms)
-    signal?.addEventListener('abort', () => {
-      clearTimeout(t)
-      reject(new DOMException('cancelled', 'AbortError'))
-    })
-  })
-
 /**
  * Wait until the asset lock is provable: an InstantSend lock where the network offers one
  * (up to 90 s), else a chain-lock proof once the tx is mined and Platform's chain-locked Core
diff --git a/forge-web/lib/auth/controller.ts b/forge-web/lib/auth/controller.ts
index 87c4aa2f6..45a0910c1 100644
--- a/forge-web/lib/auth/controller.ts
+++ b/forge-web/lib/auth/controller.ts
@@ -22,16 +22,19 @@ import type { Network } from '../constants'
 import { DEFAULT_NETWORK, NETWORKS } from '../constants'
 import { errorMessage } from '../utils'
 import { WriteAuthError, findSigningKey, readIdentityBalance, type WriteAuth } from '../sdk/write'
+import { authSdk } from '../sdk/facade'
 import type { KeyLimits } from '../view/funds'
 import { normalizeToWif } from './wif'
 import { identityFileMatchesNetwork, masterMaterialFromFile } from './identity-file'
 import { deriveMasterKey, isValidMnemonic } from './hd'
 import { readKeyLimits, registerLimitedKey, type LimitedKey, type LimitedKeyRequest } from './limited-key'
 import {
+  VaultLockedError,
   forgetVault,
   holdForSession,
   listVaults,
   lockVault,
+  onVaultLock,
   storeInVault,
   unlockWithPasskey,
   unlockWithPassphrase,
@@ -92,6 +95,13 @@ export class AuthController {
     private readonly network: Network = DEFAULT_NETWORK,
   ) {
     purgeLegacyKeystore()
+    // The 12-hour auto-lock ends the session too, so the UI offers Unlock instead of a
+    // signed-in header whose every write fails.
+    onVaultLock(() => {
+      if (this.state.session?.storage === 'vault' || this.state.session?.storage === 'session') {
+        this.setState({ session: null })
+      }
+    })
   }
 
   getState(): AuthState {
@@ -159,40 +169,62 @@ export class AuthController {
     }
   }
 
-  /** Open a session for an unlocked secret: re-verify the key on chain, load balance + limits. */
-  private async open(secret: VaultSecret, storage: AuthSession['storage']): Promise<AuthSession> {
-    const sdk = await this.getSdk()
-    const identity = await (sdk as unknown as { identities: { fetch(id: string): Promise<Parameters<typeof findSigningKey>[0] | undefined> } }).identities.fetch(secret.identityId)
-    if (!identity) throw new WriteAuthError(`identity ${secret.identityId} not found on ${this.network}`)
-    const match = await findSigningKey(identity, secret.wif, this.network, 3)
-    if (!match) throw new WriteAuthError('this key is no longer usable on the identity (disabled or expired) — sign in again')
-    const [balance, keyLimits] = await Promise.all([
-      readIdentityBalance(sdk, secret.identityId),
-      readKeyLimits(sdk, secret.identityId, match.keyId).catch(() => null),
-    ])
-    const session: AuthSession = {
-      identityId: secret.identityId,
-      balance: balance.toString(),
-      network: this.network,
-      keyLimits,
-      keyId: match.keyId,
-      storage,
+  /**
+   * Open a session for an unlocked secret: re-verify the key on chain, load balance + limits.
+   * On failure the unlocked key is dropped again, so no key sits in memory without a session.
+   */
+  private async open(secret: VaultSecret, storage: AuthSession['storage'], knownLimits?: KeyLimits): Promise<AuthSession> {
+    try {
+      const sdk = await this.getSdk()
+      const identity = await authSdk(sdk).identities.fetch(secret.identityId)
+      if (!identity) throw new WriteAuthError(`identity ${secret.identityId} not found on ${this.network}`)
+      const match = await findSigningKey(identity, secret.wif, this.network, 3)
+      if (!match) throw new KeyNotUsableError()
+      const keyLimits = knownLimits ?? (await readKeyLimits(sdk, secret.identityId, match.keyId).catch(() => null))
+      const session: AuthSession = {
+        identityId: secret.identityId,
+        balance: identity.balance.toString(),
+        network: this.network,
+        keyLimits,
+        keyId: match.keyId,
+        storage,
+      }
+      this.setState({ session })
+      return session
+    } catch (e) {
+      lockVault()
+      throw e
     }
-    this.setState({ session })
-    return session
   }
 
-  /** Store a freshly registered limited key in the vault and open its session. */
+  /**
+   * Store a freshly registered limited key in the vault and open its session. If the key is
+   * stored but the session cannot open yet (a read failed), say so: the key is safe and
+   * unlocking will continue.
+   */
   private async adopt(identityId: string, key: LimitedKey, protection: Protection): Promise<AuthSession> {
     const secret: VaultSecret = { identityId, keyId: key.keyId, wif: key.wif }
     await storeInVault(this.network, secret, protection)
-    return this.open(secret, 'vault')
+    try {
+      return await this.open(secret, 'vault', key.limits)
+    } catch (e) {
+      throw new Error(`Key saved on this device, but signing in did not finish (${errorMessage(e)}). Unlock to continue.`)
+    }
+  }
+
+  /**
+   * Store a key in the vault before it is registered on chain (identity creation). It stays
+   * unlocked for the {@link openStored} that follows; a failed run calls {@link logout}.
+   */
+  async persistKey(secret: VaultSecret, protection: Protection): Promise<void> {
+    await storeInVault(this.network, secret, protection)
   }
 
   /**
    * Import an identity file or mnemonic once: its master key signs one IdentityUpdate that
-   * registers a limited key for this browser, and is then dropped. Only the limited key is
-   * kept, encrypted under `protection`.
+   * registers a limited key for this browser (disabling the key this device held for it
+   * before, when renewing), and is then dropped. Only the limited key is kept, encrypted under
+   * `protection`.
    */
   async importIdentity(
     input: { fileText: string } | { mnemonic: string; identityId: string },
@@ -204,10 +236,7 @@ export class AuthController {
       let masterWif: string | null
       if ('fileText' in input) {
         const m = masterMaterialFromFile(input.fileText)
-        const buildKey = NETWORKS[this.network].key
-        if (!identityFileMatchesNetwork(m.networkKey, buildKey)) {
-          throw new Error(`identity file is for ${m.networkKey}, but this app is on ${buildKey}`)
-        }
+        this.checkFileNetwork(m.networkKey)
         identityId = m.identityId
         masterWif = m.masterWif ?? (m.mnemonic ? (await deriveMasterKey(m.mnemonic, this.network)).wif : null)
       } else {
@@ -216,12 +245,14 @@ export class AuthController {
         masterWif = (await deriveMasterKey(input.mnemonic, this.network)).wif
       }
       if (!masterWif) throw new Error('no master key found')
+      const previous = (await listVaults(this.network)).find((v) => v.identityId === identityId)
       const sdk = await this.getSdk()
       const key = await registerLimitedKey(sdk, {
         network: this.network,
         identityId,
         masterWif,
         group: this.group(),
+        ...(previous ? { replaceKeyId: previous.keyId } : {}),
         ...(request ? { request } : {}),
       })
       masterWif = null
@@ -229,11 +260,34 @@ export class AuthController {
     })
   }
 
+  /** Refuse an identity file made for another network (a testnet key on a devnet build). */
+  checkFileNetwork(networkKey: string | null): void {
+    const buildKey = NETWORKS[this.network].key
+    if (!identityFileMatchesNetwork(networkKey, buildKey)) {
+      throw new Error(`identity file is for ${networkKey}, but this app is on ${buildKey}`)
+    }
+  }
+
   /** Adopt a limited key obtained elsewhere (identity creation, App Connect). */
   async adoptLimitedKey(identityId: string, key: LimitedKey, protection: Protection): Promise<AuthSession> {
     return this.run(() => this.adopt(identityId, key, protection))
   }
 
+  /** Open the session of a key already in the vault and unlocked (identity creation). */
+  async openStored(identityId: string, method: { passphrase: string } | 'passkey' | null, limits?: KeyLimits): Promise<AuthSession> {
+    return this.run(async () => {
+      const secret =
+        unlockedSecret(this.network, identityId) ??
+        (method === 'passkey'
+          ? await unlockWithPasskey(this.network, identityId)
+          : method !== null
+            ? await unlockWithPassphrase(this.network, identityId, method.passphrase)
+            : null)
+      if (!secret) throw new VaultLockedError('unlock to continue')
+      return this.open(secret, 'vault', limits)
+    })
+  }
+
   /** Unlock a stored vault and open its session. */
   async unlock(identityId: string, method: { passphrase: string } | 'passkey'): Promise<AuthSession> {
     return this.run(async () => {
@@ -252,14 +306,16 @@ export class AuthController {
   async loginWithRawKey(identityId: string, privateKey: string): Promise<AuthSession> {
     return this.run(async () => {
       const wif = normalizeToWif(privateKey, this.network)
-      const sdk = await this.getSdk()
-      const identity = await (sdk as unknown as { identities: { fetch(id: string): Promise<Parameters<typeof findSigningKey>[0] | undefined> } }).identities.fetch(identityId.trim())
-      if (!identity) throw new WriteAuthError(`identity ${identityId} not found on ${this.network}`)
-      const match = await findSigningKey(identity, wif, this.network, 3)
-      if (!match) throw new WriteAuthError('that key does not control a usable (HIGH or CRITICAL) authentication key of this identity')
-      const secret: VaultSecret = { identityId: identityId.trim(), keyId: match.keyId, wif }
+      const secret: VaultSecret = { identityId: identityId.trim(), keyId: -1, wif }
       holdForSession(this.network, secret)
-      return this.open(secret, 'session')
+      try {
+        return await this.open(secret, 'session')
+      } catch (e) {
+        if (e instanceof KeyNotUsableError) {
+          throw new WriteAuthError('that key does not control a usable (HIGH or CRITICAL) authentication key of this identity')
+        }
+        throw e
+      }
     })
   }
 
@@ -277,17 +333,23 @@ export class AuthController {
     this.setState({ session: { ...current, balance: balance.toString(), keyLimits } })
   }
 
-  /** Lock: forget the unlocked key (the stored vault stays; unlock to continue). */
-  lock(): void {
+  /** Lock (keep the stored key; unlock to continue). The session ends with it. */
+  logout(): void {
     lockVault()
     this.setState({ session: null, error: null })
   }
 
-  /** Sign out and forget this browser's key entirely. */
-  async logout(forget = false): Promise<void> {
-    const session = this.state.session
-    lockVault()
-    if (forget && session) await forgetVault(this.network, session.identityId)
-    this.setState({ session: null, error: null })
+  /** Delete the stored key of `identityId` from this device (ending its session if open). */
+  async forget(identityId: string): Promise<void> {
+    if (this.state.session?.identityId === identityId) this.logout()
+    await forgetVault(this.network, identityId)
+  }
+}
+
+/** The key opened no longer controls a usable key on the identity (disabled, expired, wrong). */
+export class KeyNotUsableError extends WriteAuthError {
+  constructor() {
+    super("this browser's key is no longer usable on the identity (disabled or expired) — renew it")
+    this.name = 'KeyNotUsableError'
   }
 }
diff --git a/forge-web/lib/auth/create-identity.ts b/forge-web/lib/auth/create-identity.ts
index a197feabd..0184a27c1 100644
--- a/forge-web/lib/auth/create-identity.ts
+++ b/forge-web/lib/auth/create-identity.ts
@@ -5,15 +5,19 @@
  *   1. a fresh 12-word mnemonic; the user proves they wrote it down (three words);
  *   2. the deposit address (the mnemonic's BIP-44 asset-lock key) and QR; funds arrive from
  *      any wallet (or the faucet on dev networks);
- *   3. the asset lock is built, broadcast and proven (InstantSend or chain lock);
- *   4. one IdentityCreate registers the canonical key set (MASTER, HIGH, CRITICAL auth,
- *      CRITICAL transfer, MEDIUM encryption; DIP-13 from the mnemonic, so `dg` and the bridge
- *      open the same identity) **plus** this browser's limited key (key 5: HIGH, bound to the
- *      dash-forge contract group, budget + expiry), so no second signature is needed.
+ *   3. the asset lock is built, saved to the journal, broadcast, and proven (InstantSend or
+ *      chain lock);
+ *   4. this browser's limited key is generated and **stored in the vault first**, then one
+ *      IdentityCreate registers the canonical key set (MASTER, HIGH, CRITICAL auth, CRITICAL
+ *      transfer, MEDIUM encryption; DIP-13 from the mnemonic, so `dg` and the bridge open the
+ *      same identity) plus that key (key 5: HIGH, bound to the dash-forge contract group,
+ *      budget + expiry), so no second signature is needed.
  *
- * The journal keeps only public facts between steps (the deposit address, the asset-lock
- * txid, the identity id): nothing secret. A resumed flow re-derives every key from the
- * mnemonic, which the user types again (they have it written down; step 1 made sure).
+ * The journal keeps only public facts (the deposit address, the signed asset-lock transaction
+ * and its txid, the identity id). A resumed flow re-derives every key from the mnemonic, which
+ * the user types again. If the identity already exists on resume (created, but the tab closed
+ * before the key was confirmed), the mnemonic's master key registers a fresh limited key. The
+ * caller clears the journal only once the key is adopted.
  */
 
 import type { EvoSDK } from '@dashevo/evo-sdk'
@@ -22,22 +26,23 @@ import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js'
 
 import type { Network } from '../constants'
 import { idbDelete, idbGet, idbPut } from '../idb'
+import { authSdk } from '../sdk/facade'
 import {
   broadcastTx,
   buildAssetLock,
   coreEndpoints,
+  getUtxos,
   obtainLockProof,
   waitForDeposit,
   wifBytes,
   type CoreEndpoints,
   type LockProof,
 } from './asset-lock'
-import { CANONICAL_KEYS, assetLockKeyPath, deriveAt, identityKeyPath, normalizeMnemonic } from './hd'
-import { defaultLimits, verifyLimitedKey, type LimitedKey, type LimitedKeyRequest } from './limited-key'
+import { CANONICAL_KEYS, assetLockKeyPath, deriveAt, deriveMasterKey, identityKeyPath, normalizeMnemonic } from './hd'
+import { defaultLimits, registerLimitedKey, verifyLimitedKey, type LimitedKey, type LimitedKeyRequest } from './limited-key'
 
 /** Minimum deposit (spec §2.2: 0.02 DASH; the asset-lock floor is 0.003). */
 export const MIN_DEPOSIT_DUFFS = 2_000_000
-export const DEFAULT_DEPOSIT_DUFFS = 5_000_000
 
 /** A pending creation: public facts only (no keys, no mnemonic). */
 export interface CreationJournal {
@@ -45,6 +50,8 @@ export interface CreationJournal {
   readonly depositAddress: string
   readonly identityId: string | null
   readonly lockTxid: string | null
+  /** The signed asset-lock transaction, saved before it is broadcast (hex). */
+  readonly lockRaw: string | null
   readonly startedAt: number
 }
 
@@ -60,27 +67,32 @@ export function clearCreationJournal(network: Network): Promise<void> {
   return idbDelete('journal', journalKey(network))
 }
 
+/** What an unfinished creation's deposit address holds (duffs), to warn before discarding. */
+export async function depositBalance(network: Network, address: string, endpoints = coreEndpoints(network)): Promise<number> {
+  const utxos = await getUtxos(endpoints, address)
+  return utxos.reduce((s, u) => s + u.satoshis, 0)
+}
+
 /** The deposit address a mnemonic funds (its BIP-44 asset-lock key). */
 export async function depositAddressOf(mnemonic: string, network: Network): Promise<string> {
   return (await deriveAt(mnemonic, assetLockKeyPath(network), network)).address
 }
 
-interface StatusFacade {
-  system: { status(): Promise<{ toJSON(): { chain?: { coreChainLockedHeight?: number } } }> }
-}
-
 async function platformClh(sdk: EvoSDK): Promise<number | null> {
-  const s = await (sdk as unknown as StatusFacade).system.status()
-  const h = s.toJSON()?.chain?.coreChainLockedHeight
+  const h = (await authSdk(sdk).system.status()).toJSON()?.chain?.coreChainLockedHeight
   return typeof h === 'number' ? h : null
 }
 
 export type CreateStage = 'waiting-deposit' | 'locking' | 'proving' | 'registering' | 'verifying'
 
