diff --git a/.env.example b/.env.example
index d14ca41e..834e6bc1 100644
--- a/.env.example
+++ b/.env.example
@@ -23,13 +23,27 @@ CANTON_BACKEND_TOKEN=
 
 RPC_URL=http://localhost:3010/rpc
 
+# The token registry's own options, which dev-stack.sh passes through to it when set here.
+# CORS_ORIGINS defaults to exactly http://localhost:3012, so the dApp opened on any other
+# spelling of that address (127.0.0.1, a published port, a LAN name) needs it listed here.
+# Quoted, and no space after the comma: dev-stack.sh sources this file as a shell script,
+# where an unquoted space starts a second word and aborts `up` before anything starts.
+#CORS_ORIGINS='http://localhost:3012,http://127.0.0.1:3012'
+
 ###############################################################################
 # Frontend
 ###############################################################################
 VITE_EXPLORER_URL=http://scan.localhost:4000
-VITE_WALLET_RPC_URL=http://localhost:3010/rpc
+VITE_REGISTRY_URL=http://localhost:3013
 
 ###############################################################################
 # Vercel
 ###############################################################################
-#WALLET_SERVICE_RPC_URL=http://localhost:3010/rpc
+# Both are set on the deployed project rather than in this file, and neither can be localhost
+# there: the bundle asks its own origin, and only the function names the registry.
+#VITE_REGISTRY_URL=/api/registry
+#REGISTRY_URL=https://registry.example
+# Set by the build command in dapp/frontend/vercel.json, and by any other host that serves this
+# bundle: it is what makes the two VITE_ keys above required instead of falling back to localhost,
+# which an https page blocks as mixed content. Never set it for a local or CI build.
+#DEPLOYED_BUILD=1
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..93e81659
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+*.dar binary
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index c9209c5b..7683afe9 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -42,7 +42,7 @@ jobs:
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm typecheck
-      - run: pnpm -r --filter '!./dapp/daml' run --if-present build
+      - run: pnpm build
       - run: pnpm knip
       - run: pnpm docs:check
       - run: pnpm run check:anatomy
diff --git a/CLAUDE.md b/CLAUDE.md
index 344ca9f6..cabbd1cb 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -10,7 +10,6 @@ Each subproject can layer its own `CLAUDE.md` for stack-specific deltas:
 - [`canton-dappbooster/CLAUDE.md`](canton-dappbooster/CLAUDE.md) — L2 component authoring and file layout
 - [`canton-theme/CLAUDE.md`](canton-theme/CLAUDE.md) — L3 `--cnc-*` token naming convention
 - [`dapp/frontend/CLAUDE.md`](dapp/frontend/CLAUDE.md) — app layout and naming deltas; its seams are in [`dapp/frontend/architecture.md`](dapp/frontend/architecture.md)
-- `dapp/daml/` — see its `README.md`
 
 The dApp connects through any CIP-0103 browser wallet; no wallet lives in this monorepo. This stack
 was developed against Carpincho, which has its own repository at
@@ -39,8 +38,7 @@ Current distribution:
 |-------|--------|--------|--------|--------------|----------|
 | root | yes | shim | yes | yes | Canonical repo rules and cross-component seams. |
 | `canton-connect/` | yes | shim | yes | yes, plus `architecture/` | Public hook API, the machine-owned lifecycle, the picker/adapter seams; chapters for the connection machine and the popup close guard. |
-| `dapp/frontend/` | yes | shim | yes | yes | Canton Coin vesting dApp; `CLAUDE.md` carries the page-owns-its-components layout and the naming rules an agent would otherwise get wrong, architecture.md its internal seams. Carries a `PROVENANCE.md` recording the vendored source. |
-| `dapp/daml/` | yes | no | no | no | Single DAML package (`amulet-vesting`), vendored source, built here. Carries a `PROVENANCE.md` recording the source commit and the two integration deltas. |
+| `dapp/frontend/` | yes | shim | yes | yes | DBT vesting dApp; `CLAUDE.md` carries the page-owns-its-components layout and the naming rules an agent would otherwise get wrong, architecture.md its internal seams. Carries a `PROVENANCE.md` recording the vendored source. |
 | `canton-dappbooster/` | yes | shim | yes | yes | L2 headless components; `CLAUDE.md` carries the folder-per-component layout an agent would otherwise get wrong, architecture.md the authoring seam (anatomy contract, L2/L3 split, Zag boundary). |
 | `canton-theme/` | yes | shim | yes | no | Plain-CSS theme (L3); README covers the two CSS exports, `CLAUDE.md` the `--cnc-*` naming convention an agent adding a token would otherwise invent. |
 
@@ -61,17 +59,18 @@ A README may state that a contract exists and link to it. It may not restate it.
 
 | Category | Technology | Notes |
 |----------|-----------|-------|
-| Languages | TypeScript, DAML, Bash | TypeScript across the JS subprojects; DAML in `dapp/daml/`; Bash and Node for the root `scripts/` and `kit/` |
+| Languages | TypeScript, Bash | TypeScript across the JS subprojects; Bash and Node for the root `scripts/` and `kit/` |
 | Package manager | pnpm workspaces | Single root `pnpm-lock.yaml`; one root `pnpm install` links every workspace. Workspace layout, `linkWorkspacePackages` and `allowBuilds` live in `pnpm-workspace.yaml`. Root `package.json` orchestrates scripts via `pnpm -C <dir>` |
 | Node | 24 | Exact version pinned via root `.nvmrc`; inherits to every Node subproject. Root and the four Node subprojects all declare `engines.node` at `>=24.15.0`, which is what jsdom 30 requires |
 | Container runtime | Docker | Required by the `@bootnodedev/canton-barebones` LocalNet; nothing in this repository builds an image |
 | LocalNet | @bootnodedev/canton-barebones | Pinned exact in root devDependencies and reached through `pnpm exec canton-barebones`, so the version is the one in `package.json`. Nothing about its config is committed: `scripts/localnet-config.mjs` scaffolds the gitignored `.canton-localnet/` from the tool's own template and turns on `validators.appUser.ui` and `sv.scanUI`, without which nginx serves no `/api/validator` or `/api/scan`. The Splice checkout and the runtime env land in `.canton-localnet/.generated/` |
+| Token registry | @bootnodedev/canton-token-forge | Read-only CIP-56 registry service. A git dependency pinned to `v0.3.0` and reached through `pnpm exec canton-token-forge-registry`. Its `prepare` is what compiles `registry/dist`, so `pnpm-workspace.yaml`'s `allowBuilds` must carry the resolved git specifier or the bin resolves to nothing. `scripts/dev-stack.sh` runs it on 3013, configured entirely from the block `scripts/bootstrap-vesting.mjs` prints |
 | Commit linting | commitlint + husky | Enforced via root `.husky/commit-msg` |
 | Lint / format | Biome | One root `biome.json` and a single root `@biomejs/biome`; per-project specifics live in `overrides`. No per-subproject Biome install or config. `pnpm lint` = `biome check --error-on-warnings` (warnings fail); standalone SVG assets are excluded |
 | Pre-commit | lint-staged | Two passes from `.husky/pre-commit`, because only the first writes: `.lintstagedrc.format.mjs` runs root Biome (`biome check --write`) across `canton-connect/`, `canton-dappbooster/`, `canton-theme/`, `dapp/frontend/`, `kit/` and `scripts/`, then `.lintstagedrc.mjs` runs the read-only gates — the tests, the doc check and the anatomy check — concurrently. One pass would let a reformat land mid-parse |
 | Pre-push | tsc | Root `.husky/pre-push` runs `pnpm typecheck` (`pnpm -r run --if-present typecheck`, i.e. `tsc` in each Node subproject that defines it) |
 | Secret scanning | gitleaks | Shared `.husky/gitleaks.sh` runs gitleaks in the pre-commit (staged diff) and pre-push (outgoing range) hooks; the pinned version (`.gitleaks-version`) is installed by `scripts/install-gitleaks.sh`, so local and CI use the same rules. Accepted non-secret findings live in `.gitleaksignore` |
-| Dead code | knip | Root `knip.json` + `pnpm knip`; gates unused files/dependencies/exports. `@bootnodedev/canton-wallet-service` is in `ignoreDependencies` because nothing runs it from a `package.json` script: `scripts/dev-stack.sh` and the README call `pnpm exec canton-wallet-service`, and knip does not read shell scripts. `postcss` is there for the reason under `kit/` and the consumer scaffold |
+| Dead code | knip | Root `knip.json` + `pnpm knip`; gates unused files/dependencies/exports. `@bootnodedev/canton-wallet-service` and `@bootnodedev/canton-token-forge` are in `ignoreDependencies` because nothing runs either from a `package.json` script: `scripts/dev-stack.sh` and the README call them through `pnpm exec`, and knip does not read shell scripts. `postcss` is there for the reason under `kit/` and the consumer scaffold |
 | Doc reference + gate | typedoc | `kit/typedoc.json` over `canton-dappbooster` and `canton-connect`, each declaring its entry points in its own `typedoc.json` and extending `kit/typedoc.shared.json` for every option that resolves per package. `pnpm docs:check` validates without emitting; `pnpm docs:build` writes the site to `typedoc/`. One config for both, strict: every validation on, `treatValidationWarningsAsErrors` and `treatWarningsAsErrors` |
 | Doc rules gate | `kit/docs-check.mjs` | `pnpm docs:check` runs it after typedoc. Owns what typedoc cannot see: barrel completeness, `@example` presence and naming by tier, snippet compilation, comment width, tier caps, `@category` values, the `@throws` and anatomy-`@see` requirements, the `@param`/`@returns` refusals, and description presence on exported functions (see the splits below) |
 | Anatomy parity gate | `kit/check-anatomy.mjs` | `pnpm check:anatomy` checks every class and `data-*` selector in `canton-theme` against the `anatomy.parts.*` / `anatomy.states.*` strings in `canton-dappbooster`, and requires each anatomy to be reached by at least one selector. Asymmetric on purpose, for the reason its header gives: an unstyled part is a legitimate consumer hook, so there is no per-part check the other way. `aria-*` states are outside it. A styling gate, not a doc one |
@@ -85,13 +84,12 @@ A README may state that a contract exists and link to it. It may not restate it.
 
 | Path | Purpose | Stack | Port |
 |------|---------|-------|------|
-| [`dapp/daml/`](dapp/daml/) | `amulet-vesting` DAML model: factory, proposal, contract, residual claim, escrowing Canton Coin as a Splice `LockedAmulet`. Vendored from [cc-vesting-contracts](https://github.com/BootNodeDev/cc-vesting-contracts), where its scenarios stay | DAML | n/a (DAR artifact) |
-| [`dapp/frontend/`](dapp/frontend/) | Canton Coin vesting dApp over the local participant. Every read and write goes through the connected CIP-0103 wallet via `canton-connect`; the operator's factory, the `AmuletRules` and the open mining round all arrive by explicit disclosure. Imported from `cn-dappbooster@feat/vesting-lite` (see its `PROVENANCE.md`). | Vite + React + Ark UI + lucide-react + Tailwind v4 + zustand + react-router + Biome | 3012 |
+| [`dapp/frontend/`](dapp/frontend/) | `DBT` vesting dApp over the local participant. Every read and write goes through the connected CIP-0103 wallet via `canton-connect`; the operator's factory and the instrument's `InstrumentConfig` arrive by explicit disclosure, the config from the token registry. Imported from `cn-dappbooster@feat/vesting-lite` (see its `PROVENANCE.md`). | Vite + React + Ark UI + lucide-react + Tailwind v4 + zustand + react-router + Biome | 3012 |
 | [`canton-connect/`](canton-connect/) | wagmi-style React hooks wrapping the `dapp-sdk` facade; the SDK owns discovery, the picker, the session and the transports | TypeScript + React 19 + xstate 5 + Biome | n/a (library) |
 | [`canton-dappbooster/`](canton-dappbooster/) | L2 headless UI components for Canton dApps (tsdown-built, zero styling), plus the light/dark/system theme runtime that drives `data-theme`, plus the pure utilities the components are built on, the exact-decimal amount ones included. Styling lives in `canton-theme`. `src/index.ts` is the public API; `src/connect.ts` is the `/connect` sub-path, holding the components that read the wallet session so the main barrel stays free of the Canton SDK. | TypeScript + React 19 + tsdown + vitest + Biome | n/a (library) |
 | [`canton-theme/`](canton-theme/) | L3 plain-CSS theme for the kit: `--cnc-*` tokens + prestyled defaults, consumed by importing its CSS. | CSS | n/a (library) |
 
-Two things the loop needs are not subprojects but dependencies. wallet-service ships from
+Three things the loop needs are not subprojects but dependencies. wallet-service ships from
 [BootNodeDev/canton-wallet-service](https://github.com/BootNodeDev/canton-wallet-service),
 installs from npm as a root devDependency, and `scripts/dev-stack.sh` runs it on
 port 3010 through `pnpm exec canton-wallet-service`. The LocalNet ships from
@@ -99,6 +97,12 @@ port 3010 through `pnpm exec canton-wallet-service`. The LocalNet ships from
 devDependency whose config `scripts/dev-stack.sh` scaffolds into the gitignored
 `.canton-localnet/` and drives there over `pnpm exec`.
 
+The token registry ships from
+[BootNodeDev/canton-token-forge](https://github.com/BootNodeDev/canton-token-forge), arrives as a
+git dependency pinned to a tag, and `scripts/dev-stack.sh` runs it on port 3013 through
+`pnpm exec canton-token-forge-registry`. That repository also builds both DARs under `vendor/`;
+`vendor/PROVENANCE.md` records which release each came from.
+
 ## Code Style
 
 - All source code in English regardless of conversation language.
@@ -337,7 +341,13 @@ package, because only `canton-dappbooster` splits markup from styles across a pa
 
 - Use **pnpm** only (never npm or yarn).
 - This is a pnpm workspaces monorepo: one `pnpm install` from the repo root installs and links every package. There is no per-package install step.
-- Run a subproject script either by `cd <subproject>` or by using `pnpm -C <subproject> run <script>`. The root `package.json` is the whole local loop, in order: `mint-token`, `build-dar`, `deploy-dar -- <dar>`, `bootstrap`, `app:dev`. Docs and `dev-stack.sh` use those names, not the underlying commands, so the implementation can move without a doc sweep. There is no `format` script anywhere: `lint:fix` is `biome check --write`, which formats too.
+- Run a subproject script either by `cd <subproject>` or by using `pnpm -C <subproject> run <script>`. The root `package.json` is the whole local loop, in order: `mint-token`, `deploy-dar -- <dar>` for both `vendor/` binaries, `bootstrap`, `app:dev`. Docs and `dev-stack.sh` use those names, not the underlying commands, so the implementation can move without a doc sweep. There is no `format` script anywhere: `lint:fix` is `biome check --write`, which formats too.
+- **`bootstrap` and `dev-stack.sh` share one contract: the `KEY=value` block bootstrap prints on
+  stdout.** Nothing is written to disk, so nothing can go stale, and a manual run gets a block it
+  can paste into a `.env`. `scripts/bootstrap-vesting.test.mjs` holds the printed keys and
+  `dev-stack.sh`'s `REGISTRY_ENV_KEYS` together; add a registry variable to one and that test
+  fails until the other follows. `LEDGER_API_TOKEN` is the one variable outside it, because
+  bootstrap never sees the bearer.
 - **The LocalNet is not in this repository, and neither is its config.** It is
   `@bootnodedev/canton-barebones`, a pinned devDependency driven with `start` / `stop` / `reset` in
   the directory holding `canton-barebones.config.json`. `up` scaffolds that directory itself through
@@ -355,10 +365,12 @@ package, because only `canton-dappbooster` splits markup from styles across a pa
 - `node canton-dappbooster/scripts/add-component.mjs <PascalCaseName>` scaffolds a component folder
   in that package. Not wired into `package.json`: it is an authoring convenience, not part of the
   loop above.
-- `pnpm run bootstrap` creates the vesting operator and its factory, which the
-  dApp cannot start without. Run it after the DAR is deployed. It writes no file: the dApp reads
-  both back off the ledger once a wallet connects, so nothing can go stale between the two, and
-  pointing the wallet at another participant is the whole of switching networks.
+- `pnpm run bootstrap` creates the vesting operator and its factory, which the dApp cannot start
+  without, plus the instrument admin and its `DBT` InstrumentConfig. Run it after both DARs deploy.
+  It writes no file, printing the admin and instrument as a registry env block instead: the dApp
+  reads the operator and factory back off the ledger once a wallet connects, so nothing can go
+  stale between the two, and pointing the wallet at another participant is the whole of switching
+  networks.
 - **One `.env`, at the root.** It is wallet-service's entire configuration, because the service
   loads dotenv from the directory it starts in and `pnpm exec` starts it here; it also holds the
   signing recipe `scripts/mint-token.mjs` reads and the token `scripts/deploy-dar.sh` sends. Both
@@ -385,7 +397,7 @@ package, because only `canton-dappbooster` splits markup from styles across a pa
   how it reached npm. `dapp/frontend` also lists it in `dependencies` on the same range: pnpm and
   npm auto-install peers, yarn does not, and a consumer can turn that off. It can go back to
   optional once upstream moves that import behind a dynamic one.
-- `pnpm-workspace.yaml` lists the packages allowed to run build scripts under `allowBuilds`: `esbuild` and `protobufjs`. Anything else is blocked until it is added.
+- `pnpm-workspace.yaml` lists the packages allowed to run build scripts under `allowBuilds`: `esbuild` and `protobufjs`. Anything else is blocked until it is added. `@bootnodedev/canton-token-forge` is listed there too, because pnpm refuses to run a git dependency's `prepare` otherwise, and that key is the resolved tarball id, so moving the ref means replacing the commit sha in it.
 - Do not commit `.env.local`, `node_modules`, `dist/`, `dist-extension/`, or `.claude/settings.local.json` (covered by root `.gitignore`).
 
 ## `kit/` and the consumer scaffold
@@ -409,9 +421,9 @@ Two rules keep that entry whole:
 
 - **Tooling that belongs to one package lives in that package.**
   `canton-dappbooster/scripts/add-component.mjs` is the example.
-- **`scripts/lib/` stays put.** `fetch-daml-deps.mjs` imports `repoRoot` from `gate.mjs` and
-  survives in a consumer tree, so the folder cannot move. `manifests.mjs` moved to `kit/` because
-  only `check-versions.mjs` and `release-version.mjs` import it, and both left.
+- **A shared module follows its importers.** `gate.mjs` and `manifests.mjs` are both in `kit/`
+  because nothing outside `kit/` imports them any more; a module a surviving script still needs
+  would have to stay in `scripts/`.
 
 What survives, and why it still works with the libraries gone:
 
@@ -480,9 +492,7 @@ every publish on purpose, back when the `development` condition had no override
 order, so `canton-connect` publishes before `canton-dappbooster`, which depends on it.
 
 **Four versions move in lockstep**: the root `package.json` and the three libraries. `dapp/frontend`
-and `dapp/daml` keep their own, because neither is published — and `dapp/daml`'s real version is
-`version: 0.0.2` in `dapp/daml/daml.yaml`, which names the built DAR, so its `package.json` version
-is not the one that matters.
+keeps its own, because it is not published.
 
 **`node kit/release-version.mjs 0.4.0` does the whole bump.** `pnpm run release:version 0.4.0`
 is the same thing; never spell it with a `--` separator, which pnpm forwards into `argv` so the
@@ -549,9 +559,11 @@ See [`architecture.md`](architecture.md) for the system shape, subproject layout
   - root `scripts/` and `kit/`: covered by the root `pnpm test`, which appends
     `node --test "scripts/**/*.test.mjs" "kit/**/*.test.mjs"` to the fan-out because `pnpm -r` skips
     the root package. The version lockstep check is one of those tests,
-    `kit/check-versions.test.mjs`, for the reason under `kit/` and the consumer scaffold
+    `kit/check-versions.test.mjs`, for the reason under `kit/` and the consumer scaffold.
+    `bootstrap-vesting.test.mjs` is the one test that reads a second file: it parses
+    `dev-stack.sh` for the key list, which is what makes the two-script contract checkable
 - Kit components are tested inside `canton-dappbooster` (vitest + jsdom). `dapp/frontend`'s vitest run covers its pure logic wherever that lives; component/DOM behaviour and app+kit integration are out of scope there.
-- From the root, `pnpm test` / `pnpm typecheck` / `pnpm build` / `pnpm knip` fan out across every workspace (`pnpm -r --if-present`). CI runs these minus `dapp/daml`'s build, which needs `dpm` and a network fetch of the Splice DARs.
+- From the root, `pnpm test` / `pnpm typecheck` / `pnpm build` / `pnpm knip` fan out across every workspace (`pnpm -r --if-present`). CI runs the same set.
 - `pnpm docs:check` (typedoc plus `kit/docs-check.mjs`), `pnpm run check:anatomy` and `pnpm run check:versions` do not fan out: each reads the packages it covers directly, and typedoc has one config over both libraries. `pnpm docs:build` writes the reference site to `typedoc/`.
 - Cover the paths that matter — business logic, API integrations, component behaviour. Skip styling, third-party library internals, trivial getters/setters.
 
diff --git a/README.md b/README.md
index 89b0a2a1..a3c7d202 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,6 @@ Local Canton development stack.
 - Node 24 (>=24.15.0)
 - pnpm 11.22.0
 - Docker
-- dpm (DAML SDK 3.4.11)
 
 ## Initial setup
 
@@ -81,17 +80,20 @@ pnpm exec canton-barebones start
 - The first run pulls ~10 GB. If `start` exits 1 during splice migrations, run it again.
 - Splice can take a few minutes to start.
 
-### DAR build and deploy
+### DAR deploy
 
 `deploy-dar` requires LocalNet up and running.
 
 ```bash
-pnpm run build-dar
-# use the appropriate version for amulet-vesting-*.dar
-pnpm run deploy-dar -- dapp/daml/.daml/dist/amulet-vesting-*.dar
+pnpm run deploy-dar -- vendor/canton-token-forge.dar
+pnpm run deploy-dar -- vendor/vesting.dar
 ```
 
-**Note:** The step is only needed the first time. Run again if the Daml source changes or if LocalNet is reset.
+**Note:** Safe to re-run. It reuses the operator, factory and instrument it finds on the ledger and
+creates only what is missing, so the holdings and grants of an earlier run survive a `down` and `up`.
+A LocalNet reset drops the parties with the ledger, so the next run creates them again. Both DARs are
+committed binaries and need no build, so no DAML SDK is involved; `canton-token-forge` goes
+first, because `vesting` data-depends on it. See `vendor/PROVENANCE.md`.
 
 ### Wallet service
 
@@ -109,7 +111,29 @@ Needs both LocalNet and wallet-service up and running.
 pnpm run bootstrap
 ```
 
-**Note:** The step is only needed the first time. Run again if the Daml source changes or if LocalNet is reset.
+**Note:** Safe to re-run. It reuses the operator, factory and instrument it finds on the ledger and
+creates only what is missing, so the holdings and grants of an earlier run survive a `down` and `up`.
+A LocalNet reset drops the parties with the ledger, so the next run creates them again. A ledger
+bootstrapped before this step became idempotent carries `vesting-operator-<stamp>` parties that no
+run adopts; reset it once and the holdings from those runs are gone with it.
+
+### Token registry
+
+Needs the registry env block `bootstrap` printed above, plus `CANTON_BACKEND_TOKEN` from `.env` as the bearer.
+
+```bash
+source .env
+# paste the block bootstrap printed, skipping its LEDGER_API_TOKEN placeholder line, then:
+export LEDGER_API_URL ADMIN_PARTY INSTRUMENT_CONFIG_TEMPLATE_ID PREAPPROVAL_TEMPLATE_ID \
+  LOCKED_TOKEN_TEMPLATE_ID TRANSFER_INSTRUCTION_TEMPLATE_ID ALLOCATION_TEMPLATE_ID PORT
+DOTENV_CONFIG_PATH=/dev/null LEDGER_API_TOKEN="$CANTON_BACKEND_TOKEN" pnpm exec canton-token-forge-registry
+```
+
+`DOTENV_CONFIG_PATH=/dev/null` is not optional: the registry loads dotenv from the directory it
+starts in, which here is the repo root, so without it the whole of `.env` is read into the registry
+process, `CANTON_AUTH_SECRET` included.
+
+**Note:** `./scripts/dev-stack.sh up` automates this step, reading the block back out of its own bootstrap log.
 
 ### Demo dApp
 
diff --git a/architecture.md b/architecture.md
index 061b71c8..6c1349f1 100644
--- a/architecture.md
+++ b/architecture.md
@@ -5,11 +5,11 @@
 | Subproject | Stack | Purpose |
 | --- | --- | --- |
 | LocalNet (external: [BootNodeDev/canton-barebones](https://github.com/BootNodeDev/canton-barebones)) | Node CLI over Docker Compose + the official Splice LocalNet bundle | Starts `sv + app-user`. A pinned devDependency, scaffolded by `dev-stack.sh` into the gitignored `.canton-localnet/` |
-| `scripts/` | Bash + Node | The local loop: `dev-stack.sh`, the Splice dep fetch, the DAR build and upload, the token mint, the vesting bootstrap |
+| `scripts/` | Bash + Node | The local loop: `dev-stack.sh`, the DAR upload, the token mint, the vesting bootstrap |
 | `kit/` | Node + JSON | The tooling that reads the three libraries' source: the doc, anatomy and version gates, the release bump, and the typedoc configs. Grouped so a consumer scaffold deletes it whole; see [`CLAUDE.md`](CLAUDE.md) |
 | wallet-service (external: [BootNodeDev/canton-wallet-service](https://github.com/BootNodeDev/canton-wallet-service)) | Node 24 + Express 5 + TypeScript + `@canton-network/wallet-sdk` | Bridge the wallet uses for external-party onboarding and participant JSON API calls. A root devDependency installed from npm, run on the host by `scripts/dev-stack.sh` |
-| `dapp/frontend/` | Vite + React + Ark UI + Tailwind v4 + zustand + react-router | Canton Coin **vesting** dApp; every read and write goes through the connected CIP-0103 wallet via `canton-connect` |
-| `dapp/daml/` | DAML | `amulet-vesting` DAR: the vesting factory, proposal, contract and residual-claim templates, escrowing real Canton Coin as a Splice `LockedAmulet`. Vendored from [BootNodeDev/cc-vesting-contracts](https://github.com/BootNodeDev/cc-vesting-contracts); its Splice data-dependencies are fetched, not committed |
+| token registry (external: [BootNodeDev/canton-token-forge](https://github.com/BootNodeDev/canton-token-forge)) | Node + Express + TypeScript | Read-only CIP-56 registry over the `canton-token-forge` package: serves instrument metadata and the transfer-factory choice context. A git dependency pinned to a tag, run on the host by `scripts/dev-stack.sh` |
+| `dapp/frontend/` | Vite + React + Ark UI + lucide-react + Tailwind v4 + zustand + react-router | `DBT` **vesting** dApp; every read and write goes through the connected CIP-0103 wallet via `canton-connect`, and the `InstrumentConfig` every write carries comes from the token registry |
 | `canton-connect/` | TypeScript + React 19 | wagmi-style hooks wrapping the dapp-sdk facade |
 | `canton-dappbooster/` | TypeScript + React 19 + tsdown | L2 headless UI components, zero styling, plus the theme runtime and the pure utilities under the components, exact-decimal amounts included |
 | `canton-theme/` | CSS | L3 plain-CSS theme: `--cnc-*` tokens + prestyled defaults |
@@ -28,24 +28,26 @@ flowchart TD
   au["Splice app-user<br/>JSON API http://localhost:2975"]
   sv["Splice sv<br/>DSO / synchronizer side"]
   scan["Scan<br/>http://scan.localhost:4000"]
-  dar["amulet-vesting DAR"]
+  dar["vendored DARs<br/>canton-token-forge + vesting"]
+  reg["canton-token-forge registry<br/>http://localhost:3013"]
 
-  fe -->|"AmuletRules + open mining round, off amulet.tap"| ws
   fe <-->|"CIP-0103 provider: reads, writes, session"| wallet
   wallet -->|"onboarding, prepare/execute, JSON API"| ws
+  fe -->|"instrument + InstrumentConfig disclosure"| reg
+  reg -->|"CANTON_BACKEND_TOKEN"| au
   ws -->|"CANTON_BACKEND_TOKEN"| au
   ws -->|"AmuletRules, mining rounds"| scan
   au <--> sv
   dar --> au
 ```
 
-> `dapp/frontend` hosts the Canton Coin vesting dApp. Every ledger read and every submission goes
-> through the wallet over CIP-0103, so the dApp only ever acts as the connected account and each
-> write is signed by the account's own key. One call is not a ledger path: an Amulet-moving choice
-> takes the current `AmuletRules` and open mining round as an argument, and no connected party is a
-> stakeholder of either, so the dApp asks wallet-service's `amulet.tap` — a pure builder that
-> submits nothing — and keeps the two disclosures its answer carries. Deployed, that one call goes
-> through the app's own `/api/rpc` function, which forwards it and refuses every other method.
+> `dapp/frontend` hosts the vesting dApp. Every ledger read and every submission goes through the
+> wallet over CIP-0103, so the dApp only ever acts as the connected account and each write is signed
+> by the account's own key. One call is not a ledger path: every choice that moves a holding takes
+> the instrument's `InstrumentConfig` as an argument, and no connected party is a stakeholder of it,
+> so the dApp asks the token registry's CIP-56 transfer-factory route and keeps the disclosure its
+> answer carries. Deployed, those calls go through the app's own `/api/registry` function, which
+> forwards three read-only routes and refuses the rest.
 
 `app-user` is the primary local validator from the official Splice LocalNet
 bundle. It is not a product user. `sv` provides the Super Validator / DSO side
@@ -70,6 +72,7 @@ State boundaries:
 | wallet-service | `http://localhost:3010` | wallet bridge for onboarding and JSON API calls |
 | CIP-0103 browser wallet | `http://localhost:3011` | browser wallet UI/provider, run from its own repo |
 | dApp frontend | `http://localhost:3012` | example dApp |
+| canton-token-forge registry | `http://localhost:3013` | CIP-56 registry, run from the env block `bootstrap` prints |
 | app-user Wallet UI | `http://wallet.localhost:2000` | optional official Splice wallet UI |
 | app-user Ledger API | `grpc://localhost:2901` | SDK/tools |
 | app-user Admin API | `grpc://localhost:2902` | wallet-service/tools |
@@ -110,14 +113,13 @@ with the same script, configured manually in its LocalNet settings.
 
 | Command | What it does |
 | --- | --- |
-| `./scripts/dev-stack.sh up` | the whole local loop: LocalNet, DAR, wallet-service on 3010, bootstrap, dApp dev server |
-| `./scripts/dev-stack.sh down` | stop wallet-service and the dApp dev server, stop the LocalNet |
+| `./scripts/dev-stack.sh up` | the whole local loop: LocalNet, DARs, wallet-service on 3010, bootstrap, token registry on 3013, dApp dev server |
+| `./scripts/dev-stack.sh down` | stop the dApp dev server, the token registry and wallet-service, stop the LocalNet |
 | `pnpm exec canton-barebones start` / `stop` / `reset` / `status` | the LocalNet itself, run from `.canton-localnet/` |
 | `node scripts/localnet-config.mjs <dir>` | scaffold that directory and apply the flags nginx needs |
 | `pnpm run mint-token` | generate a LocalNet dev JWT, offline |
-| `pnpm run build-dar` | fetch the Splice deps, then compile the DAR with `dpm` |
-| `pnpm run deploy-dar -- <dar>` | upload DAR to app-user JSON API |
-| `pnpm run bootstrap` | create the vesting operator and its factory |
+| `pnpm run deploy-dar -- <dar>` | upload DAR to app-user JSON API; called for both `vendor/` binaries |
+| `pnpm run bootstrap` | create the vesting operator and its factory, the instrument admin and its `DBT` InstrumentConfig, and print the registry env block |
 | `pnpm run app:dev` | start the dApp frontend |
 
 `dev-stack.sh` shells out to the LocalNet tool in the directory passed as its second argument
diff --git a/canton-dappbooster/src/utils/readInstruments.ts b/canton-dappbooster/src/utils/readInstruments.ts
index 2b89b9d3..72b8da8f 100644
--- a/canton-dappbooster/src/utils/readInstruments.ts
+++ b/canton-dappbooster/src/utils/readInstruments.ts
@@ -28,8 +28,15 @@ interface Page {
   nextPageToken: string | undefined
 }
 