+/** The browser key's id on a created identity: right after the canonical five. */
+export const BROWSER_KEY_ID = CANONICAL_KEYS.length
+
 /**
  * Run (or resume) the creation from the funded deposit onward. Resolves with the new identity
- * id and this browser's limited key. `mnemonic` never leaves this function's scope except as
- * derived keys inside the WASM signer, which is freed before returning.
+ * id and this browser's limited key. `persistKey` is called with the key before it is
+ * registered on chain (store it in the vault there), so a tab closed mid-create can never
+ * leave a registered key that nobody holds.
  */
 export async function createIdentityFromMnemonic(
   sdk: EvoSDK,
@@ -88,6 +100,7 @@ export async function createIdentityFromMnemonic(
     readonly network: Network
     readonly mnemonic: string
     readonly group: string
+    readonly persistKey: (identityId: string, key: { keyId: number; wif: string }) => Promise<void>
     readonly minDepositDuffs?: number
     readonly limits?: LimitedKeyRequest
     readonly endpoints?: CoreEndpoints
@@ -99,24 +112,26 @@ export async function createIdentityFromMnemonic(
   const { network, group } = params
   const mnemonic = normalizeMnemonic(params.mnemonic)
   const ep = params.endpoints ?? coreEndpoints(network)
-  const evo = await import('@dashevo/evo-sdk')
-  const { AssetLockProof, OutPoint, Identity, IdentityPublicKey, IdentitySigner, PrivateKey, ContractBounds } = evo
+  const { AssetLockProof, OutPoint, Identity, IdentityPublicKey, IdentitySigner, PrivateKey, ContractBounds } = await import('@dashevo/evo-sdk')
 
   const lockKey = await deriveAt(mnemonic, assetLockKeyPath(network), network)
-  const journal = (await readCreationJournal(network)) ?? {
+  let journal: CreationJournal = (await readCreationJournal(network)) ?? {
     network,
     depositAddress: lockKey.address,
     identityId: null,
     lockTxid: null,
+    lockRaw: null,
     startedAt: Date.now(),
   }
   if (journal.depositAddress !== lockKey.address) throw new Error('these words do not match the deposit in progress')
-  await idbPut('journal', journalKey(network), journal)
+  const save = async (patch: Partial<CreationJournal>): Promise<void> => {
+    journal = { ...journal, ...patch }
+    await idbPut('journal', journalKey(network), journal)
+  }
+  await save({})
 
-  // 1-3: deposit → asset lock → proof (resumes from a broadcast lock).
-  let lockTxid = journal.lockTxid
-  let lockRaw: Uint8Array | null = null
-  if (lockTxid === null) {
+  // 1-3: deposit → asset lock (saved before broadcast) → proof.
+  if (journal.lockTxid === null || journal.lockRaw === null) {
     params.onStage?.('waiting-deposit')
     const utxos = await waitForDeposit(ep, lockKey.address, params.minDepositDuffs ?? MIN_DEPOSIT_DUFFS, {
       signal: params.signal,
@@ -126,33 +141,45 @@ export async function createIdentityFromMnemonic(
     const priv = wifBytes(lockKey.wif)
     const lock = buildAssetLock(utxos, priv)
     priv.fill(0)
-    await broadcastTx(ep, bytesToHex(lock.raw), lock.txid)
-    lockTxid = lock.txid
-    lockRaw = lock.raw
-    await idbPut('journal', journalKey(network), { ...journal, lockTxid })
+    await save({ lockTxid: lock.txid, lockRaw: bytesToHex(lock.raw) })
   }
+  const lockTxid = journal.lockTxid as string
+  const lockRaw = hexToBytes(journal.lockRaw as string)
+  // Idempotent: re-sending an accepted transaction is a no-op the explorer tolerates.
+  await broadcastTx(ep, bytesToHex(lockRaw), lockTxid)
   params.onStage?.('proving')
-  if (lockRaw === null) lockRaw = await fetchRaw(ep, lockTxid)
   const proof: LockProof = await obtainLockProof(ep, { txid: lockTxid, raw: lockRaw }, () => platformClh(sdk), {
     signal: params.signal,
     onStatus: (s) => params.onStage?.('proving', s),
   })
-
   const assetLockProof =
     proof.type === 'instant'
       ? AssetLockProof.createInstantAssetLockProof(proof.islock, proof.raw, 0)
       : AssetLockProof.createChainAssetLockProof(proof.height, new OutPoint(proof.txid, 0))
   const identityId = assetLockProof.createIdentityId().toBase58()
-  await idbPut('journal', journalKey(network), { ...journal, lockTxid, identityId })
+  await save({ identityId })
 
-  // 4: IdentityCreate with the canonical keys + this browser's limited key.
-  params.onStage?.('registering')
   const limits = params.limits ?? defaultLimits()
+  const exists = (await authSdk(sdk).identities.balance(identityId).catch(() => undefined)) !== undefined
+  if (exists) {
+    // Created by an earlier run whose browser key was lost: the master key renews it.
+    params.onStage?.('registering', 'The identity exists; registering a key for this browser…')
+    const master = await deriveMasterKey(mnemonic, network)
+    // The earlier run's key 5 may be live (its vault copy is locked or gone): disable it in
+    // the same update, so no key nobody holds stays live.
+    const key = await registerLimitedKey(sdk, { network, identityId, masterWif: master.wif, group, request: limits, replaceKeyId: BROWSER_KEY_ID })
+    await params.persistKey(identityId, key)
+    return { identityId, key }
+  }
+
+  // 4: the browser key goes to the vault first, then IdentityCreate registers it.
+  params.onStage?.('registering')
+  const browserKey = PrivateKey.fromBytes(crypto.getRandomValues(new Uint8Array(32)), network === 'mainnet' ? 'mainnet' : 'testnet')
+  const wif = browserKey.toWIF()
+  await params.persistKey(identityId, { keyId: BROWSER_KEY_ID, wif })
   const identity = new Identity(identityId)
   const signer = new IdentitySigner()
-  const browserKey = PrivateKey.fromBytes(crypto.getRandomValues(new Uint8Array(32)), network === 'mainnet' ? 'mainnet' : 'testnet')
   const assetLockPrivateKey = PrivateKey.fromWIF(lockKey.wif)
-  const browserKeyId = CANONICAL_KEYS.length
   try {
     for (const k of CANONICAL_KEYS) {
       const d = await deriveAt(mnemonic, identityKeyPath(network, k.id), network)
@@ -170,7 +197,7 @@ export async function createIdentityFromMnemonic(
     }
     identity.addPublicKey(
       new IdentityPublicKey({
-        keyId: browserKeyId,
+        keyId: BROWSER_KEY_ID,
         purpose: 'authentication',
         securityLevel: 'high',
         keyType: 'ecdsa_secp256k1',
@@ -182,32 +209,14 @@ export async function createIdentityFromMnemonic(
       }),
     )
     signer.addKey(browserKey)
-    const existing = await (sdk as unknown as { identities: { balance(id: string): Promise<bigint | undefined> } }).identities
-      .balance(identityId)
-      .catch(() => undefined)
-    if (existing === undefined) {
-      await (sdk as unknown as { identities: { create(o: unknown): Promise<void> } }).identities.create({
-        identity,
-        assetLockProof,
-        assetLockPrivateKey,
-        signer,
-      })
-    }
+    await authSdk(sdk).identities.create({ identity, assetLockProof, assetLockPrivateKey, signer })
   } finally {
     signer.free()
     assetLockPrivateKey.free()
+    browserKey.free()
   }
-  const wif = browserKey.toWIF()
-  browserKey.free()
 
   params.onStage?.('verifying')
-  const verified = await verifyLimitedKey(sdk, identityId, browserKeyId, group, network, wif)
-  await clearCreationJournal(network)
-  return { identityId, key: { keyId: browserKeyId, wif, limits: verified } }
-}
-
-async function fetchRaw(ep: CoreEndpoints, id: string): Promise<Uint8Array> {
-  const res = await fetch(`${ep.insight}/rawtx/${id}`)
-  if (!res.ok) throw new Error(`could not refetch asset lock ${id}`)
-  return hexToBytes(((await res.json()) as { rawtx: string }).rawtx)
+  const verified = await verifyLimitedKey(sdk, identityId, BROWSER_KEY_ID, group, network, wif)
+  return { identityId, key: { keyId: BROWSER_KEY_ID, wif, limits: verified } }
 }
diff --git a/forge-web/lib/auth/identity-file.ts b/forge-web/lib/auth/identity-file.ts
index 609e72bbd..54eec6d55 100644
--- a/forge-web/lib/auth/identity-file.ts
+++ b/forge-web/lib/auth/identity-file.ts
@@ -77,11 +77,8 @@ function levelRank(level: string): number {
  */
 const WIF_SIGNABLE_KEY_TYPES = new Set(['ECDSA_SECP256K1', 'ECDSA_HASH160'])
 
-/**
- * Parse a bridge-format identity JSON. Throws a descriptive error if it lacks an identity id
- * or any usable AUTHENTICATION signing key.
- */
-export function parseIdentityFile(json: unknown): ParsedIdentityFile {
+/** The header every identity file carries: its id, network and raw key list. */
+function fileHeader(json: unknown): { obj: Record<string, unknown>; identityId: string; network: Network | null; networkKey: string | null; rawKeys: unknown } {
   if (json === null || typeof json !== 'object') {
     throw new Error('identity file must be a JSON object')
   }
@@ -92,8 +89,24 @@ export function parseIdentityFile(json: unknown): ParsedIdentityFile {
   }
   const network = normalizeNetwork(obj['network'])
   const networkKey = network === null ? null : (obj['network'] as string)
+  return { obj, identityId, network, networkKey, rawKeys: obj['identityKeys'] ?? obj['keys'] }
+}
+
+function parseJson(text: string): unknown {
+  try {
+    return JSON.parse(text)
+  } catch (e) {
+    throw new Error(`identity file is not valid JSON: ${(e as Error).message}`)
+  }
+}
+
+/**
+ * Parse a bridge-format identity JSON. Throws a descriptive error if it lacks an identity id
+ * or any usable AUTHENTICATION signing key.
+ */
+export function parseIdentityFile(json: unknown): ParsedIdentityFile {
+  const { identityId, network, networkKey, rawKeys } = fileHeader(json)
 
-  const rawKeys = obj['identityKeys'] ?? obj['keys']
   if (!Array.isArray(rawKeys)) {
     throw new Error('identity file is missing an "identityKeys" array')
   }
@@ -138,19 +151,7 @@ export interface MasterMaterial {
  * Nothing else is kept: the other keys in the file are never used by the browser.
  */
 export function masterMaterialFromFile(text: string): MasterMaterial {
-  let json: unknown
-  try {
-    json = JSON.parse(text)
-  } catch (e) {
-    throw new Error(`identity file is not valid JSON: ${(e as Error).message}`)
-  }
-  if (json === null || typeof json !== 'object') throw new Error('identity file must be a JSON object')
-  const obj = json as Record<string, unknown>
-  const identityId = asString(obj['identityId']) ?? asString(obj['id'])
-  if (identityId === null) throw new Error('identity file is missing "identityId"')
-  const network = normalizeNetwork(obj['network'])
-  const networkKey = network === null ? null : (obj['network'] as string)
-  const rawKeys = obj['identityKeys'] ?? obj['keys']
+  const { obj, identityId, networkKey, rawKeys } = fileHeader(parseJson(text))
   let masterWif: string | null = null
   if (Array.isArray(rawKeys)) {
     for (const raw of rawKeys as RawKey[]) {
@@ -174,11 +175,5 @@ export function masterMaterialFromFile(text: string): MasterMaterial {
 
 /** Parse identity-file text (JSON string) with a friendly error on malformed JSON. */
 export function parseIdentityFileText(text: string): ParsedIdentityFile {
-  let json: unknown
-  try {
-    json = JSON.parse(text)
-  } catch (e) {
-    throw new Error(`identity file is not valid JSON: ${(e as Error).message}`)
-  }
-  return parseIdentityFile(json)
+  return parseIdentityFile(parseJson(text))
 }
diff --git a/forge-web/lib/auth/limited-key.ts b/forge-web/lib/auth/limited-key.ts
index 52787dcca..e98971d72 100644
--- a/forge-web/lib/auth/limited-key.ts
+++ b/forge-web/lib/auth/limited-key.ts
@@ -18,6 +18,7 @@ import type { EvoSDK } from '@dashevo/evo-sdk'
 
 import type { Network } from '../constants'
 import { CREDITS_PER_DASH } from '../sdk/cost'
+import { authSdk, type WasmKey } from '../sdk/facade'
 import type { KeyLimits } from '../view/funds'
 
 /** Browser key defaults (spec §2.1). */
@@ -44,34 +45,14 @@ export interface LimitedKey {
   readonly limits: KeyLimits
 }
 
-interface WasmKey {
-  readonly keyId: number
-  readonly purposeNumber: number
-  readonly securityLevelNumber: number
-  readonly disabledAt?: bigint
-  readonly totalBudget?: bigint
-  readonly expiresAt?: bigint
-  readonly contractBounds?: { toJSON(): { $type: string; id: string } }
-  validatePrivateKey(bytes: Uint8Array, network: string): boolean
-}
-interface WasmIdentity {
-  readonly publicKeys: WasmKey[]
-  readonly balance: bigint
-}
-interface IdentitiesFacade {
-  fetch(id: string): Promise<WasmIdentity | undefined>
-  update(options: unknown): Promise<void>
-  keysRemainingBudgets(id: string, keyIds: number[]): Promise<Map<number, bigint | null>>
-}
-
-function identities(sdk: EvoSDK): IdentitiesFacade {
-  return (sdk as unknown as { identities: IdentitiesFacade }).identities
-}
-
 /**
  * Register a limited key on `identityId`, signed once by `masterWif`. Generates the new key
  * in the WASM (never exposed until returned), registers it, verifies on chain that it landed
  * with exactly the requested bounds, budget and expiry, and returns it.
+ *
+ * `replaceKeyId`: a renewal disables this browser's previous limited key in the same update,
+ * so renewing never leaves a live key nobody holds. Only a live group-bound HIGH key is
+ * disabled; anything else named is ignored.
  */
 export async function registerLimitedKey(
   sdk: EvoSDK,
@@ -81,11 +62,12 @@ export async function registerLimitedKey(
     readonly masterWif: string
     readonly group: string
     readonly request?: LimitedKeyRequest
+    readonly replaceKeyId?: number
   },
 ): Promise<LimitedKey> {
   const { IdentityPublicKeyInCreation, ContractBounds, IdentitySigner, PrivateKey } = await import('@dashevo/evo-sdk')
   const request = params.request ?? defaultLimits()
-  const identity = await identities(sdk).fetch(params.identityId)
+  const identity = await authSdk(sdk).identities.fetch(params.identityId)
   if (!identity) throw new Error(`identity ${params.identityId} not found on ${params.network}`)
 
   // The master key must be one of this identity's MASTER keys; say so plainly rather than
@@ -117,7 +99,20 @@ export async function registerLimitedKey(
       totalBudget: request.budgetCredits,
       expiresAt: BigInt(request.expiresAt),
     })
-    await identities(sdk).update({ identity, addPublicKeys: [key], signer })
+    const old = identity.publicKeys.find((k) => k.keyId === params.replaceKeyId)
+    const disable =
+      old && old.disabledAt === undefined && old.securityLevelNumber === 2 && old.contractBounds?.toJSON().id === params.group
+        ? [old.keyId]
+        : []
+    try {
+      await authSdk(sdk).identities.update({ identity, addPublicKeys: [key], ...(disable.length ? { disablePublicKeys: disable } : {}), signer })
+    } catch (e) {
+      // Two tabs registering at once both pick max+1; the second is refused.
+      if (/revision|duplicate|already exists|key id/i.test(String((e as { message?: unknown })?.message ?? e))) {
+        throw new Error('another key was registered on this identity at the same moment; try again')
+      }
+      throw e
+    }
   } finally {
     signer.free()
     master.free()
@@ -149,7 +144,7 @@ export async function verifyLimitedKey(
   network: Network,
   wif?: string,
 ): Promise<KeyLimits> {
-  const identity = await identities(sdk).fetch(identityId)
+  const identity = await authSdk(sdk).identities.fetch(identityId)
   const k = identity?.publicKeys.find((x) => x.keyId === keyId)
   if (!k) throw new Error(`key ${keyId} is not on identity ${identityId}`)
   if (k.disabledAt !== undefined) throw new Error(`key ${keyId} is disabled`)
@@ -174,13 +169,13 @@ export async function verifyLimitedKey(
 