+// A registry that accepts the socket and never answers would otherwise leave the caller's own
+// `await` pending for good, with nothing to render and no error to show for it.
+const REQUEST_TIMEOUT_MS = 15_000
+
 const get = async (url: string): Promise<unknown> => {
-  const response = await fetch(url, { headers: { accept: 'application/json' } })
+  const response = await fetch(url, {
+    headers: { accept: 'application/json' },
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+  })
   if (!response.ok) {
     throw new Error(`${url} answered ${response.status}`)
   }
@@ -63,7 +70,8 @@ const toPage = (value: unknown): Page => {
  * Reads a registry's instrument metadata, following its pages up to a limit of 100, so the answer
  * is the registry's whole catalogue and a registry that will not stop paging cannot hang the caller.
  *
- * @throws where either request answers anything but 200, or the reply is not JSON.
+ * @throws where either request answers anything but 200, does not answer within 15s, or replies
+ * with something that is not JSON.
  *
  * @example
  * const instruments = await readInstruments('https://registry.example/api')
diff --git a/dapp/daml/.gitignore b/dapp/daml/.gitignore
deleted file mode 100644
index 60db8084..00000000
--- a/dapp/daml/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-.daml/
-deps/
diff --git a/dapp/daml/AmuletVesting.daml b/dapp/daml/AmuletVesting.daml
deleted file mode 100644
index b65cc45b..00000000
--- a/dapp/daml/AmuletVesting.daml
+++ /dev/null
@@ -1,381 +0,0 @@
-module AmuletVesting where
-
-import Splice.Amulet
-import Splice.AmuletRules
-import Splice.Expiry (TimeLock(..), maxTime)
-import AmuletVesting.Schedule (VestingSchedule, vestedAmount, validVestingSchedule, minGrantAmount)
-
--- ---------------------------------------------------------------------------
--- Shared escrow mechanic
--- ---------------------------------------------------------------------------
-
--- | The one tricky escrow mechanic, shared by both withdraw choices:
--- unlock the escrow, push `releaseAmount` to the receiver, re-lock the remainder
--- back to the owner. The re-lock holders are {provider, receiver} minus the owner, so the
--- unlock controller is always {owner, provider, receiver} -- collusion-resistant:
--- the live escrow has owner=creator (holders [provider, receiver]); a AmuletVestedClaim has
--- owner=receiver (holders [provider]). expiresAt = maxTime in both cases.
--- `backing` is the amount currently in the lock (caller knows it).
--- Returns the receiver's unlocked Amulet and the optional re-locked remainder.
--- Authority must be supplied by the calling choice (owner + provider + receiver for the
--- unlock; transfer controllers for the re-transfer).
-releaseAndRelock
-  :  AppTransferContext
-  -> Party  -- dso
-  -> Party  -- provider
-  -> Party  -- owner (creator)
-  -> Party  -- receiver
-  -> ContractId LockedAmulet
-  -> Decimal  -- backing
-  -> Decimal  -- releaseAmount
-  -> Text     -- relockContext: on-ledger optContext tag for the re-locked remainder
-  -> Update (ContractId Amulet, Optional (ContractId LockedAmulet))
-releaseAndRelock ctx dso provider owner receiver lockedCid backing releaseAmount relockContext = do
-  unlockRes <- exercise lockedCid LockedAmulet_UnlockV2
-  -- `remainder` is exact by construction: releaseAmount + remainder == backing ==
-  -- the unlocked input's initialAmount, so the transfer is an exact split (inputs ==
-  -- outputs, no sender-change). Any positive sub-dust remainder re-locks rather than
-  -- being discarded; a zero remainder means the escrow is fully drained.
-  --
-  -- ZERO-FEE DEPENDENCY (CIP-78): this exact split leaves no headroom for Amulet
-  -- transfer/create/lock fees. If any were charged, `leftOverAmount < 0` and the
-  -- AmuletRules balance check would abort with InsufficientFunds, stranding the grant.
-  -- This is safe because CIP-78 removed those fees at the protocol level: a valid
-  -- AmuletRules contract MUST satisfy `validTransferConfig`, which forces
-  -- createFee == transferFee == lockHolderFee == 0 (Splice.AmuletConfig.validTransferConfig,
-  -- enforced by the AmuletRules `ensure`). The only non-zero fee the protocol still
-  -- permits is the holding fee, which is not charged on transfers (only on Amulet_Expire).
-  -- If a future Splice version reintroduces non-zero transfer/create/lock fees, this
-  -- model must add explicit fee headroom (e.g. a receiverFeeRatio or a fee allowance
-  -- passed in by the off-ledger backend). See docs/ARCHITECTURE.md.
-  let remainder = backing - releaseAmount
-  -- Never leave a sub-`minGrantAmount` dust remainder re-locked. A tiny LockedAmulet
-  -- is DSO-expirable within ~minutes (amountExpiresAt grows with the locked amount), which
-  -- would archive the backing lock and strand the tail. The caller must either drain fully
-  -- (remainder == 0) or leave at least a viable floor.
-  assertMsg "re-lock remainder is below minGrantAmount (drain fully or leave >= the floor)"
-    (remainder == 0.0 || remainder >= minGrantAmount)
-  let relockOutputs =
-        if remainder > 0.0
-        then [ TransferOutput with
-                 receiver = owner
-                 receiverFeeRatio = 0.0
-                 amount = remainder
-                 meta = None
-                 lock = Some TimeLock with
-                   -- Hold the remainder for {provider, receiver} minus the owner. The owner is
-                   -- already an unlock controller (owner :: holders), so listing the other two
-                   -- makes the unlock require all of {owner, provider, receiver}:
-                   --   escrow re-lock (owner=creator) -> holders [provider, receiver]
-                   --   claim  re-lock (owner=receiver) -> holders [provider]
-                   holders = filter (/= owner) [provider, receiver]
-                   expiresAt = maxTime
-                   optContext = Some relockContext ]
-        else []
-      outputs =
-        TransferOutput with
-          receiver = receiver
-          receiverFeeRatio = 0.0
-          amount = releaseAmount
-          lock = None
-          meta = None
-        :: relockOutputs
-  result <- exerciseAppTransfer dso ctx Transfer with
-    sender = owner
-    provider = provider
-    inputs = [InputAmulet unlockRes.amuletCid]
-    outputs
-    beneficiaries = None
-  -- createdAmulets follows outputs order: [receiver Amulet] (++ [re-locked LockedAmulet]).
-  case result.createdAmulets of
-    [TransferResultAmulet rcv] -> pure (rcv, None)
-    [TransferResultAmulet rcv, TransferResultLockedAmulet relocked] -> pure (rcv, Some relocked)
-    _ -> abort "releaseAndRelock: unexpected transfer outputs"
-
--- ---------------------------------------------------------------------------
--- Main vesting contract
--- ---------------------------------------------------------------------------
-template AmuletVestingContract
-  with
-    provider         : Party    -- ^ the app provider Party
-    creator          : Party    -- ^ locked the CC; gets unvested CC on cancel; is the lock owner
-    receiver         : Party    -- ^ beneficiary; can withdraw vested CC; co-holder of the escrow lock
-    dso              : Party    -- ^ Canton Coin DSO (Amulet admin); passed as expectedDso to AmuletRules. Not a signatory or lock holder.
-    totalAmount      : Decimal  -- ^ total CC originally locked
-    schedule         : VestingSchedule
-    alreadyWithdrawn : Decimal  -- ^ running total already sent to receiver
-    lockedAmuletCid  : ContractId LockedAmulet  -- ^ the single locked holding backing this contract
-    note             : Optional Text
-  where
-    -- The receiver is a signatory (not merely an observer): this makes the receiver's
-    -- authority ambient in every choice on this contract, including the creator-controlled
-    -- Cancel. That, in turn, lets the escrow lock list the receiver as a holder
-    -- (holders = [provider, receiver]) so LockedAmulet_UnlockV2's controller becomes
-    -- {creator, provider, receiver} -- all three are required to unlock. Creator + provider
-    -- alone can therefore NOT drain the escrow out-of-band, while the creator still cancels
-    -- unilaterally (the receiver's consent was given once, at Accept). The receiver signs
-    -- by exercising Accept on the proposal.
-    signatory provider, creator, receiver
-
-    -- Re-assert schedule well-formedness here (not only in the Factory) so a malformed
-    -- schedule can never back a live contract, even via a direct create that bypasses the
-    -- validating Factory. The schedule is immutable, so this holds across every withdraw
-    -- successor too. `validVestingSchedule` is a pure Bool, usable in `ensure`.
-    -- `alreadyWithdrawn < totalAmount` is STRICT. A live contract therefore always has
-    -- backing = totalAmount - alreadyWithdrawn > 0, which makes the Cancel `[] -> (None, None)`
-    -- branch provably unreachable (a zero-backing Cancel would silently return the residual to
-    -- the creator as sender-change). The full-drain Withdraw archives instead of creating a
-    -- zero-backing successor, so the strict bound never rejects a legitimate successor.
-    ensure
-      totalAmount > 0.0
-      && alreadyWithdrawn >= 0.0
-      && alreadyWithdrawn < totalAmount
-      && validVestingSchedule schedule
-
-    -- -----------------------------------------------------------------------
-    -- Receiver withdraws currently-available Amulet (vested - alreadyWithdrawn)
-    -- -----------------------------------------------------------------------
-    choice AmuletVestingContract_Withdraw : AmuletVestingContract_WithdrawResult
-      with
-        withdrawAmount : Decimal
-        ctx            : AppTransferContext
-      controller receiver
-      do
-        now <- getTime
-        assertMsg "cliff not reached" (now >= schedule.cliff)
-        let vested    = vestedAmount schedule totalAmount now
-            available = vested - alreadyWithdrawn
-            backing   = totalAmount - alreadyWithdrawn
-        assertMsg "withdrawAmount must be positive" (withdrawAmount > 0.0)
-        assertMsg "withdrawAmount exceeds available vested amount" (withdrawAmount <= available)
-        (receivedAmuletCid, optRelocked) <-
-          releaseAndRelock ctx dso provider creator receiver lockedAmuletCid backing withdrawAmount "vesting-withdraw-remainder"
-        vestingCid <- case optRelocked of
-          None -> pure None   -- fully withdrawn (only possible once fully vested); contract archived
-          Some newLockedCid -> fmap Some $ create this with
-            alreadyWithdrawn = alreadyWithdrawn + withdrawAmount
-            lockedAmuletCid = newLockedCid
-        pure AmuletVestingContract_WithdrawResult with vestingCid; receivedAmuletCid
-
-    -- -----------------------------------------------------------------------
-    -- Creator cancels: receiver keeps accrued share, creator gets the rest
-    -- -----------------------------------------------------------------------
-    choice AmuletVestingContract_Cancel : AmuletVestingContract_CancelResult
-      with
-        ctx : AppTransferContext
-      controller creator
-      do
-        now <- getTime
-        let vested    = vestedAmount schedule totalAmount now
-            clawback  = totalAmount - vested            -- unvested -> creator (unlocked)
-            owed      = vested - alreadyWithdrawn        -- earned, unwithdrawn -> AmuletVestedClaim
-        -- clawback + owed == totalAmount - alreadyWithdrawn == backing of the escrow
-        -- The owed leg is re-locked into the AmuletVestedClaim; forbid a sub-floor dust
-        -- lock the DSO could expire out from under the receiver. Either nothing is owed
-        -- (owed == 0) or the residual must be at least minGrantAmount. The clawback leg is
-        -- handed back unlocked, so it needs no floor.
-        assertMsg "owed residual is below minGrantAmount (would re-lock as expirable dust)"
-          (owed == 0.0 || owed >= minGrantAmount)
-        unlockRes <- exercise lockedAmuletCid LockedAmulet_UnlockV2
-        let clawbackOutputs =
-              if clawback > 0.0
-              then [ TransferOutput with
-                       receiver = creator; receiverFeeRatio = 0.0; amount = clawback; lock = None
-                       meta = None ]
-              else []
-            owedOutputs =
-              if owed > 0.0
-              -- The owed residual is unconditionally the receiver's, so re-lock it with
-              -- owner = receiver (holders = [provider]); unlock controller = {receiver, provider}.
-              -- The creator can no longer reach it. Feasible because the receiver is a signatory
-              -- of this contract, so its authority is present in this creator-controlled Cancel.
-              then [ TransferOutput with
-                       receiver = receiver; receiverFeeRatio = 0.0; amount = owed
-                       meta = None
-                       lock = Some TimeLock with
-                         holders = [provider]; expiresAt = maxTime
-                         optContext = Some "vesting-cancel-owed" ]
-              else []
-        result <- exerciseAppTransfer dso ctx Transfer with
-          sender = creator
-          provider = provider
-          inputs = [InputAmulet unlockRes.amuletCid]
-          outputs = clawbackOutputs ++ owedOutputs
-          beneficiaries = None
-        -- createdAmulets order: [clawback Amulet?] ++ [owed LockedAmulet?]
-        let (clawbackAmuletCid, owedLockedCid) = case result.createdAmulets of
-              [] -> (None, None)
-              [TransferResultAmulet cb] -> (Some cb, None)
-              [TransferResultLockedAmulet ow] -> (None, Some ow)
-              [TransferResultAmulet cb, TransferResultLockedAmulet ow] -> (Some cb, Some ow)
-              _ -> error "AmuletVestingContract_Cancel: unexpected transfer outputs"
-        vestedClaimCid <- case owedLockedCid of
-          None -> pure None
-          Some ow -> fmap Some $ create AmuletVestedClaim with
-            provider; creator; receiver; dso
-            amount = owed; withdrawn = 0.0
-            lockedAmuletCid = ow; note
-        pure AmuletVestingContract_CancelResult with clawbackAmuletCid; vestedClaimCid
-
--- ---------------------------------------------------------------------------
--- Vested residual handed to the receiver at cancel time
--- ---------------------------------------------------------------------------
-template AmuletVestedClaim
-  with
-    provider        : Party
-    creator         : Party
-    receiver        : Party
-    dso             : Party
-    amount          : Decimal   -- total earned residual handed over at cancel
-    withdrawn       : Decimal   -- running total already pulled by receiver
-    lockedAmuletCid : ContractId LockedAmulet
-    note            : Optional Text
-  where
-    signatory provider, creator
-    observer receiver
-
-    ensure
-      amount > 0.0
-      && withdrawn >= 0.0
-      && withdrawn <= amount
-
-    -- Receiver pulls the fully-earned residual. No cliff, no schedule.
-    choice AmuletVestedClaim_Withdraw : AmuletVestedClaim_WithdrawResult
-      with
-        withdrawAmount : Decimal
-        ctx            : AppTransferContext
-      controller receiver
-      do
-        -- The claim has no schedule, so the whole un-withdrawn residual is available, and it
-        -- is also exactly what backs the lock: available == backing == amount - withdrawn.
-        let available = amount - withdrawn
-        assertMsg "withdrawAmount must be positive" (withdrawAmount > 0.0)
-        assertMsg "withdrawAmount exceeds available amount" (withdrawAmount <= available)
-        -- owner = receiver: the claim residual is wholly the receiver's, so the lock (and any
-        -- re-locked remainder) is receiver-owned; unlock controller = {receiver, provider}.
-        (receivedAmuletCid, optRelocked) <-
-          releaseAndRelock ctx dso provider receiver receiver lockedAmuletCid available withdrawAmount "vesting-claim-remainder"
-        claimCid <- case optRelocked of
-          None -> pure None
-          Some newLockedCid -> fmap Some $ create this with
-            withdrawn = withdrawn + withdrawAmount
-            lockedAmuletCid = newLockedCid
-        pure AmuletVestedClaim_WithdrawResult with claimCid; receivedAmuletCid
-
-template AmuletVestingProposal
-  with
-    provider    : Party
-    proposer    : Party
-    receiver    : Party
-    totalAmount : Decimal
-    schedule    : VestingSchedule
-    amuletCids  : [ContractId Amulet]
-    note        : Optional Text
-  where
-    signatory provider, proposer
-    observer receiver
-
-    choice AmuletVestingProposal_Accept : ContractId AmuletVestingContract
-      with
-        ctx : AppTransferContext   -- supplied off-ledger by the app backend
-      controller receiver
-      do
-        -- Derive the DSO from the funder's own input Amulets rather than trusting a
-        -- caller-supplied `dso`. An `Amulet` is signed by `{dso, owner}`, and the proposer
-        -- (owner of these amulets) is a signatory of this proposal, so fetching one is
-        -- authorized - whereas the DSO-signed `AmuletRules` is NOT fetchable by us. The
-        -- derived `dso` is the actual admin of the very CC being locked, so the stored `dso`
-        -- is correct by construction and consistent with the transfer's `expectedDso`; this
-        -- removes the footgun where a typo'd `dso` produced a proposal that could never Accept.
-        dso <- case amuletCids of
-          (cid :: _) -> (.dso) <$> fetch cid
-          []         -> abort "AmuletVestingProposal_Accept: no input amulets to fund the grant"
-        -- Self-transfer the funder's CC into a single LockedAmulet escrow:
-        --   owner = proposer (creator), holders = [provider, receiver], expiresAt = maxTime.
-        -- Listing the receiver as a holder makes LockedAmulet_UnlockV2's controller
-        -- {creator, provider, receiver}, so creator+provider cannot unlock it out-of-band.
-        -- Authority present: {provider, proposer, receiver} (proposal sigs + Accept controller);
-        -- the transfer needs {sender=proposer, lock-holders=provider,receiver} -- all present.
-        result <- exerciseAppTransfer dso ctx Transfer with
-          sender = proposer
-          provider = provider
-          inputs = map InputAmulet amuletCids
-          outputs =
-            [ TransferOutput with
-                receiver = proposer
-                receiverFeeRatio = 0.0
-                amount = totalAmount
-                meta = None
-                lock = Some TimeLock with
-                  holders = [provider, receiver]
-                  expiresAt = maxTime
-                  optContext = Some "vesting-escrow"
-            ]
-          beneficiaries = None
-        lockedCid <- case result.createdAmulets of
-          [TransferResultLockedAmulet cid] -> pure cid
-          _ -> abort "AmuletVestingProposal_Accept: expected exactly one locked output"
-        create AmuletVestingContract with
-          provider
-          creator = proposer
-          receiver
-          dso
-          totalAmount
-          schedule
-          alreadyWithdrawn = 0.0
-          lockedAmuletCid = lockedCid
-          note
-
--- | Provider-signed, observer-less factory. Because there are no on-ledger observers,
--- proposers cannot see this contract through normal visibility rules; instead the app
--- backend hands them the factory contract via explicit disclosure so they can exercise
--- AmuletVestingFactory_CreateVesting without requiring on-ledger visibility.
---
--- The factory is a long-lived, reusable singleton: AmuletVestingFactory_CreateVesting is
--- nonconsuming, so a single factory contract originates many vestings and is not archived
--- per grant (mirroring the upstream AmuletRules / ExternalPartyAmuletRules / TransferFactory
--- nonconsuming-factory pattern). One factory per provider, reused for every grant.
-template AmuletVestingFactory
-  with
-    factoryOwner : Party
-  where
-    signatory factoryOwner
-
-    nonconsuming choice AmuletVestingFactory_CreateVesting : ContractId AmuletVestingProposal
-      with
-        proposer    : Party
-        receiver    : Party
-        totalAmount : Decimal
-        schedule    : VestingSchedule
-        amuletCids  : [ContractId Amulet]
-        note        : Optional Text
-      controller proposer
-      do
-        assertMsg "schedule is not well-formed" (validVestingSchedule schedule)
-        assertMsg "grant total below minimum" (totalAmount >= minGrantAmount)
-        create AmuletVestingProposal with
-          provider = factoryOwner
-          proposer
-          receiver
-          totalAmount
-          schedule
-          amuletCids
-          note
-
--- Result records --------------------------------------------------------------
-
-data AmuletVestingContract_WithdrawResult = AmuletVestingContract_WithdrawResult
-  with
-    vestingCid        : Optional (ContractId AmuletVestingContract)
-    receivedAmuletCid : ContractId Amulet
-  deriving (Eq, Show)
-
-data AmuletVestingContract_CancelResult = AmuletVestingContract_CancelResult with
-    clawbackAmuletCid : Optional (ContractId Amulet)     -- unvested CC returned to creator
-    vestedClaimCid    : Optional (ContractId AmuletVestedClaim) -- earned residual for the receiver
-  deriving (Eq, Show)
-
-data AmuletVestedClaim_WithdrawResult = AmuletVestedClaim_WithdrawResult with
-    claimCid          : Optional (ContractId AmuletVestedClaim)
-    receivedAmuletCid : ContractId Amulet
-  deriving (Eq, Show)
diff --git a/dapp/daml/AmuletVesting/Schedule.daml b/dapp/daml/AmuletVesting/Schedule.daml
deleted file mode 100644
index 7a12b41c..00000000
--- a/dapp/daml/AmuletVesting/Schedule.daml
+++ /dev/null
@@ -1,71 +0,0 @@
-module AmuletVesting.Schedule where
-
-import DA.Time (subTime, convertRelTimeToMicroseconds)
-import DA.List (last, head)
-
--- | How CC accrues over time. Fraction-based so escrow logic stays curve-agnostic.
-data VestingCurve
-  = LinearVesting with start : Time; end : Time
-      -- ^ continuous linear accrual from start (0) to end (1)
-  | MilestoneVesting with points : [(Time, Decimal)]
-      -- ^ step function; each (time, CUMULATIVE fraction), strictly ascending, last == 1.0
-  deriving (Eq, Show)
-
-data VestingSchedule = VestingSchedule with
-    curve : VestingCurve
-    cliff : Time   -- ^ nothing is *earned* before this (true cliff)
-  deriving (Eq, Show)
-
--- | Fraction of the grant vested by `now`, in [0,1]. The ONE place curve shape matters.
-vestedFraction : VestingSchedule -> Time -> Decimal
-vestedFraction sched now
-  | now < sched.cliff = 0.0
-  | otherwise = case sched.curve of
-      LinearVesting start end
-        | now >= end   -> 1.0
-        | now <= start -> 0.0
-        | otherwise    ->
-            let elapsedUs  = convertRelTimeToMicroseconds (subTime now start)
-                durationUs = convertRelTimeToMicroseconds (subTime end start)
-            in intToDecimal elapsedUs / intToDecimal durationUs
-      MilestoneVesting points ->
-        case filter (\(t, _) -> t <= now) points of
-          []      -> 0.0
-          reached -> snd (last reached)   -- cumulative fraction of the last reached point
-
--- | CC vested by `now`, given the grant total. total * fraction.
-vestedAmount : VestingSchedule -> Decimal -> Time -> Decimal
-vestedAmount sched total now = total * vestedFraction sched now
-
--- | Conservative minimum grant size (CC). This is a sanity floor against absurdly
--- small grants, NOT a guarantee that the escrow survives the whole vesting horizon.
---
--- A LockedAmulet of `initialAmount` is DSO-reclaimable after
--- `ceil(initialAmount / holdingRate)` rounds (Splice.Expiry.amountExpiresAt). At the
--- reference rate 0.00002, `initialAmount = 1.0` survives ~50,000 rounds ≈ ~1 year at
--- 10-min rounds - so a 1.0-CC grant vesting over more than ~1 year can have its entire
--- escrow expired by the DSO mid-vest. The survival horizon scales with the grant
--- size, but the holding rate is off-ledger and cannot be read by an on-ledger choice,
--- so this floor is a flat conservative bound, not a horizon-derived one.
---
--- The off-ledger backend is responsible for sizing grants so the escrow outlives the
--- schedule (`initialAmount >= holdingRate * roundsUntil(vestingEnd)`). Tunable.
-minGrantAmount : Decimal
-minGrantAmount = 1.0
-
--- | Strictly-ascending check on a list given a comparison projection.
-strictlyAscending : Ord b => (a -> b) -> [a] -> Bool
-strictlyAscending f xs = and (zipWith (\a b -> f a < f b) xs (drop 1 xs))
-
--- | Schedule well-formedness. Enforced at proposal creation (Factory choice).
-validVestingSchedule : VestingSchedule -> Bool
-validVestingSchedule sched = case sched.curve of
-  LinearVesting start end ->
-    start < end && start <= sched.cliff && sched.cliff <= end
-  MilestoneVesting points ->
-    not (null points)
-      && strictlyAscending fst points                                   -- times ascending
-      && strictlyAscending snd points                                   -- cumulative fractions ascending
-      && all (\(_, fr) -> fr > 0.0 && fr <= 1.0) points                 -- in (0, 1]
-      && snd (last points) == 1.0                                       -- last == 1.0
-      && sched.cliff <= fst (head points)                               -- cliff at/before first point
diff --git a/dapp/daml/PROVENANCE.md b/dapp/daml/PROVENANCE.md
deleted file mode 100644
index 50c91479..00000000
--- a/dapp/daml/PROVENANCE.md
+++ /dev/null
@@ -1,46 +0,0 @@
-# Provenance
-
-The `amulet-vesting` Daml package was vendored from the `cc-vesting-contracts` repository. No
-DAR is checked in; `pnpm build-dar` produces it, and the Splice DARs it data-depends on are
-fetched rather than committed (see [`README.md`](README.md)).
-
-| Field | Value |
-|-------|-------|
-| Source repo | https://github.com/BootNodeDev/cc-vesting-contracts |
-| Source branch | `main` |
-| Source commit | `000c481b1c9119bf564568c93ab53cddd3072ab0` |
-| Imported | `daml/amulet-vesting/daml/` flattened into `dapp/daml/` |
-
-## Integration deltas
-
-- **The package sits at `dapp/daml/` rather than in a folder named after itself, and `daml.yaml`
-  reads `source: .` rather than `source: daml`.** Upstream is a container of several dpm packages
-  and needs the name in the path; there is one package here, so a rename would otherwise move every
-  reference to it. The LF package id covers the relative source root, so this layout is what
-  produces the `36560185…` recorded below where the upstream layout produces `67e6dff7…`; both are
-  reproducible, and a participant holding one refuses the other at the same name and version.
-- **`daml.yaml`'s data-dependencies point at `deps/`, and carry no version.** Upstream names
-  `splice-amulet-0.1.19.dar` under its own `deps/splice-daml/dars/`, which is the output of its
-  `scripts/fetch-dep.sh` at a hardcoded Splice tag. Here `scripts/fetch-daml-deps.mjs` reads the
-  tag off the pinned `@bootnodedev/canton-barebones` template — the same one the LocalNet is
-  scaffolded from — and copies each DAR to a version-less name, so the amulet built against and
-  the amulet the network runs cannot drift apart and no path here moves when they bump.
-- **Each of the five `TransferOutput` literals in `AmuletVesting.daml` gained `meta = None`.**
-  `Splice.AmuletRules.TransferOutput` grew a `meta : Optional Metadata` field between
-  `splice-amulet` 0.1.19, which upstream builds against, and 0.1.21, which Splice 0.6.11 runs. The
-  field is optional and nothing else in the record moved, so this is the upgrade-compatible
-  spelling and no behaviour travels with it. It belongs upstream; until it lands there, re-vendoring
-  means reapplying it.
-- The test package (`daml/amulet-vesting-test/`) is not imported. It runs against Splice's own
-  Amulet test harness, which upstream builds from a full checkout of `canton-network/splice`, and
-  that is a heavier dependency than this repository's loop needs. The scenarios stay upstream.
-
-Nothing else. `AmuletVesting.daml` and `AmuletVesting/Schedule.daml` are otherwise unmodified.
-
-## Verified on import
-
-`pnpm build-dar` under `dpm` 1.0.10 against Splice 0.6.11 (`splice-amulet` 0.1.21, package id
-`73e9ffdb…`) produces main package id
-`36560185ce1f8999ce6d9903c52933087bca82c6ef3842168eed14830fd17148`. The full grant lifecycle —
-tap, factory, proposal, accept, withdraw — was exercised against the LocalNet with that DAR
-deployed.
diff --git a/dapp/daml/README.md b/dapp/daml/README.md
deleted file mode 100644
index 417a5060..00000000
--- a/dapp/daml/README.md
+++ /dev/null
@@ -1,37 +0,0 @@
-# dApp Daml
-
-The vesting dApp's Daml code: one package, `amulet-vesting`, holding the factory, proposal,
-contract and residual claim, escrowing real Canton Coin as a Splice `LockedAmulet`. It sits
-directly here rather than in a folder named after itself, so a rename touches
-[`daml.yaml`](daml.yaml) and nothing else. Its scenarios stay in the repository it was vendored
-from; see [`PROVENANCE.md`](PROVENANCE.md).
-
-## Build and deploy
-
-From the repo root:
-
-```bash
-pnpm run build-dar
-pnpm run deploy-dar -- dapp/daml/.daml/dist/amulet-vesting-0.0.2.dar
-```
-
-`deploy-dar` uploads to the app-user JSON API and takes the bearer token from the root `.env`.
-Both commands need the Daml SDK (`dpm`), which `scripts/dev-stack.sh up` checks for before it
-starts anything.
-
-Any edit to the model changes the package id, and a participant refuses a second package at the
-same name and version — `KNOWN_PACKAGE_VERSION`. So a redeploy after a source change means either
-bumping `version` in [`daml.yaml`](daml.yaml) or resetting the LocalNet
-(`pnpm exec canton-barebones reset` in `.canton-localnet/`).
-
-## The Splice dependencies
-
-`amulet-vesting` data-depends on four Splice DARs. They are not committed: `pnpm build-dar` runs
-`scripts/fetch-daml-deps.mjs` first, which fetches them into the gitignored `deps/` and skips the
-work once they are there.
-
-Which Splice release they come from is not a choice. An Amulet-moving choice is exercised against
-the `AmuletRules` the network is running, so the build has to use that network's Amulet. The script
-therefore reads `splice.tag` off the pinned `@bootnodedev/canton-barebones` template, which is the
-same template the LocalNet is scaffolded from, and takes the highest `splice-amulet` version that
-release ships. Bumping the LocalNet moves the DAR with it; delete `deps/` to force a refetch.
diff --git a/dapp/daml/daml.yaml b/dapp/daml/daml.yaml
deleted file mode 100644
index 2977eaab..00000000
--- a/dapp/daml/daml.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-sdk-version: 3.4.11
-name: amulet-vesting
-source: .
-version: 0.0.2
-dependencies:
-  - daml-prim
-  - daml-stdlib
-# Fetched by scripts/fetch-daml-deps.mjs, which drops the version from each filename so a
-# Splice bump moves no path here.
-data-dependencies:
-  - deps/splice-amulet.dar
-  - deps/splice-api-token-holding-v1.dar
-  - deps/splice-api-token-metadata-v1.dar
-  - deps/splice-api-token-transfer-instruction-v1.dar
-# 2.1 is what the Splice deps are built at, and a data-dependency cannot be read from a
-# different LF target.
-build-options:
-  - --target=2.1
diff --git a/dapp/daml/package.json b/dapp/daml/package.json
deleted file mode 100644
index 476506cb..00000000
--- a/dapp/daml/package.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "name": "@canton-dappbooster/daml",
-  "private": true,
-  "version": "0.3.0",
-  "scripts": {
-    "build": "node ../../scripts/fetch-daml-deps.mjs && LANG=C.UTF-8 dpm build"
-  }
-}
diff --git a/dapp/frontend/CLAUDE.md b/dapp/frontend/CLAUDE.md
index 07581f7c..1c8be0ae 100644
--- a/dapp/frontend/CLAUDE.md
+++ b/dapp/frontend/CLAUDE.md
@@ -20,9 +20,14 @@ The internal seams are in [`architecture.md`](architecture.md). Deltas for this
 - `providers/` names what it provides, not the role the folder already states: `Backend`, not
   `BackendProvider`.
 - `api/` sits beside `src/`, not inside it. Vercel publishes each module there at `/api/<basename>`,
-  so the path is the route and moving one renames the endpoint. Server-side code: it never imports
-  from `src/`, reads its configuration from `process.env`, and any variable it needs is deliberately
-  not a `VITE_` name, since those are inlined into the bundle.
+  so the path is the route and moving one renames the endpoint. A bracketed filename matches exactly
+  one path segment, catch-all spelling included, so forwarding a service's own multi-segment paths
+  takes an explicit `vercel.json` rewrite carrying the path as a parameter, which is what
+  `registry.ts` does. Server-side code: it never imports from `src/`, reads its configuration from
+  `process.env`, and any variable it needs is deliberately not a `VITE_` name, since those are
+  inlined into the bundle. Every file here is published, so a test beside one is an endpoint: only a
+  `_` or `.` prefix somewhere in the path is skipped, which is why the suite is `_registry.test.ts`
+  and reaches its subject through the `#api/*` subpath imports rather than a relative specifier.
 
 ## Shared pieces to reach for
 
@@ -38,7 +43,7 @@ One implementation each, so a second one is a bug and not a choice:
   element it does not, so an icon trigger is a legal child. Childless it is a `?` badge. It adds the
   tap-to-open Ark leaves out.
 - **A figure: `components/AmountDisplay`.** It owns the grouping, the forced two decimals, and the
-  Amulet mark with its tooltip. `count` is the escape hatch for a tally, which owes neither.
+  instrument mark with its tooltip. `count` is the escape hatch for a tally, which owes neither.
   Where the surrounding text already spells out the unit, reach for `components/CompactAmount`, the
   same figure without the mark: it is what keeps the exact value in a tooltip and in the accessible
   name once an outsized amount is abbreviated, so a hand-rolled `formatFigureCompact` loses it.
diff --git a/dapp/frontend/README.md b/dapp/frontend/README.md
index 1a953be2..a62760dc 100644
--- a/dapp/frontend/README.md
+++ b/dapp/frontend/README.md
@@ -1,9 +1,10 @@
-# @canton-dappbooster/frontend — Amulet vesting dApp
+# @canton-dappbooster/frontend: vesting dApp
 
-dApp for **Amulet vesting**: propose a grant, the receiver accepts, claim as it
-vests, or cancel into a residual claim. Accepting locks the funder's Amulet in
-escrow and each claim releases part of it, so the figures on screen are real
-holdings; grants render live vested/claimable figures from the pure schedule math in
+dApp for **vesting a canton-token-forge instrument**: propose a grant, the receiver accepts or
+declines it and the funder can cancel it until they do, claim as it vests, or cancel an accepted
+grant into a residual claim. Accepting locks the funder's `DBT` in a `LockedToken` escrow and each claim
+releases part of it, so the figures on screen are real holdings; grants render live
+vested/claimable figures from the pure schedule math in
 [`src/utils/schedule.ts`](src/utils/schedule.ts).
 
 Every read and every write goes through the connected CIP-0103 wallet, so the app acts as
@@ -11,40 +12,51 @@ the wallet's primary account and each write raises a real approval prompt. There
 mock mode: without a deployment config and a wallet session the pages show a connect
 placeholder. See the root [README](../../README.md) for the wider stack.
 
-> The frontend was imported from `cn-dappbooster@feat/vesting-lite` — see
-> [`PROVENANCE.md`](PROVENANCE.md). The DAML package it speaks to lives in
-> [`../daml`](../daml).
+> The frontend was imported from `cn-dappbooster@feat/vesting-lite`, see
+> [`PROVENANCE.md`](PROVENANCE.md). The Daml packages it speaks to are the committed
+> binaries in [`../../vendor`](../../vendor).
 
 ## Run
 
-The app needs a Canton LocalNet, wallet-service on port 3010 and the vesting DAR deployed
-before it renders anything; the root [README](../../README.md) is the whole bring-up. Once
-that is up, from the repo root (one `pnpm install` links every workspace):
+The app needs a Canton LocalNet, wallet-service on port 3010, both vendored DARs deployed and the
+token registry on 3013 before it renders anything; the root [README](../../README.md) is the whole
+bring-up. Once that is up, from the repo root (one `pnpm install` links every workspace):
 
 ```bash
-pnpm run build-dar
-# use the appropriate version for amulet-vesting-*.dar
-pnpm run deploy-dar -- dapp/daml/.daml/dist/amulet-vesting-*.dar
-pnpm run bootstrap   # creates the operator and its factory
+pnpm run deploy-dar -- vendor/canton-token-forge.dar
+pnpm run deploy-dar -- vendor/vesting.dar
+pnpm run bootstrap   # creates the operator and its factory, the admin and the DBT instrument
 pnpm run app:dev     # → http://localhost:3012
 ```
 
+The registry also has to be running, against the env block `bootstrap` prints;
+`./scripts/dev-stack.sh up` does that for you.
+
 The bootstrap writes nothing. It leaves the operator and the factory on the ledger, and the dApp
 finds both once a wallet connects: the operator through the rights the bootstrap granted, the
 factory through an active-contracts read that returns its explicit-disclosure payload, without
 which a grant cannot be created. Re-running it supersedes the last one, on any ledger.
 
-Funding a grant takes Amulet, and the account menu has a faucet for it: **Tap Amulet** taps
-100 AMT into the connected party. It works on LocalNet and devnet, where the choice exists, and
-refuses until the SV has opened the first mining round, roughly ten minutes after a fresh start.
+Funding a grant takes `DBT`, and the account menu has a faucet for it: **Tap dAppBooster Token**
+taps 1000 DBT into the connected party, straight off the instrument's own config. It refuses an
+amount above the `maxPerTap` the bootstrap set, and says so in the failure toast.
 
 Connect with a CIP-0103 browser wallet; the party it reports is the one you act as, and
 the session is restored on reload by the wallet itself. Changing the wallet's primary
-account changes the party the dApp acts as. Its two env knobs — the explorer party ids
-link to and the wallet-service endpoint it builds the Amulet disclosures from — default to
+account changes the party the dApp acts as. Its two env knobs, the explorer party ids
+link to and the registry it fetches the instrument config from, default to
 the local stack and are set in the repo root's `.env`; see the root
 [`.env.example`](../../.env.example).
 
+The deployed demo is inert until its Vercel project points the registry knob at a registry reachable
+from the internet, and no such registry is hosted today, so `loadBackendConfig` hard-fails and every
+page shows "No deployment" once a wallet connects.
+
+A build whose output is going to be served takes no defaults for those two knobs: `vercel.json`'s
+build command sets `DEPLOYED_BUILD=1`, and with it an unset key fails the build rather than baking in
+a `localhost` address that an https page blocks as mixed content. Any other host serving this bundle
+sets it too; a local build and CI's compile check do not.
+
 ## How it fits together
 
 The internal seams and the reasoning behind them are in
diff --git a/dapp/frontend/api/_registry.test.ts b/dapp/frontend/api/_registry.test.ts
new file mode 100644
index 00000000..001dca87
--- /dev/null
+++ b/dapp/frontend/api/_registry.test.ts
@@ -0,0 +1,252 @@
+// Underscore-prefixed because Vercel publishes every other file under `api/` as a function: named
+// `registry.test.ts` this suite would deploy as a public endpoint at `/api/registry.test`.
+import { readFile } from 'node:fs/promises'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { GET, POST } from '#api/registry'
+
+const INFO = '/registry/metadata/v1/info'
+const INSTRUMENTS = '/registry/metadata/v1/instruments'
+const FACTORY = '/registry/transfer-instruction/v1/transfer-factory'
+
+// The rewrite carries the real path as a query parameter, so a request is spelled the way
+// `vercel.json` transforms it rather than the way the browser asks for it.
+const request = (path: string | undefined, init?: RequestInit): Request =>
+  new Request(
+    path === undefined
+      ? 'https://demo.example/api/registry'
+      : `https://demo.example/api/registry?path=${encodeURIComponent(path)}`,
+    init,
+  )
+
+const stubUpstream = (
+  reply: { status?: number; body?: string | null } = {},
+): { calls: { url: string; method: string; body?: string }[] } => {
+  const calls: { url: string; method: string; body?: string }[] = []
+  vi.stubGlobal('fetch', async (url: string, init: { method: string; body?: string }) => {
+    calls.push({ url, method: init.method, body: init.body })
+    return new Response(reply.body === undefined ? '{}' : reply.body, {
+      status: reply.status ?? 200,
+    })
+  })
+  return { calls }
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+  vi.unstubAllEnvs()
+  vi.restoreAllMocks()
+})
+
+describe('upstream url', () => {
+  it('does not double the separator when REGISTRY_URL carries a trailing slash', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.example/')
+    const { calls } = stubUpstream()
+
+    await GET(request(INFO))
+
+    expect(calls[0]?.url).toBe('https://registry.example/registry/metadata/v1/info')
+  })
+})
+
+describe('the forwarded query', () => {
+  it('carries pageToken through, so the instrument listing can follow its pages', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.example')
+    const { calls } = stubUpstream()
+
+    await GET(
+      new Request(
+        `https://demo.example/api/registry?path=${encodeURIComponent(INSTRUMENTS)}&pageToken=abc%2Fdef`,
+      ),
+    )
+
+    expect(calls[0]?.url).toBe(
+      'https://registry.example/registry/metadata/v1/instruments?pageToken=abc%2Fdef',
+    )
+  })
+
+  // `?pageToken=` is what a client following pages sends once there are none left to follow; relayed,
+  // the registry has to resolve an empty token instead of being asked for the first page.
+  it('drops a pageToken that carries no value', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.example')
+    const { calls } = stubUpstream()
+
+    await GET(
+      new Request(
+        `https://demo.example/api/registry?path=${encodeURIComponent(INSTRUMENTS)}&pageToken=`,
+      ),
+    )
+
+    expect(calls[0]?.url).toBe('https://registry.example/registry/metadata/v1/instruments')
+  })
+
+  it('drops a parameter it does not list, the rewrite\u2019s own path included', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.example')
+    const { calls } = stubUpstream()
+
+    await GET(
+      new Request(
+        `https://demo.example/api/registry?path=${encodeURIComponent(INFO)}&admin=someone`,
+      ),
+    )
+
+    expect(calls[0]?.url).toBe('https://registry.example/registry/metadata/v1/info')
+  })
+})
+
+describe('upstream reply', () => {
+  it('relays a null-body status instead of reporting the upstream unreachable', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.example')
+    stubUpstream({ status: 204, body: null })
+
+    const response = await GET(request(INFO))
+
+    expect(response.status).toBe(204)
+  })
+})
+
+const errorOf = async (response: Response): Promise<string> =>
+  ((await response.json()) as { error: string }).error
+
+describe('routes not forwarded', () => {
+  it('names the missing parameter when the rewrite carried no path', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.example')
+    stubUpstream()
+
+    const response = await GET(request(undefined))
+
+    expect(response.status).toBe(403)
+    expect(await errorOf(response)).toBe('Request did not carry exactly one path')
+  })
+
+  it('names the missing parameter when more than one path was injected', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.example')
+    stubUpstream()
+
+    const injected = new Request(
+      `https://demo.example/api/registry?path=${encodeURIComponent(INFO)}&path=%2Fevil`,
+    )
+    const response = await GET(injected)
+
+    expect(await errorOf(response)).toBe('Request did not carry exactly one path')
+  })
+
+  it('names the method a disallowed verb used, not the path alone', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.example')
+    stubUpstream()
+
+    const response = await POST(request(INFO, { method: 'POST', body: '{}' }))
+
+    expect(response.status).toBe(403)
+    expect(await errorOf(response)).toBe(`Route not forwarded: POST ${INFO}`)
+  })
+})
+
+describe('the allowlist', () => {
+  it('forwards each listed route under the verb it is listed with', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.example')
+    const { calls } = stubUpstream()
+
+    await GET(request(INFO))
+    await GET(request(INSTRUMENTS))
+    await POST(request(FACTORY, { method: 'POST', body: '{"choiceArguments":{}}' }))
+
+    expect(calls.map((call) => `${call.method} ${new URL(call.url).pathname}`)).toEqual([
+      `GET ${INFO}`,
+      `GET ${INSTRUMENTS}`,
+      `POST ${FACTORY}`,
+    ])
+  })
+
+  it('refuses a path it does not list', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.example')
+    const { calls } = stubUpstream()
+
+    const response = await GET(request('/registry/admin/v1/instruments'))
+
+    expect(response.status).toBe(403)
+    expect(calls).toEqual([])
+  })
+
+  it('refuses a GET on the route it lists as POST', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.example')
+    const { calls } = stubUpstream()
+
+    const response = await GET(request(FACTORY))
+
+    expect(response.status).toBe(403)
+    expect(calls).toEqual([])
+  })
+
+  it('refuses a HEAD rather than forwarding it as the GET it is routed to', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.example')
+    const { calls } = stubUpstream()
+
+    const response = await GET(request(INFO, { method: 'HEAD' }))
+
+    expect(response.status).toBe(403)
+    expect(calls).toEqual([])
+  })
+
+  it('sends only the parsed body, so nothing outside it reaches the registry', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.example')
+    const { calls } = stubUpstream()
+
+    await POST(request(FACTORY, { method: 'POST', body: '{ "a": 1, "b": { "c": 2 } }' }))
+
+    expect(calls[0]?.body).toBe('{"a":1,"b":{"c":2}}')
+  })
+
+  it('rejects a body that is not json before reaching the registry', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.example')
+    const { calls } = stubUpstream()
+
+    const response = await POST(request(FACTORY, { method: 'POST', body: 'not json' }))
+
+    expect(response.status).toBe(400)
+    expect(calls).toEqual([])
+  })
+})
+
+describe('deployment configuration', () => {
+  it('names REGISTRY_URL when the deployment did not set it', async () => {
+    vi.stubEnv('REGISTRY_URL', '')
+    stubUpstream()
+
+    const response = await GET(request(INFO))
+
+    expect(response.status).toBe(500)
+    expect(await errorOf(response)).toContain('REGISTRY_URL')
+  })
+
+  it('does not name the registry host when the upstream cannot be reached', async () => {
+    vi.stubEnv('REGISTRY_URL', 'https://registry.internal:3013')
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    vi.stubGlobal('fetch', async () => {
+      throw new TypeError('fetch failed: connect ECONNREFUSED 10.0.0.7:3013')
+    })
+
+    const response = await GET(request(INFO))
+
+    expect(response.status).toBe(502)
+    expect(await errorOf(response)).toBe('Upstream unreachable')
+  })
+})
+
+// This proxy and the browser client that calls it are the two legs of one registry read, so a longer
+// budget on either only makes the caller wait past a hop that has already given up. Held by reading
+// both files rather than by sharing a module: `api/` is its own tsconfig project and never imports
+// from `src/`.
+describe('the upstream timeout', () => {
+  const budgetOf = async (path: string): Promise<string | undefined> =>
+    /_TIMEOUT_MS = ([\d_]+)/.exec(await readFile(new URL(path, import.meta.url), 'utf8'))?.[1]
+
+  it('matches the budget the browser client gives the same read', async () => {
+    const [proxy, client] = await Promise.all([
+      budgetOf('./registry.ts'),
+      budgetOf('../src/backend/registry.ts'),
+    ])
+
+    expect(proxy).toBe('15_000')
+    expect(client).toBe(proxy)
+  })
+})
diff --git a/dapp/frontend/api/registry.ts b/dapp/frontend/api/registry.ts
new file mode 100644
index 00000000..57cb5e71
--- /dev/null
+++ b/dapp/frontend/api/registry.ts
@@ -0,0 +1,94 @@
+// An https page cannot reach the plain-http registry, but Node's fetch has no mixed-content policy.
+// An allowlist rather than a blanket proxy: the registry is read-only, but republishing an unknown
+// route on the product's own domain is a decision, not a default.
+
+const ALLOWED = new Map([
+  ['/registry/metadata/v1/info', 'GET'],
+  ['/registry/metadata/v1/instruments', 'GET'],
+  ['/registry/transfer-instruction/v1/transfer-factory', 'POST'],
+])
+// Allowlisted for the same reason the routes are: republishing an arbitrary parameter on the
+// product's own domain is a decision. `pageToken` is what the instrument listing follows its pages
+// with, so dropping the query strands every page past the first with no error to see.
+const FORWARDED_PARAMS = ['pageToken']
+// Held equal to the browser client's own budget by the suite in _registry.test.ts: neither file can
+// import the other, and a longer budget on either leg only makes the caller wait past a hop that has
+// already given up.
+const UPSTREAM_TIMEOUT_MS = 15_000
+
+const fail = (message: string, status: number): Response =>
+  new Response(JSON.stringify({ error: message }), {
+    status,
+    headers: { 'content-type': 'application/json' },
+  })
+
+const forward = async (request: Request, body: string | undefined): Promise<Response> => {
+  // A bracketed filename matches one segment, so vercel.json carries the real path as a parameter.
+  const asked = new URL(request.url).searchParams
+  const paths = asked.getAll('path')
+  const path = paths.length === 1 ? paths[0] : undefined
+  const method = request.method
+  if (path === undefined) {
+    return fail('Request did not carry exactly one path', 403)
+  }
+  // The method is part of the message because an allowed path reached by the wrong verb otherwise
+  // reads as an unknown route.
+  if (ALLOWED.get(path) !== method) {
+    return fail(`Route not forwarded: ${method} ${path}`, 403)
+  }
+
+  // No default: localhost cannot be right in the only environment this file runs in. Trimmed like
+  // the client's own base, since a trailing slash would request `//registry/...` and 404.
+  const upstreamUrl = process.env.REGISTRY_URL?.replace(/\/+$/, '')
+  if (!upstreamUrl) {
+    return fail('REGISTRY_URL is not set on this deployment', 500)
+  }
+
+  const forwarded = new URLSearchParams()
+  for (const name of FORWARDED_PARAMS) {
+    // An empty one is dropped rather than relayed: the registry reads `pageToken=` as a token it
+    // cannot resolve, where leaving it out asks for the first page, which is what was meant.
+    const value = asked.get(name)
+    if (value !== null && value !== '') {
+      forwarded.set(name, value)
+    }
+  }
+  const query = forwarded.size === 0 ? '' : `?${forwarded}`
+
+  let status: number
+  let payload: string
+  try {
+    const upstream = await fetch(`${upstreamUrl}${path}${query}`, {
+      method,
+      ...(body === undefined ? {} : { headers: { 'content-type': 'application/json' }, body }),
+      signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS),
+    })
+    status = upstream.status
+    payload = await upstream.text()
+  } catch (error) {
+    // A raw fetch error can name the registry's host, which an anonymous caller must not see.
+    console.error(error)
+    return fail('Upstream unreachable', 502)
+  }
+
+  // Built past the catch, and null for a status that refuses a body, so that a well-formed reply
+  // cannot surface as an unreachable upstream. Content type pinned, not relayed: relaying would let
+  // upstream serve markup from this product's own origin.
+  return new Response(payload === '' ? null : payload, {
+    status,
+    headers: { 'content-type': 'application/json' },
+  })
+}
+
+export const GET = (request: Request): Promise<Response> => forward(request, undefined)
+
+// Rebuilt rather than relayed, so nothing outside the parsed body reaches the registry.
+export const POST = async (request: Request): Promise<Response> => {
+  let body: unknown
+  try {
+    body = await request.json()
+  } catch {
+    return fail('Parse error', 400)
+  }
+  return forward(request, JSON.stringify(body))
+}
diff --git a/dapp/frontend/api/rpc.ts b/dapp/frontend/api/rpc.ts
deleted file mode 100644
index eafb0094..00000000
--- a/dapp/frontend/api/rpc.ts
+++ /dev/null
@@ -1,53 +0,0 @@
-// An https page cannot reach plain-http wallet-service, but Node's fetch has no mixed-content
-// policy. One method only: the whole dispatcher would republish `executePrepared` unauthenticated.
-
-const ALLOWED_METHOD = 'amulet.tap'
-const UPSTREAM_TIMEOUT_MS = 15_000
-
-const json = (body: unknown, status: number): Response =>
-  new Response(JSON.stringify(body), {
-    status,
-    headers: { 'content-type': 'application/json' },
-  })
-
-const fail = (id: unknown, code: number, message: string, status: number): Response =>
-  json({ jsonrpc: '2.0', id: id ?? null, error: { code, message } }, status)
-
-export const POST = async (request: Request): Promise<Response> => {
-  let body: unknown
-  try {
-    body = await request.json()
-  } catch {
-    return fail(null, -32700, 'Parse error', 400)
-  }
-
-  // A batch array is how a second method would ride along beside the allowed one.
-  if (typeof body !== 'object' || body === null || Array.isArray(body)) {
-    return fail(null, -32600, 'Only a single amulet.tap request is forwarded', 400)
-  }
-
-  const { id, method, params } = body as { id?: unknown; method?: unknown; params?: unknown }
-  if (method !== ALLOWED_METHOD) {
-    return fail(id, -32601, `Method not forwarded: ${String(method)}`, 403)
-  }
-
-  // No default: localhost cannot be right in the only environment this file runs in.
-  const upstreamUrl = process.env.WALLET_SERVICE_RPC_URL
-  if (!upstreamUrl) {
-    return fail(id, -32000, 'WALLET_SERVICE_RPC_URL is not set on this deployment', 500)
-  }
-
-  // Rebuilt rather than relayed, so nothing outside these fields reaches wallet-service.
-  try {
-    const upstream = await fetch(upstreamUrl, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ jsonrpc: '2.0', id: id ?? '1', method: ALLOWED_METHOD, params }),
-      signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS),
-    })
-    return json(await upstream.json(), upstream.status)
-  } catch (error) {
-    const message = error instanceof Error ? error.message : 'unknown error'
-    return fail(id, -32000, `Upstream: ${message}`, 502)
-  }
-}
diff --git a/dapp/frontend/architecture.md b/dapp/frontend/architecture.md
index 7096024d..363d5bd5 100644
--- a/dapp/frontend/architecture.md
+++ b/dapp/frontend/architecture.md
@@ -1,4 +1,4 @@
-# Architecture — Amulet vesting dApp
+# Architecture of the vesting dApp
 
 The app's internal seams and the reasoning behind them. What this is and how to run it is in
 [`README.md`](README.md); repo-wide rules live in [`../../CLAUDE.md`](../../CLAUDE.md) and the
@@ -12,22 +12,22 @@ interfaces carry that, and every other decision hangs off them.
 
 | Path | Role |
 |------|------|
-| `src/backend/` | The `VestingBackend` interface, `LedgerBackend` (its one implementation), the pure ACS→domain mappers, the command builders, the `WalletFns` seam, `transferContext.ts`, which builds the Amulet context off wallet-service's `amulet.tap`, `config.ts`, which loads the deployment, and `synchronizer.ts`, which reads the networks the wallet's participant is on. |
-| `src/providers/` | `Backend` builds the backend from the deployment plus the wallet session and carries the wrong-network state alongside it; `Tokens` builds the token list from every source and hands it to the kit's `TokenListProvider`, which is why it sits inside `Backend`: Canton Coin's figures are the backend's to report. The theme provider comes from the kit, the session provider from `canton-connect`. |
+| `src/backend/` | The `VestingBackend` interface, `LedgerBackend` (its one implementation), the pure ACS→domain mappers, the command builders, the `WalletFns` seam, `registry.ts`, which asks the canton-token-forge registry for the instrument, the `InstrumentConfig` disclosure and the network it sits on, `config.ts`, which loads the deployment, and `synchronizer.ts`, which reads the networks the wallet's participant is on. |
+| `src/providers/` | `Backend` builds the backend from the deployment plus the wallet session and carries the wrong-network state and the vested instrument alongside it; `Tokens` builds the token list from every source and hands it to the kit's `TokenListProvider`, which is why it sits inside `Backend`: the vested instrument's figures are the backend's to report. The theme provider comes from the kit, the session provider from `canton-connect`. |
 | `src/hooks/` | `useParty` narrows the `canton-connect` session to what the UI needs, `useConnectErrorToast` gives a rejected connection somewhere to surface, `useWrongNetwork` watches whether the wallet can still reach the app's network, and `useRoleLens` / `useCreateGrant` keep the role lens and the create dialog in the URL. `AppShell` keys React Router's `ScrollRestoration` on the pathname rather than on the default location key, so opening a grant starts at the top of the page while writing one of those params leaves the scroll where it was. |
 | `src/store/useVestingStore.ts` | Backend-backed zustand store; actions submit then refresh. |
-| `src/utils/` | Pure helpers, `schedule.ts` chief among them, plus `env.ts`, the environment contract `vite.config.ts` validates against, `config.ts`, which reads the literals that validation left behind, `network.ts`, the rule behind the wrong-network strip, `tokens.tsx`, the artwork and wording this deployment gives Canton Coin, and `assetList.ts`, which reads the curated token list. `toast.ts` is here too, the one module whose view lives elsewhere: it holds the Ark toaster and the three tone helpers, and `components/Toaster/` renders them. |
+| `src/utils/` | Pure helpers, `schedule.ts` chief among them, plus `env.ts`, the environment contract `vite.config.ts` validates against, `config.ts`, which reads `REGISTRY_URL` and the other literals that validation left behind, `network.ts`, the rule behind the wrong-network strip, `tokens.tsx`, the artwork and wording this deployment gives the instrument it vests, and `assetList.ts`, which reads the curated token list. `toast.ts` is here too, the one module whose view lives elsewhere: it holds the Ark toaster and the three tone helpers, and `components/Toaster/` renders them. |
 | `src/components/` | What two or more places render: the shell, the top bar and its account menu, the footer, the dialogs, and the primitives the pages compose. |
 | `src/icons/` | The brand and house marks only, one per file over a shared `Svg` wrapper and re-exported from `index.ts`. Every generic icon comes from `lucide-react`. |
 | `src/pages/` | Dashboard, pending grants and grant detail, each a folder whose `index.tsx` is the route and whose siblings are what only that page renders. |
 | `src/styles/` | The single stylesheet entry and the app's own tokens. |
-| `api/` | Vercel functions, published at `/api/<name>` off the deployed origin. `rpc.ts` is the only one, and it forwards a single wallet-service method. Not part of the bundle and not reachable in `pnpm dev`. |
+| `api/` | Vercel functions, published off the deployed origin. `registry.ts` is the only one, and it forwards three read-only registry routes that `vercel.json` rewrites onto it. Not part of the bundle and not reachable in `pnpm dev`. |
 
 ## The two seams
 
 **`VestingBackend`** ([`src/backend/VestingBackend.ts`](src/backend/VestingBackend.ts)) is what the
 UI depends on. It speaks grants, pending grants, and claims — never DAML templates, contract payloads,
-or transport. `LedgerBackend` satisfies it against the `amulet-vesting` DAML package; it is named
+or transport. `LedgerBackend` satisfies it against the `vesting` DAML package; it is named
 for the thing it reaches rather than for that package, so re-pointing it at another model is not a
 rename. Because the mappers that turn active-contract rows into domain types live behind this
 interface, no component knows the ledger exists.
@@ -39,66 +39,80 @@ than implemented by a class. They come straight from `canton-connect`'s `useExec
 `LedgerBackend`'s unit tests need it constructible without React.
 
 Both halves of the pairing are runtime state. The deployment comes from
-[`config.ts`](src/backend/config.ts), which reads it off the ledger through that same `ledgerApi`:
-the newest `vesting-operator-*` among the connected user's rights, then an active-contracts read as
-that operator for the factory, which yields `pkg`, the contract id and the `createdEventBlob`.
-Nothing is configured, so nothing can go stale against the participant the wallet is pointed at.
-Missing is a hard error surfaced by `AppShell`, not a fallback: without a package id there is
-nothing to query and without the blob there is no factory to disclose. It needs a session to read
-through, so it resolves after connect rather than before.
+[`config.ts`](src/backend/config.ts), which assembles it from two sources at once. Off the ledger,
+through that same `ledgerApi`: the `vesting-operator::*` party among the connected user's rights,
+then an active-contracts read as that operator for the factory, which yields `pkg`, the contract id
+and the `createdEventBlob`. And off the registry, through
+[`registry.ts`](src/backend/registry.ts), for the instrument's `admin` and `instrumentId`; reading
+those off the ledger instead would only work on LocalNet, because the instrument admin is a third
+party and no connected party is a stakeholder of its `InstrumentConfig`.
+
+The ledger half cannot go stale against the participant the wallet is pointed at, since nothing
+about it is configured. The registry half can: `VITE_REGISTRY_URL` names a separate process
+(deployed it names this origin instead, and the function's own `REGISTRY_URL` names the process),
+and one still running against a previous bootstrap's admin party answers `/info` with a party this
+ledger no longer knows. Missing is a hard error surfaced by `AppShell`, not a fallback: without a
+package id there is nothing to query and without the blob there is no factory to disclose. It needs
+a session to read through, so it resolves after connect rather than before. That error card offers a
+retry, which is the only way back: the registry restarts independently of the session, so a failure
+against it outlives neither the party nor the transport that would otherwise re-trigger the load.
 
 ## What a write has to carry
 
-Every choice that moves Amulet takes an `AppTransferContext` — the current `AmuletRules` and the
-newest open mining round — and both are DSO-signed, so no connected party is a stakeholder of
-either. [`transferContext.ts`](src/backend/transferContext.ts) asks wallet-service for one
-`amulet.tap`, whose `disclosedContracts` carry both, and returns the record and the two disclosures
-together, because a write needs both and sending one without the other fails at the participant
-rather than in the model. The record is flat: nesting the round under a `context` key fails
-preprocessing on a missing `openMiningRound`.
-
-That call is a build-and-discard: `amulet.tap` returns the command it composed and submits nothing,
-so no coin is minted and the answer is only read for its disclosures. It replaced a pair of reads
-against Scan's unauthenticated API, which a browser cannot reach on devnet at all — the SV endpoints
-refuse the origin on the preflight and the validator's scan-proxy wants a bearer. Picking the round
-went with it: tap resolves the active one itself, and a LocalNet whose SV has not opened the first
-round yet fails the call, which is a wait rather than a bug.
-
-The faucet in the account menu is the one place the app taps for real. `LedgerBackend.tap` builds
-`AmuletRules_DevNet_Tap` for `TAP_AMOUNT` out of the same record and the same two disclosures every
-other write already fetches, and the wallet signs it as the connected party, so the button costs no
-extra read. Composed here rather than forwarded: wallet-service's own prepared tap carries a fixed
-amount, and this way `TAP_AMOUNT` is the app's to change. The choice exists on LocalNet and devnet
-only, and before the SV opens the first round it refuses with `OpenMiningRound active at current
-moment not found`, which reaches the user as the failure toast.
-
-Where that call goes is `VITE_WALLET_RPC_URL`. Locally it is wallet-service itself; a deployed build
-sets it to `/api/rpc`, [the app's own function](api/rpc.ts), because an https page cannot call a
-plain-http wallet-service and Node's fetch has no such policy. The function forwards `amulet.tap`
-and nothing else, rebuilding the request rather than relaying it: the dispatcher behind it also
-serves `ledgerApi` and `executePrepared` unauthenticated, and republishing those on the product's
-own domain is the whole reason this is a function and not a blanket rewrite. `vercel.json`'s
-SPA catch-all is scoped away from `/api/` so it cannot answer the route with `index.html`.
-
-The DSO party the split has to name is the one thing tap cannot supply — a disclosure carries an
-opaque blob and no payload — so `LedgerBackend` reads it off an Amulet the split is about to
-consume. Every Amulet is DSO-signed, so it is the same party by construction.
+Every choice that moves a holding takes a `configCid`: the `InstrumentConfig` of the instrument the
+grant is denominated in. It is admin-signed and observer-less, so no connected party is a
+stakeholder of it and no ledger read can reach it.
+[`registry.ts`](src/backend/registry.ts) asks the canton-token-forge registry on 3013 for it, over
+the CIP-56 transfer-factory route with the connected party as both sender and receiver. That takes
+the route's `self` branch, whose choice context is the config alone, and the answer carries both
+halves a command needs: `factoryId`, the contract id, and a disclosure whose `templateId` is the
+resolved one, which the package-name filters cannot supply.
+
+Fetched per write rather than cached, for the reason the Amulet context was: one round trip against
+a contract that can be archived underneath us.
+
+The `(admin, instrumentId)` pair the route is asked about is not on the ledger either. The factory
+is this repo's own operator, but the instrument admin is a third party, so
+[`config.ts`](src/backend/config.ts) learns the pair from the registry's two metadata routes at the
+same time as it reads the factory, and carries both in the `Deployment`. `/registry/metadata/v1/info`
+is CIP-56 registry metadata and reports only the admin; the instruments are their own route. A
+registry administering none, or more than one, is a hard error: this dApp knows exactly one
+instrument, so picking one of several would render a grant under a symbol that is not its own.
+
+Where those calls go is `VITE_REGISTRY_URL`. Locally it is the registry itself; a deployed build
+sets it to `/api/registry`, [the app's own function](api/registry.ts), because an https
+page cannot call a plain-http registry and Node's fetch has no such policy. The function forwards
+three routes and refuses the rest: the registry is read-only, but republishing an unknown route on
+the product's own domain is a decision rather than a default. `vercel.json`'s SPA catch-all is
+scoped away from `/api/` so it cannot answer the route with `index.html`.
+
+The faucet in the account menu taps that same config. `LedgerBackend.tap` exercises
+`InstrumentConfig_Tap` for `TAP_AMOUNT` on the contract id and resolved template id the registry
+already disclosed, so the button costs no read the app was not making anyway, and the wallet signs
+it as the connected party. The choice is nonconsuming on the admin-signed config, which is what
+lets a connected wallet tap with nothing else disclosed. The registry publishes an instrument's id,
+name, symbol and decimals but never its faucet, and the config carries no readable payload, so the
+per-tap cap cannot be read from the app: `TAP_AMOUNT` has to stay at or under the `maxPerTap`
+`scripts/bootstrap-vesting.mjs` sets, and above it the choice aborts and the message reaches the
+user as the failure toast.
 
 ## Telling the user they are on the wrong network
 
 A write fails at the participant when the wallet submits to a network the app's contracts do not
-live on, because the `AmuletRules` and mining round ids do not exist on the ledger the wallet
+live on, because the factory and `InstrumentConfig` ids do not exist on the ledger the wallet
 reaches. Both sides of that are read.
-[`transferContext.ts`](src/backend/transferContext.ts) carries `fetchAppNetwork`, which taps and
-returns only the `synchronizerId` wallet-service stamped on the disclosures, the network the app's
-contracts are on. Its own export rather than a field on the transfer context: that builder waits for
-an `AmuletRules` and an open mining round both, and the SV opens the first round minutes after a
-LocalNet start, while the id sits on the rules alone.
-[`synchronizer.ts`](src/backend/synchronizer.ts) reads the other side, the synchronizers the
-wallet's own participant is connected to. That is a read of its own rather than
+[`registry.ts`](src/backend/registry.ts) carries `fetchAppNetwork`, which returns the
+`synchronizerId` the registry stamped on the `InstrumentConfig` disclosure, the network the app's
+contracts are on. It reads that from the registry rather than from
 [`config.ts`](src/backend/config.ts)'s `synchronizerId` off the factory row, which the deployment
-already carries: that one is three round trips and its answer rebuilds the backend, so repeating it
-would re-run every ledger read along with it.
+already carries, and the reason is not cost but circularity: the factory row is read through the
+connected wallet, so a wallet on another network returns no factory at all and the deployment's own
+synchronizer can only ever agree with the wallet. The registry answers over its own HTTP service,
+which is what lets the strip fire on a first load. It assumes the registry and the factory share a
+synchronizer, the same assumption `submit` already makes when it stamps the factory's onto every
+disclosure.
+[`synchronizer.ts`](src/backend/synchronizer.ts) reads the other side, the synchronizers the
+wallet's own participant is connected to.
 
 The rule in [`src/utils/network.ts`](src/utils/network.ts) is membership rather than equality,
 because a participant can be connected to several synchronizers and reaching the app's one is what
@@ -109,14 +123,10 @@ CAIP-2 label, so two wallets may spell one network differently.
 The rule reports a verdict and not the ids behind it, because **the strip names the wallet's network
 and no target.** That is a limit rather than a choice. `networkId` is the only network name CIP-0103
 defines — `Network` is `{ networkId, ledgerApi?, accessToken? }`, with no display name or alias — and
-the spec says what a *wallet* answers, so nothing in it names the app's side. wallet-service does
-expose a label of its own, `getActiveNetwork` off its `NETWORK` variable, and reaching it would take
-allowing a second method in [`api/rpc.ts`](api/rpc.ts). It was not worth it: that value and the
-wallet's are both typed by hand, by different people, so they read the same for two networks as
-easily as differently for one, and a strip saying "switch to canton:localnet" while already claiming
-to be on it is worse than one naming no target. Nothing checks either label against the id it claims
-to name, and no single source knows both sides — the wallet only knows the network it is on, and
-wallet-service only its own.
+the spec says what a *wallet* answers, so nothing in it names the app's side. Nothing checks either
+label against the id it claims to name, and no single source knows both sides: the wallet only knows
+the network it is on, and the registry only its own. A strip saying "switch to canton:localnet"
+while already claiming to be on it is worse than one naming no target.
 
 One thing to know about the label that is shown: `CantonConnectProvider` defaults `networkId` to
 `canton:local` where the wallet reports none, and nothing downstream can tell that default from a
@@ -132,16 +142,15 @@ regaining focus, and every 30 seconds. Focus is the one that catches a switch as
 switching networks means using the wallet and the wallet takes focus; `visibilitychange` misses it,
 because an extension popup draws over the tab rather than hiding it. The interval is the backstop for
 a switch made in a window the user never comes back from. A failed read is silent and leaves the last
-answer standing, because a wallet-service that is down, or a wallet that has just locked, is not a
-wrong network.
-
-Only the wallet's side is on that poll. wallet-service answers for the one network its `NETWORK`
-variable names, so the app's side is read once and kept, and every later check is a single read of
-the wallet's participant rather than another `amulet.tap` through
-[`api/rpc.ts`](api/rpc.ts). Two of those checks can still be in flight at once — a focus landing
-mid-interval — so each carries a sequence number and only the last one started may write. The
-verdict carries the party it was read for too, or the previous party's answer would be shown against
-the new one's network for as long as the first read for that party takes.
+answer standing, because a registry that is down, or a wallet that has just locked, is not a wrong
+network.
+
+Only the wallet's side is on that poll. The registry serves one deployment for as long as it is up,
+so the app's side is read once and kept, and every later check is a single read of the wallet's
+participant. Two of those checks can still be in flight at once (a focus landing mid-interval), so
+each carries a sequence number and only the last one started may write. The verdict carries the
+party it was read for too, or the previous party's answer would be shown against the new one's
+network for as long as the first read for that party takes.
 [`WrongNetwork`](src/components/WrongNetwork.tsx) renders the verdict as a strip above the header,
 and nothing dismisses it, because only the wallet can put it right.
 
@@ -150,56 +159,85 @@ operator on the ledger the wallet reaches, so it throws its `run pnpm run bootst
 [`AppShell`](src/components/AppShell.tsx) would fill the page with it. That message names a symptom:
 the deployment is there, the wallet is not looking at it. So where the verdict stands, the card
 carries the network instead and the advice is held back for the case it was written for, a ledger
-that really has no deployment.
-
-## Creating a grant takes two approvals
-
-A pending grant records the contract ids of the Amulets its Accept will lock, and that Accept
-consumes exactly those. So two grants may never name the same Amulet: accepting one archives it and
-leaves the other permanently unacceptable, `CONTRACT_NOT_FOUND` at the `fetch` before the transfer
-even runs. Which means each grant needs an Amulet of its own, and `createVesting` makes one — the
-funder self-transfers `totalAmount` through `AmuletRules_Transfer`, and the grant names only what
-that produced.
-
-That is two submissions and so two wallet prompts, and it cannot be one. Commands in a single Daml
-transaction carry fixed arguments, so the second cannot name a contract the first will create;
-composing an output into the next input is what a *choice* is for, and adding one is a change to the
-DAML rather than to this app.
-
-The split is exact because Splice values an Amulet input at its full `initialAmount` —
-`summarizeAndConsumeInput` sums that field, and the holding fee is charged only by `Amulet_Expire`.
-An Amulet therefore does not decay out from under a grant while it waits, so no headroom has to be
-guessed at, and `amuletValue` is a field read rather than a calculation. `sender`, `provider` and the
-one output's `receiver` are all the funder, which is what makes the funder the whole of
-`transferControllers` and keeps this a one-signature submission needing nothing from the operator.
-`AmuletRules_Transfer` also refuses a submission that does not name the DSO it expects, so
-`fetchTransferContext` returns the DSO party and the resolved rules template id alongside the
-context.
-
-Whatever an outstanding grant already pledged is kept out of the split's inputs, read off the
-funder's own pending-grant rows rather than remembered locally: a transfer consumes everything it is
-given, and consuming one of those is exactly the failure this exists to prevent. The Amulet the
-split created is then found by re-reading the ACS, because the wallet's own answer to a submission
-is an update id and nothing about what it created.
-
-Accept is the one write disclosing something the transfer context cannot supply: the funder's Amulet, which the
-receiver is no stakeholder of. Its blob is read with `includeCreatedEventBlob` while the funder is
-connected and kept in `localStorage`, written only once the grant is on the ledger — a declined
-prompt must not leave a blob behind for an Amulet no grant is waiting on. Appended rather than
-replacing, since every outstanding grant's own Amulet has to stay disclosable.
-
-Which of those blobs a given Accept sends is read off the ledger, not guessed: the receiver is an
-observer of the grant, so `accept` fetches it and discloses exactly the `amuletCids` it names, then
-drops them, since that submission archived them. Sending the whole store instead would re-disclose
-Amulets earlier accepts already consumed, grow without bound, and leave the guard unable to tell a
-missing blob from an unrelated one — the difference between a sentence naming the problem and an
-opaque participant rejection. It is a browser-local hand-off between two wallet accounts, which is
-what the demo is; a receiver on another machine has no way to disclose it and `accept` says so
-rather than submitting a rejection.
-
-A filter always names a template by package name (`#amulet-vesting:AmuletVesting:…`) and a command
-always by the resolved id the deployment carries. The participant rejects each in the other's
-position, the filter loudly with `INVALID_FIELD`.
+that really has no deployment, where its Try again is worth offering, which is why that button is
+shown only off the wrong network.
+
+## Creating a grant takes one approval
+
+`VestingFactory_CreateVesting` splits the funder's inputs itself: it transfers them into one
+unlocked holding of exactly the grant, hands the change straight back, and the proposal names that
+holding alone. So a grant reserves its own amount and nothing more, and the rest of the funder's
+balance stays spendable while the proposal is outstanding. That split is why the choice takes the
+`InstrumentConfig`, and it is still one submission and one wallet approval, because an unlocked
+self-transfer's controllers are the sender alone. The Amulet version could not do this in one:
+`AmuletRules_Transfer` consumes everything it is given, which is why creating a grant used to be two
+submissions and two wallet prompts.
+
+The reserved holding is still kept out of the next selection, read off the funder's own
+pending-grant rows rather than remembered locally: an Accept consumes exactly that contract, so
+spending it would leave the grant permanently unacceptable, `CONTRACT_NOT_FOUND` at the `fetch`
+before the transfer even runs. A selection built against a stale read now fails its own submission
+rather than creating a second grant on a holding that is already gone.
+
+`createVesting` picks unreserved holdings largest first until they cover the total. Largest rather
+than smallest so the factory splits the fewest inputs, no longer for the receiver's sake: the split
+leaves one holding to disclose whichever inputs went into it.
+
+A holding is worth its `amount` field and nothing is computed: a token-forge `Token` does not decay,
+so unlike an Amulet there is no decayed value to reason about and no headroom to guess at.
+
+Accept is still the one write disclosing something the connected party cannot read for itself: the
+holding the grant reserves. `Token` is `signatory admin, owner` with no observers, so the receiver is
+no stakeholder. That holding is created by the funder's own create submission, so its blob cannot be
+read before it exists: `createVesting` re-reads the funder's holdings with `includeCreatedEventBlob`
+once the grant is on the ledger, and keeps in `localStorage` the blob of every holding an
+outstanding grant of theirs reserves. Reconciling the whole set rather than only the grant just made
+is what lets a read that failed once be repaired later, instead of leaving a grant nobody can
+accept; and reading after the write rather than before is what keeps a declined prompt from leaving
+a blob behind for a holding no grant is waiting on. A failure there leaves the grant alone, since it
+is already on the ledger and reporting one would invite a second, so it is logged and left to the
+next reconcile.
+
+`viewAs` runs that same reconcile, which is what makes the repair reachable: a funder who creates
+one grant and stops never triggers a second create, and their own dashboard is the only other place
+the grant is seen. It costs nothing on the settled path, since the holdings are read only once a
+grant of this party's is found to be missing its blob, and it is skipped outright for the grants a
+party received rather than funded, whose holdings they could not read anyway.
+
+Which blob a given Accept sends is read off the ledger, not guessed: the receiver is an observer of
+the grant, so `accept` fetches it and discloses exactly the `tokenCid` it names, then drops it, since
+that submission archived it. Sending the whole store instead would re-disclose holdings earlier
+accepts already consumed, which the participant rejects, and grow without bound. It is a
+browser-local hand-off between two wallet accounts, which is what the demo
+is; a receiver on another machine has no way to disclose it and `accept` says so rather than
+submitting a rejection. A grant that has left the receiver's view says something else, because a
+stale dashboard and a missing blob are different problems and pointing the first at the blob store
+sends the reader to a browser that was never involved.
+
+Accept is no longer the only exit. `VestingProposal_Cancel` and `VestingProposal_Reject` are
+bodyless and move no holding, so the funder's cancel and the receiver's decline take neither the
+config nor a disclosure: a consuming choice archives on its controller's own authority. Nothing has
+to hand the reserved holding back either, since it is an ordinary unlocked `Token` throughout and
+`freeTokens` subtracts only what an outstanding proposal names. Both go through one `endProposal`,
+which reads the proposal before the write because the blob this browser kept is keyed by the holding
+that proposal names, and forgets that blob and its read-miss count after the write, never before: a
+prompt the wallet declines leaves a grant that is still acceptable. A grant ended from another
+browser still leaves its blob behind, since a stored blob records no owner and one party's view
+cannot safely prune another's.
+
+The escrow needs no such hand-off. A `LockedToken` is `signatory admin, owner, holders` and the
+escrow's holders are the provider and the receiver, so both ends of a grant can read it. Only the
+config is disclosed on withdraw, cancel and residual claim.
+
+A grant, a pending grant and a residual claim each carry `admin` and `instrumentId` as template
+fields, so a row from another instrument on a shared participant is dropped before it is mapped. The
+proposal stores its pair rather than deriving it, which is what lets the receiver see what a grant is
+denominated in: the funder's holdings, which the factory read the pair off, are unreadable to them.
+
+A filter always names a template by package name (`#vesting:Vesting:…`) and a command always by the
+resolved id the deployment carries. The participant rejects each in the other's position, the filter
+loudly with `INVALID_FIELD`. The one exception is the faucet: `InstrumentConfig_Tap` is exercised on
+the config, whose resolved id comes from the registry's disclosure rather than from the deployment.
 
 ## Data flow
 
@@ -263,7 +301,7 @@ write is only real once the ledger has it and the read is the only thing that kn
 every row when the party goes, because the rows were that party's.
 
 A contract id is not a grant's identity, which is the one thing a UI keyed on ids has to know here:
-`AmuletVestingContract_Withdraw` archives the contract and re-creates it with `alreadyWithdrawn`
+`VestingContract_Withdraw` archives the contract and re-creates it with `alreadyWithdrawn`
 raised, so a claim changes the id of the grant it acted on. `grantLineage` is that identity —
 everything the choice preserves — and it is what the withdraw history keys on and what `withdraw`
 uses to hand the grant-detail page its successor's id, so a URL survives a claim rather than
@@ -271,7 +309,7 @@ becoming "Grant not found".
 
 A withdraw that drains the escrow is the exception: it creates no successor, because the contract's
 `ensure alreadyWithdrawn < totalAmount` is strict and a zero-backing successor would hold a
-zero-amount `LockedAmulet`. So the grant is archived, exactly as `AmuletVestingContract_Cancel`
+zero-amount `LockedToken`. So the grant is archived, exactly as `VestingContract_Cancel`
 archives it, and the page navigates away for both rather than sitting on an id the next read will
 not return. That is why there is no drained-grant state anywhere in the UI: a fully claimed grant
 cannot be in the ACS, so nothing can render it. Showing one would mean reconstructing it from the
@@ -328,7 +366,7 @@ in [`src/utils/amountErrorText.ts`](src/utils/amountErrorText.ts), again an exha
 code added upstream fails the build here.
 
 **The create field offers the picker; the claim dialog does not, and will not.** What a grant pays
-out is fixed by the contract, so `Claim` passes `token={AMT}` and no `onTokenSelect`, which is what
+out is fixed by the contract, so `Claim` passes `token={DBT}` and no `onTokenSelect`, which is what
 makes the kit render the symbol as a static mark rather than a button.
 
 The list behind the picker is real. [`src/providers/Tokens.tsx`](src/providers/Tokens.tsx) reads the
@@ -345,11 +383,13 @@ offered what you already hold could never serve a swap's buy side. This form doe
 either: picking a token you hold nothing of simply leaves you unable to grant it, which is the
 field's own rule to enforce.
 
-**Canton Coin's figures are this app's, not the ledger's.** Its `balance` is what `balanceOf`
-reports, the coin free to fund a grant, and its `locked` is the escrowed coin plus whatever a
-pending grant has pledged. The three still sum to everything held, so the row hides nothing; it
-splits it the way this app can act on. Every other row keeps the ledger's own split, and when the
-app moves more than Canton Coin that rule needs revisiting.
+**The vested instrument's figures are this app's, not the ledger's.** Its `balance` is what
+`balanceOf` reports, what is free to fund a grant, and its `locked` is the escrowed holdings plus
+whatever a pending grant has reserved. The three still sum to everything held, so the row hides
+nothing; it splits it the way this app can act on. Every other row keeps the ledger's own split.
+Which row that is comes from `useBackend().instrument`, the `(admin, instrumentId)` pair the
+deployment read off the registry, matched on both halves: a shared participant can hold another
+admin's instrument under the same id.
 
 That is also why the create field no longer reads a balance of its own: it takes the row the picker
 handed back, so its Max and its ceiling are the figure the row showed. Pick a token you hold none of
@@ -360,8 +400,10 @@ A row carries a figure or it does not, so a read that failed looks exactly like
 field turns that into the kit's `balanceState="error"`, which is the `Balance: N/A` face.
 
 Which registries to ask comes from the same curated list: the first URL each entry publishes, plus
-`REGISTRY_URL`, which is the fallback and the only address a LocalNet has. Every one of them is read,
-not only the ones behind a holding, because a catalogue is the point.
+`REGISTRY_URL`, the canton-token-forge registry this deployment vests against and the only address a
+LocalNet has. Every one of them is read, not only the ones behind a holding, because a catalogue is
+the point. Only same-origin ones, though: a registry on another origin sends no CORS headers, so the
+browser blocks the read and the curated entry keeps the symbol and logo it already carries.
 
 The token standard's v1 APIs publish no way to find a registry, so every app keeps that mapping
 itself. [CIP-0056](https://github.com/canton-foundation/cips/blob/main/cip-0056/cip-0056.md) is the
@@ -377,30 +419,20 @@ versioning, and its shape is whoever maintains it to change. So it is trusted fo
 the symbol it publishes, never for identity or amounts, and the kit ships no reader for it.
 
 `ASSET_LIST_NETWORK` picks a top-level key of that file, and `undefined` skips the source
-altogether. The published file covers `MainNet`, `TestNet` and `DevNet` and no LocalNet, whose DSO
-party is minted with the stack, so the dev server serves the whole published list with a `LocalNet`
-section appended, built from the party its own scan reports. That is the reason it is generated
-rather than committed: a party in a file would be one developer's, and wrong for everyone else after
-the next `reset`. Either half failing costs labels and nothing else, so a stack that is down still
-serves a list.
-
-**The registry is reached through the dev server, not directly.** LocalNet serves it under the
-validator's authenticated prefix, so a browser gets a 401. `REGISTRY_URL` is therefore the
-same-origin `/registry`, and [`vite.config.ts`](vite.config.ts) proxies that to
-`SPLICE_REGISTRY_API_URL` with the bearer from the root `.env`. The token stays in the dev server
-and never reaches the bundle. It is a constant rather than a `VITE_` variable because every build
-has the same value for it; a deployment pointing at another registry is what would earn the
-variable, and that deployment does not work yet — the proxy is the dev server's, so a deployed build
-reads no metadata at all.
-
-[`src/utils/tokens.tsx`](src/utils/tokens.tsx) is down to the artwork, the name and the symbol,
-matched by instrument id: a token this deployment does not know is listed under its raw id rather
-than dropped.
+altogether. The published file covers `MainNet`, `TestNet` and `DevNet` and no LocalNet, so the dev
+server serves the whole published list with a `LocalNet` section holding the DevNet entries. This
+stack's own instrument is deliberately not written into it: the registry serves that, and a party
+in a file would be one developer's and wrong for everyone else after the next `reset`. The list
+failing costs labels and nothing else, so a stack that is down still serves one.
+
+[`src/utils/tokens.tsx`](src/utils/tokens.tsx) is down to the artwork, the name and the symbol. It
+carries no `instrumentId` at all, because the admin is minted per bootstrap run: the identity comes
+from the registry through `useBackend().instrument`, and this is only what the app calls it.
 
 One thing the pick still does not do: **it changes nothing but the field.** The re-lock floor's
-wording, the claim toast, `AmountDisplay`'s coin mark and the grant that gets created all say Amulet
-in their own right. Each has to take the chosen token instead, or a pick relabels one field and
-means nothing.
+wording, the claim toast, `AmountDisplay`'s mark and the grant that gets created all say `DBT` in
+their own right, and `createVesting` funds from the vested instrument whatever the picker shows.
+Each has to take the chosen token instead, or a pick relabels one field and means nothing.
 
 Both pages re-derive that code with the kit's own `validateAmount` rather than storing the one
 `onChange` handed them, because the bounds move on their own: the claim dialog's ceiling is a
@@ -428,17 +460,18 @@ are the same amount and `Claim`'s `backing` prop defaults to `available`.
 Both dialogs have a ceiling, and both hand it to the field as `balance`: the claim dialog's is the
 grant's own `claimable`, the create form's is whatever figure the picked row carries. So neither
 passes `aria-invalid` for the amount — the kit flags anything above the `balance` it was given — and
-where a read leaves no figure to give, the split refuses the amount instead, naming what is actually
-free.
+where a read leaves no figure to give, the selection refuses the amount instead, naming what is
+actually free.
 
 A Canton balance is a set of holding contracts rather than a scalar, so the read is party-scoped and
 summed. It reports what a grant could actually spend rather than what the party owns, over the same
-set `splitOff` will draw from: coin already escrowed is a `LockedAmulet` and so out by template, and
-coin an outstanding grant pledged is out because spending it would leave that grant unacceptable.
-The two agreeing is the point — a `Max` that offered more would put an amount in the field that the
-next step always refuses. The read belongs to `Tokens` now rather than to the form, so it runs when
-the party changes and again whenever the create dialog opens: a grant that dialog created has
-pledged coin since, and the figure it showed before would be the one from before the grant.
+set `selectHoldings` will draw from: a holding already escrowed is a `LockedToken` and so out by
+template, and the one an outstanding grant reserves is out because spending it would leave that
+grant unacceptable. The two agreeing is the point: a `Max` that offered more would put an amount in
+the field that the next step always refuses. The read belongs to `Tokens` now rather than to the
+form, so it runs when the party changes and again whenever the create dialog opens: a grant that
+dialog created has reserved a holding since, and the figure it showed before would be the one from
+before the grant.
 
 The amount field shows no validation message at all for now, which is why nothing words
 `MIN_GRANT_AMOUNT` or a bad decimal to the user; both still gate `Continue`. `AMOUNT_ERROR_TEXT`
diff --git a/dapp/frontend/index.html b/dapp/frontend/index.html
index cd8761d7..5067b10f 100644
--- a/dapp/frontend/index.html
+++ b/dapp/frontend/index.html
@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <title>Canton Vesting</title>
-    <meta name="description" content="Vesting dashboard for cc-vesting-contracts on Canton" />
+    <meta name="description" content="Vesting dashboard for a canton-token-forge instrument on Canton" />
     <meta name="theme-color" media="(prefers-color-scheme: light)" content="#f7f7f7" />
     <meta name="theme-color" media="(prefers-color-scheme: dark)" content="#14152b" />
   </head>
diff --git a/dapp/frontend/package.json b/dapp/frontend/package.json
index 0a74d0f4..15c63151 100644
--- a/dapp/frontend/package.json
+++ b/dapp/frontend/package.json
@@ -6,6 +6,12 @@
   "engines": {
     "node": ">=24.15.0"
   },
+  "imports": {
+    "#api/*": {
+      "types": "./api/*.ts",
+      "default": "./api/*"
+    }
+  },
   "scripts": {
     "dev": "vite",
     "build": "tsc -b && vite build",
diff --git a/dapp/frontend/src/assets/canton-coin.png b/dapp/frontend/src/assets/canton-coin.png
deleted file mode 100644
index 254e0d7d..00000000
Binary files a/dapp/frontend/src/assets/canton-coin.png and /dev/null differ
diff --git a/dapp/frontend/src/backend/LedgerBackend.test.ts b/dapp/frontend/src/backend/LedgerBackend.test.ts
index bb5aad43..7e4d6f4e 100644
--- a/dapp/frontend/src/backend/LedgerBackend.test.ts
+++ b/dapp/frontend/src/backend/LedgerBackend.test.ts
@@ -1,13 +1,16 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { encodeSchedule, TAP_AMOUNT } from '@/backend/commands'
+import { encodeSchedule } from '@/backend/commands'
 import type { Deployment } from '@/backend/config'
 import { LedgerBackend } from '@/backend/LedgerBackend'
 import type { DisclosedContract, LedgerCommand, WalletFns } from '@/backend/wallet'
+import { addAmounts, isZero, subtractAmounts } from '@/utils/amount'
 
 const deployment: Deployment = {
-  pkg: 'pkg1',
-  factoryCid: 'factory-cid',
+  admin: 'instrument-admin::1',
   factoryBlob: 'YmxvYg==',
+  factoryCid: 'factory-cid',
+  instrumentId: 'DBT',
+  pkg: 'pkg1',
   synchronizerId: 'sync::1',
 }
 
@@ -16,21 +19,26 @@ const schedule = {
   curve: { kind: 'linear', start: '2026-01-01T00:00:00Z', end: '2027-01-01T00:00:00Z' },
 } as const
 
-const AMULET = '#splice-amulet:Splice.Amulet:Amulet'
-const PENDING = '#amulet-vesting:AmuletVesting:AmuletVestingProposal'
-const CONTRACT = '#amulet-vesting:AmuletVesting:AmuletVestingContract'
-const CLAIM = '#amulet-vesting:AmuletVesting:AmuletVestedClaim'
+const TOKEN = '#canton-token-forge:Canton.TokenForge.Token:Token'
+const PENDING = '#vesting:Vesting:VestingProposal'
+const CONTRACT = '#vesting:Vesting:VestingContract'
+const CLAIM = '#vesting:Vesting:VestedClaim'
 
 type Submission = {
   actAs?: string[]
   commands?: LedgerCommand[]
   disclosedContracts?: DisclosedContract[]
+  synchronizerId?: string
 }
 
 // As much of the ACS query LedgerBackend builds as these tests read back, named once so the two
 // accessors below share it rather than each casting the body to its own shape.
 type PartyFilter = {
-  cumulative?: { identifierFilter?: { TemplateFilter?: { value?: { templateId?: string } } } }[]
+  cumulative?: {
+    identifierFilter?: {
+      TemplateFilter?: { value?: { includeCreatedEventBlob?: boolean; templateId?: string } }
+    }
+  }[]
 }
 
 type AcsQuery = {
@@ -38,7 +46,11 @@ type AcsQuery = {
   filter?: { filtersByParty?: Record<string, PartyFilter> }
 }
 
-type Read = { requestMethod: string; resource: string; body?: AcsQuery }
+type Read = {
+  requestMethod: string
+  resource: string
+  body?: AcsQuery
+}
 
 const byParty = (read: Read): Record<string, PartyFilter> => read.body?.filter?.filtersByParty ?? {}
 
@@ -49,97 +61,141 @@ const filteredTemplate = (read: Read): string | undefined =>
 
 const filteredParty = (read: Read): string | undefined => Object.keys(byParty(read))[0]
 
+const readsBlobs = (read: Read): boolean =>
+  byParty(read)[filteredParty(read) ?? '']?.cumulative?.[0]?.identifierFilter?.TemplateFilter?.value
+    ?.includeCreatedEventBlob === true
+
 const row = (contractId: string, arg: Record<string, unknown>): unknown => ({
   contractEntry: { JsActiveContract: { createdEvent: { contractId, createArgument: arg } } },
 })
 
-// A test passes `{}` for `extra` to make a row the split can find no DSO on.
-const amuletRow = (
-  contractId: string,
-  initialAmount = '1000',
-  extra: object = { dso: 'dso::1' },
-): unknown => ({
+const tokenRow = (contractId: string, amount: string, overrides: object = {}): unknown => ({
   contractEntry: {
     JsActiveContract: {
       createdEvent: {
         contractId,
-        createArgument: { amount: { initialAmount }, ...extra },
+        createArgument: { admin: 'instrument-admin::1', instrumentId: 'DBT', amount, ...overrides },
         createdEventBlob: `blob-${contractId}`,
-        templateId: 'amuletpkg:Splice.Amulet:Amulet',
+        templateId: 'tfpkg:Canton.TokenForge.Token:Token',
       },
     },
   },
 })
 
-const disclosedAmulet = (contractId: string): DisclosedContract => ({
-  templateId: 'amuletpkg:Splice.Amulet:Amulet',
+const disclosedToken = (contractId: string): DisclosedContract => ({
+  templateId: 'tfpkg:Canton.TokenForge.Token:Token',
   contractId,
   createdEventBlob: `blob-${contractId}`,
 })
 
-// LedgerBackend owes putting whatever comes back into every write, so the fetch is replaced
-// rather than stubbed. Which disclosures resolve is transferContext.test.ts's rule.
-const transferContext = {
-  ctx: { amuletRules: 'rules-cid', openMiningRound: 'round-2', featuredAppRight: null },
-  rulesTemplateId: 'amuletpkg:Splice.AmuletRules:AmuletRules',
-  disclosed: [
-    {
-      templateId: 'amuletpkg:Splice.AmuletRules:AmuletRules',
-      contractId: 'rules-cid',
-      createdEventBlob: 'rules-blob',
-    },
-    {
-      templateId: 'amuletpkg:Splice.Round:OpenMiningRound',
-      contractId: 'round-2',
-      createdEventBlob: 'round-blob-2',
-    },
-  ],
+// An outstanding grant of this deployment's instrument, reserving the named holding.
+const reserving = (tokenCid: string): unknown =>
+  row(`pending-${tokenCid}`, {
+    admin: 'instrument-admin::1',
+    instrumentId: 'DBT',
+    provider: 'operator::1',
+    proposer: 'funder::1',
+    receiver: 'receiver::1',
+    totalAmount: '1000',
+    tokenCid,
+    schedule: encodeSchedule(schedule),
+    note: 'Advisor grant',
+  })
+
+// What the funder kept for the receiver, read the way the backend keys it: `accept` picks one blob
+// out of this, so only a direct look says whether the store itself is growing.
+const storedTokens = (): DisclosedContract[] =>
+  JSON.parse(localStorage.getItem('vesting.tokenDisclosures') ?? '[]')
+
+// The other half of what a grant leaves behind: how many blob-bearing reads this browser has spent
+// looking for a holding it never found.
+const readMisses = (): Record<string, number> =>
+  JSON.parse(localStorage.getItem('vesting.tokenReadMisses') ?? '{}')
+
+const CONFIG = {
+  templateId: '20d54824:Canton.TokenForge.Registry:InstrumentConfig',
+  contractId: '00cfg',
+  createdEventBlob: 'cfg-blob',
 }
 
-vi.mock('@/backend/transferContext', () => ({
-  fetchTransferContext: async () => transferContext,
+// LedgerBackend owes putting whatever comes back into every write, so the fetch is replaced rather
+// than stubbed, and what the registry returns is registry.test.ts's rule. Hoisted, because a vi.mock
+// factory is lifted above every other statement in the file.
+const registryAnswer = vi.hoisted(() => ({ synchronizerId: undefined as string | undefined }))
+
+vi.mock('@/backend/registry', () => ({
+  fetchInstrumentConfig: async () => ({
+    configCid: CONFIG.contractId,
+    configTemplateId: CONFIG.templateId,
+    // Stamped the way the real client leaves it, because the registry is what vouches for where its
+    // own config lives.
+    disclosed: [
+      registryAnswer.synchronizerId === undefined
+        ? CONFIG
+        : { ...CONFIG, synchronizerId: registryAnswer.synchronizerId },
+    ],
+    synchronizerId: registryAnswer.synchronizerId,
+  }),
 }))
 
-// createVesting is two submissions now, so the harness has to behave like the ledger under both:
-// a split archives its inputs and puts the output plus any change in their place, and the factory
-// choice leaves a pending grant behind pledging what it was given. Without that second half every
-// later split would happily spend the Amulet an outstanding grant is waiting on.
-type AmuletFields = { contractId: string; createArgument: { amount: { initialAmount: string } } }
+type Created = {
+  contractId?: string
+  createArgument?: { admin?: string; amount?: string; instrumentId?: string }
+}
 
-const fields = (one: unknown): AmuletFields =>
-  (one as { contractEntry: { JsActiveContract: { createdEvent: AmuletFields } } }).contractEntry
-    .JsActiveContract.createdEvent
+const createdEvent = (contract: unknown): Created =>
+  (contract as { contractEntry?: { JsActiveContract?: { createdEvent?: Created } } }).contractEntry
+    ?.JsActiveContract?.createdEvent ?? {}
 
-const initialAmount = (one: unknown): number =>
-  Number(fields(one).createArgument.amount.initialAmount)
+const cidOf = (contract: unknown): string => createdEvent(contract).contractId ?? ''
 
-const settle = (acs: Record<string, unknown[]>, submission: Submission, nth: number): void => {
+// The harness behaves like the ledger for the one submission a grant takes: the factory splits the
+// holdings it is given, so those are consumed and replaced by one holding of exactly the grant plus
+// the funder's change, and the pending grant names the first of the two. Without that, a later
+// selection would happily spend the holding an outstanding grant is waiting on, and no holding
+// would exist for the funder to disclose to the receiver.
+const settle = (acs: Record<string, unknown[]>, submission: Submission): void => {
   const exercise = submission.commands?.[0]?.ExerciseCommand
-  if (exercise?.choice === 'AmuletVestingFactory_CreateVesting') {
-    const { amuletCids } = exercise.choiceArgument as { amuletCids: string[] }
-    acs[PENDING] = [...(acs[PENDING] ?? []), row(`pending-for-${amuletCids[0]}`, { amuletCids })]
+  if (exercise?.choice !== 'VestingFactory_CreateVesting') {
     return
   }
-  if (exercise?.choice !== 'AmuletRules_Transfer') {
-    return
+  const { note, receiver, tokenCids, totalAmount } = exercise.choiceArgument as {
+    note: string | null
+    receiver: string
+    tokenCids: string[]
+    totalAmount: string
   }
-  const transfer = exercise.choiceArgument.transfer as {
-    inputs: { value: string }[]
-    outputs: { amount: string }[]
-  }
-  const spent = new Set(transfer.inputs.map((input) => input.value))
-  const amount = Number(transfer.outputs[0].amount)
-  const before = acs[AMULET] ?? []
-  const consumed = before.filter((one) => spent.has(fields(one).contractId))
-  const change = consumed.reduce((total: number, one) => total + initialAmount(one), 0) - amount
-  acs[AMULET] = [
-    ...before.filter((one) => !spent.has(fields(one).contractId)),
-    amuletRow(`split-${nth}`, transfer.outputs[0].amount),
-    ...(change > 0 ? [amuletRow(`change-${nth}`, String(change))] : []),
+  const held = acs[TOKEN] ?? []
+  const spent = held.filter((contract) => tokenCids.includes(cidOf(contract)))
+  const change = subtractAmounts(
+    addAmounts(...spent.map((contract) => createdEvent(contract).createArgument?.amount ?? '0')),
+    totalAmount,
+  )
+  // The choice takes no instrument of its own: what comes out is the instrument of what went in, so
+  // a test that funds from another admin's holdings gets a proposal of that admin here too.
+  const { admin, instrumentId } = createdEvent(spent[0]).createArgument ?? {}
+  const instrument = { admin, instrumentId }
+  const funding = tokenRow(`funding-${tokenCids[0]}`, totalAmount, instrument)
+  const returned = isZero(change) ? [] : [tokenRow(`change-${tokenCids[0]}`, change, instrument)]
+  const pending = row(`pending-for-${tokenCids[0]}`, {
+    ...instrument,
+    provider: 'operator::1',
+    proposer: submission.actAs?.[0],
+    receiver,
+    totalAmount,
+    tokenCid: cidOf(funding),
+    note,
+  })
+  acs[TOKEN] = [
+    ...held.filter((contract) => !tokenCids.includes(cidOf(contract))),
+    funding,
+    ...returned,
   ]
+  acs[PENDING] = [...(acs[PENDING] ?? []), pending]
 }
 
-// The submission carries the synchronizer, so everything disclosed on one arrives stamped with it.
+// The deployment names one here, so every disclosure it does not already carry one for is filled in
+// with it.
 const onSync = <T>(contracts: T[]): (T & { synchronizerId: string })[] =>
   contracts.map((contract) => ({ ...contract, synchronizerId: 'sync::1' }))
 
@@ -149,17 +205,20 @@ const harness = (
     declines?: boolean
     deployment?: Deployment
     ledgerEnd?: unknown
+    readsFailAfterSubmit?: boolean
+    readsFailOnBlobs?: boolean
   } = {},
 ): { backend: LedgerBackend; submissions: Submission[]; reads: Read[] } => {
   const {
-    acs = { [AMULET]: [amuletRow('am1')] },
+    acs = { [TOKEN]: [tokenRow('t1', '1000')] },
     declines = false,
     ledgerEnd = { offset: 42 },
     deployment: config = deployment,
+    readsFailAfterSubmit = false,
+    readsFailOnBlobs = false,
   } = options
   const submissions: Submission[] = []
   const reads: Read[] = []
-  let settled = 0
   const wallet: WalletFns = {
     execute: async (params) => {
       if (declines) {
@@ -167,12 +226,20 @@ const harness = (
       }
       const submission = params as Submission
       submissions.push(submission)
-      settle(acs, submission, ++settled)
-      return {}
+      settle(acs, submission)
+      // The wallet answers with the transaction's own ids, none of which name a contract it
+      // created.
+      return { tx: { payload: { updateId: `update-${submissions.length}` } } }
     },
     ledgerApi: async (params) => {
       const read = params as Read
       reads.push(read)
+      if (readsFailAfterSubmit && submissions.length > 0) {
+        throw new Error('the participant is not answering')
+      }
+      if (readsFailOnBlobs && read.body?.filter !== undefined && readsBlobs(read)) {
+        throw new Error('the participant is not answering')
+      }
       if (read.resource === '/v2/state/ledger-end') {
         return ledgerEnd
       }
@@ -184,6 +251,7 @@ const harness = (
 
 beforeEach(() => {
   localStorage.clear()
+  registryAnswer.synchronizerId = undefined
 })
 
 describe('LedgerBackend.createVesting', () => {
@@ -196,143 +264,233 @@ describe('LedgerBackend.createVesting', () => {
     note: 'linear',
   }
 
-  it('splits the amount off first, then funds the grant from what the split produced', async () => {
+  // One submission, not two: the factory splits the funder's inputs itself, so the funder never has
+  // to pre-split and the change comes back in the same transaction.
+  it('funds the grant in a single submission', async () => {
     const { backend, submissions } = harness({
-      acs: { [AMULET]: [amuletRow('am1', '600'), amuletRow('am2', '900')] },
+      acs: { [TOKEN]: [tokenRow('t1', '600'), tokenRow('t2', '900')] },
     })
 
     await backend.createVesting(grant)
 
-    expect(submissions[0]?.commands?.[0]?.ExerciseCommand).toEqual({
-      templateId: transferContext.rulesTemplateId,
-      contractId: 'rules-cid',
-      choice: 'AmuletRules_Transfer',
-      choiceArgument: {
-        transfer: {
-          sender: 'funder::1',
-          provider: 'funder::1',
-          inputs: [
-            { tag: 'InputAmulet', value: 'am1' },
-            { tag: 'InputAmulet', value: 'am2' },
-          ],
-          outputs: [
-            {
-              receiver: 'funder::1',
-              receiverFeeRatio: '0.0',
-              amount: '1000',
-              lock: null,
-              meta: null,
-            },
-          ],
-          beneficiaries: null,
-        },
-        context: {
-          openMiningRound: 'round-2',
-          issuingMiningRounds: [],
-          validatorRights: [],
-          featuredAppRight: null,
-        },
-        expectedDso: 'dso::1',
-      },
+    expect(submissions).toHaveLength(1)
+    expect(submissions[0]?.commands?.[0]?.ExerciseCommand.choice).toBe(
+      'VestingFactory_CreateVesting',
+    )
+  })
+
+  it('names the largest holdings first, and only as many as cover the total', async () => {
+    const { backend, submissions } = harness({
+      acs: { [TOKEN]: [tokenRow('small', '100'), tokenRow('big', '900'), tokenRow('mid', '400')] },
     })
-    expect(submissions[1]?.commands?.[0]?.ExerciseCommand.choiceArgument.amuletCids).toEqual([
-      'split-1',
+
+    await backend.createVesting(grant)
+
+    expect(submissions[0]?.commands?.[0]?.ExerciseCommand.choiceArgument.tokenCids).toEqual([
+      'big',
+      'mid',
     ])
   })
 
-  it('leaves out an Amulet an outstanding grant has already pledged', async () => {
+  it('leaves out the holding an outstanding grant has already reserved', async () => {
     const { backend, submissions } = harness({
       acs: {
-        [AMULET]: [amuletRow('pledged', '1000'), amuletRow('free', '1000')],
-        [PENDING]: [row('p1', { amuletCids: ['pledged'] })],
+        [TOKEN]: [tokenRow('pledged', '1000'), tokenRow('free', '1000')],
+        [PENDING]: [row('p1', { tokenCid: 'pledged' })],
       },
     })
 
     await backend.createVesting(grant)
 
-    const transfer = submissions[0]?.commands?.[0]?.ExerciseCommand.choiceArgument.transfer as {
-      inputs: { value: string }[]
-    }
-    expect(transfer.inputs).toEqual([{ tag: 'InputAmulet', value: 'free' }])
+    expect(submissions[0]?.commands?.[0]?.ExerciseCommand.choiceArgument.tokenCids).toEqual([
+      'free',
+    ])
   })
 
-  it('refuses when what is left unpledged cannot cover the grant', async () => {
+  it('refuses when what is left unreserved cannot cover the grant', async () => {
     const { backend } = harness({
       acs: {
-        [AMULET]: [amuletRow('pledged', '1000'), amuletRow('free', '400')],
-        [PENDING]: [row('p1', { amuletCids: ['pledged'] })],
+        [TOKEN]: [tokenRow('pledged', '1000'), tokenRow('free', '400')],
+        [PENDING]: [row('p1', { tokenCid: 'pledged' })],
       },
     })
 
-    await expect(backend.createVesting(grant)).rejects.toThrow(/only 400 AMT is free/)
+    await expect(backend.createVesting(grant)).rejects.toThrow(/only 400 DBT is free/)
   })
 
-  it('exercises the factory choice with the composed note and schedule, disclosing only it', async () => {
-    const { backend, submissions } = harness()
+  it('refuses a grant the funder holds nothing for', async () => {
+    const { backend } = harness({ acs: {} })
+
+    await expect(backend.createVesting(grant)).rejects.toThrow(/only 0 DBT is free/)
+  })
+
+  // A shared participant can carry another admin's DBT, and spending one would fail at the
+  // transfer's own instrument check rather than here.
+  it('ignores a holding of another instrument entirely', async () => {
+    const { backend } = harness({
+      acs: { [TOKEN]: [tokenRow('foreign', '5000', { admin: 'other::1' })] },
+    })
+
+    await expect(backend.createVesting(grant)).rejects.toThrow(/only 0 DBT is free/)
+  })
+
+  it('exercises the factory choice with the composed note, schedule and config', async () => {
+    const { backend, submissions } = harness({ acs: { [TOKEN]: [tokenRow('t1', '1000')] } })
 
     await backend.createVesting(grant)
 
-    expect(submissions[1]?.commands).toEqual([
+    expect(submissions[0]?.commands).toEqual([
       {
         ExerciseCommand: {
-          templateId: 'pkg1:AmuletVesting:AmuletVestingFactory',
+          templateId: 'pkg1:Vesting:VestingFactory',
           contractId: 'factory-cid',
-          choice: 'AmuletVestingFactory_CreateVesting',
+          choice: 'VestingFactory_CreateVesting',
           choiceArgument: {
             proposer: 'funder::1',
             receiver: 'receiver::1',
             totalAmount: '1000',
             schedule: encodeSchedule(schedule),
-            amuletCids: ['split-1'],
+            tokenCids: ['t1'],
+            configCid: '00cfg',
             note: 'Advisor grant\nlinear',
           },
         },
       },
     ])
-    // The funder is not a stakeholder of the observer-less factory, so its disclosure is the
-    // deployment's rather than something read back here.
-    expect(submissions[1]?.disclosedContracts).toEqual([
-      {
-        templateId: 'pkg1:AmuletVesting:AmuletVestingFactory',
-        contractId: 'factory-cid',
-        createdEventBlob: 'YmxvYg==',
-        synchronizerId: 'sync::1',
-      },
-    ])
+    // The config because the split runs against it, the factory because the funder is not a
+    // stakeholder of the observer-less factory and so cannot read it. The inputs are the funder's
+    // own, so they need no disclosure.
+    expect(submissions[0]?.disclosedContracts).toEqual(
+      onSync([
+        CONFIG,
+        {
+          templateId: 'pkg1:Vesting:VestingFactory',
+          contractId: 'factory-cid',
+          createdEventBlob: 'YmxvYg==',
+        },
+      ]),
+    )
   })
 
-  it('omits the synchronizer id when the config carries none', async () => {
+  it('omits the synchronizer id when neither the deployment nor the registry names one', async () => {
     const { synchronizerId, ...rest } = deployment
     const { backend, submissions } = harness({ deployment: rest })
 
     await backend.createVesting(grant)
 
-    expect(submissions[1]?.disclosedContracts?.[0]).not.toHaveProperty('synchronizerId')
+    expect(submissions[0]?.disclosedContracts?.[0]).not.toHaveProperty('synchronizerId')
+    expect(submissions[0]).not.toHaveProperty('synchronizerId')
   })
 
-  it('refuses a grant the funder holds no Amulet for', async () => {
-    const { backend } = harness({ acs: {} })
+  // The config the registry discloses is rebuilt without the synchronizer it arrived stamped with,
+  // so what the registry knows would be thrown away rather than used where the deployment is silent.
+  it('falls back to the synchronizer the registry stamped when the deployment names none', async () => {
+    const { synchronizerId, ...rest } = deployment
+    registryAnswer.synchronizerId = 'sync::1'
+    const { backend, submissions } = harness({ deployment: rest })
 