 /** What is left of a key's budget (null when it has none). */
 export async function readRemainingBudget(sdk: EvoSDK, identityId: string, keyId: number): Promise<bigint | null> {
-  const map = await identities(sdk).keysRemainingBudgets(identityId, [keyId])
+  const map = await authSdk(sdk).identities.keysRemainingBudgets(identityId, [keyId])
   return map.get(keyId) ?? null
 }
 
 /** The limits of a key already on the identity (for a session resumed from the vault). */
 export async function readKeyLimits(sdk: EvoSDK, identityId: string, keyId: number): Promise<KeyLimits | null> {
-  const identity = await identities(sdk).fetch(identityId)
+  const identity = await authSdk(sdk).identities.fetch(identityId)
   const k = identity?.publicKeys.find((x) => x.keyId === keyId)
   if (!k) return null
   if (k.totalBudget === undefined && k.expiresAt === undefined) return null
diff --git a/forge-web/lib/auth/vault.ts b/forge-web/lib/auth/vault.ts
index dfd57fa18..69036e7df 100644
--- a/forge-web/lib/auth/vault.ts
+++ b/forge-web/lib/auth/vault.ts
@@ -158,13 +158,17 @@ export function passkeysAvailable(): boolean {
  * Create a passkey for the vault and evaluate its PRF. Returns null when the authenticator
  * does not support `prf` (the caller falls back to a passphrase). Some authenticators only
  * report `prf.enabled` at creation and need a get() to produce output; both are handled.
+ *
+ * Every passkey gets a random WebAuthn `user.id`: platform authenticators replace a
+ * discoverable credential with the same (rpId, user.id), so a shared id would let a second
+ * identity's enrolment silently destroy the first identity's only unlock method.
  */
-export async function enrollPasskey(identityId: string, label: string): Promise<{ credentialId: Uint8Array; prfSalt: Uint8Array; output: Uint8Array } | null> {
+export async function enrollPasskey(label: string): Promise<{ credentialId: Uint8Array; prfSalt: Uint8Array; output: Uint8Array } | null> {
   const prfSalt = random(32)
   const cred = (await navigator.credentials.create({
     publicKey: {
       rp: { id: rpId(), name: 'Dash Forge' },
-      user: { id: buf(sha256(enc.encode(identityId))), name: label, displayName: label },
+      user: { id: buf(random(32)), name: label, displayName: label },
       challenge: buf(random(32)),
       pubKeyCredParams: [
         { type: 'public-key', alg: -7 },
@@ -314,6 +318,15 @@ export async function forgetVault(network: Network, identityId: string): Promise
 // The unlocked secret: module memory only.
 let unlocked: { network: Network; secret: VaultSecret; at: number } | null = null
 let lockTimer: ReturnType<typeof setTimeout> | null = null
+const lockListeners = new Set<() => void>()
+
+/** Be told when the vault locks (auto-lock, sign-out). Returns an unsubscribe function. */
+export function onVaultLock(listener: () => void): () => void {
+  lockListeners.add(listener)
+  return () => {
+    lockListeners.delete(listener)
+  }
+}
 
 function setUnlocked(network: Network, secret: VaultSecret): void {
   unlocked = { network, secret, at: Date.now() }
@@ -341,7 +354,9 @@ export function unlockedSecret(network: Network, identityId: string): VaultSecre
 
 /** Forget the unlocked secret (sign-out, auto-lock). The stored record stays. */
 export function lockVault(): void {
+  const wasUnlocked = unlocked !== null
   unlocked = null
   if (lockTimer) clearTimeout(lockTimer)
   lockTimer = null
+  if (wasUnlocked) for (const l of lockListeners) l()
 }
diff --git a/forge-web/lib/sdk/facade.ts b/forge-web/lib/sdk/facade.ts
new file mode 100644
index 000000000..da73cf878
--- /dev/null
+++ b/forge-web/lib/sdk/facade.ts
@@ -0,0 +1,67 @@
+/**
+ * One typed view of the evo-sdk facades the auth layer uses. The wasm-bindgen `.d.ts` types
+ * resolve loosely across builds; narrowing through these shapes in one place keeps every call
+ * site free of `as unknown as` casts.
+ */
+
+import type { EvoSDK } from '@dashevo/evo-sdk'
+
+/** An identity public key, as the auth layer reads it. */
+export interface WasmKey {
+  readonly keyId: number
+  readonly purposeNumber: number
+  readonly securityLevelNumber: number
+  readonly disabledAt?: bigint
+  readonly totalBudget?: bigint
+  readonly expiresAt?: bigint
+  readonly contractBounds?: { toJSON(): { $type: string; id: string } }
+  validatePrivateKey(bytes: Uint8Array, network: string): boolean
+}
+
+export interface WasmIdentity {
+  readonly publicKeys: WasmKey[]
+  readonly balance: bigint
+  getPublicKeyById(keyId: number): unknown
+}
+
+export interface AuthSdk {
+  identities: {
+    fetch(id: string): Promise<WasmIdentity | undefined>
+    balance(id: string): Promise<bigint | undefined>
+    update(options: unknown): Promise<void>
+    create(options: unknown): Promise<void>
+    keysRemainingBudgets(id: string, keyIds: number[]): Promise<Map<number, bigint | null>>
+  }
+  documents: { query(q: unknown): Promise<Map<string, unknown>> }
+  contracts: { fetch(id: string): Promise<unknown> }
+  system: { status(): Promise<{ toJSON(): { chain?: { coreChainLockedHeight?: number } } }> }
+}
+
+/** The typed facades of a connected SDK. */
+export function authSdk(sdk: EvoSDK): AuthSdk {
+  return sdk as unknown as AuthSdk
+}
+
+/** A sleep that ends early (rejecting with AbortError) when `signal` aborts. */
+export function sleep(ms: number, signal?: AbortSignal): Promise<void> {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new DOMException('cancelled', 'AbortError'))
+      return
+    }
+    const onAbort = (): void => {
+      clearTimeout(t)
+      reject(new DOMException('cancelled', 'AbortError'))
+    }
+    const t = setTimeout(() => {
+      signal?.removeEventListener('abort', onAbort)
+      resolve()
+    }, ms)
+    signal?.addEventListener('abort', onAbort, { once: true })
+  })
+}
+
+/** Whether `e` is the rejection of an aborted operation. */
+export function isAbort(e: unknown): boolean {
+  return e instanceof DOMException && e.name === 'AbortError'
+}

From 31e624f868473cd9f4876252379aad51d214bc93 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sat, 26 Sep 2026 12:30:37 -0500
Subject: [PATCH 5/9] test(web): v1 file sign-in goes through the Import tile

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 forge-web/e2e/auth-write.spec.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/forge-web/e2e/auth-write.spec.ts b/forge-web/e2e/auth-write.spec.ts
index 756868b04..5fb3dc8d3 100644
--- a/forge-web/e2e/auth-write.spec.ts
+++ b/forge-web/e2e/auth-write.spec.ts
@@ -35,6 +35,8 @@ test.describe('auth + write (opt-in via E2E_AUTH=1)', () => {
     // Open the login modal from the header sign-in affordance.
     await page.getByRole('button', { name: /sign in/i }).first().click()
     await expect(page.getByText(/Sign in to Dash Forge/i)).toBeVisible()
+    // Testnet has no Forge contract group, so the only tile is the v1 identity-file import.
+    await page.getByTestId('tile-import').click()
 
     // Upload the identity file straight into the (visually hidden) file input.
     await page.setInputFiles('input[type="file"]', IDENTITY_PATH)

From 7e6bed86be8a0f19db1689f825b0ce9caa586e5a Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sat, 26 Sep 2026 12:45:21 -0500
Subject: [PATCH 6/9] fix(web): address the vault and key-handling security
 review

Asset-lock inputs are proven from their raw funding transactions (hash checked against the txid, value and script parsed from the bytes), so a lying explorer can no longer burn a deposit; the fee is asserted. App Connect asks for the dash-forge group, pages through every reply, retries a reply whose key is not visible yet, refuses when two identities answer, and makes the user confirm the full identity id and DPNS name. The vault refuses to run on shared origins (github.io project sites, IPFS path gateways), pins the Argon2 parameters instead of reading them from the record, and clears signed retry writes on sign-out and forget. Keys: random passkey user ids, renewal disables the previous key, Revoke on chain in Settings (forgetting is not revoking), verifyLimitedKey rejects expired or spent keys and checks the requested limits, the group is checked on chain to hold forge-core and forge-collab before a key binds to it, the raw-key path accepts only HIGH or CRITICAL. Secrets (identity file text, mnemonic, PRF output, granted WIF) live in refs, not React state. CSP drops 'unsafe-eval'. docs/guides/identity-and-keys.md documents the trust roots and the vault's limits.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 docs/guides/identity-and-keys.md              | 75 +++++++++++----
 forge-web/app/layout.tsx                      |  8 +-
 .../components/auth/create-identity-flow.tsx  | 19 +++-
 .../components/auth/protection-fields.tsx     | 19 +++-
 .../components/auth/wallet-connect-flow.tsx   | 55 +++++++----
 forge-web/components/keys-panel.tsx           | 43 ++++++++-
 forge-web/components/login-modal.tsx          | 28 ++++--
 forge-web/contexts/auth-context.tsx           |  5 +-
 forge-web/lib/auth/app-connect.ts             | 91 +++++++++++++-----
 forge-web/lib/auth/asset-lock.ts              | 96 +++++++++++++++++--
 forge-web/lib/auth/auth-v2.test.ts            | 66 ++++++++++++-
 forge-web/lib/auth/controller.ts              | 49 +++++++++-
 forge-web/lib/auth/create-identity.ts         |  7 +-
 forge-web/lib/auth/limited-key.ts             | 63 +++++++++++-
 forge-web/lib/auth/vault.ts                   | 48 +++++++++-
 15 files changed, 567 insertions(+), 105 deletions(-)

diff --git a/docs/guides/identity-and-keys.md b/docs/guides/identity-and-keys.md
index 62ed2415b..c3b407268 100644
--- a/docs/guides/identity-and-keys.md
+++ b/docs/guides/identity-and-keys.md
@@ -8,7 +8,9 @@ On Dash Forge, your account is a **Dash Platform identity**. No company holds it
 4. [Where keys live today](#where-keys-live-today)
 5. [Never paste a master key into a web page](#never-paste-a-master-key-into-a-web-page)
 6. [Rotating and disabling keys](#rotating-and-disabling-keys)
-7. [Limited keys (coming with protocol 14)](#limited-keys-coming-with-protocol-14)
+7. [Limited keys and the web app](#limited-keys-and-the-web-app)
+8. [The browser vault and its limits](#the-browser-vault-and-its-limits)
+9. [Trust roots](#trust-roots)
 
 ---
 
@@ -75,15 +77,16 @@ Your **repository data** needs no backup of its own. Refs, issues and PRs are on
 | `dg` | A copy of the identity file in `~/.config/dash-forge/identities/<network>/<id>.identity.json` | `--identity <file>` > `DASH_FORGE_KEY` > the default recorded by `dg auth login` |
 | `git-remote-dash` | The same file | `DASH_FORGE_KEY`, else `~/.config/dash-forge/identities/<owner>.identity.json` |
 | `forge-import` | The same file | `--identity <file>` > `DASH_FORGE_KEY` |
-| Web app | The CRITICAL (or HIGH) key's private key, **unencrypted** in the browser's `localStorage` | Loaded from an identity file or pasted in the **Sign in** dialog |
+| Web app, forge-v2 networks (devnet moutai) | A **limited key** only, encrypted in the browser's IndexedDB (passkey or passphrase), unlocked for the session | Registered once from your identity file, recovery phrase, a new identity, or your wallet; see [below](#limited-keys-and-the-web-app) |
+| Web app, testnet (v1) | The file's CRITICAL (or HIGH) key, held in the tab's memory only; gone on reload | Loaded from an identity file in the **Sign in** sheet |
 
 Things to know:
 
 - `DASH_FORGE_KEY` holds a **path** to an identity file today, not the key itself.
 - The identity file on disk is plaintext JSON. Protect it with file permissions and full-disk encryption.
-- In the web app, the key stays in that browser (it is never sent anywhere), but any script running on the page could read it. Sign out on shared machines. That removes it.
+- In the web app, the key never leaves that browser, but any script running on the page can use it while it is unlocked ([details](#the-browser-vault-and-its-limits)). Lock or sign out on shared machines.
 
-**Coming soon:** keys in the OS keychain (macOS Keychain, Secret Service, Windows Credential Manager) with a passphrase-encrypted fallback file; `dg auth new` to create an identity from the terminal; a browser key vault encrypted with a passkey or passphrase; `dg auth export` to write a backup file.
+**Coming soon:** keys in the OS keychain (macOS Keychain, Secret Service, Windows Credential Manager) with a passphrase-encrypted fallback file; `dg auth new` to create an identity from the terminal; `dg auth export` to write a backup file.
 
 ---
 
@@ -92,11 +95,12 @@ Things to know:
 A web page is whoever served it. If the page, or a script it loads, is compromised, anything you paste into it is gone.
 
 - **Never paste your MASTER key, your 12 words, or your main identity file into a website.** That includes forge.dashhq.org. Nothing on Forge needs them.
-- The web app's sign-in picks the CRITICAL key (or HIGH) from the file you load. It does not store the MASTER key or the mnemonic, but it does read the whole file you choose. If you want to be careful, give it a copy that contains only the HIGH or CRITICAL key (the `jq` recipe in the [mirror guide](mirror-a-github-repo.md#the-ci-secret) makes one).
+- On forge-v2 networks the web app's **Import** reads your identity file (or recovery phrase) once: its master key signs one update that registers a [limited key](#limited-keys-and-the-web-app) for this browser, and is not retained. If you would rather not load the master key into a web page at all, use **Use my Dash wallet** instead (the wallet registers the key), or register a limited key with `dg` once that lands.
+- On testnet (v1) the sign-in picks the CRITICAL key (or HIGH) from the file you load and keeps it in the tab only. It does not store the MASTER key or the mnemonic, but it does read the whole file you choose. If you want to be careful, give it a copy that contains only the HIGH or CRITICAL key (the `jq` recipe in the [mirror guide](mirror-a-github-repo.md#the-ci-secret) makes one).
 - The same goes for CI: give a pipeline a stripped copy or, better, a separate identity with a small balance.
 - Prefer a copy of the web app that you [serve yourself](verify-forge.md#run-your-own-copy-of-the-web-app) if you do not want to trust the one on forge.dashhq.org.
 
-When limited keys arrive (below), the web app will never see anything but a limited key. The master key will be used only in one-time steps, such as registering a limited key.
+With limited keys (below) the web app keeps nothing but a limited key. The master key is used only in one-time steps: registering, renewing or revoking a limited key.
 
 ---
 
@@ -122,28 +126,41 @@ If the **MASTER** key or the 12 words leak, rotating does not help: whoever has
 
 ---
 
-## Limited keys (coming with protocol 14)
+## Limited keys and the web app
 
-*Available on devnet moutai once client support lands; mainnet after Platform protocol 14 activates.*
+*Live in the web app on devnet moutai (protocol 14). Mainnet after Platform protocol 14 activates. CLI support (`dg auth …`) is coming.*
 
-Protocol 14 adds keys with a **spending budget and an expiry**, bound to the Forge contracts. A limited key can spend at most its budget, only on Forge documents, and only until it expires. It cannot touch your other keys or move credits.
+A limited key is an identity key with four restrictions:
 
-The planned defaults:
+- AUTHENTICATION purpose, HIGH security level;
+- bound to the `dash-forge` **contract group**: it can sign batches on forge-core and forge-collab only. Identity updates, credit transfers and writes to any other contract are refused at consensus;
+- a **budget**: the most its transitions can ever take from your identity;
+- an **expiry**.
 
 | Where | Budget | Expires |
 |---|---|---|
 | Browser | 0.05 DASH | 90 days |
-| CLI | 0.25 DASH | 180 days |
-| CI runner (Mirror Action) | 0.5 DASH | 365 days |
+| CLI (planned) | 0.25 DASH | 180 days |
+| CI runner (Mirror Action, planned) | 0.5 DASH | 365 days |
 
-With limited keys:
+Ways to get one in the web app (**Sign in**):
 
-- the **master key never lives in the browser, on disk unencrypted, or in CI**. It signs only one-time ceremonies: registering a limited key, a username, or an encryption key;
-- losing a device costs nothing beyond that key's remaining budget. Register a new limited key and disable the old one;
-- the web app will show the key's remaining budget and expiry, and warn when either runs low;
-- CI gets one pasteable value, `DASH_FORGE_KEY=dfk1:<network>:<identity id>:<key id>:<wif>`, in place of a file.
+| Route | What happens |
+|---|---|
+| Import an identity file or recovery phrase | Your master key signs one IdentityUpdate that adds the limited key. It is used once and not retained. |
+| Create a new identity | 12 words, a short backup check, then a deposit from any Dash wallet (the faucet on devnets). One IdentityCreate registers the standard key set plus this browser's limited key, so no second signature is needed. |
+| Use my Dash wallet (App Connect) | Your wallet registers the limited key and hands it over encrypted. **Check that the identity shown is yours**: a response does not prove who answered, and anyone who saw the QR code could answer. The app refuses if more than one identity answers. |
+| Advanced: paste a key | A HIGH or CRITICAL key, for this tab only. It has no limits Forge set. Never paste a master key. |
 
-The planned commands (**not available yet**):
+The header shows your balance and the key's remaining budget. It turns amber when the budget drops under 20 % or expiry is less than 7 days away, and red when the key is spent or expired. **Settings → This browser's key** shows the budget and expiry and has these actions:
+
+- **Renew key** registers a fresh key and disables the previous one in the same update.
+- **Revoke on chain** disables this browser's key. It needs your identity file once.
+- **Sign out & forget key** deletes the key from this device. Forgetting is **not** revoking: a forgotten key stays valid on chain until it expires.
+
+Losing a device costs nothing beyond that key's remaining budget. Register a new key and disable the old one.
+
+The planned CLI (**not available yet**):
 
 ```sh
 dg auth new [--amount 0.05] [--name alice]      # create + fund an identity from the terminal
@@ -152,3 +169,25 @@ dg auth keys add --budget 0.25 --expires 180d --bound dash-forge
 dg auth keys disable <id>
 dg auth name register <label>
 ```
+
+CI will get one pasteable value, `DASH_FORGE_KEY=dfk1:<network>:<identity id>:<key id>:<wif>`, in place of a file.
+
+---
+
+## The browser vault and its limits
+
+The limited key is stored in IndexedDB, encrypted with AES-256-GCM. The data key is wrapped by a passkey's PRF output (stretched with HKDF), by Argon2id of your passphrase (64 MiB, 3 passes, 16-byte salt), or by both. Each ciphertext is bound to its network and identity. Unlocked, the key lives only in page memory. It locks after 12 hours, and is cleared when you lock or sign out.
+
+What the vault does **not** protect against:
+
+- **Script running in the page.** The vault protects the key at rest. While it is unlocked, any script running on the page (an XSS) can use it. The page's CSP allows inline scripts, which Next's static bootstrap needs. It does not allow JavaScript `eval`, only `wasm-unsafe-eval` for the SDK's WebAssembly.
+- **Clickjacking where the host cannot send headers.** `frame-ancestors` only works as an HTTP header, and GitHub Pages cannot send one, so the Pages deployment can be framed. Serve the app from a host that sends `Content-Security-Policy: frame-ancestors 'none'` if that matters to you.
+- **A shared origin.** On a GitHub Pages project site (`*.github.io/<repo>`) or an IPFS path gateway (`ipfs.io/ipfs/…`), other sites share the origin and could read the vault or ask the browser for the passkey's PRF output. So the app refuses to create or unlock a vault there. Browsing still works. Use <https://forge.dashhq.org> (the Pages deployment's custom domain, set in the repository's Pages settings) or an IPFS subdomain gateway (`<cid>.ipfs.dweb.link`).
+
+---
+
+## Trust roots
+
+- **The contract group id** comes from `forge-contracts/deployments/<network>.json`, which is built into the app. Before binding a key to the group, the app checks on chain that the group holds forge-core and forge-collab. The group's owner (and any admins) can **add** contracts to it later, and every group-bound key can then sign for those contracts too. Binding a key to the group means trusting its owner. On devnet moutai that is the deployer `8HGxMu4atPn4jThH5h9X1MajzhoD3PRnzCRGrAsFcLcV`.
+- **The block explorer** (Insight, changeable in Settings) is used only while creating an identity. Its amounts are not trusted: each deposit output is proven from its raw funding transaction, fetched and hashed against its txid, before the asset lock is signed. A lying explorer can delay you or hide funds, but it cannot redirect or burn them. The asset lock is broadcast through the explorer, because the SDK has no Core broadcast. If the explorer drops it, the signed bytes are kept and sent again.
+- **The quorum keys** every proof is checked against come from `quorums.<network>.networks.dash.org`, as for every read.
diff --git a/forge-web/app/layout.tsx b/forge-web/app/layout.tsx
index 3468df50d..70df4d7a8 100644
--- a/forge-web/app/layout.tsx
+++ b/forge-web/app/layout.tsx
@@ -10,12 +10,16 @@ export const metadata: Metadata = {
 }
 
 // CSP is delivered via <meta> so it survives static export (yappr pattern).
-// - script 'unsafe-eval' + 'wasm-unsafe-eval': required by the evo-sdk WASM runtime.
+// - script 'wasm-unsafe-eval': the evo-sdk WASM runtime. JS 'unsafe-eval' is not granted
+//   (verified: reads, writes and sign-in run without it). 'unsafe-inline' stays for Next's
+//   inline bootstrap scripts.
+// - frame-ancestors is ignored in a <meta> CSP; the host must send it as a header (GitHub
+//   Pages cannot; see docs/guides/identity-and-keys.md).
 // - connect-src https:/wss:: DAPI endpoints + IPFS/S3/HTTPS pack backends.
 // - worker-src blob:: materialization / search / pack workers run off-main-thread.
 const CSP = [
   "default-src 'self'",
-  "script-src 'self' 'unsafe-eval' 'wasm-unsafe-eval' 'unsafe-inline'",
+  "script-src 'self' 'wasm-unsafe-eval' 'unsafe-inline'",
   "style-src 'self' 'unsafe-inline'",
   "img-src 'self' data: https: blob:",
   "font-src 'self'",
diff --git a/forge-web/components/auth/create-identity-flow.tsx b/forge-web/components/auth/create-identity-flow.tsx
index 08250f548..01e9ebaed 100644
--- a/forge-web/components/auth/create-identity-flow.tsx
+++ b/forge-web/components/auth/create-identity-flow.tsx
@@ -15,7 +15,7 @@
  * unmounts, and the buttons are disabled while a run is active.
  */
 
-import { useEffect, useMemo, useRef, useState } from 'react'
+import { useEffect, useRef, useState } from 'react'
 import { AlertTriangle, Check, Loader2 } from 'lucide-react'
 import { useAuth } from '@/contexts/auth-context'
 import { Button } from '@/components/ui/button'
@@ -54,7 +54,15 @@ export function CreateIdentityFlow({ onDone }: { onDone: () => void }): JSX.Elem
   const { controller, reloadVaults } = useAuth()
   const network = ACTIVE_NETWORK.network
   const [step, setStep] = useState<Step>('loading')
-  const [mnemonic, setMnemonic] = useState<string | null>(null)
+  // The words are the identity: held in a ref (not React state) and dropped on unmount. They
+  // are rendered once for the backup, which is unavoidable; nothing else keeps them.
+  const mnemonicRef = useRef<string | null>(null)
+  const [wordsShown, setWordsShown] = useState(0)
+  const mnemonic = wordsShown > 0 ? mnemonicRef.current : null
+  const setMnemonic = (m: string | null): void => {
+    mnemonicRef.current = m
+    setWordsShown((n) => n + 1)
+  }
   const [positions, setPositions] = useState<number[]>([])
   const [answers, setAnswers] = useState<string[]>(['', '', ''])
   const [journal, setJournal] = useState<CreationJournal | null>(null)
@@ -64,9 +72,10 @@ export function CreateIdentityFlow({ onDone }: { onDone: () => void }): JSX.Elem
   const [error, setError] = useState<string | null>(null)
   const [running, setRunning] = useState(false)
   const [resumeWords, setResumeWords] = useState('')
+  // Cleared as soon as a run starts (start() empties it).
   const [discardWarning, setDiscardWarning] = useState<string | null>(null)
   const { fields, protection, problem } = useProtection()
-  const words = useMemo(() => mnemonic?.split(' ') ?? [], [mnemonic])
+  const words = mnemonic?.split(' ') ?? []
   const run = useRef<AbortController | null>(null)
 
   useEffect(() => {
@@ -89,6 +98,7 @@ export function CreateIdentityFlow({ onDone }: { onDone: () => void }): JSX.Elem
     return () => {
       cancelled = true
       run.current?.abort()
+      mnemonicRef.current = null
     }
   }, [network])
 
@@ -124,6 +134,7 @@ export function CreateIdentityFlow({ onDone }: { onDone: () => void }): JSX.Elem
         network,
         mnemonic: m,
         group: v2.group,
+        contracts: [v2.core, v2.collab],
         minDepositDuffs: MIN_DEPOSIT_DUFFS,
         signal: controllerRun.signal,
         persistKey: (id, k) => controller.persistKey({ identityId: id, keyId: k.keyId, wif: k.wif }, protection),
@@ -298,7 +309,7 @@ export function CreateIdentityFlow({ onDone }: { onDone: () => void }): JSX.Elem
       </div>
       <p className="text-[12px] text-anvil-500 dark:text-anvil-400">
         To see your deposit this page asks a Dash block explorer ({new URL(coreEndpoints(network).insight).host}, changeable in
-        Settings). It can delay you but cannot take funds or keys. On {ACTIVE_NETWORK.key} the lock is proven once a block
+        Settings). It can delay you, but amounts are checked against the raw transactions, so it cannot take funds or keys. On {ACTIVE_NETWORK.key} the lock is proven once a block
         chain-locks it, which can take a few minutes.
       </p>
       {error ? <ErrorBox error={`${error} — your deposit is recorded on this device; reopen this sheet and type your 12 words to resume.`} /> : null}
diff --git a/forge-web/components/auth/protection-fields.tsx b/forge-web/components/auth/protection-fields.tsx
index 43e2f6a77..9c7387e42 100644
--- a/forge-web/components/auth/protection-fields.tsx
+++ b/forge-web/components/auth/protection-fields.tsx
@@ -7,7 +7,7 @@
  * runs only when the user asks for it.
  */
 
-import { useState } from 'react'
+import { useEffect, useRef, useState } from 'react'
 import { Fingerprint, KeyRound } from 'lucide-react'
 import { enrollPasskey, MIN_PASSPHRASE, passkeysAvailable, type Protection } from '@/lib/auth'
 import { Button } from '@/components/ui/button'
@@ -22,7 +22,17 @@ export function useProtection(): {
 } {
   const [passphrase, setPassphrase] = useState('')
   const [confirm, setConfirm] = useState('')
-  const [passkey, setPasskey] = useState<Protection['passkey'] | null>(null)
+  // The passkey's PRF output is key material: a ref (not React state), zeroed on unmount.
+  const passkeyRef = useRef<Protection['passkey'] | null>(null)
+  const [hasPasskey, setHasPasskey] = useState(false)
+  useEffect(
+    () => () => {
+      passkeyRef.current?.output.fill(0)
+      passkeyRef.current = null
+    },
+    [],
+  )
+  const passkey = hasPasskey ? passkeyRef.current : null
   const [enrolling, setEnrolling] = useState(false)
   const [passkeyError, setPasskeyError] = useState<string | null>(null)
   const canPasskey = passkeysAvailable()
@@ -33,7 +43,10 @@ export function useProtection(): {
     try {
       const p = await enrollPasskey(`Dash Forge (${new Date().toISOString().slice(0, 10)})`)
       if (p === null) setPasskeyError("This passkey can't protect keys here (no PRF support). Use a passphrase.")
-      else setPasskey(p)
+      else {
+        passkeyRef.current = p
+        setHasPasskey(true)
+      }
     } catch (e) {
       setPasskeyError(errorMessage(e, 'passkey setup was cancelled'))
     } finally {
diff --git a/forge-web/components/auth/wallet-connect-flow.tsx b/forge-web/components/auth/wallet-connect-flow.tsx
index ca9ca1f9c..79edfab2a 100644
--- a/forge-web/components/auth/wallet-connect-flow.tsx
+++ b/forge-web/components/auth/wallet-connect-flow.tsx
@@ -3,10 +3,15 @@
 /**
  * "Use my Dash wallet" (`ux-dx-spec.md` §2.2 tile 1): shows the App Connect request as a QR
  * and a deep link, waits for the wallet's `loginKeyResponse`, verifies the granted key on chain
- * (live, HIGH, bound to the dash-forge group, budgeted, expiring), then stores it in the vault.
+ * (live, HIGH, bound to the dash-forge group, budgeted, expiring), then — after the user
+ * confirms the full identity id (and DPNS name) is theirs — stores it in the vault.
+ *
+ * The response does not prove who answered: anyone who saw the QR could answer from their own
+ * identity. So the user confirms the identity, and more than one valid answer is refused.
+ * The granted key is held in a ref, never React state, and dropped when the sheet closes.
  */
 
-import { useEffect, useState } from 'react'
+import { useEffect, useRef, useState } from 'react'
 import { Loader2 } from 'lucide-react'
 import { useAuth } from '@/contexts/auth-context'
 import { Button } from '@/components/ui/button'
@@ -17,6 +22,7 @@ import { BROWSER_KEY_DEFAULTS, type LimitedKey } from '@/lib/auth'
 import { awaitWalletLogin, newRequest } from '@/lib/auth/app-connect'
 import { ensureSdk } from '@/lib/sdk'
 import { isAbort } from '@/lib/sdk/facade'
+import { resolveDpnsName } from '@/lib/view/dpns'
 import { errorMessage } from '@/lib/utils'
 
 export function WalletConnectFlow({ onDone }: { onDone: () => void }): JSX.Element {
@@ -24,8 +30,10 @@ export function WalletConnectFlow({ onDone }: { onDone: () => void }): JSX.Eleme
   const [uri, setUri] = useState<string | null>(null)
   const [pairing, setPairing] = useState('')
   const [slow, setSlow] = useState(false)
-  const [granted, setGranted] = useState<{ identityId: string; key: LimitedKey } | null>(null)
+  const [who, setWho] = useState<{ identityId: string; name: string | null } | null>(null)
+  const [confirmed, setConfirmed] = useState(false)
   const [error, setError] = useState<string | null>(null)
+  const grant = useRef<LimitedKey | null>(null)
   const { fields, protection, problem } = useProtection()
 
   useEffect(() => {
@@ -35,15 +43,14 @@ export function WalletConnectFlow({ onDone }: { onDone: () => void }): JSX.Eleme
       try {
         const v2 = ACTIVE_NETWORK.v2
         if (!v2) throw new Error('forge-v2 is not deployed here')
-        const req = newRequest(ACTIVE_NETWORK.network, v2.core)
+        const req = newRequest(ACTIVE_NETWORK.network, v2.group)
         setUri(req.uri)
         setPairing(req.pairingCode)
-        const login = await awaitWalletLogin(await ensureSdk(ACTIVE_NETWORK.network), req, {
-          network: ACTIVE_NETWORK.network,
-          group: v2.group,
-          signal: controller.signal,
-        })
-        setGranted({ identityId: login.identityId, key: { keyId: login.keyId, wif: login.wif, limits: login.limits } })
+        const sdk = await ensureSdk(ACTIVE_NETWORK.network)
+        const login = await awaitWalletLogin(sdk, req, { network: ACTIVE_NETWORK.network, group: v2.group, signal: controller.signal })
+        grant.current = { keyId: login.keyId, wif: login.wif, limits: login.limits }
+        const name = await resolveDpnsName(sdk, login.identityId, ACTIVE_NETWORK.network).catch(() => null)
+        setWho({ identityId: login.identityId, name: name ?? null })
       } catch (e) {
         if (!isAbort(e)) setError(errorMessage(e))
       }
@@ -51,25 +58,36 @@ export function WalletConnectFlow({ onDone }: { onDone: () => void }): JSX.Eleme
     return () => {
       controller.abort()
       clearTimeout(timer)
+      grant.current = null
     }
   }, [])
 