-    await expect(backend.createVesting(grant)).rejects.toThrow(/only 0 AMT is free/)
+    await backend.createVesting(grant)
+
+    expect(submissions[0]?.synchronizerId).toBe('sync::1')
+    expect(submissions[0]?.disclosedContracts?.[0]).toHaveProperty('synchronizerId', 'sync::1')
   })
 
-  // A disclosure is an opaque blob, so the split reads the DSO off an Amulet it consumes.
-  it('names the DSO the funder’s own Amulets are signed by', async () => {
-    const { backend, submissions } = harness({
-      acs: { [AMULET]: [amuletRow('am1', '1200')] },
-    })
+  // The registry vouches for its own config and for nothing else, so its answer cannot travel onto
+  // the factory's blob: where that contract lives is the deployment's to say or nobody's.
+  it('leaves the factory blob unstamped when the deployment names no synchronizer', async () => {
+    const { synchronizerId, ...rest } = deployment
+    registryAnswer.synchronizerId = 'sync::1'
+    const { backend, submissions } = harness({ deployment: rest })
+
+    await backend.createVesting(grant)
+
+    expect(submissions[0]?.disclosedContracts?.[1]).not.toHaveProperty('synchronizerId')
+  })
+
+  // One submission names one synchronizer and the two contracts it needs come from two sources, so
+  // a disagreement has to be said here: sent, it is a rejection that names neither.
+  it('refuses to submit when the registry and the deployment disagree on the synchronizer', async () => {
+    registryAnswer.synchronizerId = 'sync::2'
+    const { backend, submissions } = harness()
+
+    await expect(backend.createVesting(grant)).rejects.toThrow(/sync::2.*sync::1/)
+    expect(submissions).toHaveLength(0)
+  })
+
+  // The acceptance criterion this issue exists for: the funder keeps everything the grant did not
+  // take, rather than the whole holding it was funded from.
+  it('leaves the funder everything the grant did not reserve', async () => {
+    const { backend } = harness({ acs: { [TOKEN]: [tokenRow('t1', '1500')] } })
 
     await backend.createVesting(grant)
 
-    expect(submissions[0]?.commands?.[0]?.ExerciseCommand?.choiceArgument).toMatchObject({
-      expectedDso: 'dso::1',
+    await expect(backend.balanceOf('funder::1')).resolves.toBe('500')
+  })
+
+  // The holding the receiver will have to disclose is created by this very submission, so the read
+  // that carries its blob runs after the write and not with the selection before it.
+  it('reads the split holding back only once the grant is on the ledger', async () => {
+    const { backend, reads } = harness({ acs: { [TOKEN]: [tokenRow('t1', '1500')] } })
+
+    await backend.createVesting(grant)
+
+    const withBlobs = reads.filter(
+      (read) =>
+        read.body?.filter !== undefined && readsBlobs(read) && filteredTemplate(read) === TOKEN,
+    )
+    expect(withBlobs).toHaveLength(1)
+  })
+
+  // The grant is on the ledger by then, so reporting a failure would invite the funder to make a
+  // second one; the Accept is what says the blob is missing.
+  it('reports a grant whose funding holding could not be read back as created', async () => {
+    const { backend } = harness({
+      acs: { [TOKEN]: [tokenRow('t1', '1500')] },
+      readsFailAfterSubmit: true,
+    })
+
+    await expect(backend.createVesting(grant)).resolves.toBeUndefined()
+  })
+})
+
+describe('LedgerBackend.balanceOf', () => {
+  it('sums the unreserved holdings of this deployment’s instrument', async () => {
+    const { backend } = harness({
+      acs: {
+        [TOKEN]: [
+          tokenRow('a', '600'),
+          tokenRow('b', '400'),
+          tokenRow('reserved', '900'),
+          tokenRow('foreign', '5000', { instrumentId: 'OTHER' }),
+        ],
+        [PENDING]: [row('p1', { tokenCid: 'reserved' })],
+      },
     })
+
+    await expect(backend.balanceOf('funder::1')).resolves.toBe('1000')
   })
+})
 
-  it('refuses rather than sending an undefined expectedDso when no Amulet carries one', async () => {
-    const { backend } = harness({ acs: { [AMULET]: [amuletRow('am1', '1200', {})] } })
+describe('LedgerBackend.tap', () => {
+  // The config is nonconsuming and admin-signed, so its disclosure is the whole of what a tap needs
+  // and the resolved template id has to come from that disclosure rather than from the deployment.
+  it('exercises the faucet on the disclosed config, naming the connected party', async () => {
+    const { backend, submissions } = harness()
+
+    await backend.tap({ amount: '1000', party: 'funder::1' })
 
-    await expect(backend.createVesting(grant)).rejects.toThrow(/name no DSO party/)
+    expect(submissions[0]?.commands).toEqual([
+      {
+        ExerciseCommand: {
+          templateId: CONFIG.templateId,
+          contractId: '00cfg',
+          choice: 'InstrumentConfig_Tap',
+          choiceArgument: { user: 'funder::1', amount: '1000' },
+        },
+      },
+    ])
+    expect(submissions[0]?.disclosedContracts).toEqual(onSync([CONFIG]))
+    expect(submissions[0]?.actAs).toEqual(['funder::1'])
   })
 })
 
@@ -340,7 +498,7 @@ describe('LedgerBackend.createVesting', () => {
 // primary account: a mismatch is then a participant rejection, not a submission signed by the
 // wrong key.
 describe('LedgerBackend submissions', () => {
-  it('sends actAs for the acting party on every choice, the split included', async () => {
+  it('sends actAs for the acting party on every choice', async () => {
     const { backend, submissions } = harness()
 
     await backend.createVesting({
@@ -355,7 +513,6 @@ describe('LedgerBackend submissions', () => {
     await backend.claimResidual({ receiver: 'receiver::1', claimCid: 'r1', amount: '10' })
 
     expect(submissions.map((submission) => submission.actAs)).toEqual([
-      ['funder::1'],
       ['funder::1'],
       ['receiver::1'],
       ['funder::1'],
@@ -363,19 +520,24 @@ describe('LedgerBackend submissions', () => {
     ])
   })
 
-  it('discloses the transfer context, stamped with the synchronizer, on every Amulet-moving write', async () => {
+  it('discloses the instrument config, stamped with the synchronizer, on every write that moves a holding', async () => {
     const { backend, submissions } = harness()
 
     await backend.withdraw({ receiver: 'receiver::1', contractCid: 'c1', amount: '10' })
     await backend.cancel({ creator: 'funder::1', contractCid: 'c1' })
     await backend.claimResidual({ receiver: 'receiver::1', claimCid: 'r1', amount: '10' })
 
-    const stamped = onSync(transferContext.disclosed)
+    const stamped = onSync([CONFIG])
     expect(submissions.map((submission) => submission.disclosedContracts)).toEqual([
       stamped,
       stamped,
       stamped,
     ])
+    expect(submissions.map((submission) => submission.synchronizerId)).toEqual([
+      'sync::1',
+      'sync::1',
+      'sync::1',
+    ])
   })
 
   it('names the template and choice each write exercises', async () => {
@@ -391,45 +553,26 @@ describe('LedgerBackend submissions', () => {
         return [command?.templateId, command?.choice, command?.contractId]
       }),
     ).toEqual([
-      ['pkg1:AmuletVesting:AmuletVestingContract', 'AmuletVestingContract_Withdraw', 'c1'],
-      ['pkg1:AmuletVesting:AmuletVestingContract', 'AmuletVestingContract_Cancel', 'c1'],
-      ['pkg1:AmuletVesting:AmuletVestedClaim', 'AmuletVestedClaim_Withdraw', 'r1'],
-    ])
-  })
-
-  it('taps AmuletRules for the connected party, on the same two disclosures', async () => {
-    const { backend, submissions } = harness()
-
-    await backend.tap('funder::1')
-
-    const command = submissions[0]?.commands?.[0]?.ExerciseCommand
-    expect([command?.templateId, command?.choice, command?.contractId]).toEqual([
-      transferContext.rulesTemplateId,
-      'AmuletRules_DevNet_Tap',
-      transferContext.ctx.amuletRules,
+      ['pkg1:Vesting:VestingContract', 'VestingContract_Withdraw', 'c1'],
+      ['pkg1:Vesting:VestingContract', 'VestingContract_Cancel', 'c1'],
+      ['pkg1:Vesting:VestedClaim', 'VestedClaim_Withdraw', 'r1'],
     ])
-    expect(command?.choiceArgument).toEqual({
-      receiver: 'funder::1',
-      amount: TAP_AMOUNT,
-      openRound: transferContext.ctx.openMiningRound,
-    })
-    expect(submissions[0]?.disclosedContracts).toEqual(onSync(transferContext.disclosed))
   })
 
-  it('carries the transfer context into every choice argument that takes one', async () => {
+  it('carries the config into every choice argument that takes one', async () => {
     const { backend, submissions } = harness()
 
     await backend.withdraw({ receiver: 'receiver::1', contractCid: 'c1', amount: '10' })
 
     expect(submissions[0]?.commands?.[0]?.ExerciseCommand.choiceArgument).toEqual({
       withdrawAmount: '10',
-      ctx: transferContext.ctx,
+      configCid: '00cfg',
     })
   })
 })
 
 // Accept is the one write disclosing contracts the submitting party cannot read for itself: the
-// funder's Amulets, whose blobs were kept when the funder created the pending grant.
+// funder's holdings, whose blobs were kept when the funder created the pending grant.
 describe('LedgerBackend.accept', () => {
   const grant = (title: string) => ({
     proposer: 'funder::1',
@@ -439,48 +582,318 @@ describe('LedgerBackend.accept', () => {
     title,
   })
 
-  it('discloses the Amulet the grant names and nothing else it has ever stored', async () => {
-    const acs: Record<string, unknown[]> = { [AMULET]: [amuletRow('am1', '3000')] }
+  it('discloses the holding the grant names and nothing else it has ever stored', async () => {
+    const acs: Record<string, unknown[]> = {
+      [TOKEN]: [tokenRow('t1', '1500'), tokenRow('t2', '1500')],
+    }
     const funder = harness({ acs })
     await funder.backend.createVesting(grant('First grant'))
     await funder.backend.createVesting(grant('Second grant'))
     const { backend, submissions } = harness({ acs })
 
-    await backend.accept({ receiver: 'receiver::1', pendingCid: 'pending-for-split-1' })
+    await backend.accept({ receiver: 'receiver::1', pendingCid: 'pending-for-t1' })
 
+    // The split output, never the input it came out of: that one is archived, and re-disclosing it
+    // would only fail the transfer's own fetch.
     expect(submissions[0]?.disclosedContracts).toEqual(
-      onSync([...transferContext.disclosed, disclosedAmulet('split-1')]),
-    )
-    expect(submissions[0]?.commands?.[0]?.ExerciseCommand.choice).toBe(
-      'AmuletVestingProposal_Accept',
+      onSync([CONFIG, disclosedToken('funding-t1')]),
     )
+    expect(submissions[0]?.commands?.[0]?.ExerciseCommand.choice).toBe('VestingProposal_Accept')
   })
 
-  it('refuses rather than submitting an Accept the participant would reject', async () => {
-    const { backend } = harness()
+  // A blob the funder never handed over and a grant that is simply gone are two different things,
+  // and telling a stale dashboard about the blob store sends the receiver looking in the wrong
+  // place entirely.
+  it('refuses an Accept whose blob this browser never kept', async () => {
+    const acs: Record<string, unknown[]> = { [TOKEN]: [tokenRow('t1', '1500')] }
+    const funder = harness({ acs })
+    await funder.backend.createVesting(grant('First grant'))
+    localStorage.clear()
+    const { backend, submissions } = harness({ acs })
 
     await expect(
-      backend.accept({ receiver: 'receiver::1', pendingCid: 'pending-for-split-1' }),
+      backend.accept({ receiver: 'receiver::1', pendingCid: 'pending-for-t1' }),
     ).rejects.toThrow(/not disclosable/)
+    expect(submissions).toHaveLength(0)
+  })
+
+  it('refuses an Accept for a grant no longer in the receiver’s view', async () => {
+    const { backend, submissions } = harness()
+
+    await expect(
+      backend.accept({ receiver: 'receiver::1', pendingCid: 'pending-for-t1' }),
+    ).rejects.toThrow(/no longer outstanding/)
+    expect(submissions).toHaveLength(0)
+  })
+
+  // Why every outstanding grant is reconciled and not only the one just made: a read that failed
+  // once would otherwise leave a grant nobody can ever accept.
+  it('picks up a blob a failed read left behind when the next grant is created', async () => {
+    const acs: Record<string, unknown[]> = {
+      [TOKEN]: [tokenRow('t1', '1500'), tokenRow('t2', '1500')],
+    }
+    const flaky = harness({ acs, readsFailAfterSubmit: true })
+    await flaky.backend.createVesting(grant('First grant'))
+    const funder = harness({ acs })
+    await funder.backend.createVesting(grant('Second grant'))
+    const { backend, submissions } = harness({ acs })
+
+    await backend.accept({ receiver: 'receiver::1', pendingCid: 'pending-for-t1' })
+
+    expect(submissions[0]?.disclosedContracts).toEqual(
+      onSync([CONFIG, disclosedToken('funding-t1')]),
+    )
+  })
+
+  // The funder may never create a second grant, so the next grant cannot be the only repair: their
+  // own dashboard is where an unacceptable grant would otherwise sit unnoticed forever.
+  it('picks up a blob a failed read left behind on the funder’s next view', async () => {
+    const acs: Record<string, unknown[]> = { [TOKEN]: [tokenRow('t1', '1500')] }
+    const flaky = harness({ acs, readsFailAfterSubmit: true })
+    await flaky.backend.createVesting(grant('First grant'))
+    const funder = harness({ acs })
+    await funder.backend.viewAs('funder::1')
+    const { backend, submissions } = harness({ acs })
+
+    await backend.accept({ receiver: 'receiver::1', pendingCid: 'pending-for-t1' })
+
+    expect(submissions[0]?.disclosedContracts).toEqual(
+      onSync([CONFIG, disclosedToken('funding-t1')]),
+    )
   })
 
-  it('keeps the blobs of a live grant when a later one is declined in the wallet', async () => {
-    const acs: Record<string, unknown[]> = { [AMULET]: [amuletRow('am1', '2500')] }
+  it('keeps the blob of a live grant when a later one is declined in the wallet', async () => {
+    const acs: Record<string, unknown[]> = { [TOKEN]: [tokenRow('t1', '2500')] }
     const first = harness({ acs })
     await first.backend.createVesting(grant('First grant'))
-    const declined = harness({ acs: { [AMULET]: [amuletRow('am9')] }, declines: true })
+    const declined = harness({ acs: { [TOKEN]: [tokenRow('t9', '1000')] }, declines: true })
     await expect(declined.backend.createVesting(grant('Second grant'))).rejects.toThrow(/rejected/)
     const { backend, submissions } = harness({ acs })
 
-    await backend.accept({ receiver: 'receiver::1', pendingCid: 'pending-for-split-1' })
+    await backend.accept({ receiver: 'receiver::1', pendingCid: 'pending-for-t1' })
 
     expect(submissions[0]?.disclosedContracts).toEqual(
-      onSync([...transferContext.disclosed, disclosedAmulet('split-1')]),
+      onSync([CONFIG, disclosedToken('funding-t1')]),
     )
   })
+
+  // A miss counted before the blob was finally found used to outlive the grant entirely: `accept`
+  // dropped the blob and left the count behind for a contract id that can never come back.
+  it('drops a stale miss count when the grant is finally accepted', async () => {
+    const missed = harness({
+      acs: { [TOKEN]: [tokenRow('unrelated', '500')], [PENDING]: [reserving('funding-t1')] },
+    })
+    await missed.backend.viewAs('funder::1')
+    expect(readMisses()['funding-t1']).toBe(1)
+    const found = harness({
+      acs: { [TOKEN]: [tokenRow('funding-t1', '1000')], [PENDING]: [reserving('funding-t1')] },
+    })
+    await found.backend.viewAs('funder::1')
+
+    await found.backend.accept({ receiver: 'receiver::1', pendingCid: 'pending-funding-t1' })
+
+    expect(storedTokens()).toEqual([])
+    expect(readMisses()).toEqual({})
+  })
+})
+
+// Both exits are bodyless and archive the proposal on the controller's own authority, so the
+// interesting part is not the ledger but what stops being kept in this browser afterwards.
+describe('LedgerBackend.cancelProposal and rejectProposal', () => {
+  const grant = (title = 'Advisor grant') => ({
+    proposer: 'funder::1',
+    receiver: 'receiver::1',
+    totalAmount: '1000',
+    schedule,
+    title,
+  })
+
+  it('cancels as the funder, disclosing nothing', async () => {
+    const acs: Record<string, unknown[]> = { [TOKEN]: [tokenRow('t1', '1500')] }
+    const { backend, submissions } = harness({ acs })
+    await backend.createVesting(grant())
+
+    await backend.cancelProposal({ proposer: 'funder::1', pendingCid: 'pending-for-t1' })
+
+    const submission = submissions.at(-1)
+    expect(submission?.commands?.[0]?.ExerciseCommand.choice).toBe('VestingProposal_Cancel')
+    expect(submission?.actAs).toEqual(['funder::1'])
+    // Empty, not the config: nothing is disclosed, which is also what proves the registry was
+    // never asked.
+    expect(submission?.disclosedContracts).toEqual([])
+    // The one write that discloses nothing, so the only one where a synchronizer stamped on the
+    // disclosures alone would leave the wallet to pick its own.
+    expect(submission?.synchronizerId).toBe('sync::1')
+  })
+
+  // The exits fetch no config, so the registry's answer has to be the one an earlier write kept:
+  // without it these two would be the only writes naming no synchronizer at all, on a deployment
+  // where every other write names the registry's.
+  it('names the synchronizer an earlier write learned from the registry', async () => {
+    const { synchronizerId, ...rest } = deployment
+    registryAnswer.synchronizerId = 'sync::9'
+    const acs: Record<string, unknown[]> = { [TOKEN]: [tokenRow('t1', '1500')] }
+    const { backend, submissions } = harness({ acs, deployment: rest })
+    await backend.createVesting(grant())
+
+    await backend.cancelProposal({ proposer: 'funder::1', pendingCid: 'pending-for-t1' })
+
+    expect(submissions.at(-1)?.disclosedContracts).toEqual([])
+    expect(submissions.at(-1)?.synchronizerId).toBe('sync::9')
+  })
+
+  it('rejects as the receiver, disclosing nothing', async () => {
+    const acs: Record<string, unknown[]> = { [TOKEN]: [tokenRow('t1', '1500')] }
+    const funder = harness({ acs })
+    await funder.backend.createVesting(grant())
+    const { backend, submissions } = harness({ acs })
+
+    await backend.rejectProposal({ receiver: 'receiver::1', pendingCid: 'pending-for-t1' })
+
+    expect(submissions[0]?.commands?.[0]?.ExerciseCommand.choice).toBe('VestingProposal_Reject')
+    expect(submissions[0]?.actAs).toEqual(['receiver::1'])
+    expect(submissions[0]?.disclosedContracts).toEqual([])
+  })
+
+  // The read is for the prune, never for a guard: the receiver is not who the blob belongs to, so a
+  // participant that will not answer must cost them a stale entry rather than the decline itself.
+  it('declines even when the proposal cannot be read', async () => {
+    const submissions: Submission[] = []
+    const backend = new LedgerBackend(deployment, {
+      execute: async (params) => {
+        submissions.push(params as Submission)
+        return {}
+      },
+      ledgerApi: async () => {
+        throw new Error('the participant is not answering')
+      },
+    })
+
+    await backend.rejectProposal({ receiver: 'receiver::1', pendingCid: 'pending-for-t1' })
+
+    expect(submissions[0]?.commands?.[0]?.ExerciseCommand.choice).toBe('VestingProposal_Reject')
+  })
+
+  // Both parties are accounts of one browser, so the grant a receiver declines can be one this same
+  // browser funded and still holds the blob for. Nothing else would ever drop it.
+  it('drops the blob of a grant the receiver declined', async () => {
+    const acs: Record<string, unknown[]> = {
+      [TOKEN]: [tokenRow('t1', '1500'), tokenRow('t2', '1500')],
+    }
+    const { backend } = harness({ acs })
+    await backend.createVesting(grant('First grant'))
+    await backend.createVesting(grant('Second grant'))
+
+    await backend.rejectProposal({ receiver: 'receiver::1', pendingCid: 'pending-for-t1' })
+
+    expect(storedTokens().map((one) => one.contractId)).toEqual(['funding-t2'])
+  })
+
+  it('drops the blob of the grant it ended and keeps every other one', async () => {
+    const acs: Record<string, unknown[]> = {
+      [TOKEN]: [tokenRow('t1', '1500'), tokenRow('t2', '1500')],
+    }
+    const { backend } = harness({ acs })
+    await backend.createVesting(grant('First grant'))
+    await backend.createVesting(grant('Second grant'))
+
+    await backend.cancelProposal({ proposer: 'funder::1', pendingCid: 'pending-for-t1' })
+
+    expect(storedTokens().map((one) => one.contractId)).toEqual(['funding-t2'])
+  })
+
+  it('drops the read misses counted against the grant it ended', async () => {
+    const { backend } = harness({
+      acs: { [TOKEN]: [tokenRow('t1', '500')], [PENDING]: [reserving('archived-elsewhere')] },
+    })
+    await backend.viewAs('funder::1')
+    expect(readMisses()['archived-elsewhere']).toBe(1)
+
+    await backend.cancelProposal({
+      proposer: 'funder::1',
+      pendingCid: 'pending-archived-elsewhere',
+    })
+
+    expect(readMisses()).toEqual({})
+  })
+
+  it('refuses to end a grant that is no longer outstanding', async () => {
+    const { backend, submissions } = harness()
+
+    await expect(
+      backend.cancelProposal({ proposer: 'funder::1', pendingCid: 'pending-for-t1' }),
+    ).rejects.toThrow(/no longer outstanding/)
+    expect(submissions).toHaveLength(0)
+  })
+
+  // A prompt the wallet declines leaves a grant that is still outstanding and still acceptable, so
+  // forgetting its blob would break the one thing this browser is holding for it.
+  it('keeps the blob when the wallet declines the cancel', async () => {
+    const acs: Record<string, unknown[]> = { [TOKEN]: [tokenRow('t1', '1500')] }
+    const funder = harness({ acs })
+    await funder.backend.createVesting(grant())
+    const declined = harness({ acs, declines: true })
+
+    await expect(
+      declined.backend.cancelProposal({ proposer: 'funder::1', pendingCid: 'pending-for-t1' }),
+    ).rejects.toThrow(/rejected/)
+
+    expect(storedTokens().map((one) => one.contractId)).toEqual(['funding-t1'])
+  })
+
+  // The other way round: the exit is already on the ledger, so a browser that refuses to write must
+  // not report a failure the funder would read as the grant surviving.
+  it('reports a cancel this browser cannot record as done', async () => {
+    const acs: Record<string, unknown[]> = { [TOKEN]: [tokenRow('t1', '1500')] }
+    const { backend } = harness({ acs })
+    await backend.createVesting(grant())
+    const setItem = vi.spyOn(Storage.prototype, 'setItem').mockImplementationOnce(() => {
+      throw new DOMException('storage is blocked', 'SecurityError')
+    })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    await expect(
+      backend.cancelProposal({ proposer: 'funder::1', pendingCid: 'pending-for-t1' }),
+    ).resolves.toBeUndefined()
+
+    expect(warn).toHaveBeenCalled()
+    setItem.mockRestore()
+    warn.mockRestore()
+  })
+
+  // Criterion 3, and it costs no ledger work: the holding is excluded only while a proposal names
+  // it, so archiving the proposal is what returns it.
+  it('returns the reserved holding to the funder’s balance', async () => {
+    const acs: Record<string, unknown[]> = { [TOKEN]: [tokenRow('t1', '1500')] }
+    const { backend } = harness({ acs })
+    await backend.createVesting(grant())
+    expect(await backend.balanceOf('funder::1')).toBe('500')
+
+    await backend.cancelProposal({ proposer: 'funder::1', pendingCid: 'pending-for-t1' })
+    // The harness settles only the factory choice, so the archive the participant would do is done
+    // here.
+    acs[PENDING] = []
+
+    expect(await backend.balanceOf('funder::1')).toBe('1500')
+  })
 })
 
 describe('LedgerBackend.viewAs', () => {
+  // Coerced to an empty list, a reply the participant could not have meant reads as a party that
+  // holds nothing and owns no grants: a blank dashboard for a failure, and the reconcile below
+  // unable to tell a reservation that is gone from one it never saw.
+  it('reports a reply that is not a list of contracts rather than reading it as an empty ACS', async () => {
+    const backend = new LedgerBackend(deployment, {
+      execute: async () => ({}),
+      ledgerApi: async (params) => {
+        const read = params as Read
+        return read.resource === '/v2/state/ledger-end' ? { offset: 42 } : { error: 'UNAVAILABLE' }
+      },
+    })
+
+    await expect(backend.viewAs('funder::1')).rejects.toThrow(/list of contracts/)
+  })
+
   it('reads all three templates as the connected party at one shared offset', async () => {
     const { backend, reads } = harness()
 
@@ -498,6 +911,8 @@ describe('LedgerBackend.viewAs', () => {
       acs: {
         [CONTRACT]: [
           row('c1', {
+            admin: 'instrument-admin::1',
+            instrumentId: 'DBT',
             provider: 'operator::1',
             creator: 'funder::1',
             receiver: 'receiver::1',
@@ -523,4 +938,224 @@ describe('LedgerBackend.viewAs', () => {
     const { backend } = harness({ ledgerEnd: {} })
     await expect(backend.viewAs('receiver::1')).rejects.toThrow(/did not return an offset/)
   })
+
+  // The reconcile is the funder's alone: only they can read the holding a grant reserves, so
+  // reading the holdings on a receiver's every poll would buy nothing.
+  it('leaves the holdings unread for a party whose pending grants are all incoming', async () => {
+    const acs: Record<string, unknown[]> = { [TOKEN]: [tokenRow('t1', '1500')] }
+    const funder = harness({ acs })
+    await funder.backend.createVesting({
+      proposer: 'funder::1',
+      receiver: 'receiver::1',
+      totalAmount: '1000',
+      schedule,
+      title: 'Advisor grant',
+    })
+    // Cleared, so the blob being absent is not what keeps the read away: the receiver could never
+    // supply it, and it is whose grant this is that decides.
+    localStorage.clear()
+    const { backend, reads } = harness({ acs })
+
+    await backend.viewAs('receiver::1')
+
+    expect(reads.filter((read) => filteredTemplate(read) === TOKEN)).toEqual([])
+  })
+
+  // A dashboard that goes blank because a background repair failed would be a worse bug than the
+  // one the repair is there for.
+  it('returns the view even when the holdings cannot be read back', async () => {
+    const acs: Record<string, unknown[]> = { [TOKEN]: [tokenRow('t1', '1500')] }
+    const funder = harness({ acs })
+    await funder.backend.createVesting({
+      proposer: 'funder::1',
+      receiver: 'receiver::1',
+      totalAmount: '1000',
+      schedule,
+      title: 'Advisor grant',
+    })
+    localStorage.clear()
+    const { backend } = harness({ acs, readsFailOnBlobs: true })
+
+    const view = await backend.viewAs('funder::1')
+
+    expect(view.pendingGrants.map((one) => one.title)).toEqual(['Advisor grant'])
+  })
+
+  // Nothing on-ledger stops a funder spending the reserved holding through their wallet, which
+  // leaves a grant nobody can accept. The read that would find it carries a blob per holding, so it
+  // is given up on rather than paid for on every view from then on.
+  it('stops reading the holdings for a reservation that never turns up', async () => {
+    const { backend, reads } = harness({
+      acs: { [TOKEN]: [tokenRow('t1', '500')], [PENDING]: [reserving('archived-elsewhere')] },
+    })
+
+    for (let view = 0; view < 5; view++) {
+      await backend.viewAs('funder::1')
+    }
+
+    expect(reads.filter((read) => filteredTemplate(read) === TOKEN)).toHaveLength(3)
+  })
+
+  // The bound stops a read this browser cannot satisfy costing one per view; it must not also mean
+  // the grant is unacceptable for good, so a receiver asking for it is what buys the reads back.
+  it('looks again once a receiver has asked for a grant it gave up on', async () => {
+    const acs: Record<string, unknown[]> = {
+      [TOKEN]: [tokenRow('t1', '500')],
+      [PENDING]: [reserving('archived-elsewhere')],
+    }
+    const { backend, reads } = harness({ acs })
+    const tokenReads = (): number => reads.filter((read) => filteredTemplate(read) === TOKEN).length
+    for (let view = 0; view < 5; view++) {
+      await backend.viewAs('funder::1')
+    }
+    expect(tokenReads()).toBe(3)
+
+    await expect(
+      backend.accept({ receiver: 'receiver::1', pendingCid: 'pending-archived-elsewhere' }),
+    ).rejects.toThrow(/not disclosable/)
+    await backend.viewAs('funder::1')
+
+    expect(tokenReads()).toBe(4)
+  })
+
+  // The state the bound exists for: the reservation is gone and the funder holds nothing else, so
+  // an empty read is the only answer they will ever get. `readAcs` throws rather than answering
+  // `[]` for a reply it could not read, so this is a real answer and counts like any other.
+  it('spends that budget on a read that came back empty, and no more', async () => {
+    const { backend, reads } = harness({ acs: { [PENDING]: [reserving('archived-elsewhere')] } })
+
+    for (let view = 0; view < 5; view++) {
+      await backend.viewAs('funder::1')
+    }
+
+    expect(reads.filter((read) => filteredTemplate(read) === TOKEN)).toHaveLength(3)
+  })
+
+  // A holding whose blob the read did not carry is as unusable as one that never came back: nothing
+  // can be stored for it, so treating it as found would leave it wanted for good and never reach
+  // the limit that stops the read.
+  it('counts a holding that comes back without its blob as a miss', async () => {
+    const blobless = {
+      contractEntry: {
+        JsActiveContract: {
+          createdEvent: {
+            contractId: 'reserved',
+            createArgument: { admin: 'instrument-admin::1', instrumentId: 'DBT', amount: '1000' },
+          },
+        },
+      },
+    }
+    const { backend, reads } = harness({
+      acs: { [TOKEN]: [blobless], [PENDING]: [reserving('reserved')] },
+    })
+
+    for (let view = 0; view < 5; view++) {
+      await backend.viewAs('funder::1')
+    }
+
+    expect(reads.filter((read) => filteredTemplate(read) === TOKEN)).toHaveLength(3)
+  })
+
+  // Two reconciles can be in flight at once, a dashboard refresh alongside a fresh grant, and each
+  // decides what it is missing before either has written. Appending what it found would store the
+  // same blob twice, and nothing else bounds the store.
+  it('keeps one blob per holding when two reconciles overlap', async () => {
+    const acs: Record<string, unknown[]> = { [TOKEN]: [tokenRow('t1', '1500')] }
+    const funder = harness({ acs })
+    await funder.backend.createVesting({
+      proposer: 'funder::1',
+      receiver: 'receiver::1',
+      totalAmount: '1000',
+      schedule,
+      title: 'Advisor grant',
+    })
+    localStorage.clear()
+    const { backend } = harness({ acs })
+
+    await Promise.all([backend.viewAs('funder::1'), backend.viewAs('funder::1')])
+
+    expect(storedTokens().map((one) => one.contractId)).toEqual(['funding-t1'])
+  })
+
+  // The proposal now stores the admin and the instrument it is denominated in, so a pending grant
+  // is filtered like the other two rather than taken on trust.
+  it('drops pending grants of another instrument', async () => {
+    const pending = (contractId: string, admin: string): unknown =>
+      row(contractId, {
+        admin,
+        instrumentId: 'DBT',
+        provider: 'operator::1',
+        proposer: 'funder::1',
+        receiver: 'receiver::1',
+        totalAmount: '1000',
+        tokenCid: 'funding',
+        schedule: encodeSchedule(schedule),
+        note: 'Advisor grant',
+      })
+    const { backend } = harness({
+      acs: { [PENDING]: [pending('mine', 'instrument-admin::1'), pending('theirs', 'other::1')] },
+    })
+
+    const view = await backend.viewAs('receiver::1')
+
+    expect(view.pendingGrants.map((one) => one.id)).toEqual(['mine'])
+  })
+
+  // The instrument a grant is denominated in comes from the holdings it was funded from, so a
+  // deployment pointed at another one sees its own grants and not an empty dashboard.
+  it('keeps a grant funded under the deployment’s own instrument', async () => {
+    const instrument = { admin: 'other::1', instrumentId: 'XYZ' }
+    const { backend } = harness({
+      acs: { [TOKEN]: [tokenRow('t1', '1500', instrument)] },
+      deployment: { ...deployment, ...instrument },
+    })
+    await backend.createVesting({
+      proposer: 'funder::1',
+      receiver: 'receiver::1',
+      totalAmount: '1000',
+      schedule,
+      title: 'Advisor grant',
+    })
+
+    const view = await backend.viewAs('funder::1')
+
+    expect(view.pendingGrants.map((one) => one.title)).toEqual(['Advisor grant'])
+  })
+
+  // A shared participant can carry another admin's grants under the same package, and rendering one
+  // under this deployment's symbol would be a lie about what it holds.
+  it('drops grants and claims of another instrument', async () => {
+    const { backend } = harness({
+      acs: {
+        [CONTRACT]: [
+          row('mine', {
+            admin: 'instrument-admin::1',
+            instrumentId: 'DBT',
+            provider: 'operator::1',
+            creator: 'funder::1',
+            receiver: 'receiver::1',
+            totalAmount: '1000',
+            alreadyWithdrawn: '0',
+            schedule: encodeSchedule(schedule),
+            note: 'Mine',
+          }),
+          row('theirs', {
+            admin: 'other::1',
+            instrumentId: 'DBT',
+            provider: 'operator::1',
+            creator: 'funder::1',
+            receiver: 'receiver::1',
+            totalAmount: '1000',
+            alreadyWithdrawn: '0',
+            schedule: encodeSchedule(schedule),
+            note: 'Theirs',
+          }),
+        ],
+      },
+    })
+
+    const view = await backend.viewAs('receiver::1')
+
+    expect(view.grants.map((one) => one.id)).toEqual(['mine'])
+  })
 })
diff --git a/dapp/frontend/src/backend/LedgerBackend.ts b/dapp/frontend/src/backend/LedgerBackend.ts
index 0da5b5ee..5be4ca9a 100644
--- a/dapp/frontend/src/backend/LedgerBackend.ts
+++ b/dapp/frontend/src/backend/LedgerBackend.ts
@@ -1,44 +1,51 @@
-// The VestingBackend over the amulet-vesting templates, reached through the connected wallet: reads
-// go out as the connected party, writes come back with a real approval prompt.
+// The VestingBackend over the canton-vesting-forge templates, reached through the connected wallet:
+// reads go out as the connected party, writes come back with a real approval prompt.
 
 import {
   buildAcceptCommand,
   buildCancelCommand,
+  buildCancelProposalCommand,
   buildClaimResidualCommand,
   buildCreateVestingCommand,
-  buildSplitCommand,
+  buildRejectProposalCommand,
   buildTapCommand,
   buildWithdrawCommand,
 } from '@/backend/commands'
 import type { Deployment } from '@/backend/config'
-import { type AppTransferContext, fetchTransferContext } from '@/backend/transferContext'
+import {
+  fetchInstrumentConfig,
+  type InstrumentConfigRef,
+  type RegistryInstrument,
+} from '@/backend/registry'
 import {
   type AcsRow,
-  amuletDso,
-  amuletValue,
   type ClaimRecord,
   type CreateVestInput,
   claimChain,
   composeNote,
+  fundedBy,
   lastUpdateOffset,
-  pledgedAmulets,
+  matchesInstrument,
+  reservedToken,
   rowToClaim,
   rowToGrant,
   rowToPendingGrant,
+  selectHoldings,
+  tokenValue,
   updatesToClaims,
   type VestingBackend,
   type VestingView,
 } from '@/backend/VestingBackend'
 import type { DisclosedContract, LedgerCommand, WalletFns } from '@/backend/wallet'
-import { addAmounts, canonicalAmount, compareAmounts } from '@/utils/amount'
+import { addAmounts } from '@/utils/amount'
 
 const mapRows = <T>(rows: AcsRow[], mapper: (row: AcsRow) => T | undefined): T[] =>
   rows.map(mapper).filter((value): value is T => value !== undefined)
 
 // A filter takes the package-name reference; the participant rejects the resolved id a command
 // carries with INVALID_FIELD.
-const vesting = (entity: string): string => `#amulet-vesting:AmuletVesting:${entity}`
-const AMULET = '#splice-amulet:Splice.Amulet:Amulet'
+const vesting = (entity: string): string => `#vesting:Vesting:${entity}`
+const TOKEN = '#canton-token-forge:Canton.TokenForge.Token:Token'
 
 // The JSON Ledger API's party/template filter, shared by the ACS read and the update stream. Built
 // in one place because a typo in this nesting yields a silent empty read rather than an error.
@@ -67,20 +74,41 @@ const STREAM_IDLE_MS = 1000
 // Bounded so an offset that fails to advance cannot spin.
 const CLAIM_HISTORY_PAGES = 20
 
-// Accept locks the funder's Amulets, which the receiver is no stakeholder of and so cannot read the
-// disclosure blobs for. They are kept here as the funder submits the pending grant. Persisted, because
-// the two parties are two wallet accounts and switching between them reloads the app.
-const AMULET_STORE_KEY = 'vesting.amuletDisclosures'
+// Accept locks the holding a grant reserves, which the receiver is no stakeholder of and so cannot
+// read the disclosure blob for. It is kept here as the funder submits the pending grant. Persisted,
+// because the two parties are two wallet accounts and switching between them reloads the app.
+const TOKEN_STORE_KEY = 'vesting.tokenDisclosures'
+// How often a reservation this browser cannot find is looked for again, counted across reloads. The
+// read that answers it carries a blob per holding and runs on the funder's dashboard, so a holding
+// archived outside this dApp would otherwise cost that read on every view forever, for a grant
+// nobody can accept any more. Counted rather than given up on the first miss, because a read that
+// answers short is indistinguishable from one that answers in full.
+const MISS_STORE_KEY = 'vesting.tokenReadMisses'
+const MISS_LIMIT = 3
+
+// Shared by every exit that finds its proposal already gone, so the wording cannot drift between them.
+const PROPOSAL_GONE_MESSAGE = 'this grant is no longer outstanding: reload to see where it went'
 
-const storedAmulets = (): DisclosedContract[] => {
+const storedTokens = (): DisclosedContract[] => {
   try {
-    const stored = JSON.parse(localStorage.getItem(AMULET_STORE_KEY) ?? '[]')
-    return Array.isArray(stored) ? stored : []
+    const stored = JSON.parse(localStorage.getItem(TOKEN_STORE_KEY) ?? '[]')
+    return Array.isArray(stored) ? (stored as DisclosedContract[]) : []
   } catch {
     return []
   }
 }
 
+const readMisses = (): Record<string, number> => {
+  try {
+    const stored: unknown = JSON.parse(localStorage.getItem(MISS_STORE_KEY) ?? '{}')
+    return typeof stored === 'object' && stored !== null && !Array.isArray(stored)
+      ? (stored as Record<string, number>)
+      : {}
+  } catch {
+    return {}
+  }
+}
+
 const cidOf = (row: AcsRow): string =>
   row.contractEntry?.JsActiveContract?.createdEvent?.contractId ?? ''
 
@@ -92,26 +120,129 @@ const rowToDisclosed = (row: AcsRow): DisclosedContract | undefined => {
     : { templateId, contractId, createdEventBlob }
 }
 
+// The holdings this party's own outstanding grants reserve that this browser has neither a blob for
+// nor given up on. Empty is the common answer, which is what lets the caller skip reading the
+// holdings at all.
+const unstoredReservations = (party: string, pendingRows: AcsRow[]): Set<string> => {
+  const known = new Set(storedTokens().map((one) => one.contractId))
+  const misses = readMisses()
+  const reserved = mapRows(
+    pendingRows.filter((row) => fundedBy(row, party)),
+    reservedToken,
+  )
+  return new Set(
+    reserved.filter(
+      (contractId) => !known.has(contractId) && (misses[contractId] ?? 0) < MISS_LIMIT,
+    ),
+  )
+}
+
+// Merged by contract id rather than appended, because two reconciles can overlap, a dashboard
+// refresh racing a fresh grant, and each computes what it is missing from a store snapshot taken
+// before its own read. Answers with what it stored, which is what a miss is counted against.
+const storeTokens = (held: AcsRow[], wanted: Set<string>): Set<string> => {
+  const missing = mapRows(
+    held.filter((row) => wanted.has(cidOf(row))),
+    rowToDisclosed,
+  )
+  if (missing.length === 0) {
+    return new Set()
+  }
+  const merged = new Map(storedTokens().map((one) => [one.contractId, one]))
+  for (const one of missing) {
+    merged.set(one.contractId, one)
+  }
+  localStorage.setItem(TOKEN_STORE_KEY, JSON.stringify([...merged.values()]))
+  return new Set(missing.map((one) => one.contractId))
+}
+
+// Counted against what was stored rather than against what came back, because a holding that
+// arrives without its blob is as unusable as one that never arrived: calling it found would leave
+// it wanted with no miss ever recorded, and so no bound on the read it costs.
+const recordMisses = (wanted: Set<string>, stored: Set<string>): void => {
+  const missed = [...wanted].filter((contractId) => !stored.has(contractId))
+  if (missed.length === 0) {
+    return
+  }
+  const misses = readMisses()
+  const bumped = Object.fromEntries(missed.map((one) => [one, (misses[one] ?? 0) + 1]))
+  const abandoned = Object.entries(bumped).filter(([, count]) => count === MISS_LIMIT)
+  if (abandoned.length > 0) {
+    console.warn(
+      'giving up on the holdings these grants reserve: they cannot be accepted from this browser',
+      abandoned.map(([contractId]) => contractId),
+    )
+  }
+  localStorage.setItem(MISS_STORE_KEY, JSON.stringify({ ...misses, ...bumped }))
+}
+
+const dropMiss = (tokenCid: string): void => {
+  const kept = Object.entries(readMisses()).filter(([contractId]) => contractId !== tokenCid)
+  localStorage.setItem(MISS_STORE_KEY, JSON.stringify(Object.fromEntries(kept)))
+}
+
+// Puts a reservation this browser has given up on back in front of the reconcile. The bound exists
+// so that a holding nobody can find stops costing a blob-bearing read on every view, not so that a
+// read which came back short once leaves a live grant unacceptable until site data is wiped.
+const retryFunding = (tokenCid: string): void => {
+  try {
+    dropMiss(tokenCid)
+  } catch (cause: unknown) {
+    console.warn('could not reset the read count for the holding a grant reserves', cause)
+  }
+}
+
+// What a grant leaves in this browser once it can no longer be accepted: the blob its Accept would
+// have disclosed, and the count of reads spent looking for that holding. Both are keyed by the
+// holding, so both go whichever way the grant ended. Every caller runs after its submission has
+// landed, so a browser refusing to write must not turn a committed exit into a reported failure:
+// what is left behind names a proposal that no longer exists and can only mislead a later Accept,
+// which already says so on its own.
+const forgetFunding = (tokenCid: string | undefined): void => {
+  if (tokenCid === undefined) {
+    return
+  }
+  try {
+    localStorage.setItem(
+      TOKEN_STORE_KEY,
+      JSON.stringify(storedTokens().filter((one) => one.contractId !== tokenCid)),
+    )
+    dropMiss(tokenCid)
+  } catch (cause: unknown) {
+    console.warn('could not forget what this browser kept for a grant that has ended', cause)
+  }
+}
+
 export class LedgerBackend implements VestingBackend {
   private readonly wallet: WalletFns
   private readonly factory: DisclosedContract
+  private readonly instrument: RegistryInstrument
   private readonly synchronizerId: string | undefined
   private readonly pkg: string
+  // The registry's answer to the same question, kept from the last write that fetched a config, for
+  // the two exits that fetch none and would otherwise name no synchronizer at all.
+  private fromRegistry: string | undefined
 
   constructor(deployment: Deployment, wallet: WalletFns) {
     this.wallet = wallet
     this.synchronizerId = deployment.synchronizerId
     this.pkg = deployment.pkg
+    this.instrument = { admin: deployment.admin, instrumentId: deployment.instrumentId }
     this.factory = {
-      templateId: this.tid('AmuletVestingFactory'),
+      templateId: this.tid('VestingFactory'),
       contractId: deployment.factoryCid,
       createdEventBlob: deployment.factoryBlob,
+      // Its own deployment's, never the submission's: nothing else knows where this contract lives,
+      // so a deployment that reports none must leave the participant to resolve it.
+      ...(deployment.synchronizerId === undefined
+        ? {}
+        : { synchronizerId: deployment.synchronizerId }),
     }
   }
 
   // The resolved-id twin of `vesting()`: a command carries this spelling, a filter the other one.
   private tid(entity: string): string {
-    return `${this.pkg}:AmuletVesting:${entity}`
+    return `${this.pkg}:Vesting:${entity}`
   }
 
   private async ledgerEnd(): Promise<string | number> {
@@ -140,142 +271,195 @@ export class LedgerBackend implements VestingBackend {
         verbose: true,
       },
     })
-    return Array.isArray(rows) ? rows : []
+    // An answer that is not a list is a failure, not an empty ACS. Coercing it to `[]` made "this
+    // party holds nothing" and "the read did not work" one answer, which is what left the reconcile
+    // below unable to tell a reservation that is gone from one it simply failed to see.
+    if (!Array.isArray(rows)) {
+      throw new Error(`the participant did not answer ${templateId} with a list of contracts`)
+    }
+    return rows
   }
 
   // actAs is explicit rather than left to the wallet's primary account, so a submission that would
   // be signed by the wrong key is rejected by the participant instead of silently reassigned. The
-  // synchronizer is a property of the submission, so it is stamped here and nowhere the disclosures
-  // are built.
+  // synchronizer goes on the submission as well, because a write that discloses nothing would
+  // otherwise reach a wallet on more than one synchronizer with none named and land on its default.
   private submit(
     actAs: string,
     command: LedgerCommand,
     disclosed: DisclosedContract[],
+    sync: string | undefined = this.synchronizerId ?? this.fromRegistry,
   ): Promise<unknown> {
-    const sync = this.synchronizerId
     return this.wallet.execute({
       actAs: [actAs],
       readAs: [actAs],
       commands: [command],
-      disclosedContracts:
-        sync === undefined ? disclosed : disclosed.map((one) => ({ ...one, synchronizerId: sync })),
+      ...(sync === undefined ? {} : { synchronizerId: sync }),
+      // Filled from the deployment alone, and only where whoever built the disclosure named none:
+      // the registry vouches for its own config and for nothing else, so a fallback to its answer
+      // must not travel onto a blob it has never seen. The participant resolves an unstamped one.
+      disclosedContracts: disclosed.map((one) =>
+        one.synchronizerId === undefined && this.synchronizerId !== undefined
+          ? { ...one, synchronizerId: this.synchronizerId }
+          : one,
+      ),
     })
   }
 