-  if (granted) {
+  if (who) {
     return (
       <div className="space-y-3">
-        <p className="text-dense">
-          Your wallet granted a key to <span className="font-mono">{granted.identityId.slice(0, 10)}…</span>, verified on Platform.
-        </p>
+        <p className="text-dense">A wallet granted a key, verified on Platform, for this identity:</p>
+        <div className="rounded-md border border-anvil-200 px-3 py-2 dark:border-anvil-800">
+          {who.name ? <div className="text-dense font-medium">{who.name}</div> : null}
+          <div data-testid="granted-identity" className="break-all font-mono text-dense">
+            {who.identityId}
+          </div>
+        </div>
+        <label className="flex items-start gap-2 text-dense">
+          <input type="checkbox" checked={confirmed} onChange={(e) => setConfirmed(e.target.checked)} className="mt-1" />
+          <span>This is my identity. (If it is not, someone else answered the QR code: close this and start again.)</span>
+        </label>
         {fields}
         <Button
           variant="primary"
           className="w-full"
           loading={isLoading}
-          disabled={protection === null || isLoading}
+          disabled={!confirmed || protection === null || isLoading}
           onClick={async () => {
-            if (!protection) return
+            const key = grant.current
+            if (!protection || !key) return
             try {
-              await adoptLimitedKey(granted.identityId, granted.key, protection)
+              await adoptLimitedKey(who.identityId, key, protection)
+              grant.current = null
               onDone()
             } catch (e) {
               setError(errorMessage(e))
@@ -94,7 +112,8 @@ export function WalletConnectFlow({ onDone }: { onDone: () => void }): JSX.Eleme
       ) : null}
       <p className="text-dense">
         Approve in your wallet. Forge gets a key that can spend at most {BROWSER_KEY_DEFAULTS.budgetDash} DASH, only here, for{' '}
-        {BROWSER_KEY_DEFAULTS.days} days. Check the wallet shows code <span className="font-mono font-semibold">{pairing}</span>.
+        {BROWSER_KEY_DEFAULTS.days} days. Check the wallet shows code <span className="font-mono font-semibold">{pairing}</span>. Keep
+        this QR code private: anyone who scans it can answer it.
       </p>
       {slow ? <p className="text-dense text-caution">No response yet. Keep this tab open, or choose another method.</p> : null}
       <p className="text-[12px] text-anvil-500 dark:text-anvil-400">Needs a wallet with Platform login (App Connect).</p>
diff --git a/forge-web/components/keys-panel.tsx b/forge-web/components/keys-panel.tsx
index 46340c512..d01fc7fc1 100644
--- a/forge-web/components/keys-panel.tsx
+++ b/forge-web/components/keys-panel.tsx
@@ -7,8 +7,9 @@
  * key's limits (`IdentityKeyLimitsUpdate`) is P1. Also: lock now, and sign out + forget.
  */
 
-import { useState } from 'react'
-import { Lock, LogOut, RefreshCw } from 'lucide-react'
+import { useRef, useState } from 'react'
+import { Lock, LogOut, RefreshCw, ShieldOff } from 'lucide-react'
+import { errorMessage } from '@/lib/utils'
 import { useAuth } from '@/contexts/auth-context'
 import { useUiStore } from '@/hooks/use-ui-store'
 import { Button } from '@/components/ui/button'
@@ -18,10 +19,21 @@ import { INSIGHT_OVERRIDE_KEY } from '@/lib/auth/asset-lock'
 
 /** Shown before deleting a stored key: for a wallet-granted key this is the only copy. */
 export const FORGET_CONFIRM =
-  "Delete this browser's key? You will need your identity file, recovery phrase or wallet to sign in again here. Its budget stays on the identity until it expires."
+  "Delete this browser's key from this device? This does not revoke it: the key stays valid on chain until it expires (use \"Revoke on chain\" for that). You will need your identity file, recovery phrase or wallet to sign in again here."
 
 export function KeysPanel(): JSX.Element {
-  const { identity, keyLimits, storage, funds, logout, forget } = useAuth()
+  const { identity, keyLimits, storage, funds, logout, forget, revokeStored, isLoading } = useAuth()
+  const revokeRef = useRef<HTMLInputElement>(null)
+  const [revokeError, setRevokeError] = useState<string | null>(null)
+  const revoke = async (file: File): Promise<void> => {
+    if (!identity) return
+    setRevokeError(null)
+    try {
+      await revokeStored(identity, { fileText: await file.text() })
+    } catch (e) {
+      setRevokeError(errorMessage(e))
+    }
+  }
   const openLogin = useUiStore((s) => s.openLogin)
   const [explorer, setExplorer] = useState(() =>
     typeof window === 'undefined' ? '' : window.localStorage.getItem(INSIGHT_OVERRIDE_KEY) ?? '',
@@ -67,7 +79,30 @@ export function KeysPanel(): JSX.Element {
         >
           <LogOut className="h-3.5 w-3.5" aria-hidden /> Sign out &amp; forget key
         </Button>
+        {storage === 'vault' ? (
+          <>
+            <Button variant="danger" size="sm" loading={isLoading} onClick={() => revokeRef.current?.click()}>
+              <ShieldOff className="h-3.5 w-3.5" aria-hidden /> Revoke on chain
+            </Button>
+            <input
+              ref={revokeRef}
+              type="file"
+              aria-label="Identity file to revoke with"
+              accept="application/json,.json,.txt"
+              className="sr-only"
+              onChange={(e) => {
+                const f = e.target.files?.[0]
+                if (f && window.confirm('Disable this browser\'s key on chain? Your identity file\'s master key signs it once and is not stored.')) void revoke(f)
+                e.target.value = ''
+              }}
+            />
+          </>
+        ) : null}
       </div>
+      <p className="text-[12px] text-anvil-500 dark:text-anvil-400">
+        Forgetting deletes the key from this device only. Revoking disables it on chain (needs your identity file once).
+      </p>
+      {revokeError ? <p role="alert" className="text-[12px] text-danger">{revokeError}</p> : null}
       <Field
         label="Block explorer (used only to watch identity deposits)"
         htmlFor="explorer-url"
diff --git a/forge-web/components/login-modal.tsx b/forge-web/components/login-modal.tsx
index e0d21bc9c..fde8ded7a 100644
--- a/forge-web/components/login-modal.tsx
+++ b/forge-web/components/login-modal.tsx
@@ -303,7 +303,16 @@ function UnlockView({ initial, onDone, onOther, onRenew }: { initial: string | n
 function ImportView({ onDone, onStored }: { onDone: () => void; onStored: (identityId: string) => void }): JSX.Element {
   const { importIdentity, isLoading, vaults, identity } = useAuth()
   const [mode, setMode] = useState<'file' | 'mnemonic'>('file')
-  const [fileText, setFileText] = useState<string | null>(null)
+  // The identity file holds every private key: a ref (not React state), dropped on unmount
+  // and after use; state only records that one was chosen.
+  const fileRef = useRef<string | null>(null)
+  const [fileChosen, setFileChosen] = useState(false)
+  useEffect(
+    () => () => {
+      fileRef.current = null
+    },
+    [],
+  )
   const [fileName, setFileName] = useState('')
   const [fileIdentity, setFileIdentity] = useState('')
   const [mnemonic, setMnemonic] = useState('')
@@ -321,21 +330,26 @@ function ImportView({ onDone, onStored }: { onDone: () => void; onStored: (ident
     try {
       setFileIdentity(masterMaterialFromFile(text).identityId)
     } catch (e) {
+      fileRef.current = null
+      setFileChosen(false)
       setFileIdentity('')
       setError(errorMessage(e))
       return
     }
-    setFileText(text)
+    fileRef.current = text
+    setFileChosen(true)
     setFileName(file.name)
   }
 
-  const ready = protection !== null && !isLoading && (mode === 'file' ? fileText !== null : mnemonic.trim() !== '' && identityId.trim() !== '')
+  const ready = protection !== null && !isLoading && (mode === 'file' ? fileChosen : mnemonic.trim() !== '' && identityId.trim() !== '')
   const submit = async (): Promise<void> => {
     if (!protection || isLoading) return
     setError(null)
     try {
-      await importIdentity(mode === 'file' ? { fileText: fileText as string } : { mnemonic, identityId }, protection)
-      setFileText(null)
+      const text = fileRef.current
+      if (mode === 'file' && text === null) return
+      await importIdentity(mode === 'file' ? { fileText: text as string } : { mnemonic, identityId }, protection)
+      fileRef.current = null
       setMnemonic('')
       onDone()
     } catch (e) {
@@ -366,7 +380,7 @@ function ImportView({ onDone, onStored }: { onDone: () => void; onStored: (ident
           <Field label="Identity ID" htmlFor="import-id">
             <Input id="import-id" value={identityId} onChange={(e) => setIdentityId(e.target.value)} className="font-mono" spellCheck={false} autoComplete="off" />
           </Field>
-          <Field label="Recovery phrase (12 or 24 words)" htmlFor="import-mnemonic" hint="Used once to derive the master key, then discarded.">
+          <Field label="Recovery phrase (12 or 24 words)" htmlFor="import-mnemonic" hint="Used once to derive the master key; not stored.">
             <Textarea id="import-mnemonic" value={mnemonic} onChange={(e) => setMnemonic(e.target.value)} className="min-h-[72px] font-mono" spellCheck={false} autoComplete="off" />
           </Field>
         </>
@@ -387,7 +401,7 @@ function ImportView({ onDone, onStored }: { onDone: () => void; onStored: (ident
       <Button variant="primary" className="w-full" onClick={submit} loading={isLoading} disabled={!ready}>
         Create this browser&apos;s key
       </Button>
-      {problem && (fileText !== null || mnemonic !== '') ? <p className="text-[12px] text-anvil-500">{problem}</p> : null}
+      {problem && (fileChosen || mnemonic !== '') ? <p className="text-[12px] text-anvil-500">{problem}</p> : null}
       <ErrorBox error={error} />
     </div>
   )
diff --git a/forge-web/contexts/auth-context.tsx b/forge-web/contexts/auth-context.tsx
index fbcea4c1e..d07e9e0d4 100644
--- a/forge-web/contexts/auth-context.tsx
+++ b/forge-web/contexts/auth-context.tsx
@@ -71,8 +71,10 @@ interface AuthContextValue {
   refreshBalance: () => Promise<void>
   /** Lock: end the session, keep the stored key (unlock to continue). */
   logout: () => void
-  /** Delete the stored key of `identityId` from this device. */
+  /** Delete the stored key of `identityId` from this device (does not revoke it on chain). */
   forget: (identityId: string) => Promise<void>
+  /** Disable this device's key on chain with the master key (file or phrase), then forget it. */
+  revokeStored: (identityId: string, input: { fileText: string } | { mnemonic: string }) => Promise<void>
   reloadVaults: () => void
   /** The headless controller (identity creation stores its key before registering it). */
   readonly controller: AuthController
@@ -120,6 +122,7 @@ export function AuthProvider({
       refreshBalance: () => controller.refreshBalance(),
       logout: () => controller.logout(),
       forget: withReload(controller.forget.bind(controller)),
+      revokeStored: withReload(controller.revokeStored.bind(controller)),
     }),
     [controller, withReload],
   )
diff --git a/forge-web/lib/auth/app-connect.ts b/forge-web/lib/auth/app-connect.ts
index 1474fba85..507349ce3 100644
--- a/forge-web/lib/auth/app-connect.ts
+++ b/forge-web/lib/auth/app-connect.ts
@@ -8,8 +8,13 @@
  * derives the shared secret (ECDH x → HKDF-SHA256, salt "dash:key-exchange:v1"), decrypts the
  * 32-byte login key (AES-256-GCM), derives the auth key (HKDF(loginKey, identityId, "auth")),
  * and then **verifies on chain** that a live key on the responder's identity is that key, with
- * AUTHENTICATION/HIGH, the dash-forge group bound, and a budget and expiry — the response
- * alone proves nothing about who answered (`app-connect.md`, "Approval and re-login" step 3).
+ * AUTHENTICATION/HIGH, the dash-forge group bound, and a budget and expiry.
+ *
+ * Who answered is NOT proven by the response (`app-connect.md`, step 3): anyone who saw the QR
+ * can answer from their own identity. So the flow shows the full identity id and DPNS name and
+ * asks the user to confirm it is theirs, and refuses outright when more than one identity
+ * answered validly. (The v1 response schema has no field for a wallet signature over the
+ * request; when one exists, verify it here.)
  *
  * The crypto is the Yappr key-exchange envelope the Dash wallets already speak.
  */
@@ -46,17 +51,19 @@ function networkTag(network: Network): string {
 }
 
 /**
- * A fresh request for `contractId` (forge-core). The payload is the key-exchange request:
- * version(1) ‖ appEphemeralPub(33) ‖ contractId(32) ‖ keyIndex(u32 LE) ‖ labelLen(1) ‖ label.
+ * A fresh request. The payload is the key-exchange request: version(1) ‖ appEphemeralPub(33) ‖
+ * scope(32) ‖ keyIndex(u32 LE) ‖ labelLen(1) ‖ label. `scope` is the dash-forge **contract
+ * group** id: the key Forge accepts is bound to the group, not to one contract, so that is what
+ * the wallet must be asked for.
  */
-export function newRequest(network: Network, contractId: string, label = 'Sign in to Dash Forge'): AppConnectRequest {
+export function newRequest(network: Network, groupId: string, label = 'Sign in to Dash Forge'): AppConnectRequest {
   const priv = secp.utils.randomSecretKey()
   const pub = secp.getPublicKey(priv, true)
   const labelBytes = enc.encode(label).slice(0, 64)
   const body = new Uint8Array(1 + 33 + 32 + 4 + 1 + labelBytes.length)
   body[0] = 1
   body.set(pub, 1)
-  body.set(base58Decode(contractId), 34)
+  body.set(base58Decode(groupId), 34)
   body[70] = labelBytes.length
   body.set(labelBytes, 71)
   const pubHash = hash160(pub)
@@ -128,48 +135,82 @@ export interface WalletLogin {
  * identity with the Forge bounds (then resolve), or the signal aborts. Responses that do not
  * decrypt, or whose key is not verifiably a Forge browser key, are skipped.
  */
+/** More than one identity answered the request with a valid key: refuse (spec: pairing). */
+export class AmbiguousWalletLogin extends Error {
+  constructor(readonly identityIds: readonly string[]) {
+    super(`More than one identity answered this sign-in request (${identityIds.join(', ')}). Someone else saw the QR code. Start again and keep it private.`)
+    this.name = 'AmbiguousWalletLogin'
+  }
+}
+
 export async function awaitWalletLogin(
   sdk: import('@dashevo/evo-sdk').EvoSDK,
   req: AppConnectRequest,
-  params: { network: Network; group: string; signal?: AbortSignal; intervalMs?: number },
+  params: { network: Network; group: string; signal?: AbortSignal; intervalMs?: number; settleMs?: number },
 ): Promise<WalletLogin> {
   // Owners whose response does not decrypt with our key are not answering us: skip them for
   // good. A response that decrypts but whose key is not verifiable yet (the wallet published
   // before its key update was visible, or a read failed) is retried on the next poll.
   const notOurs = new Set<string>()
+  const valid = new Map<string, WalletLogin>()
+  let firstValidAt = 0
   for (;;) {
     if (params.signal?.aborted) throw new DOMException('cancelled', 'AbortError')
-    let rows: Map<string, unknown> = new Map()
-    try {
-      rows = await authSdk(sdk).documents.query({
-        dataContractId: APP_CONNECT_CONTRACT_ID,
-        documentTypeName: 'loginKeyResponse',
-        where: [['appEphemeralPubKeyHash', '==', btoa(String.fromCharCode(...req.appEphemeralPubKeyHash))]],
-        orderBy: [['appEphemeralPubKeyHash', 'asc']],
-        limit: 10,
-      })
-    } catch {
-      /* transient: poll again */
-    }
-    for (const raw of rows.values()) {
-      if (!raw) continue
-      const j = (raw as RawResponse).toJSON()
-      if (notOurs.has(j.$ownerId)) continue
+    for (const j of await allResponses(sdk, req)) {
+      if (notOurs.has(j.$ownerId) || valid.has(j.$ownerId)) continue
       try {
         const wif = await decryptGrant(req, j, params.network)
         const keyId = await findKeyId(sdk, j.$ownerId, wif, params.network)
         if (keyId === null) continue
         const limits = await verifyLimitedKey(sdk, j.$ownerId, keyId, params.group, params.network, wif)
-        disposeRequest(req)
-        return { identityId: j.$ownerId, keyId, wif, limits }
+        valid.set(j.$ownerId, { identityId: j.$ownerId, keyId, wif, limits })
+        if (firstValidAt === 0) firstValidAt = Date.now()
       } catch (e) {
         if (e instanceof NotOurs) notOurs.add(j.$ownerId)
       }
     }
+    if (valid.size > 1) {
+      disposeRequest(req)
+      throw new AmbiguousWalletLogin([...valid.keys()])
+    }
+    // One valid answer: wait one more poll for a competing one before accepting it.
+    if (valid.size === 1 && Date.now() - firstValidAt >= (params.settleMs ?? 3000)) {
+      disposeRequest(req)
+      return [...valid.values()][0] as WalletLogin
+    }
     await sleep(params.intervalMs ?? 3000, params.signal)
   }
 }
 