-  // What is free to fund a grant, which is the same set `splitOff` will spend and not simply what
-  // the party holds: coin already escrowed is a LockedAmulet and so out by template, and coin an
-  // outstanding grant pledged is out because spending it would leave that grant unacceptable.
-  // Offering more than this would put an amount in the field that the next step always refuses.
+  // What is free to fund a grant, and not simply what the party holds: a holding already escrowed is
+  // a LockedToken and so out by template, and the holding an outstanding grant reserves is out
+  // because spending it would leave that grant unacceptable. Offering more than this would put an
+  // amount in the field that the next step always refuses.
   async balanceOf(partyId: string): Promise<string> {
-    const { free } = await this.freeAmulets(partyId)
-    return addAmounts(...free.map(amuletValue))
+    const free = await this.freeTokens(partyId)
+    return addAmounts(...free.map(tokenValue))
   }
 
   async viewAs(partyId: string): Promise<VestingView> {
     // One ledger-end fetch for all three reads, so they share a consistent snapshot offset.
     const offset = await this.ledgerEnd()
     const [pendingGrantRows, contractRows, claimRows] = await Promise.all([
-      this.readAcs(partyId, vesting('AmuletVestingProposal'), offset),
-      this.readAcs(partyId, vesting('AmuletVestingContract'), offset),
-      this.readAcs(partyId, vesting('AmuletVestedClaim'), offset),
+      this.readAcs(partyId, vesting('VestingProposal'), offset),
+      this.readAcs(partyId, vesting('VestingContract'), offset),
+      this.readAcs(partyId, vesting('VestedClaim'), offset),
     ])
+    // The funder's own view is the one place a grant whose blob never got recorded is seen again,
+    // so it is also where that is repaired: without it a funder who makes one grant and stops has
+    // an unacceptable grant and no way to notice. A failure here must not blank the dashboard.
+    await this.storeFunding(partyId, offset, pendingGrantRows).catch((cause: unknown) => {
+      console.warn('could not read back the holdings this party’s grants reserve', cause)
+    })
     return {
-      pendingGrants: mapRows(pendingGrantRows, rowToPendingGrant),
-      grants: mapRows(contractRows, rowToGrant),
-      claims: mapRows(claimRows, rowToClaim),
+      pendingGrants: mapRows(this.ofInstrument(pendingGrantRows), rowToPendingGrant),
+      grants: mapRows(this.ofInstrument(contractRows), rowToGrant),
+      claims: mapRows(this.ofInstrument(claimRows), rowToClaim),
     }
   }
 
-  // Two submissions, so two wallet approvals: a grant has to name an Amulet nothing else pledged,
-  // and one Daml transaction cannot feed a contract that one command creates into the next. So the
-  // funder splits exactly `totalAmount` off its unpledged holdings, and the grant names only what
-  // the split produced. The factory is the operator's and observer-less, so the funder cannot read
-  // it and its disclosure comes from the deployment.
+  // One submission, so one wallet approval: the factory splits the funder's inputs down to the grant
+  // and hands the change back in the same transaction, so the funder never pre-splits the way the
+  // Amulet version had to. The factory is the operator's and observer-less, so the funder cannot
+  // read it and its disclosure comes from the deployment.
   async createVesting(args: CreateVestInput): Promise<void> {
-    const escrow = await this.splitOff(args.proposer, args.totalAmount)
-    const command = buildCreateVestingCommand(this.factory.templateId, this.factory.contractId, {
-      proposer: args.proposer,
-      receiver: args.receiver,
-      totalAmount: args.totalAmount,
-      schedule: args.schedule,
-      amuletCids: [escrow.contractId],
-      note: composeNote(args.title, args.note),
+    const free = await this.freeTokens(args.proposer)
+    const picked = selectHoldings(free, args.totalAmount)
+    if (picked === undefined) {
+      throw new Error(
+        `only ${addAmounts(...free.map(tokenValue))} ${this.instrument.instrumentId} is free to fund this grant`,
+      )
+    }
+    await this.submitWithConfig(
+      args.proposer,
+      ({ configCid }) =>
+        buildCreateVestingCommand(this.factory.templateId, this.factory.contractId, {
+          configCid,
+          proposer: args.proposer,
+          receiver: args.receiver,
+          totalAmount: args.totalAmount,
+          schedule: args.schedule,
+          tokenCids: picked.map(cidOf),
+          note: composeNote(args.title, args.note),
+        }),
+      [this.factory],
+    )
+    // The grant is on the ledger by now, so a failure to record the blob must not report one: it
+    // would invite the funder to make a second grant, and `accept` is where a missing blob is felt
+    // and said. Logged rather than swallowed outright, because the next reconcile is what repairs
+    // it and nothing else would say one was needed.
+    await this.reconcileFunding(args.proposer).catch((cause: unknown) => {
+      console.warn('could not read back the holding this grant reserves', cause)
     })
-    await this.submit(args.proposer, command, [this.factory])
-    // After the submit, not before: a grant the wallet declined must not leave blobs behind for an
-    // Amulet no grant is waiting on. Appended rather than replacing, because every outstanding
-    // grant's own Amulet has to stay disclosable.
-    localStorage.setItem(AMULET_STORE_KEY, JSON.stringify([...storedAmulets(), escrow]))
   }
 
-  // A transfer consumes everything it is given, so an Amulet an outstanding grant pledged has to
-  // stay out of one: consuming it is exactly what leaves that grant unacceptable. `held` is the
-  // whole set, which is what tells a later read which Amulets are new.
-  private async freeAmulets(owner: string): Promise<{ free: AcsRow[]; held: AcsRow[] }> {
+  // The receiver has to disclose the holding a grant reserves, and only the funder can read it: a
+  // `Token` has no observers. Every outstanding grant of this funder is reconciled rather than just
+  // the one just made, so a read that failed once is repaired by their next grant or their next
+  // dashboard load instead of leaving a grant nobody can accept. The holdings are read only when
+  // something is actually missing, since this runs on every view, and a reservation the read keeps
+  // not answering is given up on so that this cannot become a read on every view for good.
+  private async storeFunding(
+    party: string,
+    offset: string | number,
+    pendingRows: AcsRow[],
+  ): Promise<void> {
+    const wanted = unstoredReservations(party, pendingRows)
+    if (wanted.size === 0) {
+      return
+    }
+    const held = await this.readAcs(party, TOKEN, offset, true)
+    // An empty read counts like any other: it is the answer a funder who no longer holds the
+    // reservation gets, and it is the only one they ever get, so skipping it left the bound below
+    // unreachable in exactly the case it exists for. What keeps that from condemning a grant whose
+    // read was merely short is `retryFunding`, which the receiver's own Accept reaches.
+    recordMisses(wanted, storeTokens(held, wanted))
+  }
+
+  // Reconciles against a snapshot of its own, for a caller that has read no rows to hand over.
+  // Taken after the submit, never before, because the factory creates the holding in that very
+  // submission and a grant the wallet declined must leave no blob behind.
+  private async reconcileFunding(party: string): Promise<void> {
+    const offset = await this.ledgerEnd()
+    const pendingRows = await this.readAcs(party, vesting('VestingProposal'), offset)
+    await this.storeFunding(party, offset, pendingRows)
+  }
+
+  async tap(args: { amount: string; party: string }): Promise<void> {
+    await this.submitWithConfig(args.party, ({ configCid, configTemplateId }) =>
+      buildTapCommand(configTemplateId, configCid, { amount: args.amount, user: args.party }),
+    )
+  }
+
+  // A transfer consumes every holding it is given, so the one an outstanding grant reserves has to
+  // stay out: consuming it is exactly what leaves that grant unacceptable.
+  private async freeTokens(owner: string): Promise<AcsRow[]> {
     const offset = await this.ledgerEnd()
     const [held, pendingRows] = await Promise.all([
-      this.readAcs(owner, AMULET, offset),
-      this.readAcs(owner, vesting('AmuletVestingProposal'), offset),
+      this.readAcs(owner, TOKEN, offset),
+      this.readAcs(owner, vesting('VestingProposal'), offset),
     ])
-    const pledged = new Set(pendingRows.flatMap(pledgedAmulets))
-    return { free: held.filter((row) => !pledged.has(cidOf(row))), held }
+    const reserved = new Set(pendingRows.map(reservedToken))
+    return held.filter(
+      (row) => matchesInstrument(row, this.instrument) && !reserved.has(cidOf(row)),
+    )
+  }
+
+  private ofInstrument(rows: AcsRow[]): AcsRow[] {
+    return rows.filter((row) => matchesInstrument(row, this.instrument))
   }
 
-  // Every Amulet-moving choice takes the same context and the same two disclosures, so the
-  // invariant is held here rather than re-spelled per choice; `extra` is what only Accept adds.
-  private async submitWithContext(
+  // Every choice that moves a holding takes the same config and the same one disclosure, so the
+  // invariant is held here rather than re-spelled per choice; `extra` is what only create and
+  // Accept add. It answers with what it disclosed, which only create has a use for.
+  private async submitWithConfig(
     actAs: string,
-    build: (ctx: AppTransferContext, rulesTemplateId: string) => LedgerCommand,
+    build: (config: InstrumentConfigRef) => LedgerCommand,
     extra: DisclosedContract[] = [],
-  ): Promise<void> {
-    const { ctx, disclosed, rulesTemplateId } = await fetchTransferContext(actAs)
-    await this.submit(actAs, build(ctx, rulesTemplateId), [...disclosed, ...extra])
+  ): Promise<DisclosedContract[]> {
+    const { disclosed, synchronizerId, ...config } = await fetchInstrumentConfig(
+      actAs,
+      this.instrument,
+    )
+    const sent = [...disclosed, ...extra]
+    await this.submit(actAs, build(config), sent, this.agreedSynchronizer(synchronizerId))
+    return sent
   }
 
-  // Self-transfers `amount` into an Amulet of the funder's own and returns it, disclosure blob
-  // included. The result is found by re-reading rather than off the submission, which reports an
-  // update id and nothing about what it created.
-  private async splitOff(owner: string, amount: string): Promise<DisclosedContract> {
-    const [{ free, held }, { ctx, disclosed, rulesTemplateId }] = await Promise.all([
-      this.freeAmulets(owner),
-      fetchTransferContext(owner),
-    ])
-    const freeTotal = addAmounts(...free.map(amuletValue))
-    if (compareAmounts(freeTotal, amount) < 0) {
+  // One submission names one synchronizer, and the two contracts it needs are stamped by two
+  // different sources: the registry stamps the config it discloses, the deployment carries the
+  // factory's. The app assumes they agree, so a disagreement is said here rather than sent as a
+  // submission the participant refuses without naming either.
+  private agreedSynchronizer(fromConfig: string | undefined): string | undefined {
+    if (
+      fromConfig !== undefined &&
+      this.synchronizerId !== undefined &&
+      fromConfig !== this.synchronizerId
+    ) {
       throw new Error(
-        `only ${freeTotal} AMT is free to fund this grant — the rest is pledged to a pending one`,
+        `the registry's InstrumentConfig is on synchronizer ${fromConfig} and the vesting factory on ${this.synchronizerId}: this dApp needs both on one`,
       )
     }
-    const dso = free.map(amuletDso).find((party) => party !== undefined)
-    if (dso === undefined) {
-      throw new Error('the Amulets funding this grant name no DSO party')
-    }
-
-    await this.submit(
-      owner,
-      buildSplitCommand(rulesTemplateId, ctx.amuletRules, {
-        amount,
-        amuletCids: free.map(cidOf),
-        dso,
-        openMiningRound: ctx.openMiningRound,
-        owner,
-      }),
-      disclosed,
-    )
-
-    // The split archives every input, so anything of the right size that was not there before is
-    // one of its two outputs and pledged to nothing.
-    const before = new Set(held.map(cidOf))
-    const wanted = canonicalAmount(amount)
-    const after = await this.readAcs(owner, AMULET, await this.ledgerEnd(), true)
-    const created = after.find(
-      (row) => !before.has(cidOf(row)) && canonicalAmount(amuletValue(row)) === wanted,
-    )
-    const disclosure = created === undefined ? undefined : rowToDisclosed(created)
-    if (disclosure === undefined) {
-      throw new Error('the split produced no Amulet of the grant amount')
-    }
-    return disclosure
+    this.fromRegistry = fromConfig ?? this.fromRegistry
+    return this.synchronizerId ?? fromConfig
   }
 
   // `TRANSACTION_SHAPE_LEDGER_EFFECTS` is what carries the exercise; the default ACS-delta shape
@@ -297,7 +481,7 @@ export class LedgerBackend implements VestingBackend {
             transactionShape: 'TRANSACTION_SHAPE_LEDGER_EFFECTS',
             eventFormat: {
               verbose: true,
-              ...templateFilter(partyId, vesting('AmuletVestingContract')),
+              ...templateFilter(partyId, vesting('VestingContract')),
             },
           },
         },
@@ -315,7 +499,7 @@ export class LedgerBackend implements VestingBackend {
     let beginExclusive: string | number = 0
     for (let page = 0; page < CLAIM_HISTORY_PAGES; page++) {
       const updates = await this.readUpdates(partyId, beginExclusive, endInclusive)
-      records.push(...updatesToClaims(updates))
+      records.push(...updatesToClaims(updates, this.instrument, this.tid('VestingContract')))
       const last = lastUpdateOffset(updates)
       if (!Array.isArray(updates) || updates.length < CLAIM_HISTORY_LIMIT || last === undefined) {
         break
@@ -325,57 +509,95 @@ export class LedgerBackend implements VestingBackend {
     return claimChain(records, contractCid)
   }
 
-  // The grant names the Amulet its Accept locks, and the receiver is an observer of the grant, so
+  // The grant names the holding its Accept locks, and the receiver is an observer of the grant, so
   // which blob to send is read off the ledger rather than guessed at. Sending the whole store
-  // instead would re-disclose Amulets earlier accepts already consumed, and would leave the guard
-  // below unable to tell a missing blob from an unrelated one.
+  // instead would re-disclose holdings earlier accepts already consumed, which the participant
+  // rejects.
   async accept(args: { receiver: string; pendingCid: string }): Promise<void> {
-    const offset = await this.ledgerEnd()
-    const rows = await this.readAcs(args.receiver, vesting('AmuletVestingProposal'), offset)
-    const wanted = new Set(
-      rows.filter((row) => cidOf(row) === args.pendingCid).flatMap(pledgedAmulets),
-    )
-    const amulets = storedAmulets().filter((amulet) => wanted.has(amulet.contractId))
-    if (wanted.size === 0 || amulets.length !== wanted.size) {
-      throw new Error('the funder Amulets this grant locks are not disclosable from this browser')
+    const proposal = await this.findProposal(args.receiver, args.pendingCid)
+    // Two different failures, and pointing a stale view at the blob store would send the receiver
+    // hunting for a browser that never had anything to do with it.
+    if (proposal === undefined) {
+      throw new Error(PROPOSAL_GONE_MESSAGE)
+    }
+    const wanted = reservedToken(proposal)
+    const token = storedTokens().find((one) => one.contractId === wanted)
+    if (wanted === undefined || token === undefined) {
+      // A receiver asking for a grant this browser gave up finding the funding for is the one signal
+      // that it is worth another look, so the funder's next view gets its read budget back.
+      if (wanted !== undefined) {
+        retryFunding(wanted)
+      }
+      throw new Error('the funder holding this grant locks is not disclosable from this browser')
     }
-    await this.submitWithContext(
+    await this.submitWithConfig(
       args.receiver,
-      (ctx) => buildAcceptCommand(this.tid('AmuletVestingProposal'), args.pendingCid, ctx),
-      amulets,
-    )
-    // The submission archived them, so their blobs can only mislead a later Accept from here on.
-    localStorage.setItem(
-      AMULET_STORE_KEY,
-      JSON.stringify(storedAmulets().filter((amulet) => !wanted.has(amulet.contractId))),
+      ({ configCid }) =>
+        buildAcceptCommand(this.tid('VestingProposal'), args.pendingCid, configCid),
+      [token],
     )
+    // The submission archived the proposal, so nothing this browser kept for it can do anything but
+    // mislead a later Accept.
+    forgetFunding(wanted)
+  }
+
+  // Neither exit moves anything, so neither takes the config or discloses a contract: the proposal
+  // is archived on its controller's own authority and the holding it reserved is already an
+  // ordinary Token of the funder's, back in their balance as soon as nothing names it.
+  private endProposal(
+    party: string,
+    pendingCid: string,
+    build: (templateId: string, pendingCid: string) => LedgerCommand,
+  ): Promise<unknown> {
+    return this.submit(party, build(this.tid('VestingProposal'), pendingCid), [])
+  }
+
+  // Read before the archive for the holding the proposal names, since reading it after would be too
+  // late.
+  async cancelProposal(args: { proposer: string; pendingCid: string }): Promise<void> {
+    const proposal = await this.findProposal(args.proposer, args.pendingCid)
+    if (proposal === undefined) {
+      throw new Error(PROPOSAL_GONE_MESSAGE)
+    }
+    await this.endProposal(args.proposer, args.pendingCid, buildCancelProposalCommand)
+    // Only once the submission has landed: a prompt the wallet declines leaves a grant that is
+    // still outstanding and still acceptable.
+    forgetFunding(reservedToken(proposal))
+  }
+
+  // The two parties are two accounts of one browser, so a grant this receiver declines can be one
+  // this same browser funded and still holds the blob for. Read like the cancel above, but never
+  // guarded on: the receiver is not who the prune is for, so a read that fails must cost them a
+  // stale entry rather than a decline they cannot make.
+  async rejectProposal(args: { receiver: string; pendingCid: string }): Promise<void> {
+    const proposal = await this.findProposal(args.receiver, args.pendingCid).catch(() => undefined)
+    await this.endProposal(args.receiver, args.pendingCid, buildRejectProposalCommand)
+    forgetFunding(proposal === undefined ? undefined : reservedToken(proposal))
+  }
+
+  // One proposal by id, for the three exits that each need its row before archiving it: accept for
+  // the holding to disclose, cancel and decline for the holding to forget.
+  private async findProposal(party: string, pendingCid: string): Promise<AcsRow | undefined> {
+    const offset = await this.ledgerEnd()
+    const rows = await this.readAcs(party, vesting('VestingProposal'), offset)
+    return rows.find((row) => cidOf(row) === pendingCid)
   }
 
   async withdraw(args: { receiver: string; contractCid: string; amount: string }): Promise<void> {
-    await this.submitWithContext(args.receiver, (ctx) =>
-      buildWithdrawCommand(this.tid('AmuletVestingContract'), args.contractCid, args.amount, ctx),
+    await this.submitWithConfig(args.receiver, ({ configCid }) =>
+      buildWithdrawCommand(this.tid('VestingContract'), args.contractCid, args.amount, configCid),
     )
   }
 
   async cancel(args: { creator: string; contractCid: string }): Promise<void> {
-    await this.submitWithContext(args.creator, (ctx) =>
-      buildCancelCommand(this.tid('AmuletVestingContract'), args.contractCid, ctx),
+    await this.submitWithConfig(args.creator, ({ configCid }) =>
+      buildCancelCommand(this.tid('VestingContract'), args.contractCid, configCid),
     )
   }
 
   async claimResidual(args: { receiver: string; claimCid: string; amount: string }): Promise<void> {
-    await this.submitWithContext(args.receiver, (ctx) =>
-      buildClaimResidualCommand(this.tid('AmuletVestedClaim'), args.claimCid, args.amount, ctx),
-    )
-  }
-
-  // The only write not on an amulet-vesting template: it exercises AmuletRules itself.
-  async tap(partyId: string): Promise<void> {
-    await this.submitWithContext(partyId, (ctx, rulesTemplateId) =>
-      buildTapCommand(rulesTemplateId, ctx.amuletRules, {
-        openMiningRound: ctx.openMiningRound,
-        receiver: partyId,
-      }),
+    await this.submitWithConfig(args.receiver, ({ configCid }) =>
+      buildClaimResidualCommand(this.tid('VestedClaim'), args.claimCid, args.amount, configCid),
     )
   }
 }
diff --git a/dapp/frontend/src/backend/VestingBackend.test.ts b/dapp/frontend/src/backend/VestingBackend.test.ts
index 2d6515b1..377f3408 100644
--- a/dapp/frontend/src/backend/VestingBackend.test.ts
+++ b/dapp/frontend/src/backend/VestingBackend.test.ts
@@ -1,14 +1,18 @@
 import { describe, expect, it } from 'vitest'
 import { encodeSchedule } from '@/backend/commands'
+import type { AcsRow } from '@/backend/VestingBackend'
 import {
-  amuletValue,
   claimChain,
   composeNote,
   lastUpdateOffset,
+  matchesInstrument,
+  reservedToken,
   rowToClaim,
   rowToGrant,
   rowToPendingGrant,
+  selectHoldings,
   splitNote,
+  tokenValue,
   updatesToClaims,
 } from '@/backend/VestingBackend'
 
@@ -17,6 +21,8 @@ const linearEncoded = encodeSchedule({
   curve: { kind: 'linear', start: '2026-01-01T00:00:00Z', end: '2027-01-01T00:00:00Z' },
 })
 
+const INSTRUMENT = { admin: 'admin::1', instrumentId: 'DBT' }
+
 const row = (contractId: string, arg: Record<string, unknown>) => ({
   contractEntry: { JsActiveContract: { createdEvent: { contractId, createArgument: arg } } },
 })
@@ -170,7 +176,7 @@ const claimUpdate = (
         events: [
           {
             ExercisedEvent: {
-              choice: 'AmuletVestingContract_Withdraw',
+              choice: 'VestingContract_Withdraw',
               choiceArgument: { withdrawAmount: amount },
               contractId: replaces,
             },
@@ -178,7 +184,10 @@ const claimUpdate = (
           {
             CreatedEvent: {
               contractId: successor,
+              templateId: 'pkg1:Vesting:VestingContract',
               createArgument: {
+                admin: 'admin::1',
+                instrumentId: 'DBT',
                 provider: 'OP',
                 creator: 'funder',
                 receiver: 'receiver',
@@ -195,9 +204,50 @@ const claimUpdate = (
   },
 })
 
+// The resolved id LedgerBackend spells its own commands with, which is where this comes from.
+const SUCCESSOR = 'pkg1:Vesting:VestingContract'
+
 describe('updatesToClaims', () => {
+  // A withdraw pays the receiver as well as replacing the grant, so its transaction carries a
+  // `Token` create the receiver is an informee of. Its payload is `{admin, instrumentId, amount}`,
+  // which the instrument filter accepts, so picking the first create rather than the successor's
+  // own template threw on the `totalAmount` it has no field for and lost the whole history.
+  it('skips the holding the withdraw paid out, even when it comes first', () => {
+    const { update } = claimUpdate(7, 'c1', 'c2', '250', '250')
+    const paidOut = {
+      CreatedEvent: {
+        contractId: 'paid-out',
+        templateId: 'tfpkg:Canton.TokenForge.Token:Token',
+        createArgument: { admin: 'admin::1', instrumentId: 'DBT', amount: '250' },
+      },
+    }
+    const { events, ...value } = update.Transaction.value
+    const withHolding = {
+      update: { Transaction: { value: { ...value, events: [events[0], paidOut, events[1]] } } },
+    }
+
+    const [record] = updatesToClaims([withHolding], INSTRUMENT, SUCCESSOR)
+
+    expect(record?.grant.id).toBe('c2')
+  })
+
+  // A grant created before the package was upgraded is still its own successor, so the match is on
+  // module and entity rather than on the whole resolved id.
+  it('accepts a successor created under another version of the package', () => {
+    const [record] = updatesToClaims(
+      [claimUpdate(7, 'c1', 'c2', '250', '250')],
+      INSTRUMENT,
+      'otherpkg:Vesting:VestingContract',
+    )
+    expect(record?.grant.id).toBe('c2')
+  })
+
   it('carries the id the claim consumed alongside the successor it created', () => {
-    const [record] = updatesToClaims([claimUpdate(7, 'c1', 'c2', '250', '250')])
+    const [record] = updatesToClaims(
+      [claimUpdate(7, 'c1', 'c2', '250', '250')],
+      INSTRUMENT,
+      SUCCESSOR,
+    )
     expect(record?.replaces).toBe('c1')
     expect(record?.grant.id).toBe('c2')
     expect(record?.amount).toBe('250')
@@ -219,21 +269,25 @@ describe('updatesToClaims', () => {
         },
       },
     }
-    expect(updatesToClaims([orphan])).toEqual([])
+    expect(updatesToClaims([orphan], INSTRUMENT, SUCCESSOR)).toEqual([])
   })
 
   it('ignores anything that is not an array of transactions', () => {
-    expect(updatesToClaims(undefined)).toEqual([])
-    expect(updatesToClaims([{}])).toEqual([])
+    expect(updatesToClaims(undefined, INSTRUMENT, SUCCESSOR)).toEqual([])
+    expect(updatesToClaims([{}], INSTRUMENT, SUCCESSOR)).toEqual([])
   })
 })
 
 describe('claimChain', () => {
-  const records = updatesToClaims([
-    claimUpdate(7, 'c1', 'c2', '250', '250'),
-    claimUpdate(9, 'c2', 'c3', '500', '250'),
-    claimUpdate(11, 'other1', 'other2', '10', '10'),
-  ])
+  const records = updatesToClaims(
+    [
+      claimUpdate(7, 'c1', 'c2', '250', '250'),
+      claimUpdate(9, 'c2', 'c3', '500', '250'),
+      claimUpdate(11, 'other1', 'other2', '10', '10'),
+    ],
+    INSTRUMENT,
+    SUCCESSOR,
+  )
 
   it('walks a grant back through the contracts its own claims replaced, newest first', () => {
     expect(claimChain(records, 'c3').map((r) => r.grant.id)).toEqual(['c3', 'c2'])
@@ -264,14 +318,94 @@ describe('lastUpdateOffset', () => {
   })
 })
 
-describe('amuletValue', () => {
-  const amulet = (initialAmount: string) => row('a1', { amount: { initialAmount } })
+const tokenRow = (contractId: string, amount: string, overrides: Record<string, unknown> = {}) =>
+  ({
+    contractEntry: {
+      JsActiveContract: {
+        createdEvent: {
+          contractId,
+          createArgument: { admin: 'admin::1', instrumentId: 'DBT', amount, ...overrides },
+        },
+      },
+    },
+  }) as AcsRow
+
+describe('tokenValue', () => {
+  it('reads the holding amount off the payload', () => {
+    expect(tokenValue(tokenRow('t1', '1000.5'))).toBe('1000.5')
+  })
+
+  // Lenient where the mappers throw: this feeds a balance, and one odd row must not blank it.
+  it('reads a row carrying no amount as zero', () => {
+    expect(tokenValue({} as AcsRow)).toBe('0')
+  })
+})
+
+describe('matchesInstrument', () => {
+  it('accepts a holding of the deployment’s own instrument', () => {
+    expect(matchesInstrument(tokenRow('t1', '1'), INSTRUMENT)).toBe(true)
+  })
+
+  it('rejects the same instrument id under another admin', () => {
+    expect(matchesInstrument(tokenRow('t1', '1', { admin: 'other::1' }), INSTRUMENT)).toBe(false)
+  })
+
+  it('rejects another instrument of the same admin', () => {
+    expect(matchesInstrument(tokenRow('t1', '1', { instrumentId: 'OTHER' }), INSTRUMENT)).toBe(
+      false,
+    )
+  })
+})
+
+describe('reservedToken', () => {
+  it('reads the holding a pending grant’s Accept will consume', () => {
+    const pending = {
+      contractEntry: {
+        JsActiveContract: {
+          createdEvent: {
+            contractId: 'p1',
+            createArgument: { tokenCid: 't1' },
+          },
+        },
+      },
+    } as AcsRow
+    expect(reservedToken(pending)).toBe('t1')
+  })
+
+  it('reads a row naming none as undefined', () => {
+    expect(reservedToken({} as AcsRow)).toBeUndefined()
+  })
+})
+
+describe('selectHoldings', () => {
+  // Largest first, so the factory splits the fewest inputs: the receiver carries one disclosure
+  // whatever is picked, since the split leaves a single holding behind.
+  it('takes the largest holdings first and stops once they cover the total', () => {
+    const rows = [tokenRow('small', '100'), tokenRow('big', '900'), tokenRow('mid', '400')]
+    expect(selectHoldings(rows, '1000')?.map((row) => tokenValue(row))).toEqual(['900', '400'])
+  })
+
+  it('takes one holding when one covers the total', () => {
+    const rows = [tokenRow('big', '900'), tokenRow('small', '100')]
+    expect(selectHoldings(rows, '500')?.map((row) => tokenValue(row))).toEqual(['900'])
+  })
+
+  it('takes everything when the total needs everything', () => {
+    const rows = [tokenRow('a', '600'), tokenRow('b', '400')]
+    expect(selectHoldings(rows, '1000')).toHaveLength(2)
+  })
+
+  it('returns undefined rather than an under-covering set', () => {
+    expect(selectHoldings([tokenRow('a', '600')], '1000')).toBeUndefined()
+  })
 
-  it('is the face amount, which is what a transfer credits an input at', () => {
-    expect(amuletValue(amulet('100.0000000000'))).toBe('100.0000000000')
+  it('returns undefined when there is nothing to select from', () => {
+    expect(selectHoldings([], '1')).toBeUndefined()
   })
 
-  it('reads a row it cannot decode as nothing, so a balance never blanks', () => {
-    expect(amuletValue(row('a1', {}))).toBe('0')
+  it('returns undefined for a non-positive total rather than an empty set', () => {
+    const rows = [tokenRow('a', '600')]
+    expect(selectHoldings(rows, '0')).toBeUndefined()
+    expect(selectHoldings(rows, '-1')).toBeUndefined()
   })
 })
diff --git a/dapp/frontend/src/backend/VestingBackend.ts b/dapp/frontend/src/backend/VestingBackend.ts
index 8b52ffb7..8df89863 100644
--- a/dapp/frontend/src/backend/VestingBackend.ts
+++ b/dapp/frontend/src/backend/VestingBackend.ts
@@ -2,8 +2,9 @@
 // transport details. The mappers below turn active-contract rows into those domain types.
 
 import { decodeSchedule } from '@/backend/commands'
+import type { RegistryInstrument } from '@/backend/registry'
 import type { Grant, PartyId, PendingGrant, VestedClaim } from '@/store/types'
-import { isAmount } from '@/utils/amount'
+import { addAmounts, compareAmounts, isAmount } from '@/utils/amount'
 import type { VestingSchedule } from '@/utils/schedule'
 
 export interface VestingView {
@@ -21,9 +22,10 @@ export interface CreateVestInput {
   totalAmount: string
 }
 
-// One `AmuletVestingContract_Withdraw` off the ledger: the amount and ledger time from the transaction, plus the
-// two contract ids it sits between. `replaces` is what the claim consumed and `grant` what it
-// created, so a caller can walk a grant's ancestry rather than match on fields two grants can share.
+// One `VestingContract_Withdraw` off the ledger: the amount and ledger time from the
+// transaction, plus the two contract ids it sits between. `replaces` is what the claim consumed
+// and `grant` what it created, so a caller can walk a grant's ancestry rather than match on
+// fields two grants can share.
 export interface ClaimRecord {
   amount: string
   at: string
@@ -35,10 +37,12 @@ export interface VestingBackend {
   accept(args: { receiver: string; pendingCid: string }): Promise<void>
   balanceOf(partyId: string): Promise<string>
   cancel(args: { creator: string; contractCid: string }): Promise<void>
+  cancelProposal(args: { proposer: string; pendingCid: string }): Promise<void>
   claimHistory(partyId: string, contractCid: string): Promise<ClaimRecord[]>
   claimResidual(args: { receiver: string; claimCid: string; amount: string }): Promise<void>
   createVesting(args: CreateVestInput): Promise<void>
-  tap(partyId: string): Promise<void>
+  rejectProposal(args: { receiver: string; pendingCid: string }): Promise<void>
+  tap(args: { amount: string; party: string }): Promise<void>
   viewAs(partyId: string): Promise<VestingView>
   withdraw(args: { receiver: string; contractCid: string; amount: string }): Promise<void>
 }
@@ -182,7 +186,11 @@ type UpdateEntry = {
       value?: {
         effectiveAt?: string
         events?: {
-          CreatedEvent?: { contractId?: string; createArgument?: Record<string, unknown> }
+          CreatedEvent?: {
+            contractId?: string
+            createArgument?: Record<string, unknown>
+            templateId?: string
+          }
           ExercisedEvent?: {
             choice?: string
             choiceArgument?: Record<string, unknown>
@@ -201,14 +209,28 @@ export const lastUpdateOffset = (updates: unknown): number | undefined => {
   return entries.at(-1)?.update?.Transaction?.value?.offset
 }
 
-export const updatesToClaims = (updates: unknown): ClaimRecord[] =>
-  (Array.isArray(updates) ? (updates as UpdateEntry[]) : []).flatMap((entry) => {
+export const updatesToClaims = (
+  updates: unknown,
+  instrument: RegistryInstrument,
+  successorTemplateId: string,
+): ClaimRecord[] => {
+  // Module and entity rather than the whole id, so a grant created under an earlier version of the
+  // package still joins its own chain; taken from the caller's resolved id rather than spelled here
+  // a third time, so a Daml rename cannot leave this one behind.
+  const entity = successorTemplateId.slice(successorTemplateId.indexOf(':'))
+  return (Array.isArray(updates) ? (updates as UpdateEntry[]) : []).flatMap((entry) => {
     const transaction = entry.update?.Transaction?.value
     const events = transaction?.events ?? []
     const claim = events.find(
-      (event) => event.ExercisedEvent?.choice === 'AmuletVestingContract_Withdraw',
+      (event) => event.ExercisedEvent?.choice === 'VestingContract_Withdraw',
     )?.ExercisedEvent
-    const created = events.find((event) => event.CreatedEvent !== undefined)?.CreatedEvent
+    // The successor contract, picked by template rather than by being the first create: a withdraw
+    // also creates the receiver's `Token`, whose payload carries the same flat admin/instrumentId
+    // pair, so the instrument filter below cannot tell the two apart and `rowToGrant` would throw on
+    // the missing `totalAmount` rather than skip the event.
+    const created = events.find((event) =>
+      event.CreatedEvent?.templateId?.endsWith(entity),
+    )?.CreatedEvent
     const amount = claim?.choiceArgument?.withdrawAmount
     const replaces = claim?.contractId
     if (
@@ -219,7 +241,11 @@ export const updatesToClaims = (updates: unknown): ClaimRecord[] =>
     ) {
       return []
     }
-    const grant = rowToGrant({ contractEntry: { JsActiveContract: { createdEvent: created } } })
+    const row: AcsRow = { contractEntry: { JsActiveContract: { createdEvent: created } } }
+    if (!matchesInstrument(row, instrument)) {
+      return []
+    }
+    const grant = rowToGrant(row)
     return grant === undefined
       ? []
       : [
@@ -231,28 +257,60 @@ export const updatesToClaims = (updates: unknown): ClaimRecord[] =>
           },
         ]
   })
+}
+
+type TokenArg = { admin?: string; amount?: string; instrumentId?: string }
+
+const argOf = (row: AcsRow): Record<string, unknown> =>
+  row.contractEntry?.JsActiveContract?.createdEvent?.createArgument ?? {}
 
-type AmuletArg = { amount?: { initialAmount?: string }; dso?: string }
+// What a holding is worth, which is the field itself: a token-forge Token does not decay, so there
+// is no decayed value to compute. Lenient where the mappers throw, because this feeds a balance and
+// one odd row must not blank the field.
+export const tokenValue = (row: AcsRow): string => {
+  const { amount } = argOf(row) as TokenArg
+  return typeof amount === 'string' ? amount : '0'
+}
+
+// A shared participant can hold another admin's instrument under the same id, so both halves of the
+// pair are compared.
+export const matchesInstrument = (row: AcsRow, instrument: RegistryInstrument): boolean => {
+  const { admin, instrumentId } = argOf(row) as TokenArg
+  return admin === instrument.admin && instrumentId === instrument.instrumentId
+}
 
-// What an Amulet is worth as a transfer input, which is its face value and not a decayed one:
-// `summarizeAndConsumeInput` sums `initialAmount`, and the holding fee is charged only by
-// `Amulet_Expire`. Lenient where the mappers above throw: this feeds a balance, and one odd row
-// must not blank the field.
-export const amuletValue = (row: AcsRow): string => {
-  const { amount } = (row.contractEntry?.JsActiveContract?.createdEvent?.createArgument ??
-    {}) as AmuletArg
-  return amount?.initialAmount ?? '0'
+// The holding a pending grant reserves: the factory split it off at exactly the grant, and its
+// Accept consumes that one contract, so nothing else may spend it while the grant is outstanding.
+export const reservedToken = (row: AcsRow): string | undefined => {
+  const cid = argOf(row).tokenCid
+  return typeof cid === 'string' ? cid : undefined
 }
 
-// Read off a holding because a disclosure carries an opaque blob and no payload.
-export const amuletDso = (row: AcsRow): string | undefined =>
-  (row.contractEntry?.JsActiveContract?.createdEvent?.createArgument as AmuletArg | undefined)?.dso
+// Whether a pending grant is one this party funded. A `Token` has no observers, so only the funder
+// can read the holding their own grant reserves, and the grants they received are nobody's to
+// reconcile from here.
+export const fundedBy = (row: AcsRow, party: string): boolean => argOf(row).proposer === party
 
-// The Amulets a pending grant has already pledged: its Accept consumes exactly these, so nothing
-// else may spend them while it is outstanding.
-export const pledgedAmulets = (row: AcsRow): string[] => {
-  const cids = row.contractEntry?.JsActiveContract?.createdEvent?.createArgument?.amuletCids
-  return Array.isArray(cids) ? cids.map(String) : []
+// Largest first, so the factory splits the fewest inputs. Not for the receiver's sake any more: the
+// split leaves one holding whatever is picked. Undefined rather than a partial set, so the caller
+// can report by how much the funder is short.
+export const selectHoldings = (rows: AcsRow[], total: string): AcsRow[] | undefined => {
+  // The empty set covers a non-positive total, and a grant submitted with no inputs aborts at
+  // Accept, leaving the receiver to decline it for nothing.
+  if (compareAmounts(total, '0') <= 0) {
+    return undefined
+  }
+  const ordered = [...rows].sort((a, b) => compareAmounts(tokenValue(b), tokenValue(a)))
+  const picked: AcsRow[] = []
+  let covered = '0'
+  for (const row of ordered) {
+    if (compareAmounts(covered, total) >= 0) {
+      break
+    }
+    picked.push(row)
+    covered = addAmounts(covered, tokenValue(row))
+  }
+  return compareAmounts(covered, total) >= 0 ? picked : undefined
 }
 
 export const rowToClaim = (row: AcsRow): VestedClaim | undefined => {
diff --git a/dapp/frontend/src/backend/commands.test.ts b/dapp/frontend/src/backend/commands.test.ts
index fdafe500..2d3b8bbb 100644
--- a/dapp/frontend/src/backend/commands.test.ts
+++ b/dapp/frontend/src/backend/commands.test.ts
@@ -2,22 +2,18 @@ import { describe, expect, it } from 'vitest'
 import {
   buildAcceptCommand,
   buildCancelCommand,
+  buildCancelProposalCommand,
   buildClaimResidualCommand,
   buildCreateVestingCommand,
+  buildRejectProposalCommand,
   buildTapCommand,
   buildWithdrawCommand,
   decodeSchedule,
   encodeSchedule,
-  TAP_AMOUNT,
 } from '@/backend/commands'
-import type { AppTransferContext } from '@/backend/transferContext'
 import type { VestingSchedule } from '@/utils/schedule'
 
-const ctx: AppTransferContext = {
-  amuletRules: 'rules-cid',
-  openMiningRound: 'round-cid',
-  featuredAppRight: null,
-}
+const CONFIG_CID = '00cfg'
 
 const linear: VestingSchedule = {
   cliff: '2026-01-01T00:00:00Z',
@@ -80,123 +76,146 @@ describe('decodeSchedule', () => {
 })
 
 describe('command builders', () => {
-  it('buildCreateVestingCommand shapes the factory choice with the encoded schedule', () => {
-    const cmd = buildCreateVestingCommand('TID', 'fcid', {
-      proposer: 'P',
-      receiver: 'B',
-      totalAmount: '1000',
-      schedule: linear,
-      amuletCids: ['a1', 'a2'],
-      note: 'Title\nbody',
-    })
-    expect(cmd).toEqual({
+  it('builds the factory choice with the canonical amount, encoded schedule and token ids', () => {
+    expect(
+      buildCreateVestingCommand('pkg:Vesting:VestingFactory', 'factory-cid', {
+        configCid: CONFIG_CID,
+        proposer: 'funder::1',
+        receiver: 'receiver::1',
+        totalAmount: '1000.00',
+        schedule: linear,
+        tokenCids: ['t1', 't2'],
+      }),
+    ).toEqual({
       ExerciseCommand: {
-        templateId: 'TID',
-        contractId: 'fcid',
-        choice: 'AmuletVestingFactory_CreateVesting',
+        templateId: 'pkg:Vesting:VestingFactory',
+        contractId: 'factory-cid',
+        choice: 'VestingFactory_CreateVesting',
         choiceArgument: {
-          proposer: 'P',
-          receiver: 'B',
+          proposer: 'funder::1',
+          receiver: 'receiver::1',
           totalAmount: '1000',
           schedule: encodeSchedule(linear),
-          amuletCids: ['a1', 'a2'],
-          note: 'Title\nbody',
+          tokenCids: ['t1', 't2'],
+          configCid: CONFIG_CID,
+          note: null,
         },
       },
     })
   })
 
-  it('buildCreateVestingCommand sends null note when omitted', () => {
-    const cmd = buildCreateVestingCommand('TID', 'fcid', {
-      proposer: 'P',
-      receiver: 'B',
-      totalAmount: '1',
-      schedule: linear,
-      amuletCids: [],
+  it('builds Accept carrying nothing but the config', () => {
+    expect(buildAcceptCommand('pkg:Vesting:VestingProposal', 'p1', CONFIG_CID)).toEqual({
+      ExerciseCommand: {
+        templateId: 'pkg:Vesting:VestingProposal',
+        contractId: 'p1',
+        choice: 'VestingProposal_Accept',
+        choiceArgument: { configCid: CONFIG_CID },
+      },
     })
-    expect((cmd.ExerciseCommand.choiceArgument as { note: unknown }).note).toBeNull()
   })
 
-  it('buildWithdrawCommand carries the amount and the context, no nowMicros (getTime)', () => {
-    expect(buildWithdrawCommand('TID', 'cid', '100', ctx)).toEqual({
+  it("builds the funder's proposal cancel with no argument at all", () => {
+    expect(buildCancelProposalCommand('pkg:Vesting:VestingProposal', 'p1')).toEqual({
       ExerciseCommand: {
-        templateId: 'TID',
-        contractId: 'cid',
-        choice: 'AmuletVestingContract_Withdraw',
-        choiceArgument: { withdrawAmount: '100', ctx },
+        templateId: 'pkg:Vesting:VestingProposal',
+        contractId: 'p1',
+        choice: 'VestingProposal_Cancel',
+        choiceArgument: {},
       },
     })
   })
 
-  it('buildAcceptCommand carries the flat transfer context and nothing else', () => {
-    expect(buildAcceptCommand('TID', 'pcid', ctx)).toEqual({
+  it("builds the receiver's proposal reject with no argument at all", () => {
+    expect(buildRejectProposalCommand('pkg:Vesting:VestingProposal', 'p1')).toEqual({
       ExerciseCommand: {
-        templateId: 'TID',
-        contractId: 'pcid',
-        choice: 'AmuletVestingProposal_Accept',
-        choiceArgument: { ctx },
+        templateId: 'pkg:Vesting:VestingProposal',
+        contractId: 'p1',
+        choice: 'VestingProposal_Reject',
+        choiceArgument: {},
       },
     })
   })
 
-  it('buildCancelCommand takes the context as its only argument', () => {
-    expect(buildCancelCommand('TID', 'ccid', ctx)).toEqual({
+  it('builds Withdraw with a canonical amount beside the config', () => {
+    expect(buildWithdrawCommand('pkg:Vesting:VestingContract', 'c1', '10.5', CONFIG_CID)).toEqual({
       ExerciseCommand: {
-        templateId: 'TID',
-        contractId: 'ccid',
-        choice: 'AmuletVestingContract_Cancel',
-        choiceArgument: { ctx },
+        templateId: 'pkg:Vesting:VestingContract',
+        contractId: 'c1',
+        choice: 'VestingContract_Withdraw',
+        choiceArgument: { withdrawAmount: '10.5', configCid: CONFIG_CID },
       },
     })
   })
 
-  it('buildClaimResidualCommand targets the residual claim and carries withdrawAmount', () => {
-    expect(buildClaimResidualCommand('TID', 'rcid', '50', ctx)).toEqual({
+  it('builds Cancel with the config alone', () => {
+    expect(buildCancelCommand('pkg:Vesting:VestingContract', 'c1', CONFIG_CID)).toEqual({
       ExerciseCommand: {
-        templateId: 'TID',
-        contractId: 'rcid',
-        choice: 'AmuletVestedClaim_Withdraw',
-        choiceArgument: { withdrawAmount: '50', ctx },
+        templateId: 'pkg:Vesting:VestingContract',
+        contractId: 'c1',
+        choice: 'VestingContract_Cancel',
+        choiceArgument: { configCid: CONFIG_CID },
       },
     })
   })
 
-  it('buildTapCommand exercises AmuletRules itself, for the fixed amount', () => {
+  it('builds the residual withdraw against the claim template', () => {
+    expect(buildClaimResidualCommand('pkg:Vesting:VestedClaim', 'r1', '2.00', CONFIG_CID)).toEqual({
+      ExerciseCommand: {
+        templateId: 'pkg:Vesting:VestedClaim',
+        contractId: 'r1',
+        choice: 'VestedClaim_Withdraw',
+        choiceArgument: { withdrawAmount: '2', configCid: CONFIG_CID },
+      },
+    })
+  })
+
+  // The faucet is exercised on the config itself, so it takes the resolved template id the
+  // registry's disclosure carries rather than the package-name form a filter takes.
+  it('builds the faucet tap against the resolved config template id', () => {
     expect(
-      buildTapCommand('RULESTID', ctx.amuletRules, {
-        openMiningRound: ctx.openMiningRound,
-        receiver: 'P',
+      buildTapCommand('20d54824:Canton.TokenForge.Registry:InstrumentConfig', CONFIG_CID, {
+        amount: '1000.00',
+        user: 'funder::1',
       }),
     ).toEqual({
       ExerciseCommand: {
-        templateId: 'RULESTID',
-        contractId: 'rules-cid',
-        choice: 'AmuletRules_DevNet_Tap',
-        choiceArgument: { receiver: 'P', amount: TAP_AMOUNT, openRound: 'round-cid' },
+        templateId: '20d54824:Canton.TokenForge.Registry:InstrumentConfig',
+        contractId: CONFIG_CID,
+        choice: 'InstrumentConfig_Tap',
+        choiceArgument: { user: 'funder::1', amount: '1000' },
       },
     })
   })
 
+  // A Daml Numeric literal has no trailing-dot form; the input filters upstream let '1000.' through.
   it('canonicalizes a trailing-dot amount before it reaches the payload', () => {
-    // A Daml Numeric literal has no trailing-dot form; the input filters upstream let '1000.' through.
     const cmd = buildCreateVestingCommand('TID', 'fcid', {
+      configCid: CONFIG_CID,
       proposer: 'P',
       receiver: 'B',
       totalAmount: '1000.',
       schedule: linear,
-      amuletCids: [],
+      tokenCids: [],
     })
     expect((cmd.ExerciseCommand.choiceArgument as { totalAmount: string }).totalAmount).toBe('1000')
     expect(
-      buildWithdrawCommand('TID', 'cid', '100.', ctx).ExerciseCommand.choiceArgument.withdrawAmount,
+      buildWithdrawCommand('TID', 'cid', '100.', CONFIG_CID).ExerciseCommand.choiceArgument
+        .withdrawAmount,
     ).toBe('100')
     expect(
-      buildClaimResidualCommand('TID', 'rcid', '50.', ctx).ExerciseCommand.choiceArgument
+      buildClaimResidualCommand('TID', 'rcid', '50.', CONFIG_CID).ExerciseCommand.choiceArgument
         .withdrawAmount,
     ).toBe('50')
   })
 
-  it('rejects a malformed amount rather than sending it to the ledger', () => {
-    expect(() => buildWithdrawCommand('TID', 'cid', 'not-a-number', ctx)).toThrow()
+  it('canonicalizes the amount and refuses one it cannot parse', () => {
+    expect(
+      buildWithdrawCommand('pkg:Vesting:VestingContract', 'c1', '10.50', CONFIG_CID).ExerciseCommand
+        .choiceArgument.withdrawAmount,
+    ).toBe('10.5')
+    expect(() =>
+      buildWithdrawCommand('pkg:Vesting:VestingContract', 'c1', 'not-a-number', CONFIG_CID),
+    ).toThrow()
   })
 })
diff --git a/dapp/frontend/src/backend/commands.ts b/dapp/frontend/src/backend/commands.ts
index 1959fe53..e3bc817a 100644
--- a/dapp/frontend/src/backend/commands.ts
+++ b/dapp/frontend/src/backend/commands.ts
@@ -1,7 +1,6 @@
 // JSON-Ledger-API v2 command builders and the one curve encode/decode pair. No I/O, so it is
 // unit-tested directly in commands.test.ts.
 
-import type { AppTransferContext } from '@/backend/transferContext'
 import { canonicalAmount } from '@/utils/amount'
 import type { VestingSchedule } from '@/utils/schedule'
 
@@ -69,11 +68,12 @@ export const decodeSchedule = (raw: unknown): VestingSchedule => {
 // ── Command builders ────────────────────────────────────────────────────────
 
 type CreateVestingArgs = {
-  amuletCids: string[]
+  configCid: string
   note?: string
   proposer: string
   receiver: string
   schedule: VestingSchedule
+  tokenCids: string[]
   totalAmount: string
 }
 
@@ -84,112 +84,75 @@ const exercise = (
   choiceArgument: Record<string, unknown>,
 ) => ({ ExerciseCommand: { templateId, contractId, choice, choiceArgument } })
 
-// The only choice taking no transfer context: it moves no Amulet, it only records which of the
-// funder's holdings the eventual Accept will lock.
+// `tokenCids` are the funder's inputs, which the choice splits down to the grant; the holding the
+// proposal ends up naming is the exact-size output that split leaves behind.
 export const buildCreateVestingCommand = (
   templateId: string,
   factoryCid: string,
   args: CreateVestingArgs,
 ) =>
-  exercise(templateId, factoryCid, 'AmuletVestingFactory_CreateVesting', {
+  exercise(templateId, factoryCid, 'VestingFactory_CreateVesting', {
     proposer: args.proposer,
     receiver: args.receiver,
     totalAmount: canonicalAmount(args.totalAmount),
     schedule: encodeSchedule(args.schedule),
-    amuletCids: args.amuletCids,
+    tokenCids: args.tokenCids,
+    configCid: args.configCid,
     note: args.note ?? null,
   })
 
-// The funder self-transfers `amount` out of its own holdings, so the grant can name an Amulet
-// nothing else has pledged. sender, provider and receiver are all the funder, which is what makes
-// the funder the only controller and keeps this a one-signature submission. Splice values an input
-// at its full `initialAmount` — the holding fee is charged only by `Amulet_Expire` — so an exact
-// split leaves the eventual Accept exactly covered, with no headroom to guess at.
-export const buildSplitCommand = (
-  templateId: string,
-  amuletRulesCid: string,
-  args: {
-    amount: string
-    amuletCids: string[]
-    dso: string
-    openMiningRound: string
-    owner: string
-  },
-) =>
-  exercise(templateId, amuletRulesCid, 'AmuletRules_Transfer', {
-    transfer: {
-      sender: args.owner,
-      provider: args.owner,
-      inputs: args.amuletCids.map((contractId) => ({ tag: 'InputAmulet', value: contractId })),
-      outputs: [
-        {
-          receiver: args.owner,
-          receiverFeeRatio: '0.0',
-          amount: canonicalAmount(args.amount),
-          lock: null,
-          meta: null,
-        },
-      ],
-      beneficiaries: null,
-    },
-    // Both maps are empty because the only input kind here is an Amulet; rewards and validator
-    // rights are what the other kinds need. `expectedDso` is not optional in practice:
-    // `checkExpectedDso` aborts when it is absent.
-    context: {
-      openMiningRound: args.openMiningRound,
-      issuingMiningRounds: [],
-      validatorRights: [],
-      featuredAppRight: null,
-    },
-    expectedDso: args.dso,
-  })
+export const buildAcceptCommand = (templateId: string, pendingCid: string, configCid: string) =>
+  exercise(templateId, pendingCid, 'VestingProposal_Accept', { configCid })
 
-// One fixed amount, so a tap is a button and not a form.
-export const TAP_AMOUNT = '100'
-
-// LocalNet and devnet only: the DSO does not carry this choice on a real network.
-export const buildTapCommand = (
-  templateId: string,
-  amuletRulesCid: string,
-  args: { openMiningRound: string; receiver: string },
-) =>
-  exercise(templateId, amuletRulesCid, 'AmuletRules_DevNet_Tap', {
-    receiver: args.receiver,
-    amount: TAP_AMOUNT,
-    openRound: args.openMiningRound,
-  })
+// Neither exit takes the config: both choices are bodyless and move no holding, so a proposal is
+// archived on its controller's authority alone.
+export const buildCancelProposalCommand = (templateId: string, pendingCid: string) =>
+  exercise(templateId, pendingCid, 'VestingProposal_Cancel', {})
 
-export const buildAcceptCommand = (
-  templateId: string,
-  pendingCid: string,
-  ctx: AppTransferContext,
-) => exercise(templateId, pendingCid, 'AmuletVestingProposal_Accept', { ctx })
+export const buildRejectProposalCommand = (templateId: string, pendingCid: string) =>
+  exercise(templateId, pendingCid, 'VestingProposal_Reject', {})
 
 // No nowMicros: the choice reads on-ledger getTime.
 export const buildWithdrawCommand = (
   templateId: string,
   contractCid: string,
   withdrawAmount: string,
-  ctx: AppTransferContext,
+  configCid: string,
 ) =>
-  exercise(templateId, contractCid, 'AmuletVestingContract_Withdraw', {
+  exercise(templateId, contractCid, 'VestingContract_Withdraw', {
     withdrawAmount: canonicalAmount(withdrawAmount),
-    ctx,
+    configCid,
   })
 
-export const buildCancelCommand = (
-  templateId: string,
-  contractCid: string,
-  ctx: AppTransferContext,
-) => exercise(templateId, contractCid, 'AmuletVestingContract_Cancel', { ctx })
+export const buildCancelCommand = (templateId: string, contractCid: string, configCid: string) =>
+  exercise(templateId, contractCid, 'VestingContract_Cancel', { configCid })
 
 export const buildClaimResidualCommand = (
   templateId: string,
   claimCid: string,
   withdrawAmount: string,
-  ctx: AppTransferContext,
+  configCid: string,
 ) =>
-  exercise(templateId, claimCid, 'AmuletVestedClaim_Withdraw', {
+  exercise(templateId, claimCid, 'VestedClaim_Withdraw', {
     withdrawAmount: canonicalAmount(withdrawAmount),
-    ctx,
+    configCid,
+  })
+
+// One fixed amount, so a tap is a menu item and not a form. The registry publishes an instrument's
+// id, name, symbol and decimals but never its faucet, and the config is admin-signed with no
+// payload in its disclosure, so the per-tap cap cannot be read from the app. This must stay at or
+// under the `maxPerTap` scripts/bootstrap-vesting.mjs sets; above it, InstrumentConfig_Tap aborts
+// and the message surfaces in the caller's toast.
+export const TAP_AMOUNT = '1000'
+
+// Nonconsuming on the admin-signed config, so a connected wallet taps with nothing disclosed but
+// the config itself.
+export const buildTapCommand = (
+  templateId: string,
+  configCid: string,
+  args: { amount: string; user: string },
+) =>
+  exercise(templateId, configCid, 'InstrumentConfig_Tap', {
+    user: args.user,
+    amount: canonicalAmount(args.amount),
   })
diff --git a/dapp/frontend/src/backend/config.test.ts b/dapp/frontend/src/backend/config.test.ts
index 6b926c5c..7aba5e8d 100644
--- a/dapp/frontend/src/backend/config.test.ts
+++ b/dapp/frontend/src/backend/config.test.ts
@@ -1,8 +1,10 @@
-import { describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { type LedgerApi, loadBackendConfig } from '@/backend/config'
 
-const OPERATOR = 'vesting-operator-1700000000001::ns'
-const OLDER = 'vesting-operator-1600000000000::ns'
+const OPERATOR = 'vesting-operator::ns'
+// What a bootstrap predating the stable hint left behind. A different party, whose factory is not
+// the one the registry is now configured for.
+const LEGACY = 'vesting-operator-1700000000001::ns'
 
 const factoryRow = (
   createdEvent: Record<string, unknown>,
@@ -16,7 +18,7 @@ const factoryRow = (
 const created = {
   contractId: '00cid',
   createdEventBlob: 'YmxvYg==',
-  templateId: 'abc123:AmuletVesting:AmuletVestingFactory',
+  templateId: 'abc123:Vesting:VestingFactory',
 }
 
 // The four reads loadBackendConfig makes, keyed by resource so a test overrides only what it is
@@ -33,7 +35,7 @@ const ledger = (
     if (resource.endsWith('/rights')) {
       return {
         rights: overrides.rights ?? [
-          { kind: { CanActAs: { value: { party: OLDER } } } },
+          { kind: { CanActAs: { value: { party: LEGACY } } } },
           { kind: { CanActAs: { value: { party: OPERATOR } } } },
           { kind: { ParticipantAdmin: { value: {} } } },
         ],
@@ -50,29 +52,64 @@ const ledger = (
   return { ledgerApi, filteredParty: () => filteredParty }
 }
 
+const ADMIN = 'instrument-admin-1700000000000::ns'
+
+// loadBackendConfig now reads the instrument off the registry as well as the factory off the
+// ledger, so every case needs the happy registry unless it is about the registry failing.
+beforeEach(() => {
+  vi.stubGlobal('fetch', async (url: string) => ({
+    ok: true,
+    status: 200,
+    json: async () =>
+      String(url).endsWith('/instruments')
+        ? { instruments: [{ id: 'DBT' }] }
+        : { adminId: ADMIN, supportedApis: {} },
+  }))
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
 describe('loadBackendConfig', () => {
   it('returns the deployment it reads back, synchronizer id included', async () => {
     const { ledgerApi } = ledger()
     await expect(loadBackendConfig(ledgerApi)).resolves.toEqual({
+      admin: ADMIN,
       factoryBlob: 'YmxvYg==',
       factoryCid: '00cid',
+      instrumentId: 'DBT',
       pkg: 'abc123',
       synchronizerId: 'sync::1',
     })
   })
 
+  // The pair comes from the registry because nothing on the ledger carries it: the factory is this
+  // repo's own operator, the instrument admin is a third party.
+  it('carries the registry’s instrument into the deployment', async () => {
+    const { ledgerApi } = ledger()
+    const deployment = await loadBackendConfig(ledgerApi)
+    expect([deployment.admin, deployment.instrumentId]).toEqual([ADMIN, 'DBT'])
+  })
+
   it('omits the synchronizer id when the row carries none', async () => {
     const { ledgerApi } = ledger({ acs: [factoryRow(created)] })
     await expect(loadBackendConfig(ledgerApi)).resolves.not.toHaveProperty('synchronizerId')
   })
 
-  // Every run leaves its operator behind, so the newest is the one whose factory the config means.
-  it('reads as the newest operator among the rights', async () => {
+  it('reads as the operator allocated under the bootstrap hint', async () => {
     const { ledgerApi, filteredParty } = ledger()
     await loadBackendConfig(ledgerApi)
     expect(filteredParty()).toBe(OPERATOR)
   })
 
+  // The stamped spelling is a prefix of nothing the current bootstrap creates, and adopting it would
+  // point the app at that run's factory while the registry serves this run's admin.
+  it('does not adopt a stamped operator from an earlier bootstrap', async () => {
+    const { ledgerApi } = ledger({ rights: [{ kind: { CanActAs: { value: { party: LEGACY } } } }] })
+    await expect(loadBackendConfig(ledgerApi)).rejects.toThrow(/no vesting operator/)
+  })
+
   it('names the bootstrap script when no operator was ever created', async () => {
     const { ledgerApi } = ledger({ rights: [{ kind: { ParticipantAdmin: { value: {} } } }] })
     await expect(loadBackendConfig(ledgerApi)).rejects.toThrow(
diff --git a/dapp/frontend/src/backend/config.ts b/dapp/frontend/src/backend/config.ts
index 0ebaebb3..fe2a985a 100644
--- a/dapp/frontend/src/backend/config.ts
+++ b/dapp/frontend/src/backend/config.ts
@@ -1,12 +1,14 @@
 // The deployment the bootstrap left on the ledger, read back through the wallet rather than carried
-// in a file: every bootstrap run mints a fresh operator and factory, and a stale copy of either
-// shows as an empty dashboard with no error.
+// in a file: a stale copy of the operator or the factory shows as an empty dashboard with no error.
 
 import type { LedgerApiParams } from '@bootnodedev/canton-connect'
+import { fetchInstrument } from '@/backend/registry'
 
 export type Deployment = {
+  admin: string
   factoryBlob: string
   factoryCid: string
+  instrumentId: string
   pkg: string
   synchronizerId?: string
 }
@@ -14,8 +16,11 @@ export type Deployment = {
 export type LedgerApi = (params: LedgerApiParams) => Promise<unknown>
 
 // A filter takes the package-name reference, never the id it resolves to.
-const FACTORY = '#amulet-vesting:AmuletVesting:AmuletVestingFactory'
-const OPERATOR_HINT = 'vesting-operator-'
+const FACTORY = '#vesting:Vesting:VestingFactory'
+// Canton mints `<hint>::<fingerprint>`, so the separator belongs to the prefix: without it a
+// `vesting-operator-<stamp>::ns` party from a bootstrap predating the stable hint matches too, and
+// the app runs on that run's factory while bootstrap configures the registry for this one.
+const OPERATOR_HINT = 'vesting-operator::'
 
 const advice = (reason: string): Error => new Error(`${reason} — run pnpm run bootstrap`)
 
@@ -32,9 +37,10 @@ type ActiveContract = {
 }
 
 // The bootstrap grants this user `CanActAs` on each operator it creates, so its rights are the
-// operator list. Reading the ledger's parties instead would also return everyone else's on a shared
-// participant. The hint carries the run's timestamp, so the last one sorted is the newest.
-const newestOperator = async (ledgerApi: LedgerApi): Promise<string> => {
+// operator list, where reading the ledger's parties would also return everyone else's. Sorted only
+// so that a shared participant, where the hint can resolve under two namespaces, picks one of them
+// on every load rather than whichever came first.
+const operatorParty = async (ledgerApi: LedgerApi): Promise<string> => {
   const { user } = await call<{ user?: { id?: string } }>(ledgerApi, {
     requestMethod: 'get',
     resource: '/v2/authenticated-user',
@@ -57,7 +63,7 @@ const newestOperator = async (ledgerApi: LedgerApi): Promise<string> => {
 }
 
 export const loadBackendConfig = async (ledgerApi: LedgerApi): Promise<Deployment> => {
-  const operator = await newestOperator(ledgerApi)
+  const [operator, instrument] = await Promise.all([operatorParty(ledgerApi), fetchInstrument()])
   const { offset } = await call<{ offset?: string | number }>(ledgerApi, {
     requestMethod: 'get',
     resource: '/v2/state/ledger-end',
@@ -100,8 +106,10 @@ export const loadBackendConfig = async (ledgerApi: LedgerApi): Promise<Deploymen
     throw advice('the factory came back with no package id')
   }
   return {
+    admin: instrument.admin,
     factoryBlob: created.createdEventBlob,
     factoryCid: created.contractId,
+    instrumentId: instrument.instrumentId,
     pkg,
     ...(factory?.synchronizerId === undefined ? {} : { synchronizerId: factory.synchronizerId }),
   }
diff --git a/dapp/frontend/src/backend/registry.test.ts b/dapp/frontend/src/backend/registry.test.ts
new file mode 100644
index 00000000..5f3622e5
--- /dev/null
+++ b/dapp/frontend/src/backend/registry.test.ts
@@ -0,0 +1,253 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { fetchAppNetwork, fetchInstrument, fetchInstrumentConfig } from '@/backend/registry'
+
+const ADMIN = 'instrument-admin-1700000000000::ns'
+const INSTRUMENT = { admin: ADMIN, instrumentId: 'DBT' }
+
+const CONFIG = {
+  templateId: '20d54824:Canton.TokenForge.Registry:InstrumentConfig',
+  contractId: '00cfg',
+  createdEventBlob: 'YmxvYg==',
+  synchronizerId: 'global-domain::1220',
+}
+
+// Keyed by the path each route answers, so a case names only the response it is about. `calls`
+// records the request bodies, which is how the transfer-factory case reads back what was sent.
+const stubRegistry = (
+  routes: Record<string, { body?: unknown; status?: number }>,
+): { calls: { path: string; body: unknown }[] } => {
+  const calls: { path: string; body: unknown }[] = []
+  vi.stubGlobal('fetch', async (url: string, init?: { body?: string }) => {
+    const path = new URL(url, 'http://localhost:3013').pathname
+    calls.push({ path, body: init?.body === undefined ? undefined : JSON.parse(init.body) })
+    const route = routes[path]
+    if (route === undefined) {
+      return { ok: false, status: 404, json: async () => ({ error: 'not found' }) }
+    }
+    const status = route.status ?? 200
+    return { ok: status >= 200 && status < 300, status, json: async () => route.body }
+  })
+  return { calls }
+}
+
+const metadata = {
+  '/registry/metadata/v1/info': { body: { adminId: ADMIN, supportedApis: {} } },
+  '/registry/metadata/v1/instruments': {
+    body: { instruments: [{ id: 'DBT', name: 'dAppBooster Token', symbol: 'DBT', decimals: 10 }] },
+  },
+}
+
+const factory = {
+  '/registry/transfer-instruction/v1/transfer-factory': {
+    body: {
+      factoryId: '00cfg',
+      transferKind: 'self',
+      choiceContext: { choiceContextData: { values: {} }, disclosedContracts: [CONFIG] },
+    },
+  },
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('fetchInstrument', () => {
+  it('pairs the admin from /info with the one instrument from /instruments', async () => {
+    stubRegistry(metadata)
+
+    await expect(fetchInstrument()).resolves.toEqual(INSTRUMENT)
+  })
+
+  it('names the bootstrap script when the registry administers no instrument', async () => {
+    stubRegistry({
+      ...metadata,
+      '/registry/metadata/v1/instruments': { body: { instruments: [] } },
+    })
+
+    await expect(fetchInstrument()).rejects.toThrow(/no instrument.*pnpm run bootstrap/s)
+  })
+
+  // Two live configs for one admin is what bootstrap's own findInstrumentConfig refuses, and the
+  // dApp knows exactly one instrument, so picking one silently would render grants under a symbol
+  // that is not theirs.
+  it('refuses to guess when the registry lists more than one instrument', async () => {
+    stubRegistry({
+      ...metadata,
+      '/registry/metadata/v1/instruments': {
+        body: { instruments: [{ id: 'DBT' }, { id: 'OTHER' }] },
+      },
+    })
+
+    await expect(fetchInstrument()).rejects.toThrow(/more than one instrument/)
+  })
+
+  it('reports the route that failed rather than a bare status', async () => {
+    stubRegistry({ ...metadata, '/registry/metadata/v1/info': { status: 503, body: {} } })
+
+    await expect(fetchInstrument()).rejects.toThrow(
+      /registry answered 503 for \/registry\/metadata\/v1\/info/,
+    )
+  })
+
+  it('names the registry and the url when the fetch itself never answers', async () => {
+    vi.stubGlobal('fetch', async () => {
+      throw new TypeError('Failed to fetch')
+    })
+
+    await expect(fetchInstrument()).rejects.toThrow(
+      /registry is unreachable at http:\/\/localhost:3013\/registry\/metadata\/v1\/info/,
+    )
+  })
+
+  it('refuses an /info body with no admin party', async () => {
+    stubRegistry({ ...metadata, '/registry/metadata/v1/info': { body: { supportedApis: {} } } })
+
+    await expect(fetchInstrument()).rejects.toThrow(/no admin party/)
+  })
+
+  it('names the bootstrap script when the one instrument came back with no id', async () => {
+    stubRegistry({
+      ...metadata,
+      '/registry/metadata/v1/instruments': { body: { instruments: [{}] } },
+    })
+
+    await expect(fetchInstrument()).rejects.toThrow(/no id.*pnpm run bootstrap/s)
+  })
+})
+
+describe('fetchInstrumentConfig', () => {
+  it('asks the self branch, naming the connected party as both ends', async () => {
+    const { calls } = stubRegistry(factory)
+
+    await fetchInstrumentConfig('funder::1', INSTRUMENT)
+
+    expect(calls[0]?.body).toEqual({
+      choiceArguments: {
+        transfer: {
+          instrumentId: { admin: ADMIN, id: 'DBT' },
+          receiver: 'funder::1',
+          sender: 'funder::1',
+        },
+      },
+    })
+  })
+
+  // The synchronizer stays on the disclosure, because the registry is what vouches for where that
+  // contract lives, and comes back loose as well for `fetchAppNetwork` to compare the wallet against.
+  it('returns the config reference, its rebuilt disclosure and the synchronizer id', async () => {
+    stubRegistry(factory)
+
+    await expect(fetchInstrumentConfig('funder::1', INSTRUMENT)).resolves.toEqual({
+      configCid: '00cfg',
+      configTemplateId: CONFIG.templateId,
+      disclosed: [
+        {
+          templateId: CONFIG.templateId,
+          contractId: '00cfg',
+          createdEventBlob: 'YmxvYg==',
+          synchronizerId: 'global-domain::1220',
+        },
+      ],
+      synchronizerId: 'global-domain::1220',
+    })
+  })
+
+  it('refuses a 200 that disclosed no config', async () => {
+    stubRegistry({
+      '/registry/transfer-instruction/v1/transfer-factory': {
+        body: { factoryId: '00cfg', choiceContext: { disclosedContracts: [] } },
+      },
+    })
+
+    await expect(fetchInstrumentConfig('funder::1', INSTRUMENT)).rejects.toThrow(
+      /disclosed no InstrumentConfig/,
+    )
+  })
+
+  it('refuses a disclosure whose templateId names something other than InstrumentConfig', async () => {
+    stubRegistry({
+      '/registry/transfer-instruction/v1/transfer-factory': {
+        body: {
+          factoryId: '00cfg',
+          choiceContext: {
+            disclosedContracts: [
+              { ...CONFIG, templateId: '20d54824:Canton.TokenForge.Registry:Token' },
+            ],
+          },
+        },
+      },
+    })
+
+    await expect(fetchInstrumentConfig('funder::1', INSTRUMENT)).rejects.toThrow(
+      /disclosed no InstrumentConfig/,
+    )
+  })
+
+  it('refuses a factoryId the disclosure does not vouch for', async () => {
+    stubRegistry({
+      '/registry/transfer-instruction/v1/transfer-factory': {
+        body: {
+          factoryId: '00other',
+          choiceContext: { disclosedContracts: [CONFIG] },
+        },
+      },
+    })
+
+    await expect(fetchInstrumentConfig('funder::1', INSTRUMENT)).rejects.toThrow(
+      /disclosed no InstrumentConfig/,
+    )
+  })
+
+  it('surfaces the registry’s own error message', async () => {
+    stubRegistry({
+      '/registry/transfer-instruction/v1/transfer-factory': {
+        status: 409,
+        body: { error: 'multiple active configs' },
+      },
+    })
+
+    await expect(fetchInstrumentConfig('funder::1', INSTRUMENT)).rejects.toThrow(
+      /multiple active configs/,
+    )
+  })
+
+  it('reports a non-JSON body rather than a parse error', async () => {
+    vi.stubGlobal('fetch', async () => ({
+      ok: true,
+      status: 200,
+      json: async () => {
+        throw new Error('Unexpected token <')
+      },
+    }))
+
+    await expect(fetchInstrumentConfig('funder::1', INSTRUMENT)).rejects.toThrow(
+      /registry answered/,
+    )
+  })
+})
+
+describe('fetchAppNetwork', () => {
+  it('reads the network off the config disclosure the registry serves', async () => {
+    stubRegistry({ ...metadata, ...factory })
+
+    await expect(fetchAppNetwork('funder::1')).resolves.toBe('global-domain::1220')
+  })
+
+  // A registry that answers without one leaves the check with nothing to compare, which reads as
+  // no verdict rather than a mismatch.
+  it('reports no network when the disclosure carries none', async () => {
+    const { synchronizerId, ...bare } = CONFIG
+    stubRegistry({
+      ...metadata,
+      '/registry/transfer-instruction/v1/transfer-factory': {
+        body: {
+          factoryId: '00cfg',
+          transferKind: 'self',
+          choiceContext: { choiceContextData: { values: {} }, disclosedContracts: [bare] },
+        },
+      },
+    })
+
+    await expect(fetchAppNetwork('funder::1')).resolves.toBeUndefined()
+  })
+})
diff --git a/dapp/frontend/src/backend/registry.ts b/dapp/frontend/src/backend/registry.ts
new file mode 100644
index 00000000..a5a7232f
--- /dev/null
+++ b/dapp/frontend/src/backend/registry.ts
@@ -0,0 +1,161 @@
+// The canton-token-forge registry, which is where the InstrumentConfig disclosure every write
+// carries comes from. Reading the config off the ledger instead would only work on LocalNet: the
+// instrument admin is a third party, so no connected party is a stakeholder of its contract.
+
+import type { DisclosedContract } from '@/backend/wallet'
+import { REGISTRY_URL } from '@/utils/config'
+
+export type RegistryInstrument = {
+  admin: string
+  instrumentId: string
+}
+
+// The two halves a command needs: the contract id to exercise, and the resolved template id a
+// command must carry, which the package-name filters cannot supply.
+export type InstrumentConfigRef = {
+  configCid: string
+  configTemplateId: string
+}
+
+type WireDisclosure = {
+  contractId?: string
+  createdEventBlob?: string
+  synchronizerId?: string
+  templateId?: string
+}
+
+const advice = (reason: string): Error => new Error(`${reason}, run pnpm run bootstrap`)
+
+// A registry that accepts the socket and never answers would otherwise hang the write that is
+// waiting on it for good, with only the confirm button's spinner to show for it. The same budget the
+// deployed proxy gives its own upstream hop, which `api/_registry.test.ts` is what holds.
+const REGISTRY_TIMEOUT_MS = 15_000
+
+// The registry answers a refusal with a status and a JSON `error`, so read both: a stopped service
+// is fronted by an html error page, which would otherwise surface as a JSON syntax error.
+const call = async <T>(path: string, body?: unknown): Promise<T> => {
+  const init = {
+    ...(body === undefined
+      ? { method: 'GET' }
+      : {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify(body),
+        }),
+  }
+  let response: Response
+  try {
+    response = await fetch(`${REGISTRY_URL}${path}`, {
+      ...init,
+      signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS),
+    })
+  } catch (cause: unknown) {
+    // A service that is down, a CORS refusal and a mixed-content block all reject alike, as a bare
+    // `Failed to fetch` naming neither the registry nor where it was looked for. A timeout is told
+    // apart from those, because it is the one where the registry did answer the connection.
+    if (cause instanceof DOMException && cause.name === 'TimeoutError') {
+      throw new Error(
+        `the registry did not answer ${path} within ${REGISTRY_TIMEOUT_MS / 1000}s (${REGISTRY_URL})`,
+      )
+    }
+    throw new Error(`the registry is unreachable at ${REGISTRY_URL}${path}`)
+  }
+  const parsed = (await response.json().catch(() => undefined)) as { error?: string } | undefined
+  const reason = parsed?.error
+  if (reason !== undefined) {
+    throw new Error(`the registry refused ${path}: ${reason}`)
+  }
+  if (!response.ok || typeof parsed !== 'object' || parsed === null) {
+    throw new Error(`the registry answered ${response.status} for ${path}`)
+  }
+  return parsed as T
+}
+
+// Once per session, from `loadBackendConfig`. Two calls because /info is CIP-56 registry metadata
+// and carries only the admin; the instruments are their own route.
+export const fetchInstrument = async (): Promise<RegistryInstrument> => {
+  const [info, listing] = await Promise.all([
+    call<{ adminId?: string }>('/registry/metadata/v1/info'),
+    call<{ instruments?: { id?: string }[] }>('/registry/metadata/v1/instruments'),
+  ])
+  const instruments = listing.instruments ?? []
+  if (info.adminId === undefined) {
+    throw new Error('the registry reported no admin party')
+  }
+  if (instruments.length === 0) {
+    throw advice('the registry administers no instrument')
+  }
+  // The dApp knows exactly one instrument, so picking one of several would render a grant under a
+  // symbol that is not its own.
+  if (instruments.length > 1) {
+    throw new Error(
+      `the registry lists more than one instrument (${instruments.map((one) => one.id).join(', ')})`,
+    )
+  }
+  const instrumentId = instruments[0]?.id
+  if (instrumentId === undefined) {
+    throw advice('the registry listed an instrument with no id')
+  }
+  return { admin: info.adminId, instrumentId }
+}
+
+// Per write, not cached: one round trip against a contract that can be archived underneath us.
+// sender === receiver takes the route's `self` branch, whose choice context is the config alone;
+// `transferKind` is not read, because the disclosure is the same on every branch.
+export const fetchInstrumentConfig = async (
+  party: string,
+  instrument: RegistryInstrument,
+): Promise<
+  InstrumentConfigRef & { disclosed: DisclosedContract[]; synchronizerId: string | undefined }
+> => {
+  const result = await call<{
+    choiceContext?: { disclosedContracts?: WireDisclosure[] }
+    factoryId?: string
+  }>('/registry/transfer-instruction/v1/transfer-factory', {
+    choiceArguments: {
+      transfer: {
+        instrumentId: { admin: instrument.admin, id: instrument.instrumentId },
+        receiver: party,
+        sender: party,
+      },
+    },
+  })
+  const config = (result.choiceContext?.disclosedContracts ?? []).at(0)
+  // Defence in depth: the four vesting choices re-derive `expectedAdmin`/`expectedInstrumentId` in
+  // Daml regardless, but `tap` exercises directly on the templateId and contract id below, so a
+  // pair the disclosure does not vouch for is refused here rather than handed to the wallet.
+  if (
+    result.factoryId === undefined ||
+    config?.contractId === undefined ||
+    config.contractId !== result.factoryId ||
+    config.createdEventBlob === undefined ||
+    config.templateId === undefined ||
+    !config.templateId.endsWith(':Canton.TokenForge.Registry:InstrumentConfig')
+  ) {
+    throw new Error('the registry disclosed no InstrumentConfig for this instrument')
+  }
+  return {
+    configCid: result.factoryId,
+    configTemplateId: config.templateId,
+    // Rebuilt field by field so nothing else off the wire travels, `synchronizerId` kept: the
+    // registry is what vouches for where this contract lives. Returned alongside as well, because
+    // the submission carrying it has to agree with the deployment's own.
+    disclosed: [
+      {
+        templateId: config.templateId,
+        contractId: config.contractId,
+        createdEventBlob: config.createdEventBlob,
+        ...(config.synchronizerId === undefined ? {} : { synchronizerId: config.synchronizerId }),
+      },
+    ],
+    synchronizerId: config.synchronizerId,
+  }
+}
+
+// The app's side of the wrong-network check. Read from the registry rather than off the deployment
+// the wallet reads back: a wallet on another network returns no factory at all, so the deployment's
+// own synchronizer can only ever agree with it, and the strip would never fire on a first load.
+export const fetchAppNetwork = async (party: string): Promise<string | undefined> => {
+  const { synchronizerId } = await fetchInstrumentConfig(party, await fetchInstrument())
+  return synchronizerId
+}
diff --git a/dapp/frontend/src/backend/transferContext.test.ts b/dapp/frontend/src/backend/transferContext.test.ts
deleted file mode 100644
index 53e97116..00000000
--- a/dapp/frontend/src/backend/transferContext.test.ts
+++ /dev/null
@@ -1,172 +0,0 @@
-import { describe, expect, it, vi } from 'vitest'
-import { fetchAppNetwork, fetchTransferContext } from '@/backend/transferContext'
-
-const disclosure = (templateId: string, contractId: string): Record<string, unknown> => ({
-  templateId,
-  contractId,
-  createdEventBlob: `blob-${contractId}`,
-  synchronizerId: 'global-domain::1220',
-})
-
-const RULES = disclosure('rulespkg:Splice.AmuletRules:AmuletRules', 'rules-cid')
-const ROUND = disclosure('roundpkg:Splice.Round:OpenMiningRound', 'round-2')
-
-// Only the disclosures and `openRound` are kept; the command tap builds is discarded.
-const stubTap = (disclosedContracts: unknown[], openRound = 'round-2'): { calls: unknown[] } => {
-  const calls: unknown[] = []
-  vi.stubGlobal('fetch', async (_url: string, init: { body: string }) => {
-    calls.push(JSON.parse(init.body))
-    return {
-      ok: true,
-      status: 200,
-      json: async () => ({
-        jsonrpc: '2.0',
-        id: '1',
-        result: {
-          commands: { ExerciseCommand: { choiceArgument: { openRound } } },
-          disclosedContracts,
-        },
-      }),
-    }
-  })
-  return { calls }
-}
-
-describe('fetchTransferContext', () => {
-  it('keeps the AmuletRules and open mining round disclosures and drops the rest', async () => {
-    stubTap([
-      RULES,
-      ROUND,
-      disclosure('roundpkg:Splice.ExternalPartyConfigState:ExternalPartyConfigState', 'cfg'),
-    ])
-
-    const { ctx, disclosed, rulesTemplateId } = await fetchTransferContext('funder::1')
-
-    expect(ctx).toEqual({
-      amuletRules: 'rules-cid',
-      openMiningRound: 'round-2',
-      featuredAppRight: null,
-    })
-    expect(disclosed).toEqual([
-      {
-        templateId: 'rulespkg:Splice.AmuletRules:AmuletRules',
-        contractId: 'rules-cid',
-        createdEventBlob: 'blob-rules-cid',
-      },
-      {
-        templateId: 'roundpkg:Splice.Round:OpenMiningRound',
-        contractId: 'round-2',
-        createdEventBlob: 'blob-round-2',
-      },
-    ])
-    // The split exercises AmuletRules directly, so it needs the resolved id the filters skip.
-    expect(rulesTemplateId).toBe('rulespkg:Splice.AmuletRules:AmuletRules')
-  })
-
-  // The url is the build's, so only the request is asserted on here.
-  it('asks for a tap to the connected party', async () => {
-    const { calls } = stubTap([RULES, ROUND])
-
-    await fetchTransferContext('funder::1')
-
-    expect(calls).toEqual([
-      {
-        jsonrpc: '2.0',
-        id: '1',
-        method: 'amulet.tap',
-        params: { receiver: 'funder::1' },
-      },
-    ])
-  })
-
-  // The array is the registry's, so its order decides nothing: the command names the live round.
-  it('takes the round the command names rather than the first one disclosed', async () => {
-    const stale = disclosure('roundpkg:Splice.Round:OpenMiningRound', 'round-1')
-
-    stubTap([RULES, stale, ROUND], 'round-2')
-
-    const { ctx, disclosed } = await fetchTransferContext('funder::1')
-
-    expect(ctx.openMiningRound).toBe('round-2')
-    expect(disclosed[1]?.contractId).toBe('round-2')
-  })
-
-  it('rejects when either disclosure is missing', async () => {
-    stubTap([RULES])
-
-    await expect(fetchTransferContext('funder::1')).rejects.toThrow(/disclosed no AmuletRules/)
-  })
-
-  // wallet-service refuses with a 200 carrying `error`, /api/rpc with a status and the same
-  // member, so the reason survives either way.
-  it.each([
-    ['a 200 from wallet-service', true, 200],
-    ['a 403 from the forwarding function', false, 403],
-  ])('surfaces the reason behind %s', async (_case, ok, status) => {
-    vi.stubGlobal('fetch', async () => ({
-      ok,
-      status,
-      json: async () => ({
-        jsonrpc: '2.0',
-        id: '1',
-        error: { code: -32601, message: 'Method not forwarded: amulet.tap' },
-      }),
-    }))
-
-    await expect(fetchTransferContext('funder::1')).rejects.toThrow(/Method not forwarded/)
-  })
-
-  it('names the status rather than letting an html error page fail as a parse error', async () => {
-    vi.stubGlobal('fetch', async () => ({
-      ok: false,
-      status: 502,
-      json: async () => {
-        throw new SyntaxError('Unexpected token <')
-      },
-    }))
-
-    await expect(fetchTransferContext('funder::1')).rejects.toThrow(
-      /wallet-service answered 502 for amulet.tap/,
-    )
-  })
-
-  // A 200 carrying neither member used to throw a bare TypeError naming nothing.
-  it('names the status when a 200 carries neither result nor error', async () => {
-    vi.stubGlobal('fetch', async () => ({
-      ok: true,
-      status: 200,
-      json: async () => ({ jsonrpc: '2.0', id: '1' }),
-    }))
-
-    await expect(fetchTransferContext('funder::1')).rejects.toThrow(
-      /wallet-service answered 200 for amulet.tap/,
-    )
-  })
-})
-
-describe('fetchAppNetwork', () => {
-  it('reads the network wallet-service stamped on the AmuletRules disclosure', async () => {
-    stubTap([RULES, ROUND])
-
-    await expect(fetchAppNetwork('funder::1')).resolves.toBe('global-domain::1220')
-  })
-
-  // The id sits on the rules alone, and the SV opens the first round minutes after a LocalNet
-  // start, so waiting for one the way `fetchTransferContext` must would answer nothing until then.
-  it('answers before the SV has opened a round', async () => {
-    stubTap([RULES])
-
-    await expect(fetchAppNetwork('funder::1')).resolves.toBe('global-domain::1220')
-  })
-
-  const { synchronizerId: _dropped, ...RULES_WITHOUT_NETWORK } = RULES
-
-  it.each([
-    ['no AmuletRules is disclosed', [ROUND]],
-    ['the disclosure carries no network', [RULES_WITHOUT_NETWORK]],
-  ])('reports nothing when %s', async (_case, disclosures) => {
-    stubTap(disclosures)
-
-    await expect(fetchAppNetwork('funder::1')).resolves.toBeUndefined()
-  })
-})
diff --git a/dapp/frontend/src/backend/transferContext.ts b/dapp/frontend/src/backend/transferContext.ts
deleted file mode 100644
index 7ffe2957..00000000
--- a/dapp/frontend/src/backend/transferContext.ts
+++ /dev/null
@@ -1,87 +0,0 @@
-// Built off wallet-service rather than Scan: on devnet the SV endpoints refuse the browser's
-// origin and the validator's scan-proxy wants a bearer.
-
-import type { DisclosedContract } from '@/backend/wallet'
-import { WALLET_RPC_URL } from '@/utils/config'
-
-// tap is a pure builder: it composes a command and submits nothing, so this mints no coin.
-type TapResult = {
-  commands?: { ExerciseCommand?: { choiceArgument?: { openRound?: string } } }
-  disclosedContracts?: DisclosedContract[]
-}
-
-type RpcBody = { error?: { message?: string }; result?: unknown }
-
-// Flat, not nested under a `context` key: nesting fails preprocessing on the missing field.
-export type AppTransferContext = {
-  amuletRules: string
-  featuredAppRight: null
-  openMiningRound: string
-}
-
-const AMULET_RULES = ':Splice.AmuletRules:AmuletRules'
-
-// Suffix match: the resolved package id differs per network and, on devnet, between entries.
-const byTemplate = (disclosures: DisclosedContract[], entity: string): DisclosedContract[] =>
-  disclosures.filter((disclosure) => disclosure.templateId.endsWith(entity))
-
-// wallet-service refuses with a 200 carrying `error`, /api/rpc with a status, so read both.
-const rpc = async (method: string, params: Record<string, unknown>): Promise<unknown> => {
-  const response = await fetch(WALLET_RPC_URL, {
-    method: 'POST',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ jsonrpc: '2.0', id: '1', method, params }),
-  })
-  const body = (await response.json().catch(() => undefined)) as RpcBody | undefined
-  const reason = body?.error?.message
-  if (reason !== undefined) {
-    throw new Error(`wallet-service refused ${method}: ${reason}`)
-  }
-  // Covers the html error page a stopped service is fronted by, and a 200 carrying neither.
-  if (!response.ok || typeof body?.result !== 'object' || body.result === null) {
-    throw new Error(`wallet-service answered ${response.status} for ${method}`)
-  }
-  return body.result
-}
-
-// The network wallet-service answered for, which is the only thing comparable against the wallet's
-// own. Its own read rather than a field on `fetchTransferContext`: the id sits on the AmuletRules
-// disclosure alone, so it must not inherit that builder's wait for an open round.
-export const fetchAppNetwork = async (party: string): Promise<string | undefined> => {
-  const result = (await rpc('amulet.tap', { receiver: party })) as TapResult
-  return byTemplate(result.disclosedContracts ?? [], AMULET_RULES).at(0)?.synchronizerId
-}
-
-export const fetchTransferContext = async (
-  party: string,
-): Promise<{
-  ctx: AppTransferContext
-  disclosed: DisclosedContract[]
-  rulesTemplateId: string
-}> => {
-  const result = (await rpc('amulet.tap', { receiver: party })) as TapResult
-  const disclosures = result.disclosedContracts ?? []
-  const amuletRules = byTemplate(disclosures, AMULET_RULES).at(0)
-  const rounds = byTemplate(disclosures, ':Splice.Round:OpenMiningRound')
-  const chosen = result.commands?.ExerciseCommand?.choiceArgument?.openRound
-  const round = rounds.find((one) => one.contractId === chosen) ?? rounds.at(0)
-  // The SV opens the first round minutes after a LocalNet start; until then tap cannot build.
-  if (amuletRules === undefined || round === undefined) {
-    throw new Error('wallet-service disclosed no AmuletRules and open mining round pair')
-  }
-  return {
-    ctx: {
-      amuletRules: amuletRules.contractId,
-      openMiningRound: round.contractId,
-      featuredAppRight: null,
-    },
-    // Rebuilt field by field to drop the wire object's `synchronizerId`, which `submit` stamps.
-    disclosed: [amuletRules, round].map(({ templateId, contractId, createdEventBlob }) => ({
-      templateId,
-      contractId,
-      createdEventBlob,
-    })),
-    // The split exercises AmuletRules directly, so it needs the resolved id the filters skip.
-    rulesTemplateId: amuletRules.templateId,
-  }
-}
diff --git a/dapp/frontend/src/components/AmountDisplay.tsx b/dapp/frontend/src/components/AmountDisplay.tsx
index d85ae505..1985802e 100644
--- a/dapp/frontend/src/components/AmountDisplay.tsx
+++ b/dapp/frontend/src/components/AmountDisplay.tsx
@@ -1,9 +1,9 @@
 import { formatAmount } from '@bootnodedev/canton-dappbooster'
-import cantonCoin from '@/assets/canton-coin.png'
 import { CompactAmount } from '@/components/CompactAmount'
 import { InfoTip } from '@/components/InfoTip'
+import { TokenMark } from '@/icons'
 import { cn } from '@/utils/cn'
-import { AMT } from '@/utils/tokens'
+import { DBT } from '@/utils/tokens'
 
 interface AmountDisplayProps {
   className?: string
@@ -14,15 +14,16 @@ interface AmountDisplayProps {
 }
 
 // The token mark is the only thing naming the unit, so it carries the name rather than an empty alt.
-const UNIT = `${AMT.name} (${AMT.symbol})`
+const UNIT = `${DBT.name} (${DBT.symbol})`
 
 // Neither varies, so hoisting them lets React skip the subtree by element identity. The dashboard
 // re-renders every amount once a second off the live clock, and each mark carries a `useId` tooltip.
 // The mark scales with its figure except on a KPI, where the figures differ in size but their marks
-// should not.
+// should not. `InfoTip` gives an element child no accessible name of its own, so the mark carries
+// its own `role="img"` and drops the `aria-hidden` it has by default outside this wrapper.
 const mark = (size: string): React.JSX.Element => (
   <InfoTip label={UNIT}>
-    <img alt={UNIT} className={size} src={cantonCoin} />
+    <TokenMark role="img" aria-label={UNIT} aria-hidden={undefined} className={size} />
   </InfoTip>
 )
 const MARK = mark('size-[0.92em]')
diff --git a/dapp/frontend/src/components/AppShell.tsx b/dapp/frontend/src/components/AppShell.tsx
index 9cf404c3..319cbaf7 100644
--- a/dapp/frontend/src/components/AppShell.tsx
+++ b/dapp/frontend/src/components/AppShell.tsx
@@ -1,9 +1,11 @@
 import { useEffect } from 'react'
 import { Outlet, ScrollRestoration } from 'react-router-dom'
+import { Button } from '@/components/Button'
 import { Card } from '@/components/Card'
 import { CreateGrant } from '@/components/CreateGrant'
 import { Footer } from '@/components/Footer'
 import { Loading } from '@/components/Loading'
+import { ReadError } from '@/components/ReadError'
 import { Toaster } from '@/components/Toaster'
 import { TopBar } from '@/components/TopBar'
 import { WrongNetwork } from '@/components/WrongNetwork'
@@ -12,7 +14,8 @@ import { useCreateGrant } from '@/hooks/useCreateGrant'
 import { useBackend } from '@/providers/Backend'
 
 export const AppShell = (): React.JSX.Element => {
-  const { backend, configPending, configError, sessionPending, wrongNetwork } = useBackend()
+  const { backend, configPending, configError, retryConfig, sessionPending, wrongNetwork } =
+    useBackend()
   // Mounted here rather than per page, because `?create=1` is route state: every page that offers
   // the action would otherwise repeat the mount, and a reader can open it from any of them.
   const [creating, setCreating] = useCreateGrant()
@@ -58,11 +61,19 @@ export const AppShell = (): React.JSX.Element => {
                   ? 'This app found nothing on the network the wallet is connected to. Switch networks in the wallet to load it.'
                   : configError}
               </p>
+              {/* Only off the wrong network: there the read failed for a reason retrying cannot
+                  change, and the wallet is where the fix is. */}
+              {!wrongNetwork && (
+                <Button variant="secondary" size="sm" onClick={retryConfig}>
+                  Try again
+                </Button>
+              )}
             </Card>
           )}
           {configPending && <Loading />}
           {configError === undefined && !configPending && (
             <>
+              <ReadError />
               <Outlet />
               {creating && backend !== undefined && (
                 <CreateGrant onClose={() => setCreating(false)} />
diff --git a/dapp/frontend/src/components/Button.tsx b/dapp/frontend/src/components/Button.tsx
index 66e456f9..c7ad27e6 100644
--- a/dapp/frontend/src/components/Button.tsx
+++ b/dapp/frontend/src/components/Button.tsx
@@ -79,12 +79,18 @@ export const Button = (props: ButtonProps): React.JSX.Element => {
     disabled = false,
     children,
     asLink: _a,
+    'aria-label': ariaLabel,
     ...rest
   } = props
   return (
     <button
       type={type}
       aria-busy={pending || undefined}
+      // Dropped while pending, because the swap below replaces the visible label with "Submitting…"
+      // and a caller's name would go on announcing the action this button no longer offers. The new
+      // name is not what carries the change, though: `disabled` takes the button out of the tab
+      // order, so nothing focuses it to hear one. The live region below is what announces it.
+      aria-label={pending ? undefined : ariaLabel}
       className={buttonClass(variant, size, className)}
       disabled={disabled || pending}
       {...rest}
@@ -92,7 +98,7 @@ export const Button = (props: ButtonProps): React.JSX.Element => {
       {pending ? (
         <>
           <Spinner size={16} />
-          Submitting…
+          <span role="status">Submitting…</span>
         </>
       ) : (
         children
diff --git a/dapp/frontend/src/components/CancelGrant.tsx b/dapp/frontend/src/components/CancelGrant.tsx
index 3f06de66..5880f76d 100644
--- a/dapp/frontend/src/components/CancelGrant.tsx
+++ b/dapp/frontend/src/components/CancelGrant.tsx
@@ -3,6 +3,7 @@ import { AmountDisplay } from '@/components/AmountDisplay'
 import { Button } from '@/components/Button'
 import { FieldError } from '@/components/FieldError'
 import { Modal } from '@/components/Modal'
+import { useOnScreen } from '@/hooks/useOnScreen'
 import type { Grant } from '@/store/types'
 import { deriveGrant } from '@/store/useVestingStore'
 import { errorText } from '@/utils/errorText'
@@ -33,13 +34,18 @@ export const CancelGrant = ({
   // Recomputed each tick with `nowMs`, so a residual growing past the floor re-enables the button
   // on its own rather than sending a submission the contract will assert on.
   const floorOk = residualMeetsFloor(derived.claimable)
+  // Only the confirm button is disabled while a submission is in flight, so the dialog can still be
+  // dismissed over the wallet prompt; the toast still fires, because the cancel did land.
+  const onScreen = useOnScreen()
 
   const submit = async (): Promise<void> => {
     setSubmitting(true)
     try {
       await onConfirm()
       toast.success(successMessage)
-      onClose()
+      if (onScreen.current) {
+        onClose()
+      }
     } catch (err) {
       toast.error(errorText(err))
     } finally {
@@ -63,7 +69,7 @@ export const CancelGrant = ({
         {!floorOk && (
           <FieldError
             id="cancel-residual-floor"
-            message={`The residual must be 0 or at least ${MIN_GRANT_AMOUNT} AMT. Cancel once more has vested, or let the receiver claim it down to zero.`}
+            message={`The residual must be 0 or at least ${MIN_GRANT_AMOUNT} DBT. Cancel once more has vested, or let the receiver claim it down to zero.`}
           />
         )}
         <Button
diff --git a/dapp/frontend/src/components/Claim.tsx b/dapp/frontend/src/components/Claim.tsx
index c71a5207..6d34f89d 100644
--- a/dapp/frontend/src/components/Claim.tsx
+++ b/dapp/frontend/src/components/Claim.tsx
@@ -3,13 +3,14 @@ import { useState } from 'react'
 import { Button } from '@/components/Button'
 import { FieldError } from '@/components/FieldError'
 import { Modal } from '@/components/Modal'
+import { useOnScreen } from '@/hooks/useOnScreen'
 import { isPositive } from '@/utils/amount'
 import { AMOUNT_ERROR_TEXT } from '@/utils/amountErrorText'
 import { errorText } from '@/utils/errorText'
 import { formatFigureFull } from '@/utils/format'
 import { MIN_GRANT_AMOUNT, meetsRelockFloor } from '@/utils/schedule'
 import { toast } from '@/utils/toast'
-import { AMT } from '@/utils/tokens'
+import { DBT } from '@/utils/tokens'
 
 interface ClaimProps {
   available: string
@@ -31,6 +32,9 @@ export const Claim = ({
 }: ClaimProps): React.JSX.Element => {
   const [raw, setRaw] = useState('')
   const [submitting, setSubmitting] = useState(false)
+  // Only the confirm button is disabled while a submission is in flight, so the dialog can still be
+  // dismissed over the wallet prompt; the toast still fires, because the claim did land.
+  const onScreen = useOnScreen()
 