+/** Every response to `req`, paged by `$ownerId` (junk replies cannot hide the real one). */
+async function allResponses(sdk: import('@dashevo/evo-sdk').EvoSDK, req: AppConnectRequest): Promise<ReturnType<RawResponse['toJSON']>[]> {
+  const hash = btoa(String.fromCharCode(...req.appEphemeralPubKeyHash))
+  const out: ReturnType<RawResponse['toJSON']>[] = []
+  let after: string | null = null
+  for (let page = 0; page < 20; page++) {
+    let rows: Map<string, unknown>
+    try {
+      rows = await authSdk(sdk).documents.query({
+        dataContractId: APP_CONNECT_CONTRACT_ID,
+        documentTypeName: 'loginKeyResponse',
+        where: [['appEphemeralPubKeyHash', '==', hash], ...(after ? [['$ownerId', '>', after]] : [])],
+        orderBy: [
+          ['appEphemeralPubKeyHash', 'asc'],
+          ['$ownerId', 'asc'],
+        ],
+        limit: 50,
+      })
+    } catch {
+      break
+    }
+    const batch = [...rows.values()].filter(Boolean).map((r) => (r as RawResponse).toJSON())
+    out.push(...batch)
+    if (batch.length < 50) break
+    after = batch[batch.length - 1]?.$ownerId ?? null
+  }
+  return out
+}
+
 async function decryptGrant(req: AppConnectRequest, j: ReturnType<RawResponse['toJSON']>, network: Network): Promise<string> {
   let login: Uint8Array
   try {
diff --git a/forge-web/lib/auth/asset-lock.ts b/forge-web/lib/auth/asset-lock.ts
index 3d76245c8..af7696589 100644
--- a/forge-web/lib/auth/asset-lock.ts
+++ b/forge-web/lib/auth/asset-lock.ts
@@ -10,8 +10,15 @@
  *      (testnet), else a chain-lock proof once Platform's chain-locked Core height reaches the
  *      transaction's block (devnets).
  *
- * The explorer can delay the user but not take funds or keys: it only sees the address and
- * the signed transaction.
+ * The explorer is not trusted with amounts. It lists which outputs pay the deposit address,
+ * but every input is re-derived from its raw funding transaction — fetched, hashed and checked
+ * against the txid, then parsed for the output's value and script — before anything is
+ * signed. (The legacy sighash does not commit to input values: trusting the explorer's
+ * amounts would let a lying one turn the deposit into miner fees.) With that, an explorer can
+ * delay the user or hide funds, but not take them or learn a key.
+ *
+ * Broadcast goes to the explorer: the evo-sdk exposes no DAPI Core broadcast. A lying explorer
+ * can drop the transaction, which only delays; the signed bytes are journaled and re-sent.
  */
 
 import * as secp from '@noble/secp256k1'
@@ -74,6 +81,72 @@ export async function getUtxos(ep: CoreEndpoints, address: string): Promise<Utxo
   return rows.map((u) => ({ txid: u.txid, vout: u.vout, satoshis: u.satoshis, scriptPubKey: u.scriptPubKey, confirmations: u.confirmations ?? 0 }))
 }
 
+/** The value and script of each output of a raw transaction (Dash; special payload skipped). */
+export function parseOutputs(raw: Uint8Array): { value: bigint; script: Uint8Array }[] {
+  let at = 0
+  const need = (n: number): void => {
+    if (at + n > raw.length) throw new Error('truncated transaction')
+  }
+  const u8 = (): number => {
+    need(1)
+    return raw[at++] as number
+  }
+  const bytes = (n: number): Uint8Array => {
+    need(n)
+    const b = raw.slice(at, at + n)
+    at += n
+    return b
+  }
+  const varint = (): number => {
+    const first = u8()
+    if (first < 0xfd) return first
+    const b = bytes(first === 0xfd ? 2 : first === 0xfe ? 4 : 8)
+    let n = 0
+    for (let i = b.length - 1; i >= 0; i--) n = n * 256 + (b[i] as number)
+    return n
+  }
+  bytes(4) // version | type
+  const inputs = varint()
+  for (let i = 0; i < inputs; i++) {
+    bytes(36)
+    bytes(varint())
+    bytes(4)
+  }
+  const count = varint()
+  const out: { value: bigint; script: Uint8Array }[] = []
+  for (let i = 0; i < count; i++) {
+    const v = bytes(8)
+    let value = 0n
+    for (let j = 7; j >= 0; j--) value = value * 256n + BigInt(v[j] as number)
+    out.push({ value, script: bytes(varint()) })
+  }
+  return out
+}
+
+/**
+ * The deposit's spendable outputs, each proven from its raw funding transaction: the raw
+ * bytes must hash to the txid the explorer named, and the value and script come from those
+ * bytes. Outputs that do not pay `address`'s P2PKH script are dropped.
+ */
+export async function verifiedUtxos(ep: CoreEndpoints, address: string, listed: readonly Utxo[]): Promise<Utxo[]> {
+  const script = bytesToHex(p2pkh(addressHash(address)))
+  const out: Utxo[] = []
+  const rawCache = new Map<string, Uint8Array>()
+  for (const u of listed) {
+    let raw = rawCache.get(u.txid)
+    if (!raw) {
+      raw = hexToBytes((await getJson<{ rawtx: string }>(`${ep.insight}/rawtx/${u.txid}`)).rawtx)
+      if (txid(raw) !== u.txid) throw new Error(`the block explorer returned a transaction that is not ${u.txid}`)
+      rawCache.set(u.txid, raw)
+    }
+    const o = parseOutputs(raw)[u.vout]
+    if (!o || bytesToHex(o.script) !== script) continue
+    if (o.value > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error('deposit output too large')
+    out.push({ ...u, satoshis: Number(o.value), scriptPubKey: script })
+  }
+  return out
+}
+
 export async function getTxHeight(ep: CoreEndpoints, txid: string): Promise<number | null> {
   const tx = await getJson<{ blockheight?: number }>(`${ep.insight}/tx/${txid}`)
   return typeof tx.blockheight === 'number' && tx.blockheight >= 0 ? tx.blockheight : null
@@ -222,6 +295,10 @@ export function buildAssetLock(utxos: readonly Utxo[], priv: Uint8Array): { raw:
   const fee = ASSET_LOCK_FEE_PER_INPUT * utxos.length
   const locked = total - fee
   if (locked <= 0) throw new Error('deposit too small to cover the fee')
+  // Every input's script must be the lock key's own P2PKH (verifiedUtxos checked the values).
+  const own = bytesToHex(p2pkh(hash160(secp.getPublicKey(priv, true))))
+  if (utxos.some((u) => u.scriptPubKey !== own)) throw new Error('an input is not paid to the deposit key')
+  if (locked + fee !== total) throw new Error('asset-lock fee mismatch')
   const pubHash = hash160(secp.getPublicKey(priv, true))
   const payload = concatBytes(Uint8Array.of(1), varint(1), serOut({ value: BigInt(locked), script: p2pkh(pubHash) }))
   const tx: Tx = {
@@ -324,10 +401,17 @@ export async function waitForDeposit(
   opts: { signal?: AbortSignal; onSeen?: (duffs: number) => void; intervalMs?: number } = {},
 ): Promise<Utxo[]> {
   for (;;) {
-    const utxos = await getUtxos(ep, address).catch(() => [] as Utxo[])
-    const total = utxos.reduce((s, u) => s + u.satoshis, 0)
-    opts.onSeen?.(total)
-    if (total >= minDuffs && utxos.length > 0) return utxos
+    const listed = await getUtxos(ep, address).catch(() => [] as Utxo[])
+    const claimed = listed.reduce((s, u) => s + u.satoshis, 0)
+    if (claimed >= minDuffs && listed.length > 0) {
+      // The explorer says it is there: prove each output from its raw transaction.
+      const utxos = await verifiedUtxos(ep, address, listed)
+      const total = utxos.reduce((s, u) => s + u.satoshis, 0)
+      opts.onSeen?.(total)
+      if (total >= minDuffs) return utxos
+    } else {
+      opts.onSeen?.(claimed)
+    }
     await sleep(opts.intervalMs ?? 4000, opts.signal)
   }
 }
diff --git a/forge-web/lib/auth/auth-v2.test.ts b/forge-web/lib/auth/auth-v2.test.ts
index 1cd8d0990..91617b872 100644
--- a/forge-web/lib/auth/auth-v2.test.ts
+++ b/forge-web/lib/auth/auth-v2.test.ts
@@ -7,7 +7,7 @@ import * as secp from '@noble/secp256k1'
 import { hkdf } from '@noble/hashes/hkdf.js'
 import { sha256 } from '@noble/hashes/sha2.js'
 import { bytesToHex } from '@noble/hashes/utils.js'
-import { beforeEach, describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { idbEntries, resetMemoryStores } from '../idb'
 import {
@@ -16,14 +16,15 @@ import {
   listVaults,
   lockVault,
   prfKey,
+  sharedOriginProblem,
   storeInVault,
   unlockWithPassphrase,
   unlockedSecret,
 } from './vault'
 import { authKeyFromLogin, newRequest, openResponse } from './app-connect'
-import { buildAssetLock, hash160, txid, type Utxo } from './asset-lock'
+import { buildAssetLock, buildPayment, hash160, txid, verifiedUtxos, type Utxo } from './asset-lock'
 import { masterMaterialFromFile } from './identity-file'
-import { base58Decode, base58Encode } from './base58'
+import { base58CheckEncode, base58Decode, base58Encode } from './base58'
 import { encodeWif } from './wif'
 import { purgeLegacyKeystore } from './controller'
 
@@ -79,6 +80,15 @@ describe('vault', () => {
     expect(await listVaults('devnet')).toEqual([])
   }, 30_000)
 
+  it('refuses shared origins (Pages project sites, IPFS path gateways) but not dedicated ones', () => {
+    expect(sharedOriginProblem({ hostname: 'pastapastapasta.github.io', pathname: '/dash-forge/' })).toMatch(/dedicated origin/)
+    expect(sharedOriginProblem({ hostname: 'ipfs.io', pathname: '/ipfs/bafy/' })).toMatch(/dedicated origin/)
+    expect(sharedOriginProblem({ hostname: 'gw.example', pathname: '/ipns/forge.eth/' })).toMatch(/dedicated origin/)
+    expect(sharedOriginProblem({ hostname: 'forge.dashhq.org', pathname: '/' })).toBeNull()
+    expect(sharedOriginProblem({ hostname: 'bafy.ipfs.dweb.link', pathname: '/' })).toBeNull()
+    expect(sharedOriginProblem({ hostname: '127.0.0.1', pathname: '/settings/' })).toBeNull()
+  })
+
   it('stretches a passkey PRF output per identity', () => {
     const out = new Uint8Array(32).fill(1)
     expect(bytesToHex(prfKey(out, 'devnet', ID))).not.toBe(bytesToHex(prfKey(out, 'devnet', 'other')))
@@ -141,6 +151,8 @@ describe('App Connect envelope (Yappr key exchange)', () => {
 })
 
 describe('asset-lock transaction', () => {
+  afterEach(() => vi.unstubAllGlobals())
+
   it('locks the deposit minus the fee into one credit output with a valid signature', () => {
     const priv = new Uint8Array(32).fill(5)
     const pub = secp.getPublicKey(priv, true)
@@ -170,6 +182,54 @@ describe('asset-lock transaction', () => {
     expect(lock.txid).toBe('452aa5a12caf5b23d314ac9ae8ef129a283f9a4c72492cff1fc5bf9cfc6d4fff')
   })
 
+  describe('a lying block explorer', () => {
+    const priv = new Uint8Array(32).fill(5)
+    const pub = secp.getPublicKey(priv, true)
+    const script = `76a914${bytesToHex(hash160(pub))}88ac`
+    const address = base58CheckEncode(new Uint8Array([140, ...hash160(pub)]))
+    // A funding transaction paying 5 DASH to the deposit address (built with the same code).
+    const funding = buildPayment(
+      [{ txid: 'cd'.repeat(32), vout: 0, satoshis: 600_000_000, scriptPubKey: script, confirmations: 9 }],
+      priv,
+      { address, duffs: 500_000_000 },
+      address,
+    )
+    const ep = { insight: 'https://explorer.invalid', islockRpc: null }
+    const serve = (rawtx: Uint8Array): void => {
+      vi.stubGlobal('fetch', async (url: string) => ({ ok: true, json: async () => ({ rawtx: bytesToHex(rawtx) }), url }))
+    }
+
+    it('cannot make the lock burn the deposit by under-reporting its value', async () => {
+      serve(funding.raw)
+      const listed: Utxo[] = [{ txid: funding.txid, vout: 0, satoshis: 2_000_000, scriptPubKey: script, confirmations: 1 }]
+      const utxos = await verifiedUtxos(ep, address, listed)
+      expect(utxos[0]?.satoshis).toBe(500_000_000)
+      const lock = buildAssetLock(utxos, priv)
+      expect(lock.lockedDuffs).toBe(500_000_000 - 1000)
+    })
+
+    it('rejects a raw transaction that does not hash to the listed txid', async () => {
+      serve(funding.raw)
+      const listed: Utxo[] = [{ txid: 'ee'.repeat(32), vout: 0, satoshis: 500_000_000, scriptPubKey: script, confirmations: 1 }]
+      await expect(verifiedUtxos(ep, address, listed)).rejects.toThrow(/not ee/)
+    })
+
+    it('drops outputs that do not pay the deposit address', async () => {
+      serve(funding.raw)
+      const listed: Utxo[] = [{ txid: funding.txid, vout: 1, satoshis: 500_000_000, scriptPubKey: script, confirmations: 1 }]
+      // Output 1 is the change back to the same address in this fixture: still ours.
+      expect((await verifiedUtxos(ep, address, listed)).length).toBe(1)
+      const other: Utxo[] = [{ txid: funding.txid, vout: 7, satoshis: 1, scriptPubKey: script, confirmations: 1 }]
+      expect(await verifiedUtxos(ep, address, other)).toEqual([])
+    })
+
+    it('refuses to sign inputs whose script is not the deposit key', () => {
+      expect(() => buildAssetLock([{ txid: 'ab'.repeat(32), vout: 0, satoshis: 5_000_000, scriptPubKey: '76a914' + '00'.repeat(20) + '88ac', confirmations: 1 }], priv)).toThrow(
+        /not paid to the deposit key/,
+      )
+    })
+  })
+
   it('refuses a deposit that cannot pay its fee', () => {
     const priv = new Uint8Array(32).fill(5)
     expect(() => buildAssetLock([{ txid: 'ab'.repeat(32), vout: 0, satoshis: 900, scriptPubKey: '', confirmations: 1 }], priv)).toThrow()
diff --git a/forge-web/lib/auth/controller.ts b/forge-web/lib/auth/controller.ts
index 45a0910c1..b1b688807 100644
--- a/forge-web/lib/auth/controller.ts
+++ b/forge-web/lib/auth/controller.ts
@@ -3,7 +3,7 @@
  *
  * A session is an identity plus the key this browser signs with. The key is one of:
  *   - a PV14 **limited key** (the normal case): registered by importing an identity file or
- *     mnemonic (the master key signs one IdentityUpdate and is dropped), created with a new
+ *     mnemonic (the master key signs one IdentityUpdate and is not retained), created with a new
  *     identity, or granted by a wallet through App Connect. It lives encrypted in the
  *     {@link ./vault} and, unlocked, only in that module's memory;
  *   - an **advanced raw key** pasted by a developer: held for this tab only (never stored),
@@ -21,13 +21,13 @@ import type { EvoSDK } from '@dashevo/evo-sdk'
 import type { Network } from '../constants'
 import { DEFAULT_NETWORK, NETWORKS } from '../constants'
 import { errorMessage } from '../utils'
-import { WriteAuthError, findSigningKey, readIdentityBalance, type WriteAuth } from '../sdk/write'
+import { SECURITY_LEVEL, WriteAuthError, findSigningKey, readIdentityBalance, type WriteAuth } from '../sdk/write'
 import { authSdk } from '../sdk/facade'
 import type { KeyLimits } from '../view/funds'
 import { normalizeToWif } from './wif'
 import { identityFileMatchesNetwork, masterMaterialFromFile } from './identity-file'
 import { deriveMasterKey, isValidMnemonic } from './hd'
-import { readKeyLimits, registerLimitedKey, type LimitedKey, type LimitedKeyRequest } from './limited-key'
+import { readKeyLimits, registerLimitedKey, revokeLimitedKey, type LimitedKey, type LimitedKeyRequest } from './limited-key'
 import {
   VaultLockedError,
   forgetVault,
@@ -35,6 +35,7 @@ import {
   listVaults,
   lockVault,
   onVaultLock,
+  clearSignedWrites,
   storeInVault,
   unlockWithPasskey,
   unlockWithPassphrase,
@@ -127,6 +128,12 @@ export class AuthController {
     return v2.group
   }
 