   // Recomputed from `available` rather than stored from the last keystroke: it drops each second
   // for a live-vesting grant, so a stored code would keep flagging an amount the field itself has
@@ -42,7 +46,7 @@ export const Claim = ({
     amountError !== undefined
       ? AMOUNT_ERROR_TEXT[amountError]
       : !floorOk && isPositive(raw)
-        ? `Remainder must be 0 or at least ${MIN_GRANT_AMOUNT} AMT (re-lock floor).`
+        ? `Remainder must be 0 or at least ${MIN_GRANT_AMOUNT} DBT (re-lock floor).`
         : undefined
 
   const valid = amountError === undefined && isPositive(raw) && floorOk
@@ -56,8 +60,10 @@ export const Claim = ({
       await onConfirm(raw)
       // Exact, not abbreviated: this is the only record of what the ledger took and it carries no
       // tooltip to recover the digits from.
-      toast.success(`Claimed ${formatFigureFull(raw)} ${AMT.symbol}`)
-      onClose()
+      toast.success(`Claimed ${formatFigureFull(raw)} ${DBT.symbol}`)
+      if (onScreen.current) {
+        onClose()
+      }
     } catch (err) {
       toast.error(errorText(err))
     } finally {
@@ -74,7 +80,7 @@ export const Claim = ({
         id="claim-amount"
         label="Available to claim"
         onChange={(next) => setRaw(next)}
-        token={AMT}
+        token={DBT}
         usdValue="Not Available"
         value={raw}
       />
diff --git a/dapp/frontend/src/components/CompactAmount.tsx b/dapp/frontend/src/components/CompactAmount.tsx
index ff8ef2d8..b865217c 100644
--- a/dapp/frontend/src/components/CompactAmount.tsx
+++ b/dapp/frontend/src/components/CompactAmount.tsx
@@ -1,9 +1,9 @@
 import { InfoTip } from '@/components/InfoTip'
 import { formatFigureCompact, formatFigureFull, isCompacted } from '@/utils/format'
-import { AMT } from '@/utils/tokens'
+import { DBT } from '@/utils/tokens'
 
-// An Amulet figure, abbreviated past 10,000 with the exact one still reachable. Carries no unit and
-// no mark, so it suits a line that already spells out AMT; `AmountDisplay` wraps it for the rest.
+// A token figure, abbreviated past 10,000 with the exact one still reachable. Carries no unit and
+// no mark, so it suits a line that already spells out DBT; `AmountDisplay` wraps it for the rest.
 // `plain` drops the tooltip for a caller that cannot legally nest its trigger, which is a button:
 // the exact figure then reaches a reader by ear only, and its unit comes from the caller's own text.
 export const CompactAmount = ({
@@ -26,7 +26,7 @@ export const CompactAmount = ({
       </>
     )
   }
-  const labelled = `${exact} ${AMT.symbol}`
+  const labelled = `${exact} ${DBT.symbol}`
   return (
     <>
       <InfoTip label={labelled}>
diff --git a/dapp/frontend/src/components/CreateGrant/Details.tsx b/dapp/frontend/src/components/CreateGrant/Details.tsx
index 2efa6c66..093d811f 100644
--- a/dapp/frontend/src/components/CreateGrant/Details.tsx
+++ b/dapp/frontend/src/components/CreateGrant/Details.tsx
@@ -82,6 +82,7 @@ export const Details = ({
         <div>
           <TokenInput
             {...funding}
+            aria-describedby="amount-reservation"
             className="w-full border-0 p-0"
             id="amount"
             label="Total amount"
@@ -89,6 +90,10 @@ export const Details = ({
             usdValue="N/A"
             value={amount}
           />
+          <p className="mt-1 text-xs text-fg-muted" id="amount-reservation">
+            An outstanding grant reserves exactly this amount; the rest of your balance stays
+            spendable. Cancel the grant from Pending to release it before the receiver accepts.
+          </p>
         </div>
       </div>
     </>
diff --git a/dapp/frontend/src/components/CreateGrant/index.tsx b/dapp/frontend/src/components/CreateGrant/index.tsx
index c2a376b0..1e21b2f9 100644
--- a/dapp/frontend/src/components/CreateGrant/index.tsx
+++ b/dapp/frontend/src/components/CreateGrant/index.tsx
@@ -15,6 +15,7 @@ import {
 } from '@/components/CreateGrant/scheduleForm'
 import { useFundingToken } from '@/components/CreateGrant/useFundingToken'
 import { Modal } from '@/components/Modal'
+import { useOnScreen } from '@/hooks/useOnScreen'
 import { useParty } from '@/hooks/useParty'
 import { useBackend } from '@/providers/Backend'
 import { useVestingStore } from '@/store/useVestingStore'
@@ -44,6 +45,10 @@ export const CreateGrant = ({ onClose }: { onClose: () => void }): React.JSX.Ele
   const [title, setTitle] = useState('')
   const [submitting, setSubmitting] = useState(false)
   const [step, setStep] = useState(0)
+  // Only the submit button is disabled while the write is in flight, so the dialog can still be
+  // dismissed over the wallet prompt; its `onClose` clears a single `?create=1` slot, which by then
+  // may belong to a second dialog the reader has already opened.
+  const onScreen = useOnScreen()
 
   const schedule = toSchedule(scheduleForm)
   const scheduleValid = scheduleFormValid(scheduleForm)
@@ -73,10 +78,12 @@ export const CreateGrant = ({ onClose }: { onClose: () => void }): React.JSX.Ele
         schedule: demo === null ? schedule : shiftSchedule(schedule, now() - demo.anchorMs),
         title: title.trim(),
       })
-      onClose()
       toast.success('Grant created', {
         action: { label: 'View pending grants', to: '/pending?role=funder' },
       })
+      if (onScreen.current) {
+        onClose()
+      }
     } catch (err) {
       toast.error(errorText(err))
     } finally {
diff --git a/dapp/frontend/src/components/CreateGrant/useFundingToken.ts b/dapp/frontend/src/components/CreateGrant/useFundingToken.ts
index 5c5c0d00..091af62e 100644
--- a/dapp/frontend/src/components/CreateGrant/useFundingToken.ts
+++ b/dapp/frontend/src/components/CreateGrant/useFundingToken.ts
@@ -1,7 +1,8 @@
 import { type Token, type TokenMeta, tokenKey, useTokenList } from '@bootnodedev/canton-dappbooster'
 import { useEffect, useState } from 'react'
+import { useBackend } from '@/providers/Backend'
 import { useTokenFigures } from '@/providers/Tokens'
-import { AMT, isAmulet } from '@/utils/tokens'
+import { DBT } from '@/utils/tokens'
 
 export interface FundingToken {
   balance?: string
@@ -14,9 +15,17 @@ export interface FundingToken {
 export const useFundingToken = (): FundingToken => {
   const [pickedKey, setPickedKey] = useState<string>()
   const { byKey, tokens } = useTokenList()
+  const { instrument } = useBackend()
+  // The instrument this deployment vests is the default, since it is the one a grant can be funded
+  // from; a shared participant can carry another admin's under the same id, so both halves match.
   const token =
     (pickedKey === undefined ? undefined : byKey.get(pickedKey)) ??
-    tokens.find(({ instrumentId }) => isAmulet(instrumentId))
+    tokens.find(
+      ({ instrumentId }) =>
+        instrument !== undefined &&
+        instrumentId.admin === instrument.admin &&
+        instrumentId.id === instrument.instrumentId,
+    )
   const { failed, refresh } = useTokenFigures()
 
   useEffect(() => {
@@ -29,6 +38,6 @@ export const useFundingToken = (): FundingToken => {
     balance,
     balanceState: failed ? 'error' : balance === undefined ? 'loading' : undefined,
     onTokenSelect: ({ instrumentId }) => setPickedKey(tokenKey(instrumentId)),
-    token: token ?? AMT,
+    token: token ?? DBT,
   }
 }
diff --git a/dapp/frontend/src/components/ReadError.tsx b/dapp/frontend/src/components/ReadError.tsx
new file mode 100644
index 00000000..8e244c50
--- /dev/null
+++ b/dapp/frontend/src/components/ReadError.tsx
@@ -0,0 +1,37 @@
+import { Button } from '@/components/Button'
+import { Card } from '@/components/Card'
+import { useParty } from '@/hooks/useParty'
+import { useBackend } from '@/providers/Backend'
+import { useVestingStore } from '@/store/useVestingStore'
+
+// A failed read keeps the rows the last good one returned, which is what stops a write's own refresh
+// blanking the page; without this the failure would reach nobody and those rows would read as
+// current. Mounted by the shell rather than per page, because the store is what every page renders.
+export const ReadError = (): React.JSX.Element | null => {
+  const error = useVestingStore((s) => s.error)
+  const loading = useVestingStore((s) => s.loading)
+  const refresh = useVestingStore((s) => s.refresh)
+  const { backend } = useBackend()
+  const { party } = useParty()
+
+  if (error === undefined || backend === undefined || party === undefined) {
+    return null
+  }
+
+  return (
+    <Card role="alert" className="mb-6 flex flex-wrap items-center gap-3 px-5 py-4">
+      <p className="min-w-60 flex-1 text-sm text-fg-muted">
+        <span className="font-semibold text-danger">This page may be out of date. </span>
+        {error}
+      </p>
+      <Button
+        variant="secondary"
+        size="sm"
+        pending={loading}
+        onClick={() => void refresh(backend, party.partyId)}
+      >
+        Try again
+      </Button>
+    </Card>
+  )
+}
diff --git a/dapp/frontend/src/components/TopBar/AccountMenu.tsx b/dapp/frontend/src/components/TopBar/AccountMenu.tsx
index 582a05dd..72f26eb9 100644
--- a/dapp/frontend/src/components/TopBar/AccountMenu.tsx
+++ b/dapp/frontend/src/components/TopBar/AccountMenu.tsx
@@ -13,7 +13,7 @@ import { cn } from '@/utils/cn'
 import { errorText } from '@/utils/errorText'
 import { popoverClass } from '@/utils/popover'
 import { toast } from '@/utils/toast'
-import { AMT } from '@/utils/tokens'
+import { DBT } from '@/utils/tokens'
 
 const TRUNCATE = { head: 6, hint: 12, tail: 6 }
 
@@ -35,9 +35,9 @@ export const AccountMenu = ({ party }: AccountMenuProps): React.JSX.Element => {
   const { backend } = useBackend()
 
   const runTap = (ledger: VestingBackend): void => {
-    toast.info(`Tapping ${TAP_AMOUNT} ${AMT.symbol}…`)
-    ledger.tap(party.partyId).then(
-      () => toast.success(`${TAP_AMOUNT} ${AMT.symbol} tapped`),
+    toast.info(`Tapping ${TAP_AMOUNT} ${DBT.symbol}…`)
+    ledger.tap({ amount: TAP_AMOUNT, party: party.partyId }).then(
+      () => toast.success(`${TAP_AMOUNT} ${DBT.symbol} tapped`),
       (err: unknown) => toast.error(errorText(err)),
     )
   }
@@ -91,9 +91,9 @@ export const AccountMenu = ({ party }: AccountMenuProps): React.JSX.Element => {
                     <Droplet />
                   </span>
                   <span className="flex flex-col">
-                    <span className="text-sm font-semibold text-fg">Tap {AMT.name}</span>
+                    <span className="text-sm font-semibold text-fg">Tap {DBT.name}</span>
                     <span className="text-xs text-fg-muted">
-                      Get {TAP_AMOUNT} {AMT.symbol} from the faucet
+                      Get {TAP_AMOUNT} {DBT.symbol} from the faucet
                     </span>
                   </span>
                 </Menu.Item>
diff --git a/dapp/frontend/src/hooks/useOnScreen.ts b/dapp/frontend/src/hooks/useOnScreen.ts
new file mode 100644
index 00000000..e5c005b5
--- /dev/null
+++ b/dapp/frontend/src/hooks/useOnScreen.ts
@@ -0,0 +1,17 @@
+import { useEffect, useRef } from 'react'
+
+// Whether the component is still on screen, for a step that runs after an await: a dialog stays
+// dismissible over the wallet prompt, so its submission can resolve into a component the user has
+// already replaced, and closing then closes whichever dialog took its place. Set in the effect body
+// and not only cleared in its cleanup, because StrictMode runs setup, cleanup, setup on mount and a
+// ref the cleanup alone touches reads false from the first render onwards.
+export const useOnScreen = (): React.RefObject<boolean> => {
+  const onScreen = useRef(true)
+  useEffect(() => {
+    onScreen.current = true
+    return () => {
+      onScreen.current = false
+    }
+  }, [])
+  return onScreen
+}
diff --git a/dapp/frontend/src/hooks/useWrongNetwork.ts b/dapp/frontend/src/hooks/useWrongNetwork.ts
index 0407ea73..c5bea1d8 100644
--- a/dapp/frontend/src/hooks/useWrongNetwork.ts
+++ b/dapp/frontend/src/hooks/useWrongNetwork.ts
@@ -4,8 +4,8 @@
 
 import { useEffect, useRef, useState } from 'react'
 import type { LedgerApi } from '@/backend/config'
+import { fetchAppNetwork } from '@/backend/registry'
 import { walletSynchronizers } from '@/backend/synchronizer'
-import { fetchAppNetwork } from '@/backend/transferContext'
 import { wrongNetwork } from '@/utils/network'
 
 // Backstop for a switch made in a window the user never comes back from.
@@ -17,10 +17,11 @@ type Verdict = { party: string; wrong: boolean }
 
 export const useWrongNetwork = (ledgerApi: LedgerApi, partyId: string | undefined): boolean => {
   const [verdict, setVerdict] = useState<Verdict | undefined>(undefined)
-  // wallet-service answers for the one network its `NETWORK` variable names, for as long as it is
-  // up, so the app's side is read once and the poll re-reads only the wallet's. Boxed so that an
-  // answer carrying no id counts as read; the bare id would re-tap on every check.
-  const appNetwork = useRef<{ id: string | undefined } | undefined>(undefined)
+  // The registry serves one deployment for as long as it is up, so the app's side is read once and
+  // the poll re-reads only the wallet's. The promise is what is held, not its answer: assigning on
+  // resolve leaves nothing to find while the first read is still out, so every focus and every tick
+  // would start another one. Boxed so that an answer carrying no id still counts as read.
+  const appNetwork = useRef<Promise<{ id: string | undefined }> | undefined>(undefined)
 
   useEffect(() => {
     if (partyId === undefined) {
@@ -33,11 +34,18 @@ export const useWrongNetwork = (ledgerApi: LedgerApi, partyId: string | undefine
 
     const check = (): void => {
       const seq = ++started
-      const app = appNetwork.current ?? fetchAppNetwork(partyId).then((id) => ({ id }))
+      appNetwork.current ??= fetchAppNetwork(partyId).then(
+        (id) => ({ id }),
+        (cause: unknown) => {
+          // Cleared rather than cached, or a registry that was down once would answer from that
+          // failure for the rest of the session and the poll would never recover.
+          appNetwork.current = undefined
+          throw cause
+        },
+      )
 
-      void Promise.all([walletSynchronizers(ledgerApi, partyId), app]).then(
+      void Promise.all([walletSynchronizers(ledgerApi, partyId), appNetwork.current]).then(
         ([wallet, network]) => {
-          appNetwork.current = network
           if (!cancelled && seq === started) {
             setVerdict({ party: partyId, wrong: wrongNetwork(wallet, network.id) })
           }
diff --git a/dapp/frontend/src/icons/TokenMark.tsx b/dapp/frontend/src/icons/TokenMark.tsx
new file mode 100644
index 00000000..a95c22da
--- /dev/null
+++ b/dapp/frontend/src/icons/TokenMark.tsx
@@ -0,0 +1,21 @@
+import { type SVGProps, useId } from 'react'
+
+// The app's own mark, standing in for the instrument this deployment vests. Not over `Svg`, which
+// is stroke-based: this is two filled shapes.
+export const TokenMark = (props: SVGProps<SVGSVGElement>): React.JSX.Element => {
+  // Two marks on one page would otherwise share a gradient id.
+  const gradient = useId()
+
+  return (
+    <svg viewBox="0 0 32 32" width={32} height={32} aria-hidden="true" {...props}>
+      <defs>
+        <linearGradient id={gradient} x1="0" y1="0" x2="1" y2="1">
+          <stop offset="0%" stopColor="var(--accent)" />
+          <stop offset="100%" stopColor="var(--pink)" />
+        </linearGradient>
+      </defs>
+      <rect width="32" height="32" rx="8" fill={`url(#${gradient})`} />
+      <path d="M9 10l4.4 12h1.8L19.6 10h-2.5l-2.8 8.4L11.5 10z" fill="#fff" />
+    </svg>
+  )
+}
diff --git a/dapp/frontend/src/icons/index.ts b/dapp/frontend/src/icons/index.ts
index f7ce95cc..fa6db16e 100644
--- a/dapp/frontend/src/icons/index.ts
+++ b/dapp/frontend/src/icons/index.ts
@@ -4,4 +4,5 @@ export { GithubMark } from '@/icons/GithubMark'
 export { LinkedInMark } from '@/icons/LinkedInMark'
 export { LogoMark } from '@/icons/LogoMark'
 export { TelegramMark } from '@/icons/TelegramMark'
+export { TokenMark } from '@/icons/TokenMark'
 export { XMark } from '@/icons/XMark'
diff --git a/dapp/frontend/src/pages/Dashboard/GrantCard/index.tsx b/dapp/frontend/src/pages/Dashboard/GrantCard/index.tsx
index c0c83e25..10a4c547 100644
--- a/dapp/frontend/src/pages/Dashboard/GrantCard/index.tsx
+++ b/dapp/frontend/src/pages/Dashboard/GrantCard/index.tsx
@@ -11,12 +11,16 @@ import { InfoTip } from '@/components/InfoTip'
 import { ScheduleBar } from '@/components/ScheduleBar'
 import { Legend } from '@/pages/Dashboard/GrantCard/Legend'
 import type { Grant, Role } from '@/store/types'
-import type { GrantDerived } from '@/store/useVestingStore'
+import type { BusyKind, GrantDerived } from '@/store/useVestingStore'
 import { cn } from '@/utils/cn'
 import { formatDate, formatPct, relativeTime } from '@/utils/format'
 import { nextMilestone } from '@/utils/schedule'
 
+// `busy` is the exit this grant already has in flight. A dialog stays dismissible over the wallet
+// prompt, so dismissing it mid-flight would otherwise leave these controls offering a second write
+// against a contract the first is about to archive.
 interface GrantCardProps {
+  busy: BusyKind | undefined
   className?: string
   derived: GrantDerived
   grant: Grant
@@ -53,6 +57,7 @@ const scheduleMeta = (
 }
 
 export const GrantCard = ({
+  busy,
   grant,
   derived,
   role,
@@ -136,6 +141,7 @@ export const GrantCard = ({
               <Button
                 size="sm"
                 disabled={!derived.canClaim}
+                pending={busy !== undefined}
                 onClick={() => onClaim(grant)}
                 className="md:w-auto"
               >
@@ -165,6 +171,7 @@ export const GrantCard = ({
                 aria-label="Cancel grant"
                 size="icon"
                 variant="danger-ghost"
+                disabled={busy !== undefined}
                 onClick={() => onCancel(grant)}
               >
                 <Trash2 size={16} />
diff --git a/dapp/frontend/src/pages/Dashboard/index.tsx b/dapp/frontend/src/pages/Dashboard/index.tsx
index af2168f5..7e02b06e 100644
--- a/dapp/frontend/src/pages/Dashboard/index.tsx
+++ b/dapp/frontend/src/pages/Dashboard/index.tsx
@@ -30,7 +30,7 @@ import {
 import { addAmounts, isPositive } from '@/utils/amount'
 import { now, useNow } from '@/utils/clock'
 import { cn } from '@/utils/cn'
-import { AMT } from '@/utils/tokens'
+import { DBT } from '@/utils/tokens'
 
 interface GrantRow {
   derived: GrantDerived
@@ -79,6 +79,7 @@ export const Dashboard = (): React.JSX.Element => {
   const grants = useVestingStore((s) => s.grants)
   const claims = useVestingStore((s) => s.claims)
   const loading = useVestingStore((s) => s.loading)
+  const busy = useVestingStore((s) => s.busy)
   const withdraw = useVestingStore((s) => s.withdraw)
   const claimResidual = useVestingStore((s) => s.claimResidual)
   const cancel = useVestingStore((s) => s.cancel)
@@ -208,6 +209,7 @@ export const Dashboard = (): React.JSX.Element => {
               className={cn(grant.id === justClaimed && HIGHLIGHT)}
               onClaim={openClaim}
               onCancel={setCancelTarget}
+              busy={busy.get(grant.id)}
             />
           ))}
         </div>
@@ -220,7 +222,7 @@ export const Dashboard = (): React.JSX.Element => {
             <span className="font-mono text-xs text-fg-muted">
               {isPositive(residualClaimable) && (
                 <>
-                  <CompactAmount value={residualClaimable} /> {AMT.symbol} claimable
+                  <CompactAmount value={residualClaimable} /> {DBT.symbol} claimable
                 </>
               )}
             </span>
@@ -247,7 +249,11 @@ export const Dashboard = (): React.JSX.Element => {
                     className="text-lg font-semibold text-success"
                   />
                 </div>
-                <Button size="sm" onClick={() => openResidual(claim)}>
+                <Button
+                  size="sm"
+                  onClick={() => openResidual(claim)}
+                  pending={busy.get(claim.id) !== undefined}
+                >
                   Claim
                 </Button>
               </div>
@@ -259,7 +265,7 @@ export const Dashboard = (): React.JSX.Element => {
       {claimTarget !== null && (
         <Claim
           onClose={() => setClaimTarget(null)}
-          title={claimTarget.kind === 'grant' ? 'Claim vested AMT' : 'Claim residual'}
+          title={claimTarget.kind === 'grant' ? 'Claim vested DBT' : 'Claim residual'}
           available={claimTarget.available}
           backing={claimTarget.backing}
           onConfirm={onConfirmClaim}
@@ -271,7 +277,7 @@ export const Dashboard = (): React.JSX.Element => {
           onClose={() => setCancelTarget(null)}
           grant={cancelTarget}
           nowMs={nowMs}
-          description={`Vested-but-unclaimed AMT is set aside as a residual claim for ${partyHint(cancelTarget.receiver)}.`}
+          description={`Vested-but-unclaimed DBT is set aside as a residual claim for ${partyHint(cancelTarget.receiver)}.`}
           successMessage="Grant cancelled; earned residual set aside for the receiver"
           onConfirm={() => cancel(backend, partyId, cancelTarget.id)}
         />
diff --git a/dapp/frontend/src/pages/GrantDetail/MilestoneTimeline.tsx b/dapp/frontend/src/pages/GrantDetail/MilestoneTimeline.tsx
index 322f85d8..d421f5a5 100644
--- a/dapp/frontend/src/pages/GrantDetail/MilestoneTimeline.tsx
+++ b/dapp/frontend/src/pages/GrantDetail/MilestoneTimeline.tsx
@@ -3,7 +3,7 @@ import { multiplyByFraction } from '@/utils/amount'
 import { cn } from '@/utils/cn'
 import { formatDate } from '@/utils/format'
 import type { VestingSchedule } from '@/utils/schedule'
-import { AMT } from '@/utils/tokens'
+import { DBT } from '@/utils/tokens'
 
 interface MilestoneTimelineProps {
   nowMs: number
@@ -11,7 +11,7 @@ interface MilestoneTimelineProps {
   total: string
 }
 
-// Vertical list of milestone points with reached/pending state and the AMT unlocked
+// Vertical list of milestone points with reached/pending state and the DBT unlocked
 // at each step (delta of cumulative fractions).
 export const MilestoneTimeline = ({
   schedule,
@@ -57,7 +57,7 @@ export const MilestoneTimeline = ({
                 </span>
               </div>
               <div className="mt-0.5 font-mono text-xs text-fg-muted">
-                {formatDate(point.time)} · +<CompactAmount value={unlocked} /> {AMT.symbol}
+                {formatDate(point.time)} · +<CompactAmount value={unlocked} /> {DBT.symbol}
               </div>
             </div>
           </li>
diff --git a/dapp/frontend/src/pages/GrantDetail/index.tsx b/dapp/frontend/src/pages/GrantDetail/index.tsx
index 2fbfe686..51f016b8 100644
--- a/dapp/frontend/src/pages/GrantDetail/index.tsx
+++ b/dapp/frontend/src/pages/GrantDetail/index.tsx
@@ -32,6 +32,7 @@ export const GrantDetail = (): React.JSX.Element => {
   const { backend, partyId, sessionPending } = useVesting()
   const grant = useVestingStore((s) => s.grants.find((g) => g.id === id))
   const loading = useVestingStore((s) => s.loading)
+  const busy = useVestingStore((s) => s.busy)
   const withdraw = useVestingStore((s) => s.withdraw)
   const cancel = useVestingStore((s) => s.cancel)
   const [claimOpen, setClaimOpen] = useState(false)
@@ -85,6 +86,9 @@ export const GrantDetail = (): React.JSX.Element => {
   }
 
   const derived = deriveGrant(grant, nowMs)
+  // Either dialog stays dismissible over the wallet prompt, so without this the control behind it
+  // would offer a second write against a contract the first is about to archive.
+  const inFlight = busy.get(grant.id) !== undefined
   const isReceiver = grant.receiver === partyId
   const isCreator = grant.creator === partyId
   const isMilestone = grant.schedule.curve.kind === 'milestone'
@@ -112,12 +116,21 @@ export const GrantDetail = (): React.JSX.Element => {
             (derived.locked ? (
               <GrantLock className="self-center" />
             ) : (
-              <Button disabled={!derived.canClaim} onClick={() => setClaimOpen(true)}>
-                Claim <CompactAmount value={derived.claimable} plain /> AMT
+              <Button
+                disabled={!derived.canClaim}
+                pending={inFlight}
+                onClick={() => setClaimOpen(true)}
+              >
+                Claim <CompactAmount value={derived.claimable} plain /> DBT
               </Button>
             ))}
           {isCreator && (
-            <Button size="sm" variant="danger" onClick={() => setCancelOpen(true)}>
+            <Button
+              size="sm"
+              variant="danger"
+              disabled={inFlight}
+              onClick={() => setCancelOpen(true)}
+            >
               Cancel grant
             </Button>
           )}
@@ -227,7 +240,7 @@ export const GrantDetail = (): React.JSX.Element => {
       {claimOpen && (
         <Claim
           onClose={() => setClaimOpen(false)}
-          title="Claim vested AMT"
+          title="Claim vested DBT"
           available={derived.claimable}
           backing={grantBacking(grant)}
           onConfirm={async (amount) => {
@@ -246,7 +259,7 @@ export const GrantDetail = (): React.JSX.Element => {
           onClose={() => setCancelOpen(false)}
           grant={grant}
           nowMs={nowMs}
-          description="Vested-but-unclaimed AMT becomes a residual claim for the receiver; the contract is archived."
+          description="Vested-but-unclaimed DBT becomes a residual claim for the receiver; the contract is archived."
           successMessage="Grant cancelled"
           onConfirm={async () => {
             await cancel(backend, partyId, grant.id)
diff --git a/dapp/frontend/src/pages/PendingGrants/EndPendingGrant.tsx b/dapp/frontend/src/pages/PendingGrants/EndPendingGrant.tsx
new file mode 100644
index 00000000..a2c8d4d9
--- /dev/null
+++ b/dapp/frontend/src/pages/PendingGrants/EndPendingGrant.tsx
@@ -0,0 +1,78 @@
+import { useState } from 'react'
+import { AmountDisplay } from '@/components/AmountDisplay'
+import { Button } from '@/components/Button'
+import { Modal } from '@/components/Modal'
+import { useOnScreen } from '@/hooks/useOnScreen'
+import type { PendingGrant, Role } from '@/store/types'
+import { errorText } from '@/utils/errorText'
+import { toast } from '@/utils/toast'
+
+interface EndPendingGrantProps {
+  onClose: () => void
+  onConfirm: () => Promise<void>
+  pendingGrant: PendingGrant
+  role: Role
+}
+
+// The two ways an outstanding grant ends without being accepted, in one component: the ledger
+// choices differ only in who exercises them, and neither moves anything. Like CancelGrant it owns
+// the submit, toast, error and submitting lifecycle so the page does not.
+export const EndPendingGrant = ({
+  onClose,
+  onConfirm,
+  pendingGrant,
+  role,
+}: EndPendingGrantProps): React.JSX.Element => {
+  const [submitting, setSubmitting] = useState(false)
+  const funder = role === 'funder'
+  // Only the confirm button is disabled while a submission is in flight, so the dialog can still be
+  // dismissed over the wallet prompt; the toast still fires, because the choice did land.
+  const onScreen = useOnScreen()
+
+  const submit = async (): Promise<void> => {
+    setSubmitting(true)
+    try {
+      await onConfirm()
+      toast.success(funder ? 'Grant cancelled' : 'Grant declined')
+      if (onScreen.current) {
+        onClose()
+      }
+    } catch (err) {
+      toast.error(errorText(err))
+    } finally {
+      setSubmitting(false)
+    }
+  }
+
+  return (
+    <Modal
+      onClose={onClose}
+      title={funder ? 'Cancel grant' : 'Decline grant'}
+      description={
+        funder
+          ? 'The offer is withdrawn and the holding it reserves becomes spendable again. Nothing has vested, so the receiver is owed nothing.'
+          : 'The offer is declined for good and cannot be accepted later. Nothing moves: the funder keeps everything the grant reserved.'
+      }
+    >
+      <div className="flex flex-col gap-4">
+        <div className="rounded-xl border border-border bg-bg/40 p-4 text-sm">
+          <div className="flex justify-between">
+            <span className="text-fg-muted">
+              {funder ? 'Back to your balance' : 'Stays with the funder'}
+            </span>
+            <AmountDisplay value={pendingGrant.totalAmount} className="font-semibold" />
+          </div>
+        </div>
+        <Button
+          className="mt-2 w-full"
+          variant="danger"
+          size="sm"
+          onClick={() => void submit()}
+          pending={submitting}
+        >
+          {funder ? 'Cancel grant' : 'Decline grant'}
+        </Button>
+      </div>
+    </Modal>
+  )
+}
diff --git a/dapp/frontend/src/pages/PendingGrants/PendingGrantCard.tsx b/dapp/frontend/src/pages/PendingGrants/PendingGrantCard.tsx
index cb7270b5..cfd2e63f 100644
--- a/dapp/frontend/src/pages/PendingGrants/PendingGrantCard.tsx
+++ b/dapp/frontend/src/pages/PendingGrants/PendingGrantCard.tsx
@@ -7,23 +7,29 @@ import { InfoTip } from '@/components/InfoTip'
 import { ScheduleBar } from '@/components/ScheduleBar'
 import { StatusPill } from '@/components/StatusPill'
 import type { PendingGrant } from '@/store/types'
+import type { BusyKind } from '@/store/useVestingStore'
 import { formatDate, relativeTime } from '@/utils/format'
 import { vestedFraction } from '@/utils/schedule'
 
 // `direction` incoming means the acting party is the receiver and can accept; outgoing was sent as
-// funder.
+// funder. `busy` is the submission this grant already has in flight: whichever exit it names, both
+// controls are out until it settles, or the same grant could be accepted and declined at once.
 interface PendingGrantCardProps {
+  busy: BusyKind | undefined
   direction: 'incoming' | 'outgoing'
   nowMs: number
   onAccept: (pendingGrant: PendingGrant) => void
+  onEnd: (pendingGrant: PendingGrant) => void
   pendingGrant: PendingGrant
 }
 
 export const PendingGrantCard = ({
   pendingGrant,
   direction,
+  busy,
   nowMs,
   onAccept,
+  onEnd,
 }: PendingGrantCardProps): React.JSX.Element => {
   const curve = pendingGrant.schedule.curve
   const milestones = curve.kind === 'milestone' ? curve.points.map((p) => p.fraction) : undefined
@@ -73,11 +79,40 @@ export const PendingGrantCard = ({
           />
         </div>
         {direction === 'incoming' ? (
-          <Button size="sm" onClick={() => onAccept(pendingGrant)}>
-            Accept
-          </Button>
+          <div className="flex gap-2">
+            <Button
+              size="sm"
+              variant="danger-ghost"
+              className="flex-1 md:flex-none"
+              onClick={() => onEnd(pendingGrant)}
+              pending={busy === 'end'}
+              disabled={busy !== undefined}
+              aria-label={`Decline ${pendingGrant.title}`}
+            >
+              Decline
+            </Button>
+            <Button
+              size="sm"
+              className="flex-1 md:flex-none"
+              onClick={() => onAccept(pendingGrant)}
+              pending={busy === 'accept'}
+              disabled={busy !== undefined}
+              aria-label={`Accept ${pendingGrant.title}`}
+            >
+              Accept
+            </Button>
+          </div>
         ) : (
-          <span className="font-mono text-xs text-fg-muted">awaiting acceptance</span>
+          <Button
+            size="sm"
+            variant="danger-ghost"
+            onClick={() => onEnd(pendingGrant)}
+            pending={busy === 'end'}
+            disabled={busy !== undefined}
+            aria-label={`Cancel ${pendingGrant.title}`}
+          >
+            Cancel
+          </Button>
         )}
       </div>
     </Card>
diff --git a/dapp/frontend/src/pages/PendingGrants/index.tsx b/dapp/frontend/src/pages/PendingGrants/index.tsx
index 0eaabaa4..55f17c60 100644
--- a/dapp/frontend/src/pages/PendingGrants/index.tsx
+++ b/dapp/frontend/src/pages/PendingGrants/index.tsx
@@ -1,4 +1,4 @@
-import { useMemo } from 'react'
+import { useEffect, useMemo, useState } from 'react'
 import { Button } from '@/components/Button'
 import { ConnectPrompt } from '@/components/ConnectPrompt'
 import { EmptyState } from '@/components/EmptyState'
@@ -8,13 +8,20 @@ import { RoleSelect } from '@/components/RoleSelect'
 import { useCreateGrant } from '@/hooks/useCreateGrant'
 import { useDocumentTitle } from '@/hooks/useDocumentTitle'
 import { useRoleLens } from '@/hooks/useRoleLens'
+import { EndPendingGrant } from '@/pages/PendingGrants/EndPendingGrant'
 import { PendingGrantCard } from '@/pages/PendingGrants/PendingGrantCard'
-import type { PendingGrant } from '@/store/types'
+import type { PendingGrant, Role } from '@/store/types'
 import { useVesting, useVestingStore } from '@/store/useVestingStore'
 import { useNow } from '@/utils/clock'
 import { errorText } from '@/utils/errorText'
 import { toast } from '@/utils/toast'
 
+interface Ending {
+  partyId: string
+  pendingGrant: PendingGrant
+  role: Role
+}
+
 export const PendingGrants = (): React.JSX.Element => {
   useDocumentTitle('Pending Grants')
   const nowMs = useNow()
@@ -24,6 +31,19 @@ export const PendingGrants = (): React.JSX.Element => {
   const pendingGrants = useVestingStore((s) => s.pendingGrants)
   const loading = useVestingStore((s) => s.loading)
   const accept = useVestingStore((s) => s.accept)
+  // Captured at open, not read live: the role comes from a URL search param and the party from the
+  // wallet session, so either can flip under an open dialog (browser Back/Forward, an account
+  // change). This is what keeps the dialog's title and its write pinned to the grant it opened on.
+  const [ending, setEnding] = useState<Ending | undefined>(undefined)
+  const busy = useVestingStore((s) => s.busy)
+  const cancelProposal = useVestingStore((s) => s.cancelProposal)
+  const rejectProposal = useVestingStore((s) => s.rejectProposal)
+
+  // Pinning the party is only half of it: the grant belongs to the account that opened the dialog,
+  // so an account switch under it would submit as a party the wallet no longer holds. Close it.
+  useEffect(() => {
+    setEnding((current) => (current?.partyId === partyId ? current : undefined))
+  }, [partyId])
 
   const direction = role === 'receiver' ? 'incoming' : 'outgoing'
   const visible = useMemo<PendingGrant[]>(
@@ -39,6 +59,8 @@ export const PendingGrants = (): React.JSX.Element => {
     return sessionPending ? <Loading /> : <ConnectPrompt />
   }
 
+  // The accept owns its own toasts, where the two ends leave theirs to the dialog that confirmed
+  // them: this is the only one reached from the card itself.
   const onAccept = async (pendingGrant: PendingGrant): Promise<void> => {
     try {
       await accept(backend, partyId, pendingGrant.id)
@@ -48,6 +70,11 @@ export const PendingGrants = (): React.JSX.Element => {
     }
   }
 
+  const endGrant = (target: Ending): Promise<void> =>
+    target.role === 'funder'
+      ? cancelProposal(backend, target.partyId, target.pendingGrant.id)
+      : rejectProposal(backend, target.partyId, target.pendingGrant.id)
+
   return (
     <div className="flex flex-col gap-7">
       <PageTitle title="Pending Grants" lens={<RoleSelect value={role} onChange={setRole} />} />
@@ -74,10 +101,21 @@ export const PendingGrants = (): React.JSX.Element => {
               direction={direction}
               nowMs={nowMs}
               onAccept={(p) => void onAccept(p)}
+              onEnd={(p) => setEnding({ pendingGrant: p, role, partyId })}
+              busy={busy.get(pendingGrant.id)}
             />
           ))}
         </div>
       )}
+
+      {ending !== undefined && (
+        <EndPendingGrant
+          onClose={() => setEnding(undefined)}
+          pendingGrant={ending.pendingGrant}
+          role={ending.role}
+          onConfirm={() => endGrant(ending)}
+        />
+      )}
     </div>
   )
 }
diff --git a/dapp/frontend/src/providers/Backend.tsx b/dapp/frontend/src/providers/Backend.tsx
index 1fbd2630..d7599f7a 100644
--- a/dapp/frontend/src/providers/Backend.tsx
+++ b/dapp/frontend/src/providers/Backend.tsx
@@ -1,7 +1,17 @@
 import { useExecute, useLedger, useParty } from '@bootnodedev/canton-connect'
-import { createContext, type ReactNode, useContext, useEffect, useMemo, useState } from 'react'
+import {
+  createContext,
+  type ReactNode,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+} from 'react'
 import { type Deployment, loadBackendConfig } from '@/backend/config'
 import { LedgerBackend } from '@/backend/LedgerBackend'
+import type { RegistryInstrument } from '@/backend/registry'
 import type { VestingBackend } from '@/backend/VestingBackend'
 import { useWrongNetwork } from '@/hooks/useWrongNetwork'
 import { errorText } from '@/utils/errorText'
@@ -14,6 +24,10 @@ export interface BackendState {
   backend: VestingBackend | undefined
   configError: string | undefined
   configPending: boolean
+  // The one instrument this deployment vests, which is what tells the token catalogue which of its
+  // rows the app can act on. Undefined until the deployment is read.
+  instrument: RegistryInstrument | undefined
+  retryConfig: () => void
   sessionPending: boolean
   wrongNetwork: boolean
 }
@@ -29,6 +43,9 @@ const BackendContext = createContext<BackendState | undefined>(undefined)
 export const Backend = ({ children }: { children: ReactNode }): React.JSX.Element => {
   const [deployment, setDeployment] = useState<Deployment | undefined>(undefined)
   const [configError, setConfigError] = useState<string | undefined>(undefined)
+  // Only the newest load may write: a retry can be asked for while an earlier one is still in
+  // flight, and the effect's own teardown has no way to reach a call the callback started.
+  const generation = useRef(0)
   const { execute } = useExecute()
   const { ledgerApi } = useLedger()
   // A restored-but-locked session reports `connected` with no party, so the party is the gate: it
@@ -46,32 +63,52 @@ export const Backend = ({ children }: { children: ReactNode }): React.JSX.Elemen
     return () => clearTimeout(timer)
   }, [])
 
-  // The deployment is read off the ledger, so it cannot resolve before there is a session to read
-  // through. Until then it is not pending but absent, which is what leaves the pages free to render
-  // their own connect card.
-  useEffect(() => {
-    if (!hasParty) {
-      return
-    }
-    let cancelled = false
+  // A callback rather than effect-body code because the error card offers it again: half the
+  // deployment comes from the registry, a separately restarted process, so a failure here outlives
+  // neither the party nor the ledger transport and nothing else would ever retry it. The error is
+  // cleared on entry, so a retry that succeeds cannot leave the shell reporting the failure it
+  // replaced.
+  const loadConfig = useCallback(() => {
+    const attempt = ++generation.current
+    setConfigError(undefined)
 
     void loadBackendConfig(ledgerApi).then(
       (config) => {
-        if (!cancelled) {
+        if (generation.current === attempt) {
           setDeployment(config)
         }
       },
       (err: unknown) => {
-        if (!cancelled) {
+        if (generation.current === attempt) {
           setConfigError(errorText(err))
         }
       },
     )
+  }, [ledgerApi])
+
+  // The registry half of the deployment needs no session, but it shares this one call with the
+  // ledger half, which does, so until there is a party the deployment is not pending but absent,
+  // which leaves the pages free to render their own connect card. Keyed on the id rather than on
+  // merely having one, because the deployment is read as that party: a wallet switching accounts
+  // with no disconnect between would otherwise keep the previous account's factory, and the id
+  // being a string is what still makes re-pushing the same account a no-op.
+  useEffect(() => {
+    if (partyId === undefined) {
+      // Cleared, not merely left alone: a reconnect against another participant would otherwise
+      // build a backend from the previous deployment for a render, long enough for a write to carry
+      // the old factory, and an error card left standing would hold the shell where a session that
+      // no longer exists cannot retry it.
+      generation.current += 1
+      setDeployment(undefined)
+      setConfigError(undefined)
+      return
+    }
+    loadConfig()
 
     return () => {
-      cancelled = true
+      generation.current += 1
     }
-  }, [hasParty, ledgerApi])
+  }, [partyId, loadConfig])
 
   // Its own memo, because the grace timer below flips a purely visual flag: sharing one would mint a
   // new backend identity mid-session and re-run every read that keys off it.
@@ -83,15 +120,34 @@ export const Backend = ({ children }: { children: ReactNode }): React.JSX.Elemen
     [deployment, execute, hasParty, ledgerApi],
   )
 
+  const instrument = useMemo<RegistryInstrument | undefined>(
+    () =>
+      deployment === undefined
+        ? undefined
+        : { admin: deployment.admin, instrumentId: deployment.instrumentId },
+    [deployment],
+  )
+
   const value = useMemo<BackendState>(
     () => ({
       backend,
       configPending: hasParty && deployment === undefined && configError === undefined,
       configError,
+      instrument,
+      retryConfig: loadConfig,
       sessionPending: checkingSession && !hasParty,
       wrongNetwork,
     }),
-    [backend, checkingSession, configError, deployment, hasParty, wrongNetwork],
+    [
+      backend,
+      checkingSession,
+      configError,
+      deployment,
+      hasParty,
+      instrument,
+      loadConfig,
+      wrongNetwork,
+    ],
   )
 
   return <BackendContext.Provider value={value}>{children}</BackendContext.Provider>
diff --git a/dapp/frontend/src/providers/Tokens.tsx b/dapp/frontend/src/providers/Tokens.tsx
index 873bde5f..34b92237 100644
--- a/dapp/frontend/src/providers/Tokens.tsx
+++ b/dapp/frontend/src/providers/Tokens.tsx
@@ -1,6 +1,7 @@
 import {
   type Instrument,
   type InstrumentBalance,
+  type InstrumentId,
   mergeTokens,
   type PartialToken,
   readInstruments,
@@ -19,12 +20,13 @@ import {
   useRef,
   useState,
 } from 'react'
+import type { RegistryInstrument } from '@/backend/registry'
 import { useParty } from '@/hooks/useParty'
 import { useBackend } from '@/providers/Backend'
 import { addAmounts, subtractAmounts } from '@/utils/amount'
 import { type AssetListEntry, readAssetList } from '@/utils/assetList'
 import { ASSET_LIST_NETWORK, ASSET_LIST_URL, REGISTRY_URL } from '@/utils/config'
-import { AMT, isAmulet, tokenLogo } from '@/utils/tokens'
+import { DBT, tokenLogo } from '@/utils/tokens'
 
 const fromCurated = (entries: readonly AssetListEntry[]): readonly PartialToken[] =>
   entries.map(({ instrumentId, logoUrl, symbol }) => ({
@@ -36,22 +38,33 @@ const fromCurated = (entries: readonly AssetListEntry[]): readonly PartialToken[
 const fromRegistries = (instruments: readonly Instrument[]): readonly PartialToken[] =>
   instruments.map(({ instrumentId, name, symbol }) => ({ instrumentId, name, symbol }))
 