+  /** forge-core and forge-collab, which the group must hold. */
+  forgeContracts(): readonly string[] {
+    const v2 = NETWORKS[this.network].v2
+    return v2 ? [v2.core, v2.collab] : []
+  }
+
   /** Whether this network supports limited keys (protocol 14 + a forge-v2 group). */
   supportsLimitedKeys(): boolean {
     return NETWORKS[this.network].v2 !== null
@@ -178,7 +185,7 @@ export class AuthController {
       const sdk = await this.getSdk()
       const identity = await authSdk(sdk).identities.fetch(secret.identityId)
       if (!identity) throw new WriteAuthError(`identity ${secret.identityId} not found on ${this.network}`)
-      const match = await findSigningKey(identity, secret.wif, this.network, 3)
+      const match = await findSigningKey(identity, secret.wif, this.network, SECURITY_LEVEL.HIGH)
       if (!match) throw new KeyNotUsableError()
       const keyLimits = knownLimits ?? (await readKeyLimits(sdk, secret.identityId, match.keyId).catch(() => null))
       const session: AuthSession = {
@@ -223,7 +230,7 @@ export class AuthController {
   /**
    * Import an identity file or mnemonic once: its master key signs one IdentityUpdate that
    * registers a limited key for this browser (disabling the key this device held for it
-   * before, when renewing), and is then dropped. Only the limited key is kept, encrypted under
+   * before, when renewing), and is not retained. Only the limited key is kept, encrypted under
    * `protection`.
    */
   async importIdentity(
@@ -253,6 +260,7 @@ export class AuthController {
         masterWif,
         group: this.group(),
         ...(previous ? { replaceKeyId: previous.keyId } : {}),
+        contracts: this.forgeContracts(),
         ...(request ? { request } : {}),
       })
       masterWif = null
@@ -307,6 +315,12 @@ export class AuthController {
     return this.run(async () => {
       const wif = normalizeToWif(privateKey, this.network)
       const secret: VaultSecret = { identityId: identityId.trim(), keyId: -1, wif }
+      // HIGH or CRITICAL only (the sheet says so): findSigningKey with CRITICAL..HIGH.
+      const sdk = await this.getSdk()
+      const identity = await authSdk(sdk).identities.fetch(secret.identityId)
+      if (!identity || !(await findSigningKey(identity, wif, this.network, SECURITY_LEVEL.HIGH))) {
+        throw new WriteAuthError('that key does not control a usable (HIGH or CRITICAL) authentication key of this identity')
+      }
       holdForSession(this.network, secret)
       try {
         return await this.open(secret, 'session')
@@ -336,9 +350,34 @@ export class AuthController {
   /** Lock (keep the stored key; unlock to continue). The session ends with it. */
   logout(): void {
     lockVault()
+    clearSignedWrites()
     this.setState({ session: null, error: null })
   }
 
+  /**
+   * Disable this device's key for `identityId` on chain (the identity file or phrase supplies
+   * the master key, used once), then forget it here. Forgetting alone does not revoke.
+   */
+  async revokeStored(identityId: string, input: { fileText: string } | { mnemonic: string }): Promise<void> {
+    return this.run(async () => {
+      const stored = (await listVaults(this.network)).find((v) => v.identityId === identityId)
+      if (!stored) throw new Error('no key for this identity is stored here')
+      let masterWif: string | null
+      if ('fileText' in input) {
+        const m = masterMaterialFromFile(input.fileText)
+        if (m.identityId !== identityId) throw new Error('that identity file is for another identity')
+        this.checkFileNetwork(m.networkKey)
+        masterWif = m.masterWif ?? (m.mnemonic ? (await deriveMasterKey(m.mnemonic, this.network)).wif : null)
+      } else {
+        masterWif = (await deriveMasterKey(input.mnemonic, this.network)).wif
+      }
+      if (!masterWif) throw new Error('no master key found')
+      await revokeLimitedKey(await this.getSdk(), { network: this.network, identityId, masterWif, keyId: stored.keyId, group: this.group() })
+      masterWif = null
+      await this.forget(identityId)
+    })
+  }
+
   /** Delete the stored key of `identityId` from this device (ending its session if open). */
   async forget(identityId: string): Promise<void> {
     if (this.state.session?.identityId === identityId) this.logout()
diff --git a/forge-web/lib/auth/create-identity.ts b/forge-web/lib/auth/create-identity.ts
index 0184a27c1..a17288b30 100644
--- a/forge-web/lib/auth/create-identity.ts
+++ b/forge-web/lib/auth/create-identity.ts
@@ -39,7 +39,7 @@ import {
   type LockProof,
 } from './asset-lock'
 import { CANONICAL_KEYS, assetLockKeyPath, deriveAt, deriveMasterKey, identityKeyPath, normalizeMnemonic } from './hd'
-import { defaultLimits, registerLimitedKey, verifyLimitedKey, type LimitedKey, type LimitedKeyRequest } from './limited-key'
+import { assertGroupHolds, defaultLimits, registerLimitedKey, verifyLimitedKey, type LimitedKey, type LimitedKeyRequest } from './limited-key'
 
 /** Minimum deposit (spec §2.2: 0.02 DASH; the asset-lock floor is 0.003). */
 export const MIN_DEPOSIT_DUFFS = 2_000_000
@@ -100,6 +100,8 @@ export async function createIdentityFromMnemonic(
     readonly network: Network
     readonly mnemonic: string
     readonly group: string
+    /** forge-core and forge-collab: the group must hold them on chain before a key binds to it. */
+    readonly contracts: readonly string[]
     readonly persistKey: (identityId: string, key: { keyId: number; wif: string }) => Promise<void>
     readonly minDepositDuffs?: number
     readonly limits?: LimitedKeyRequest
@@ -110,6 +112,7 @@ export async function createIdentityFromMnemonic(
   },
 ): Promise<{ identityId: string; key: LimitedKey }> {
   const { network, group } = params
+  await assertGroupHolds(sdk, group, params.contracts)
   const mnemonic = normalizeMnemonic(params.mnemonic)
   const ep = params.endpoints ?? coreEndpoints(network)
   const { AssetLockProof, OutPoint, Identity, IdentityPublicKey, IdentitySigner, PrivateKey, ContractBounds } = await import('@dashevo/evo-sdk')
@@ -217,6 +220,6 @@ export async function createIdentityFromMnemonic(
   }
 
   params.onStage?.('verifying')
-  const verified = await verifyLimitedKey(sdk, identityId, BROWSER_KEY_ID, group, network, wif)
+  const verified = await verifyLimitedKey(sdk, identityId, BROWSER_KEY_ID, group, network, wif, limits)
   return { identityId, key: { keyId: BROWSER_KEY_ID, wif, limits: verified } }
 }
diff --git a/forge-web/lib/auth/limited-key.ts b/forge-web/lib/auth/limited-key.ts
index e98971d72..cdad4fc36 100644
--- a/forge-web/lib/auth/limited-key.ts
+++ b/forge-web/lib/auth/limited-key.ts
@@ -10,8 +10,9 @@
  *   - expiring (`expiresAt`, default 90 days).
  *
  * The master key signs the one IdentityUpdate that registers it (and the new key signs its own
- * proof of possession), then is dropped: the WASM signer holding it is freed and the caller's
- * copy is not retained here.
+ * proof of possession) and is not retained: the WASM objects holding it are freed (which
+ * releases, but does not zero, their memory) and no reference to the WIF is kept. JS strings
+ * cannot be zeroed; the design minimizes how long they live.
  */
 
 import type { EvoSDK } from '@dashevo/evo-sdk'
@@ -47,8 +48,9 @@ export interface LimitedKey {
 
 /**
  * Register a limited key on `identityId`, signed once by `masterWif`. Generates the new key
- * in the WASM (never exposed until returned), registers it, verifies on chain that it landed
- * with exactly the requested bounds, budget and expiry, and returns it.
+ * in the WASM (not retained beyond the returned WIF), registers it, verifies on chain that it
+ * landed with the group bound, the requested budget and expiry, and returns it. The group is
+ * first checked on chain to hold forge-core and forge-collab.
  *
  * `replaceKeyId`: a renewal disables this browser's previous limited key in the same update,
  * so renewing never leaves a live key nobody holds. Only a live group-bound HIGH key is
@@ -63,10 +65,13 @@ export async function registerLimitedKey(
     readonly group: string
     readonly request?: LimitedKeyRequest
     readonly replaceKeyId?: number
+    /** The contracts the group must hold (forge-core, forge-collab), checked on chain first. */
+    readonly contracts?: readonly string[]
   },
 ): Promise<LimitedKey> {
   const { IdentityPublicKeyInCreation, ContractBounds, IdentitySigner, PrivateKey } = await import('@dashevo/evo-sdk')
   const request = params.request ?? defaultLimits()
+  if (params.contracts) await assertGroupHolds(sdk, params.group, params.contracts)
   const identity = await authSdk(sdk).identities.fetch(params.identityId)
   if (!identity) throw new Error(`identity ${params.identityId} not found on ${params.network}`)
 
@@ -119,7 +124,7 @@ export async function registerLimitedKey(
   }
   const wif = fresh.toWIF()
   fresh.free()
-  const limits = await verifyLimitedKey(sdk, params.identityId, keyId, params.group, params.network, wif)
+  const limits = await verifyLimitedKey(sdk, params.identityId, keyId, params.group, params.network, wif, request)
   return { keyId, wif, limits }
 }
 
@@ -143,6 +148,7 @@ export async function verifyLimitedKey(
   group: string,
   network: Network,
   wif?: string,
+  request?: LimitedKeyRequest,
 ): Promise<KeyLimits> {
   const identity = await authSdk(sdk).identities.fetch(identityId)
   const k = identity?.publicKeys.find((x) => x.keyId === keyId)
@@ -154,6 +160,11 @@ export async function verifyLimitedKey(
     throw new Error(`key ${keyId} is not bound to the dash-forge contract group`)
   }
   if (k.totalBudget === undefined || k.expiresAt === undefined) throw new Error(`key ${keyId} has no budget or expiry`)
+  if (Number(k.expiresAt) <= Date.now()) throw new Error(`key ${keyId} has expired`)
+  if (request) {
+    if (k.totalBudget !== request.budgetCredits) throw new Error(`key ${keyId} has a different budget than requested`)
+    if (Number(k.expiresAt) !== request.expiresAt) throw new Error(`key ${keyId} has a different expiry than requested`)
+  }
   if (wif !== undefined) {
     const { PrivateKey } = await import('@dashevo/evo-sdk')
     const pk = PrivateKey.fromWIF(wif)
@@ -164,6 +175,7 @@ export async function verifyLimitedKey(
     if (!ok) throw new Error(`the stored private key does not control key ${keyId}`)
   }
   const remaining = await readRemainingBudget(sdk, identityId, keyId)
+  if (remaining !== null && remaining <= 0n) throw new Error(`key ${keyId} has no budget left`)
   return { remaining, total: k.totalBudget, expiresAt: Number(k.expiresAt) }
 }
 
@@ -186,3 +198,44 @@ export async function readKeyLimits(sdk: EvoSDK, identityId: string, keyId: numb
     expiresAt: k.expiresAt === undefined ? null : Number(k.expiresAt),
   }
 }
+
+/**
+ * Refuse to bind a key to a group the chain does not show holding the forge contracts. The
+ * group id comes from the bundled deployment file; this checks it against state. (Its owner
+ * can add contracts later, which widens every group-bound key: see docs/guides/identity-and-keys.md.)
+ */
+export async function assertGroupHolds(sdk: EvoSDK, group: string, contracts: readonly string[]): Promise<void> {
+  const facade = (sdk as unknown as { contractGroups: { forContract(id: string): Promise<{ toJSON?(): { contract: string[] }; contract?: string[] }> } }).contractGroups
+  for (const id of contracts) {
+    const m = await facade.forContract(id)
+    const groups = (m.toJSON ? m.toJSON() : m).contract ?? []
+    if (!groups.includes(group)) throw new Error(`contract ${id} is not in the dash-forge group on chain; refusing to bind a key to it`)
+  }
+}
+
+/**
+ * Disable `keyId` on chain (an IdentityUpdate signed by the master key, used once and not
+ * retained). Only a group-bound HIGH key — a Forge browser key — may be disabled this way.
+ */
+export async function revokeLimitedKey(
+  sdk: EvoSDK,
+  params: { readonly network: Network; readonly identityId: string; readonly masterWif: string; readonly keyId: number; readonly group: string },
+): Promise<void> {
+  const { IdentitySigner, PrivateKey } = await import('@dashevo/evo-sdk')
+  const identity = await authSdk(sdk).identities.fetch(params.identityId)
+  const k = identity?.publicKeys.find((x) => x.keyId === params.keyId)
+  if (!identity || !k) throw new Error(`key ${params.keyId} is not on identity ${params.identityId}`)
+  if (k.disabledAt !== undefined) return
+  if (k.securityLevelNumber !== 2 || k.contractBounds?.toJSON().id !== params.group) {
+    throw new Error(`key ${params.keyId} is not a Forge browser key; refusing to disable it here`)
+  }
+  const master = PrivateKey.fromWIF(params.masterWif)
+  const signer = new IdentitySigner()
+  try {
+    signer.addKey(master)
+    await authSdk(sdk).identities.update({ identity, disablePublicKeys: [params.keyId], signer })
+  } finally {
+    signer.free()
+    master.free()
+  }
+}
diff --git a/forge-web/lib/auth/vault.ts b/forge-web/lib/auth/vault.ts
index 69036e7df..64c1fc018 100644
--- a/forge-web/lib/auth/vault.ts
+++ b/forge-web/lib/auth/vault.ts
@@ -3,7 +3,7 @@
  * rest, unlocked for the session.
  *
  * - What it holds: one record per (network, identity) — the identity id, the limited key's id
- *   and its private key. Never a master key: the import and create flows discard it before
+ *   and its private key. Never a master key: the import and create flows do not retain it past
  *   anything reaches here.
  * - At rest: IndexedDB (`vault` store), the secret sealed with AES-256-GCM under a random
  *   256-bit data key. The data key is itself wrapped (AES-GCM) by one or both of:
@@ -34,6 +34,28 @@ export const ARGON2_PARAMS = { m: 64 * 1024, t: 3, p: 1, dkLen: 32 } as const
 /** The minimum passphrase length the vault accepts. */
 export const MIN_PASSPHRASE = 10
 
+/**
+ * Hosts where many sites share one origin — a GitHub Pages project site, an IPFS path gateway.
+ * Every co-hosted site could read this vault's records and ask the browser for the passkey's
+ * PRF output, so the vault refuses to run there. Browsing still works.
+ */
+const SHARED_ORIGIN_HOSTS = [/\.github\.io$/i, /^(ipfs\.io|dweb\.link|gateway\.pinata\.cloud|cloudflare-ipfs\.com|ipfs\.[^.]+\.[^.]+)$/i]
+
+/** Why signing in cannot happen on this origin, or null when it can. */
+export function sharedOriginProblem(location: { hostname: string; pathname: string } | null = typeof window === 'undefined' ? null : window.location): string | null {
+  if (location === null) return null
+  const pathGateway = /^\/ip[fn]s\//.test(location.pathname)
+  if (pathGateway || SHARED_ORIGIN_HOSTS.some((re) => re.test(location.hostname))) {
+    return 'Signing in needs a dedicated origin; use https://forge.dashhq.org or an IPFS subdomain gateway. Browsing works here.'
+  }
+  return null
+}
+
+function assertDedicatedOrigin(): void {
+  const problem = sharedOriginProblem()
+  if (problem) throw new VaultLockedError(problem)
+}
+
 /** What the vault protects. */
 export interface VaultSecret {
   readonly identityId: string
@@ -220,6 +242,7 @@ export interface Protection {
  * and keep it unlocked for this session. At least one protection is required.
  */
 export async function storeInVault(network: Network, secret: VaultSecret, protection: Protection): Promise<void> {
+  assertDedicatedOrigin()
   if (!protection.passphrase && !protection.passkey) throw new Error('the vault needs a passphrase or a passkey')
   if (protection.passphrase !== undefined && protection.passphrase.length < MIN_PASSPHRASE) {
     throw new Error(`use a passphrase of at least ${MIN_PASSPHRASE} characters`)
@@ -286,16 +309,21 @@ async function unwrapWith(network: Network, record: VaultRecord, kek: Uint8Array
 
 /** Unlock with a passphrase. Throws {@link VaultLockedError} on a wrong one. */
 export async function unlockWithPassphrase(network: Network, identityId: string, passphrase: string): Promise<VaultSecret> {
+  assertDedicatedOrigin()
   const record = await idbGet<VaultRecord>('vault', key(network, identityId))
   const slot = record?.slots.find((s) => s.kind === 'passphrase')
   if (!record || !slot || slot.kind !== 'passphrase') throw new VaultLockedError('no passphrase-protected key for this identity here')
-  const secret = await unwrapWith(network, record, await passphraseKey(passphrase, slot.salt, slot.params), slot)
+  // The parameters are pinned, never read from the (unauthenticated) record: a tampered
+  // record cannot make unlock allocate gigabytes.
+  if (JSON.stringify(slot.params) !== JSON.stringify(ARGON2_PARAMS)) throw new VaultLockedError('this key was stored with unsupported settings')
+  const secret = await unwrapWith(network, record, await passphraseKey(passphrase, slot.salt), slot)
   setUnlocked(network, secret)
   return secret
 }
 
 /** Unlock with the enrolled passkey (a WebAuthn assertion with the PRF extension). */
 export async function unlockWithPasskey(network: Network, identityId: string): Promise<VaultSecret> {
+  assertDedicatedOrigin()
   const record = await idbGet<VaultRecord>('vault', key(network, identityId))
   const slot = record?.slots.find((s) => s.kind === 'passkey')
   if (!record || !slot || slot.kind !== 'passkey') throw new VaultLockedError('no passkey-protected key for this identity here')
@@ -313,6 +341,22 @@ export async function unlockWithPasskey(network: Network, identityId: string): P
 export async function forgetVault(network: Network, identityId: string): Promise<void> {
   lockVault()
   await idbDelete('vault', key(network, identityId))
+  clearSignedWrites()
+}
+
+/** Drop signed-but-unconfirmed writes this browser kept for retry (no keys; still, tidy up). */
+export function clearSignedWrites(): void {
+  if (typeof window === 'undefined') return
+  try {
+    const doomed: string[] = []
+    for (let i = 0; i < window.localStorage.length; i++) {
+      const k = window.localStorage.key(i)
+      if (k?.startsWith('forge:pending-st:')) doomed.push(k)
+    }
+    for (const k of doomed) window.localStorage.removeItem(k)
+  } catch {
+    /* storage disabled */
+  }
 }
 
 // The unlocked secret: module memory only.

From 211f661370f592124287df4d21b298e9860b3d8a Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sat, 26 Sep 2026 13:04:57 -0500
Subject: [PATCH 7/9] fix(web): refuse vault keys bound to a retired contract
 group

A contract re-registration leaves limited keys bound to the old group: they still validate but every write is refused. Unlock now reports them as needing renewal; renew and revoke accept any group-bound budgeted HIGH key so old keys can be disabled. The e2e reads the group from the deployment file.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 forge-web/e2e/v2-auth.spec.ts     |  5 ++++-
 forge-web/lib/auth/controller.ts  | 14 +++++++++++---
 forge-web/lib/auth/limited-key.ts | 18 ++++++++++++------
 3 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/forge-web/e2e/v2-auth.spec.ts b/forge-web/e2e/v2-auth.spec.ts
index a6fcb8f2d..49651cfeb 100644
--- a/forge-web/e2e/v2-auth.spec.ts
+++ b/forge-web/e2e/v2-auth.spec.ts
@@ -25,7 +25,10 @@ test.skip(!existsSync(idFile('CI-RUNNER')), 'devnet test identities not found')
 test.describe.configure({ mode: 'serial', timeout: 30 * 60_000 })
 
 const ROOT = resolve(__dirname, '../..')
-const GROUP = '23iVLZABbVQ5a4heSa6GLVbVqSWr74JTSESSMTEYNd6o'
+/** The group the app binds keys to: the one in the deployment file it is built with. */
+const GROUP: string = E2E_DEVNET
+  ? JSON.parse(readFileSync(join(ROOT, `forge-contracts/deployments/devnet-${E2E_DEVNET}.json`), 'utf8')).v2.forgeCore.contractGroupId
+  : ''
 
 /** Read an identity's keys straight from Platform (evo-sdk in Node), independent of the app. */
 async function onChainKeys(identityId: string): Promise<{ id: number; level: string; budget: bigint | null; expiresAt: number | null; bound: string | null; remaining: bigint | null }[]> {
diff --git a/forge-web/lib/auth/controller.ts b/forge-web/lib/auth/controller.ts
index b1b688807..f5d075df2 100644
--- a/forge-web/lib/auth/controller.ts
+++ b/forge-web/lib/auth/controller.ts
@@ -187,6 +187,14 @@ export class AuthController {
       if (!identity) throw new WriteAuthError(`identity ${secret.identityId} not found on ${this.network}`)
       const match = await findSigningKey(identity, secret.wif, this.network, SECURITY_LEVEL.HIGH)
       if (!match) throw new KeyNotUsableError()
+      // A vault key is a limited key: bound to a group that no longer holds the forge contracts
+      // (they were re-registered), it would open a session whose every write is refused.
+      if (storage === 'vault') {
+        const bounds = identity.publicKeys.find((k) => k.keyId === match.keyId)?.contractBounds?.toJSON()
+        if (bounds?.$type === 'contractGroup' && bounds.id !== this.group()) {
+          throw new KeyNotUsableError("this browser's key is bound to an old dash-forge contract group — renew it")
+        }
+      }
       const keyLimits = knownLimits ?? (await readKeyLimits(sdk, secret.identityId, match.keyId).catch(() => null))
       const session: AuthSession = {
         identityId: secret.identityId,
@@ -372,7 +380,7 @@ export class AuthController {
         masterWif = (await deriveMasterKey(input.mnemonic, this.network)).wif
       }
       if (!masterWif) throw new Error('no master key found')
-      await revokeLimitedKey(await this.getSdk(), { network: this.network, identityId, masterWif, keyId: stored.keyId, group: this.group() })
+      await revokeLimitedKey(await this.getSdk(), { network: this.network, identityId, masterWif, keyId: stored.keyId })
       masterWif = null
       await this.forget(identityId)
     })
@@ -387,8 +395,8 @@ export class AuthController {
 
 /** The key opened no longer controls a usable key on the identity (disabled, expired, wrong). */
 export class KeyNotUsableError extends WriteAuthError {
-  constructor() {
-    super("this browser's key is no longer usable on the identity (disabled or expired) — renew it")
+  constructor(message = "this browser's key is no longer usable on the identity (disabled or expired) — renew it") {
+    super(message)
     this.name = 'KeyNotUsableError'
   }
 }
diff --git a/forge-web/lib/auth/limited-key.ts b/forge-web/lib/auth/limited-key.ts
index cdad4fc36..c6ab7a07c 100644
--- a/forge-web/lib/auth/limited-key.ts
+++ b/forge-web/lib/auth/limited-key.ts
@@ -105,10 +105,7 @@ export async function registerLimitedKey(
       expiresAt: BigInt(request.expiresAt),
     })
     const old = identity.publicKeys.find((k) => k.keyId === params.replaceKeyId)
-    const disable =
-      old && old.disabledAt === undefined && old.securityLevelNumber === 2 && old.contractBounds?.toJSON().id === params.group
-        ? [old.keyId]
-        : []
+    const disable = old && old.disabledAt === undefined && isForgeBrowserKey(old) ? [old.keyId] : []
     try {
       await authSdk(sdk).identities.update({ identity, addPublicKeys: [key], ...(disable.length ? { disablePublicKeys: disable } : {}), signer })
     } catch (e) {
@@ -213,20 +210,29 @@ export async function assertGroupHolds(sdk: EvoSDK, group: string, contracts: re
   }
 }
 
+/**
+ * A key Forge may renew over or revoke: HIGH, bound to a contract group, with a budget. Any
+ * group, not just the current one, so a key left on an old group by a contract
+ * re-registration can still be disabled.
+ */
+function isForgeBrowserKey(k: WasmKey): boolean {
+  return k.securityLevelNumber === 2 && k.contractBounds?.toJSON().$type === 'contractGroup' && k.totalBudget !== undefined
+}
+
 /**
  * Disable `keyId` on chain (an IdentityUpdate signed by the master key, used once and not
  * retained). Only a group-bound HIGH key — a Forge browser key — may be disabled this way.
  */
 export async function revokeLimitedKey(
   sdk: EvoSDK,
-  params: { readonly network: Network; readonly identityId: string; readonly masterWif: string; readonly keyId: number; readonly group: string },
+  params: { readonly network: Network; readonly identityId: string; readonly masterWif: string; readonly keyId: number },
 ): Promise<void> {
   const { IdentitySigner, PrivateKey } = await import('@dashevo/evo-sdk')
   const identity = await authSdk(sdk).identities.fetch(params.identityId)
   const k = identity?.publicKeys.find((x) => x.keyId === params.keyId)
   if (!identity || !k) throw new Error(`key ${params.keyId} is not on identity ${params.identityId}`)
   if (k.disabledAt !== undefined) return
-  if (k.securityLevelNumber !== 2 || k.contractBounds?.toJSON().id !== params.group) {
+  if (!isForgeBrowserKey(k)) {
     throw new Error(`key ${params.keyId} is not a Forge browser key; refusing to disable it here`)
   }
   const master = PrivateKey.fromWIF(params.masterWif)

From 2bbe14a09e71f6b8eb888697bf9b368d2ffe5fc9 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sat, 26 Sep 2026 13:12:10 -0500
Subject: [PATCH 8/9] test(web): use the re-registered moutai forge-core id in
 App Connect tests

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 forge-web/lib/auth/auth-v2.test.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/forge-web/lib/auth/auth-v2.test.ts b/forge-web/lib/auth/auth-v2.test.ts
index 91617b872..ba2733562 100644
--- a/forge-web/lib/auth/auth-v2.test.ts
+++ b/forge-web/lib/auth/auth-v2.test.ts
@@ -116,7 +116,7 @@ describe('vault', () => {
 
 describe('App Connect envelope (Yappr key exchange)', () => {
   it('builds a dash-key request that carries the ephemeral key and contract', () => {
-    const contract = 'GdZYaEntYPiW9dvUGCHyeqN7H7qEocbSkuj81n341i3L'
+    const contract = 'GM7ozWV1MNuAxyMnrf4JngAyGSDickvLznGi72WMp8EL'
     const req = newRequest('devnet', contract)
     expect(req.uri).toMatch(/^dash-key:[1-9A-HJ-NP-Za-km-z]+\?n=d&v=1$/)
     const body = base58Decode(req.uri.slice('dash-key:'.length, req.uri.indexOf('?')))
@@ -128,7 +128,7 @@ describe('App Connect envelope (Yappr key exchange)', () => {
   })
 
   it('opens what a wallet seals, and derives the auth key', async () => {
-    const req = newRequest('devnet', 'GdZYaEntYPiW9dvUGCHyeqN7H7qEocbSkuj81n341i3L')
+    const req = newRequest('devnet', 'GM7ozWV1MNuAxyMnrf4JngAyGSDickvLznGi72WMp8EL')
     const appPub = base58Decode(req.uri.slice(9, req.uri.indexOf('?'))).slice(1, 34)
     // The wallet side (BrowserLoginKeyProtocol.seal).
     const walletPriv = secp.utils.randomSecretKey()

From 21174c0e445cb4dc4488d1ef1a92aa6b3f68d9e0 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sat, 26 Sep 2026 13:23:49 -0500
Subject: [PATCH 9/9] fix(web): retry the key read-back after registering a
 limited key

A lagging node answered 'key N is not on identity' right after the update landed (live a1).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 forge-web/lib/auth/limited-key.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/forge-web/lib/auth/limited-key.ts b/forge-web/lib/auth/limited-key.ts
index c6ab7a07c..9ba300904 100644
--- a/forge-web/lib/auth/limited-key.ts
+++ b/forge-web/lib/auth/limited-key.ts
@@ -21,6 +21,7 @@ import type { Network } from '../constants'
 import { CREDITS_PER_DASH } from '../sdk/cost'
 import { authSdk, type WasmKey } from '../sdk/facade'
 import type { KeyLimits } from '../view/funds'
+import { retryWhileMissing } from '../view/retry'
 
 /** Browser key defaults (spec §2.1). */
 export const BROWSER_KEY_DEFAULTS = { budgetDash: 0.05, days: 90 } as const
@@ -147,8 +148,11 @@ export async function verifyLimitedKey(
   wif?: string,
   request?: LimitedKeyRequest,
 ): Promise<KeyLimits> {
-  const identity = await authSdk(sdk).identities.fetch(identityId)
-  const k = identity?.publicKeys.find((x) => x.keyId === keyId)
+  // Called right after registering: a node a block behind does not show the key yet.
+  const k = await retryWhileMissing(async () => {
+    const identity = await authSdk(sdk).identities.fetch(identityId)
+    return identity?.publicKeys.find((x) => x.keyId === keyId) ?? null
+  }, 6)
   if (!k) throw new Error(`key ${keyId} is not on identity ${identityId}`)
   if (k.disabledAt !== undefined) throw new Error(`key ${keyId} is disabled`)
   if (k.purposeNumber !== 0 || k.securityLevelNumber !== 2) throw new Error(`key ${keyId} is not an AUTHENTICATION/HIGH key`)