-const fromApp = (rows: readonly PartialToken[]): readonly PartialToken[] =>
+// A shared participant can hold another admin's instrument under the same id, so both halves of
+// the pair are compared. Nothing matches until the deployment is read.
+const isVested = (id: InstrumentId, instrument: RegistryInstrument | undefined): boolean =>
+  instrument !== undefined && id.admin === instrument.admin && id.id === instrument.instrumentId
+
+// The registry's metadata carries no artwork, so the one instrument this app vests gets its mark
+// here; every other row keeps whatever its own source gave it.
+const fromApp = (
+  rows: readonly PartialToken[],
+  instrument: RegistryInstrument | undefined,
+): readonly PartialToken[] =>
   rows
-    .filter(({ instrumentId }) => isAmulet(instrumentId))
-    .map(({ instrumentId }) => ({ instrumentId, logo: AMT.logo }))
+    .filter(({ instrumentId }) => isVested(instrumentId, instrument))
+    .map(({ instrumentId }) => ({ instrumentId, logo: DBT.logo }))
 
 // The figures this app can act on, which are not the ledger's: what is free to fund a grant is the
-// balance, and coin a pending grant pledged joins the escrowed coin as locked. The three still sum
-// to everything held, so the row hides nothing.
+// balance, and a holding a pending grant reserves joins the escrowed one as locked. The three still
+// sum to everything held, so the row hides nothing.
 const fromVesting = (
   held: readonly InstrumentBalance[],
   free: string | undefined,
+  instrument: RegistryInstrument | undefined,
 ): readonly PartialToken[] =>
   free === undefined
     ? []
     : held
-        .filter(({ instrumentId }) => isAmulet(instrumentId))
+        .filter(({ instrumentId }) => isVested(instrumentId, instrument))
         .map(({ balance, instrumentId, locked }) => ({
           balance: free,
           instrumentId,
@@ -79,7 +92,7 @@ const FiguresContext = createContext<TokenFigures | undefined>(undefined)
 
 export const Tokens = ({ children }: { children: ReactNode }): React.JSX.Element => {
   const { error: holdingsError, holdings, refetch: refetchHoldings } = useHoldings()
-  const { backend } = useBackend()
+  const { backend, instrument } = useBackend()
   const { party } = useParty()
   const partyId = party?.partyId
   const [instruments, setInstruments] = useState<readonly Instrument[]>([])
@@ -167,12 +180,16 @@ export const Tokens = ({ children }: { children: ReactNode }): React.JSX.Element
       fromRegistries(instruments),
       held,
     ]
-    const rows = mergeTokens([...sources, fromApp(sources.flat()), fromVesting(held, free)])
+    const rows = mergeTokens([
+      ...sources,
+      fromApp(sources.flat(), instrument),
+      fromVesting(held, free, instrument),
+    ])
     // The read enumerates every holding, so once it answers, a token missing from it is one the
     // party holds none of rather than one nobody asked about.
     if (holdings === undefined) return rows
     return rows.map((row) => (row.balance === undefined ? { ...row, balance: '0' } : row))
-  }, [curated, free, holdings, instruments])
+  }, [curated, free, holdings, instrument, instruments])
 
   return (
     <FiguresContext.Provider value={figures}>
diff --git a/dapp/frontend/src/store/useVestingStore.test.ts b/dapp/frontend/src/store/useVestingStore.test.ts
index 83558413..13fa2d07 100644
--- a/dapp/frontend/src/store/useVestingStore.test.ts
+++ b/dapp/frontend/src/store/useVestingStore.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import type { VestingBackend, VestingView } from '@/backend/VestingBackend'
-import type { Grant } from '@/store/types'
+import type { Grant, PendingGrant } from '@/store/types'
 import { deriveGrant, grantBacking, grantLineage, useVestingStore } from '@/store/useVestingStore'
 import { toNumber } from '@/utils/amount'
 
@@ -233,3 +233,50 @@ describe('useVestingStore.withdraw', () => {
     expect(next).toBe('g2')
   })
 })
+
+describe('useVestingStore.cancelProposal and rejectProposal', () => {
+  const pending = (): PendingGrant => ({
+    id: 'p1',
+    title: 'Advisor grant',
+    provider: 'p::1',
+    proposer: 'c::1',
+    receiver: 'r::1',
+    totalAmount: '1000',
+    schedule: {
+      cliff: '2025-06-01T00:00:00Z',
+      curve: { kind: 'linear', start: '2025-01-01T00:00:00Z', end: '2026-01-01T00:00:00Z' },
+    },
+  })
+
+  // The ledger archived the proposal, so the view read after the write no longer carries it.
+  const endedBackend = (calls: string[]): VestingBackend =>
+    ({
+      viewAs: async () => ({ grants: [], pendingGrants: [], claims: [] }),
+      cancelProposal: async (args: { proposer: string; pendingCid: string }) => {
+        calls.push(`cancel ${args.proposer} ${args.pendingCid}`)
+      },
+      rejectProposal: async (args: { receiver: string; pendingCid: string }) => {
+        calls.push(`reject ${args.receiver} ${args.pendingCid}`)
+      },
+    }) as unknown as VestingBackend
+
+  it('cancels as the funder and re-reads the view', async () => {
+    const calls: string[] = []
+    useVestingStore.setState({ pendingGrants: [pending()] })
+
+    await useVestingStore.getState().cancelProposal(endedBackend(calls), 'c::1', 'p1')
+
+    expect(calls).toEqual(['cancel c::1 p1'])
+    expect(useVestingStore.getState().pendingGrants).toEqual([])
+  })
+
+  it('rejects as the receiver and re-reads the view', async () => {
+    const calls: string[] = []
+    useVestingStore.setState({ pendingGrants: [pending()] })
+
+    await useVestingStore.getState().rejectProposal(endedBackend(calls), 'r::1', 'p1')
+
+    expect(calls).toEqual(['reject r::1 p1'])
+    expect(useVestingStore.getState().pendingGrants).toEqual([])
+  })
+})
diff --git a/dapp/frontend/src/store/useVestingStore.ts b/dapp/frontend/src/store/useVestingStore.ts
index 0842194b..629b84dc 100644
--- a/dapp/frontend/src/store/useVestingStore.ts
+++ b/dapp/frontend/src/store/useVestingStore.ts
@@ -114,7 +114,13 @@ const trackSuccessor = <T extends { id: string }>(
   return (after) => after.find((item) => !seen.has(item.id) && lineageOf(item) === lineage)?.id
 }
 
+// Which exit a contract already has in flight. Every dialog here stays dismissible over the wallet
+// prompt, so one can unmount with its submission still out, and the control behind it would then
+// offer the same exit again on a contract the first is about to archive.
+export type BusyKind = 'accept' | 'cancel' | 'claim' | 'end'
+
 interface VestingState {
+  busy: ReadonlyMap<string, BusyKind>
   claims: VestedClaim[]
   error: string | undefined
   grants: Grant[]
@@ -123,6 +129,7 @@ interface VestingState {
 
   accept: (backend: VestingBackend, partyId: string, pendingCid: string) => Promise<void>
   cancel: (backend: VestingBackend, partyId: string, contractCid: string) => Promise<void>
+  cancelProposal: (backend: VestingBackend, partyId: string, pendingCid: string) => Promise<void>
   claimResidual: (
     backend: VestingBackend,
     partyId: string,
@@ -132,6 +139,7 @@ interface VestingState {
   clear: () => void
   createVesting: (backend: VestingBackend, partyId: string, input: CreateVestInput) => Promise<void>
   refresh: (backend: VestingBackend, partyId: string) => Promise<void>
+  rejectProposal: (backend: VestingBackend, partyId: string, pendingCid: string) => Promise<void>
   withdraw: (
     backend: VestingBackend,
     partyId: string,
@@ -144,73 +152,108 @@ interface VestingState {
 // resolve last and clobber the fresh view.
 let refreshEpoch = 0
 
-export const useVestingStore = create<VestingState>((set, get) => ({
-  grants: [],
-  pendingGrants: [],
-  claims: [],
-  loading: false,
-  error: undefined,
-
-  // Bumps the epoch too, so a read in flight for the party being dropped cannot land after it.
-  clear: () => {
-    refreshEpoch++
-    set({ grants: [], pendingGrants: [], claims: [], loading: false, error: undefined })
-  },
-
-  refresh: async (backend, partyId) => {
-    const epoch = ++refreshEpoch
-    set({ loading: true, error: undefined })
+export const useVestingStore = create<VestingState>((set, get) => {
+  // Held by the store rather than by the page that opened the dialog, because leaving the route
+  // unmounts a page while its submission is still in flight.
+  const busyWith = async <T>(id: string, kind: BusyKind, run: () => Promise<T>): Promise<T> => {
+    set((state) => ({ busy: new Map(state.busy).set(id, kind) }))
     try {
-      const view = await backend.viewAs(partyId)
-      if (epoch !== refreshEpoch) {
-        return
-      }
-      set({
-        grants: sortBy(view.grants, grantLineage),
-        pendingGrants: sortBy(view.pendingGrants, (pendingGrant) => pendingGrant.id),
-        claims: sortBy(view.claims, claimLineage),
-        loading: false,
+      return await run()
+    } finally {
+      set((state) => {
+        const next = new Map(state.busy)
+        next.delete(id)
+        return { busy: next }
       })
-    } catch (err) {
-      if (epoch !== refreshEpoch) {
-        return
-      }
-      set({ loading: false, error: errorText(err) })
     }
-  },
-
-  createVesting: async (backend, partyId, input) => {
-    await backend.createVesting(input)
-    await get().refresh(backend, partyId)
-  },
-
-  accept: async (backend, partyId, pendingCid) => {
-    await backend.accept({ receiver: partyId, pendingCid })
-    await get().refresh(backend, partyId)
-  },
-
-  // Returns the successor's contract id, since the claim replaced the one the caller passed.
-  withdraw: async (backend, partyId, contractCid, amount) => {
-    const successor = trackSuccessor(get().grants, contractCid, grantLineage)
-    await backend.withdraw({ receiver: partyId, contractCid, amount })
-    await get().refresh(backend, partyId)
-    return successor(get().grants)
-  },
-
-  cancel: async (backend, partyId, contractCid) => {
-    await backend.cancel({ creator: partyId, contractCid })
-    await get().refresh(backend, partyId)
-  },
-
-  // Like withdraw, except a drained claim is archived outright rather than re-created, so undefined
-  // here means there is nothing left to point at.
-  claimResidual: async (backend, partyId, claimCid, amount) => {
-    const successor = trackSuccessor(get().claims, claimCid, claimLineage)
-    await backend.claimResidual({ receiver: partyId, claimCid, amount })
-    await get().refresh(backend, partyId)
-    return successor(get().claims)
-  },
-}))
+  }
+
+  return {
+    busy: new Map(),
+    grants: [],
+    pendingGrants: [],
+    claims: [],
+    loading: false,
+    error: undefined,
+
+    // Bumps the epoch too, so a read in flight for the party being dropped cannot land after it.
+    // `busy` survives: a submission the wallet still holds outlives the party that opened it.
+    clear: () => {
+      refreshEpoch++
+      set({ grants: [], pendingGrants: [], claims: [], loading: false, error: undefined })
+    },
+
+    refresh: async (backend, partyId) => {
+      const epoch = ++refreshEpoch
+      set({ loading: true, error: undefined })
+      try {
+        const view = await backend.viewAs(partyId)
+        if (epoch !== refreshEpoch) {
+          return
+        }
+        set({
+          grants: sortBy(view.grants, grantLineage),
+          pendingGrants: sortBy(view.pendingGrants, (pendingGrant) => pendingGrant.id),
+          claims: sortBy(view.claims, claimLineage),
+          loading: false,
+        })
+      } catch (err) {
+        if (epoch !== refreshEpoch) {
+          return
+        }
+        set({ loading: false, error: errorText(err) })
+      }
+    },
+
+    createVesting: async (backend, partyId, input) => {
+      await backend.createVesting(input)
+      await get().refresh(backend, partyId)
+    },
+
+    accept: (backend, partyId, pendingCid) =>
+      busyWith(pendingCid, 'accept', async () => {
+        await backend.accept({ receiver: partyId, pendingCid })
+        await get().refresh(backend, partyId)
+      }),
+
+    cancelProposal: (backend, partyId, pendingCid) =>
+      busyWith(pendingCid, 'end', async () => {
+        await backend.cancelProposal({ proposer: partyId, pendingCid })
+        await get().refresh(backend, partyId)
+      }),
+
+    rejectProposal: (backend, partyId, pendingCid) =>
+      busyWith(pendingCid, 'end', async () => {
+        await backend.rejectProposal({ receiver: partyId, pendingCid })
+        await get().refresh(backend, partyId)
+      }),
+
+    // Returns the successor's contract id, since the claim replaced the one the caller passed.
+    withdraw: (backend, partyId, contractCid, amount) =>
+      busyWith(contractCid, 'claim', async () => {
+        const successor = trackSuccessor(get().grants, contractCid, grantLineage)
+        await backend.withdraw({ receiver: partyId, contractCid, amount })
+        await get().refresh(backend, partyId)
+        return successor(get().grants)
+      }),
+
+    cancel: (backend, partyId, contractCid) =>
+      busyWith(contractCid, 'cancel', async () => {
+        await backend.cancel({ creator: partyId, contractCid })
+        await get().refresh(backend, partyId)
+      }),
+
+    // Like withdraw, except a drained claim is archived outright rather than re-created, so undefined
+    // here means there is nothing left to point at.
+    claimResidual: (backend, partyId, claimCid, amount) =>
+      busyWith(claimCid, 'claim', async () => {
+        const successor = trackSuccessor(get().claims, claimCid, claimLineage)
+        await backend.claimResidual({ receiver: partyId, claimCid, amount })
+        await get().refresh(backend, partyId)
+        return successor(get().claims)
+      }),
+  }
+})
 
 // Wires the store to the context backend + acting party and re-reads the ACS whenever either
 // changes. Components call this once near the top of a page; an undefined backend means no
diff --git a/dapp/frontend/src/utils/config.ts b/dapp/frontend/src/utils/config.ts
index f4574da7..f5310a66 100644
--- a/dapp/frontend/src/utils/config.ts
+++ b/dapp/frontend/src/utils/config.ts
@@ -4,9 +4,8 @@ import type { ExplorerConfig } from '@bootnodedev/canton-dappbooster'
 /** @public */
 export const EXPLORER: ExplorerConfig = { baseUrl: import.meta.env.VITE_EXPLORER_URL }
 
-export const WALLET_RPC_URL: string = import.meta.env.VITE_WALLET_RPC_URL
-
-export const REGISTRY_URL = '/registry'
+// Direct in dev; #169 fronts it same-origin: an https page cannot reach a plain-http registry.
+export const REGISTRY_URL: string = import.meta.env.VITE_REGISTRY_URL
 
 // The published list plus a LocalNet entry, served by the dev server: `vite.config.ts`.
 export const ASSET_LIST_URL = '/assets.json'
diff --git a/dapp/frontend/src/utils/env.test.ts b/dapp/frontend/src/utils/env.test.ts
index 35567b58..75d25f73 100644
--- a/dapp/frontend/src/utils/env.test.ts
+++ b/dapp/frontend/src/utils/env.test.ts
@@ -3,7 +3,7 @@ import { parseEnv } from '@/utils/env'
 
 const DEFAULTS = {
   VITE_EXPLORER_URL: 'http://scan.localhost:4000',
-  VITE_WALLET_RPC_URL: 'http://localhost:3010/rpc',
+  VITE_REGISTRY_URL: 'http://localhost:3013',
 }
 
 describe('parseEnv', () => {
@@ -22,7 +22,7 @@ describe('parseEnv', () => {
 
   // An unset var in a .env file reaches Vite as an empty string, not as a missing key, so it is a
   // mistake to report rather than a request for the default.
-  it.each(['VITE_EXPLORER_URL', 'VITE_WALLET_RPC_URL'])(
+  it.each(['VITE_EXPLORER_URL', 'VITE_REGISTRY_URL'])(
     'names %s and rejects an empty value',
     (key) => {
       expect(() => parseEnv({ ...DEFAULTS, [key]: '' })).toThrow(new RegExp(key))
@@ -41,12 +41,39 @@ describe('parseEnv', () => {
     },
   )
 
-  // The deployed spelling: `fetch` resolves it against the page, so it is same-origin.
-  it('accepts a same-origin path as the rpc url', () => {
-    expect(parseEnv({ ...DEFAULTS, VITE_WALLET_RPC_URL: '/api/rpc' })).toEqual({
-      ...DEFAULTS,
-      VITE_WALLET_RPC_URL: '/api/rpc',
-    })
+  it('rejects a source that is not an object', () => {
+    expect(() => parseEnv(undefined)).toThrow()
+  })
+
+  it.each(Object.keys(DEFAULTS) as (keyof typeof DEFAULTS)[])(
+    'refuses to fall back to the local default for %s without them',
+    (key) => {
+      expect(() => parseEnv({ ...DEFAULTS, [key]: undefined }, false)).toThrow(
+        /must be set explicitly/,
+      )
+    },
+  )
+
+  it('takes an explicit value without the local defaults', () => {
+    const deployed = {
+      VITE_EXPLORER_URL: 'https://scan.example',
+      VITE_REGISTRY_URL: '/api/registry',
+    }
+    expect(parseEnv(deployed, false)).toEqual(deployed)
+  })
+})
+
+describe('VITE_REGISTRY_URL', () => {
+  it('defaults to the local registry port', () => {
+    expect(parseEnv({}).VITE_REGISTRY_URL).toBe('http://localhost:3013')
+  })
+
+  it('accepts a same-origin path, which is what a deployed build sets', () => {
+    expect(parseEnv({ VITE_REGISTRY_URL: '/api/registry' }).VITE_REGISTRY_URL).toBe('/api/registry')
+  })
+
+  it('rejects a value that is neither a url nor a path', () => {
+    expect(() => parseEnv({ VITE_REGISTRY_URL: 'registry' })).toThrow(/VITE_REGISTRY_URL/)
   })
 
   // Leading-slash spellings the URL parser still resolves to somebody else's origin.
@@ -56,13 +83,25 @@ describe('parseEnv', () => {
     '/\\/evil.example/rpc',
     '/\t/evil.example/rpc',
     '/\n/evil.example/rpc',
-    'api/rpc',
+    'api/registry',
     'javascript:alert(1)',
-  ])('rejects %j as the rpc url', (VITE_WALLET_RPC_URL) => {
-    expect(() => parseEnv({ ...DEFAULTS, VITE_WALLET_RPC_URL })).toThrow(/VITE_WALLET_RPC_URL/)
+  ])('rejects %j as the registry url', (VITE_REGISTRY_URL) => {
+    expect(() => parseEnv({ ...DEFAULTS, VITE_REGISTRY_URL })).toThrow(/VITE_REGISTRY_URL/)
   })
 
-  it('rejects a source that is not an object', () => {
-    expect(() => parseEnv(undefined)).toThrow()
+  // A base, not an endpoint: every caller appends a path, so a trailing slash would request
+  // `//registry/...` and 404 against a path the thrown message would then misreport.
+  it.each([
+    ['http://localhost:3013/', 'http://localhost:3013'],
+    ['http://localhost:3013///', 'http://localhost:3013'],
+    ['/api/registry/', '/api/registry'],
+  ])('trims the trailing slash off %j', (VITE_REGISTRY_URL, expected) => {
+    expect(parseEnv({ VITE_REGISTRY_URL }).VITE_REGISTRY_URL).toBe(expected)
+  })
+
+  // Accepted by `isUrlOrPath` but nothing once trimmed, which would resolve every call against the
+  // app's own origin and hand `response.json()` the SPA catch-all's `index.html`.
+  it.each(['/', '///'])('rejects %j, which trims away to no base at all', (VITE_REGISTRY_URL) => {
+    expect(() => parseEnv({ VITE_REGISTRY_URL })).toThrow(/VITE_REGISTRY_URL/)
   })
 })
diff --git a/dapp/frontend/src/utils/env.ts b/dapp/frontend/src/utils/env.ts
index 6039751a..b91af183 100644
--- a/dapp/frontend/src/utils/env.ts
+++ b/dapp/frontend/src/utils/env.ts
@@ -1,11 +1,11 @@
 export interface Env {
   VITE_EXPLORER_URL: string
-  VITE_WALLET_RPC_URL: string
+  VITE_REGISTRY_URL: string
 }
 
 const DEFAULTS: Env = {
   VITE_EXPLORER_URL: 'http://scan.localhost:4000',
-  VITE_WALLET_RPC_URL: 'http://localhost:3010/rpc',
+  VITE_REGISTRY_URL: 'http://localhost:3013',
 }
 
 const isHttpUrl = (value: string): boolean => {
@@ -20,36 +20,58 @@ const ORIGIN = 'https://same.origin.invalid'
 const isSameOriginPath = (value: string): boolean =>
   value.startsWith('/') && new URL(value, ORIGIN).origin === ORIGIN
 
-const isRpcUrl = (value: string): boolean => isSameOriginPath(value) || isHttpUrl(value)
+const isUrlOrPath = (value: string): boolean => isSameOriginPath(value) || isHttpUrl(value)
 
-// Reads one env key and validates it
+// The registry value is a base every call appends a path to, and `isUrlOrPath` accepts a trailing
+// slash, which would request `//registry/...` and 404 against a path the error then misreports.
+const trimBase = (value: string): string => value.replace(/\/+$/, '')
+
+// Reads one env key, normalizing before the check so the value validated is the value returned: a
+// base of `/` trims to nothing, and unchecked it would resolve every call against the app's origin.
 const read = (
   values: Record<string, unknown>,
   key: keyof Env,
   accepts: (value: string) => boolean,
   expected: string,
+  localDefaults: boolean,
+  normalize: (value: string) => string = (value) => value,
 ): string => {
-  const value = values[key] ?? DEFAULTS[key]
+  const raw = values[key] ?? (localDefaults ? DEFAULTS[key] : undefined)
+  if (raw === undefined) {
+    throw new Error(`Invalid environment: ${key} must be set explicitly, e.g. ${DEFAULTS[key]}`)
+  }
+  const value = typeof raw === 'string' ? normalize(raw) : raw
   if (typeof value !== 'string' || !accepts(value)) {
     throw new Error(`Invalid environment: ${key} must be ${expected}, e.g. ${DEFAULTS[key]}`)
   }
   return value
 }
 
-// Validates the build's environment
-export const parseEnv = (source: unknown): Env => {
+// Validates the build's environment. `localDefaults` is off for a production build, where a value
+// left unset must fail the build instead: these are baked into the bundle, an https page blocks a
+// http://localhost call as mixed content before any request leaves, and localhost would mean the
+// viewer's own machine anyway, so the default can only produce a deployment nobody can use.
+export const parseEnv = (source: unknown, localDefaults = true): Env => {
   if (typeof source !== 'object' || source === null) {
     throw new Error('Invalid environment: expected the variables as an object')
   }
   const values = source as Record<string, unknown>
 
   return {
-    VITE_EXPLORER_URL: read(values, 'VITE_EXPLORER_URL', isHttpUrl, 'an http(s) url'),
-    VITE_WALLET_RPC_URL: read(
+    VITE_EXPLORER_URL: read(
+      values,
+      'VITE_EXPLORER_URL',
+      isHttpUrl,
+      'an http(s) url',
+      localDefaults,
+    ),
+    VITE_REGISTRY_URL: read(
       values,
-      'VITE_WALLET_RPC_URL',
-      isRpcUrl,
+      'VITE_REGISTRY_URL',
+      isUrlOrPath,
       'an http(s) url or a same-origin path',
+      localDefaults,
+      trimBase,
     ),
   }
 }
diff --git a/dapp/frontend/src/utils/toast.test.ts b/dapp/frontend/src/utils/toast.test.ts
index 2d18354f..663ba200 100644
--- a/dapp/frontend/src/utils/toast.test.ts
+++ b/dapp/frontend/src/utils/toast.test.ts
@@ -7,7 +7,7 @@ describe('toast lifetime', () => {
   })
 
   it('lets a plain toast time out on the shared duration', () => {
-    toast.success('Claimed 250 AMT')
+    toast.success('Claimed 250 DBT')
     expect(toaster.getVisibleToasts()[0].duration).toBe(3200)
   })
 
diff --git a/dapp/frontend/src/utils/tokens.tsx b/dapp/frontend/src/utils/tokens.tsx
index 9ed097cb..41741589 100644
--- a/dapp/frontend/src/utils/tokens.tsx
+++ b/dapp/frontend/src/utils/tokens.tsx
@@ -1,20 +1,16 @@
-import type { InstrumentId } from '@bootnodedev/canton-dappbooster'
-import cantonCoin from '@/assets/canton-coin.png'
-
-// The id the Amulet registry serves. The admin party is the network's own DSO, so it is read off
-// the holdings rather than written down here.
-const AMULET_ID = 'Amulet'
-
-export const isAmulet = ({ id }: InstrumentId): boolean => id === AMULET_ID
+import type { TokenMeta } from '@bootnodedev/canton-dappbooster'
+import { TokenMark } from '@/icons'
 
 // The kit's logo slot is 2rem with `overflow: hidden`, so artwork has to be told to fit.
 export const tokenLogo = (src: string): React.JSX.Element => (
   <img alt="" className="size-full object-contain" src={src} />
 )
 
-// The artwork is the Canton Coin mark.
-export const AMT = {
-  logo: tokenLogo(cantonCoin),
-  name: 'Amulet',
-  symbol: 'AMT',
+// The instrument this deployment vests, as the app spells it in its own copy and marks. It carries
+// no `instrumentId`: the admin is minted per bootstrap run, so the identity comes from the registry
+// through `useBackend().instrument` and this is only the artwork and the words.
+export const DBT: TokenMeta & { name: string } = {
+  logo: <TokenMark className="size-full" />,
+  name: 'dAppBooster Token',
+  symbol: 'DBT',
 }
diff --git a/dapp/frontend/tsconfig.node.json b/dapp/frontend/tsconfig.node.json
index 62ee2118..06780885 100644
--- a/dapp/frontend/tsconfig.node.json
+++ b/dapp/frontend/tsconfig.node.json
@@ -20,5 +20,5 @@
     "noFallthroughCasesInSwitch": true,
     "noUncheckedSideEffectImports": true
   },
-  "include": ["api/*.ts", "vite.config.ts", "src/utils/env.ts"]
+  "include": ["api/**/*.ts", "vite.config.ts", "src/utils/env.ts"]
 }
diff --git a/dapp/frontend/vercel.json b/dapp/frontend/vercel.json
index f24f6385..f5765bd9 100644
--- a/dapp/frontend/vercel.json
+++ b/dapp/frontend/vercel.json
@@ -2,7 +2,10 @@
   "$schema": "https://openapi.vercel.sh/vercel.json",
   "framework": "vite",
   "installCommand": "pnpm install",
-  "buildCommand": "cd ../.. && pnpm -r --filter '!./dapp/daml' run --if-present build",
+  "buildCommand": "cd ../.. && DEPLOYED_BUILD=1 pnpm build",
   "outputDirectory": "dist",
-  "rewrites": [{ "source": "/:path((?!api/).*)", "destination": "/index.html" }]
+  "rewrites": [
+    { "source": "/api/registry/:path*", "destination": "/api/registry?path=/:path*" },
+    { "source": "/:path((?!api/).*)", "destination": "/index.html" }
+  ]
 }
diff --git a/dapp/frontend/vite.config.ts b/dapp/frontend/vite.config.ts
index 031f5a37..9a8ef179 100644
--- a/dapp/frontend/vite.config.ts
+++ b/dapp/frontend/vite.config.ts
@@ -8,65 +8,26 @@ import { parseEnv } from './src/utils/env'
 
 // The empty prefix loads every key in the root `.env`, so only what `parseEnv` returns may be
 // defined back, never the loaded object.
-// LocalNet serves the token registry behind the validator's authenticated prefix, so the browser
-// cannot read it: the bearer stays here, in the dev server, and the page asks its own origin.
-const REGISTRY_PROXY = '/registry'
-const LOCALNET_REGISTRY = 'http://localhost:2000/api/validator/v0/scan-proxy'
-
-// `loadEnv` reads a key present but set to nothing as an empty string, which is a `.env` asking for
-// the default rather than an address to reach: `new URL('')` throws and takes the dev server with it.
-const address = (value: string | undefined, fallback: string): string =>
-  value === undefined || value === '' ? fallback : value
-
-const registryTarget = (values: Record<string, string>) => {
-  const upstream = new URL(address(values.SPLICE_REGISTRY_API_URL, LOCALNET_REGISTRY))
-  const token = values.CANTON_BACKEND_TOKEN ?? ''
-  return {
-    changeOrigin: true,
-    headers: token === '' ? {} : { Authorization: `Bearer ${token}` },
-    rewrite: (path: string) => path.replace(REGISTRY_PROXY, upstream.pathname.replace(/\/$/, '')),
-    target: upstream.origin,
-  }
-}
-
 const ASSET_LIST_ROUTE = '/assets.json'
 const PUBLISHED_LIST =
   'https://raw.githubusercontent.com/canton-network/wallet/main/api-specs/assets.json'
-const LOCALNET_SCAN = 'http://scan.localhost:4000/api/scan'
 
 const json = async (url: string): Promise<unknown> => (await fetch(url)).json()
 
-// The published list covers no LocalNet, and a LocalNet's DSO party is minted with the stack, so
-// the entry is read off the running scan here rather than every developer committing their own.
-// Either half missing costs labels and nothing else, so a stack that is down still serves a list.
-const localnetAssets = (values: Record<string, string>): Plugin => ({
+// The published list covers no LocalNet. This stack's own instrument is not written down here: the
+// token registry serves it, and `providers/Tokens.tsx` reads it from there. What the section is
+// for is the rest of the catalogue, so a list missing entirely costs labels and nothing else.
+const localnetAssets = (): Plugin => ({
   apply: 'serve',
   configureServer: (server) => {
     server.middlewares.use(ASSET_LIST_ROUTE, async (_request, response) => {
-      const scan = address(values.SPLICE_SCAN_API_URL, LOCALNET_SCAN)
-      const [published, dso] = await Promise.all([
-        json(PUBLISHED_LIST).catch(() => ({})) as Promise<Record<string, unknown>>,
-        json(`${scan}/v0/dso-party-id`)
-          .then((body) => (body as { dso_party_id?: string }).dso_party_id)
-          .catch(() => undefined),
-      ])
-      const amulet = {
-        instrumentId: { admin: dso, id: 'Amulet' },
-        registryURLs: [REGISTRY_PROXY],
-        symbol: 'CC',
-      }
+      const published = (await json(PUBLISHED_LIST).catch(() => ({}))) as Record<string, unknown>
       // The published DevNet entries land in the LocalNet section too, so a local list is a real
       // catalogue rather than the one token this stack issues. DevNet rather than every network,
       // because the three carry the same instruments under a DSO party each.
       const devnet = published.DevNet
-      const all = Array.isArray(devnet) ? devnet : []
       response.setHeader('content-type', 'application/json')
-      response.end(
-        JSON.stringify({
-          ...published,
-          LocalNet: [...(dso === undefined ? [] : [amulet]), ...all],
-        }),
-      )
+      response.end(JSON.stringify({ ...published, LocalNet: Array.isArray(devnet) ? devnet : [] }))
     })
   },
   name: 'localnet-asset-list',
@@ -74,8 +35,12 @@ const localnetAssets = (values: Record<string, string>): Plugin => ({
 
 export default defineConfig(({ mode }) => {
   const envDir = fileURLToPath(new URL('../..', import.meta.url))
-  const loaded = loadEnv(mode, envDir, '')
-  const env = parseEnv(loaded)
+  // A build that is going to be served takes no localhost fallback: an unset key fails here rather
+  // than shipping a bundle that points at the viewer's own machine. The deployer declares which kind
+  // of build this is, `vercel.json` for the one project that serves this bundle, because nothing
+  // here can tell: `mode` is production for CI's compile check too, which has no `.env` and deploys
+  // nothing, while a vendor's own variable leaves every other host silently on the fallback.
+  const env = parseEnv(loadEnv(mode, envDir, ''), process.env.DEPLOYED_BUILD !== '1')
 
   return {
     define: Object.fromEntries(
@@ -84,7 +49,7 @@ export default defineConfig(({ mode }) => {
     // Without this a leftover `dapp/frontend/.env.local` is still loaded, silently losing to the
     // root for exactly the keys defined above.
     envDir,
-    plugins: [react(), tailwindcss(), localnetAssets(loaded)],
+    plugins: [react(), tailwindcss(), localnetAssets()],
     resolve: {
       alias: {
         '@': fileURLToPath(new URL('./src', import.meta.url)),
@@ -93,7 +58,6 @@ export default defineConfig(({ mode }) => {
     server: {
       host: 'localhost',
       port: 3012,
-      proxy: { [REGISTRY_PROXY]: registryTarget(loaded) },
       strictPort: true,
     },
     // jsdom despite no DOM assertions: the wallet SDK touches DOM globals on import.
diff --git a/kit/check-anatomy.mjs b/kit/check-anatomy.mjs
index 153b031f..499b145d 100644
--- a/kit/check-anatomy.mjs
+++ b/kit/check-anatomy.mjs
@@ -16,7 +16,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import postcss from 'postcss'
 import ts from 'typescript'
-import { createGate, repoRoot } from '../scripts/lib/gate.mjs'
+import { createGate, repoRoot } from './gate.mjs'
 
 // A provider is here because ThemeProvider writes `data-theme` to <html>: it renders no markup, but
 // it does place a selector the theme keys on, so it owes an anatomy like any component.
diff --git a/kit/check-versions.mjs b/kit/check-versions.mjs
index 06fc2603..803dbc16 100644
--- a/kit/check-versions.mjs
+++ b/kit/check-versions.mjs
@@ -12,7 +12,7 @@
 import { readFileSync } from 'node:fs'
 import path from 'node:path'
 import ts from 'typescript'
-import { createGate, repoRoot } from '../scripts/lib/gate.mjs'
+import { createGate, repoRoot } from './gate.mjs'
 import { DEPENDENCY_FIELDS, libraryNames, ROOT_MANIFEST, readManifests } from './manifests.mjs'
 
 // The gate's contract is `file:line message`, and JSON.parse keeps no positions, so the line comes
diff --git a/kit/docs-check.mjs b/kit/docs-check.mjs
index 1749a3ec..e1fa422b 100644
--- a/kit/docs-check.mjs
+++ b/kit/docs-check.mjs
@@ -13,7 +13,7 @@
 import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import ts from 'typescript'
-import { createGate, repoRoot } from '../scripts/lib/gate.mjs'
+import { createGate, repoRoot } from './gate.mjs'
 
 const readJson = (file) => JSON.parse(readFileSync(file, 'utf8'))
 
diff --git a/scripts/lib/gate.mjs b/kit/gate.mjs
similarity index 97%
rename from scripts/lib/gate.mjs
rename to kit/gate.mjs
index 0be9e279..d556e0e4 100644
--- a/scripts/lib/gate.mjs
+++ b/kit/gate.mjs
@@ -4,7 +4,7 @@
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-export const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..')
+export const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
 
 export const createGate = (name) => {
   const findings = []
diff --git a/kit/manifests.mjs b/kit/manifests.mjs
index b5e0b00c..94ae98ed 100644
--- a/kit/manifests.mjs
+++ b/kit/manifests.mjs
@@ -4,7 +4,7 @@
 
 import fs from 'node:fs'
 import path from 'node:path'
-import { repoRoot } from '../scripts/lib/gate.mjs'
+import { repoRoot } from './gate.mjs'
 
 export const ROOT_MANIFEST = 'package.json'
 
@@ -31,7 +31,7 @@ export const readManifests = () =>
 
 /**
  * The published libraries, by package name. A workspace manifest is one unless it is private,
- * which is what leaves the root, `dapp/frontend` and `dapp/daml` out of the lockstep.
+ * which is what leaves the root and `dapp/frontend` out of the lockstep.
  */
 export const libraryNames = (manifests) =>
   new Set(
diff --git a/kit/release-version.mjs b/kit/release-version.mjs
index 7c82b572..7a1df273 100644
--- a/kit/release-version.mjs
+++ b/kit/release-version.mjs
@@ -12,7 +12,7 @@
 import { execFileSync } from 'node:child_process'
 import fs from 'node:fs'
 import path from 'node:path'
-import { repoRoot } from '../scripts/lib/gate.mjs'
+import { repoRoot } from './gate.mjs'
 import { DEPENDENCY_FIELDS, libraryNames, ROOT_MANIFEST, readManifests } from './manifests.mjs'
 
 // semver.org's own regex, minus the named groups: a build-metadata or prerelease version has to
diff --git a/kit/release-version.test.mjs b/kit/release-version.test.mjs
index d0700529..7519d53b 100644
--- a/kit/release-version.test.mjs
+++ b/kit/release-version.test.mjs
@@ -2,8 +2,8 @@ import assert from 'node:assert/strict'
 import { describe, it } from 'node:test'
 import { isPrerelease, parseVersion, rewriteManifests } from './release-version.mjs'
 
-// The workspace in miniature: a private root, two published libraries, one private consumer that
-// depends on both, and a private package that depends on neither.
+// The workspace in miniature: a private root, two published libraries, and one private consumer
+// that depends on both.
 const manifests = {
   'package.json': { name: 'cn-dappbooster', private: true, version: '0.3.0' },
   'canton-connect/package.json': { name: '@bootnodedev/canton-connect', version: '0.3.0' },
@@ -13,7 +13,6 @@ const manifests = {
     devDependencies: { '@bootnodedev/canton-connect': '^0.3.0', tsdown: '^0.22.14' },
     peerDependencies: { '@bootnodedev/canton-connect': '^0.3.0', react: '^19.0.0' },
   },
-  'dapp/daml/package.json': { name: '@canton-dappbooster/daml', private: true, version: '0.3.0' },
   'dapp/frontend/package.json': {
     name: '@canton-dappbooster/frontend',
     private: true,
@@ -33,8 +32,7 @@ describe('release version rewriting', () => {
     assert.equal(next['package.json'].version, '0.4.0')
     assert.equal(next['canton-connect/package.json'].version, '0.4.0')
     assert.equal(next['canton-dappbooster/package.json'].version, '0.4.0')
-    // Private, so it keeps its own version: the DAR is named by dapp/daml/daml.yaml.
-    assert.equal(next['dapp/daml/package.json'].version, '0.3.0')
+    // Private, so it keeps its own version even though its ranges are rewritten.
     assert.equal(next['dapp/frontend/package.json'].version, '0.3.0')
   })
 
diff --git a/knip.json b/knip.json
index 34a98595..4891f4fa 100644
--- a/knip.json
+++ b/knip.json
@@ -1,8 +1,11 @@
 {
   "$schema": "https://unpkg.com/knip@6/schema.json",
   "ignoreExportsUsedInFile": true,
-  "ignoreDependencies": ["@bootnodedev/canton-wallet-service", "postcss"],
-  "ignoreWorkspaces": ["dapp/daml"],
+  "ignoreDependencies": [
+    "@bootnodedev/canton-token-forge",
+    "@bootnodedev/canton-wallet-service",
+    "postcss"
+  ],
   "workspaces": {
     ".": {
       "entry": ["scripts/**/*.mjs!", "kit/**/*.mjs!", ".lintstagedrc.format.mjs"]
@@ -14,7 +17,7 @@
       "entry": ["src/**/*.test.{ts,tsx}", "scripts/*.mjs!"]
     },
     "dapp/frontend": {
-      "entry": ["api/*.ts"]
+      "entry": ["api/**/*.ts"]
     }
   }
 }
diff --git a/package.json b/package.json
index 0e7ed96c..0b16c637 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,6 @@
   "scripts": {
     "app:dev": "pnpm -C dapp/frontend run dev",
     "bootstrap": "node --env-file-if-exists=.env scripts/bootstrap-vesting.mjs",
-    "build-dar": "pnpm -C dapp/daml run build",
     "build": "pnpm -r run --if-present build",
     "check:anatomy": "node kit/check-anatomy.mjs",
     "check:versions": "node kit/check-versions.mjs",
@@ -31,6 +30,7 @@
   "devDependencies": {
     "@biomejs/biome": "2.5.11",
     "@bootnodedev/canton-barebones": "0.5.0",
+    "@bootnodedev/canton-token-forge": "github:BootNodeDev/canton-token-forge#v0.3.0",
     "@bootnodedev/canton-wallet-service": "^0.3.0",
     "@commitlint/cli": "^21.0.1",
     "@commitlint/config-conventional": "^21.0.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 0ff8c7aa..500a79f5 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -14,6 +14,9 @@ importers:
       '@bootnodedev/canton-barebones':
         specifier: 0.5.0
         version: 0.5.0
+      '@bootnodedev/canton-token-forge':
+        specifier: github:BootNodeDev/canton-token-forge#v0.3.0
+        version: https://codeload.github.com/BootNodeDev/canton-token-forge/tar.gz/1639372eb66941e505aa52399d00b8b4121953f7(@types/json-schema@7.0.15)(supports-color@7.2.0)
       '@bootnodedev/canton-wallet-service':
         specifier: ^0.3.0
         version: 0.3.0(supports-color@7.2.0)
@@ -160,8 +163,6 @@ importers:
 
   canton-theme: {}
 
-  dapp/daml: {}
-
   dapp/frontend:
     dependencies:
       '@ark-ui/react':
@@ -240,6 +241,12 @@ packages:
   '@adraffy/ens-normalize@1.11.1':
     resolution: {integrity: sha512-nhCBV3quEgesuf7c7KYfperqSS14T8bYuvJ8PcLJp6znkZpFc0AuW4qBtr8eKVyPPe/8RSr7sglCWPU5eaxwKQ==}
 
+  '@apidevtools/json-schema-ref-parser@14.2.1':
+    resolution: {integrity: sha512-HmdFw9CDYqM6B25pqGBpNeLCKvGPlIx1EbLrVL0zPvj50CJQUHyBNBw45Muk0kEIkogo1VZvOKHajdMuAzSxRg==}
+    engines: {node: '>= 20'}
+    peerDependencies:
+      '@types/json-schema': ^7.0.15
+
   '@ark-ui/react@5.39.1':
     resolution: {integrity: sha512-QiEyu2AwECSxViSy+DIF+0yT0OSLvZurzc65o2gyaGVfUBxt4RZMWpIKI6F9WgvGcrYFUAIyLpCUvjS9tmdDQg==}
     peerDependencies:
@@ -345,6 +352,12 @@ packages:
     engines: {node: '>=22'}
     hasBin: true
 
+  '@bootnodedev/canton-token-forge@https://codeload.github.com/BootNodeDev/canton-token-forge/tar.gz/1639372eb66941e505aa52399d00b8b4121953f7':
+    resolution: {gitHosted: true, integrity: sha512-vnxpItMo7nPZGu9F5y93gYVVLwkepeTY8BRIpPH1wgSyXLC7MS7rrEiCnI/tku0PBStMPVzcGb3adkvO8mZXkw==, tarball: https://codeload.github.com/BootNodeDev/canton-token-forge/tar.gz/1639372eb66941e505aa52399d00b8b4121953f7}
+    version: 0.3.0
+    engines: {node: '>=20'}
+    hasBin: true
+
   '@bootnodedev/canton-wallet-service@0.3.0':
     resolution: {integrity: sha512-C+cT4UBUpivKZBW1DPt16+0ySTwTN1tsgcWjyKqvsaYLpli1KGXWMSWuVijdtIzln/ff89S+8J2ygCvp1sMD5Q==}
     engines: {node: '>=24.15.0'}
@@ -683,6 +696,9 @@ packages:
   '@js-sdsl/ordered-map@4.4.2':
     resolution: {integrity: sha512-iUKgm52T8HOE/makSxjqoWhe95ZJA1/G1sYsGev2JDKUSS14KAgg1LHb+Ba+IPow0xflbnSkOsZcO08C7w1gYw==}
 
+  '@jsdevtools/ono@7.1.3':
+    resolution: {integrity: sha512-4JQNk+3mVzK3xh2rqd6RB4J46qUR19azEHBneZyTZM+c456qOrbbM/5xcR8huNCCcbVt7+UmizG6GuUvPvKUYg==}
+
   '@lit-labs/ssr-dom-shim@1.6.0':
     resolution: {integrity: sha512-VHb0ALPMTlgKjM6yIxxoQNnpKyUKLD04VzeQdsiXkMqkvYlAHxq9glGLmgbb889/1GsohSOAjvQYoiBppXFqrQ==}
 
@@ -1297,9 +1313,15 @@ packages:
   '@types/aria-query@5.0.4':
     resolution: {integrity: sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw==}
 
+  '@types/body-parser@1.19.6':
+    resolution: {integrity: sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==}
+
   '@types/chai@5.2.3':
     resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
 
+  '@types/connect@3.4.38':
+    resolution: {integrity: sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==}
+
   '@types/debug@4.1.13':
     resolution: {integrity: sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==}
 
@@ -1309,21 +1331,42 @@ packages:
   '@types/estree@1.0.9':
     resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
 
+  '@types/express-serve-static-core@5.1.3':
+    resolution: {integrity: sha512-dPfW8NFiOF4wOHc7+N/QSxlY9cfSsenewGbAz8C8U/MULPd/YZ27LvJUIlzaXie7e6Ove9YunJGgC9tbHD2cKw==}
+
+  '@types/express@5.0.6':
+    resolution: {integrity: sha512-sKYVuV7Sv9fbPIt/442koC7+IIwK5olP1KWeD88e/idgoJqDm3JV/YUiPwkoKK92ylff2MGxSz1CSjsXelx0YA==}
+
   '@types/hast@3.0.5':
     resolution: {integrity: sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==}
 
+  '@types/http-errors@2.0.5':
+    resolution: {integrity: sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==}
+
+  '@types/json-schema@7.0.15':
+    resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
+
   '@types/lodash@4.17.25':
     resolution: {integrity: sha512-+K1NIO8I+F9/wNulfVvu23QYd0Pe9/OCqRrim4NoYIf1VoEDL90Ve4ClzpyqBLc7NpGGWRvYNCKZ1BE/Jpf8dQ==}
 
   '@types/ms@2.1.0':
     resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
 
+  '@types/multer@2.2.0':
+    resolution: {integrity: sha512-3U1troeqGV8Ntp7Q3klwf4zr23VEoqYVocYXaswm9+8z3O9UHDYAqLxjJ/h550iRADTjKdOdhhasXw6gD6kYtg==}
+
   '@types/node@25.9.5':
     resolution: {integrity: sha512-OScDchr2fwuUmWdf4kZ9h7PcJiYDVInhJizG/biAq3cAvqwYktuy/TYGGdZNMtNTFUP7rnb0NU4TUdm82kt4Rg==}
 
   '@types/node@26.4.0':
     resolution: {integrity: sha512-faiGnoIrLH/V8cibOMEAZ8pMw6oXqSukl29ra4mN8GdaB2ZewzeaLj+INpV5N+Z1eKWzY+IzaIZH2EIR6YZRNQ==}
 
+  '@types/qs@6.15.1':
+    resolution: {integrity: sha512-GZHUBZR9hckSUhrxmp1nG6NwdpM9fCunJwyThLW1X3AyHgd9IlHb6VANpQQqDr2o/qQp6McZ3y/IA2rVzKzSbw==}
+
+  '@types/range-parser@1.2.7':
+    resolution: {integrity: sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==}
+
   '@types/react-dom@19.2.5':
     resolution: {integrity: sha512-fMPwH9v7r/pp43yUd2/Mbiex5KouJwwR3dzHkhLREUC6764VyDsqxhAxv6OFEYR1RhjOyD1naqba8ECDBe7ZQg==}
     peerDependencies:
@@ -1332,6 +1375,12 @@ packages:
   '@types/react@19.2.18':
     resolution: {integrity: sha512-AnzbBERsrLKtk2XSfTbYRLjQPdy116Sty4q+T+Bp3IC4l6jNBvreVPAHmpq9qhXQM7CXZPjLVmGMw9sy+hxQ3w==}
 
+  '@types/send@1.2.1':
+    resolution: {integrity: sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ==}
+
+  '@types/serve-static@2.2.0':
+    resolution: {integrity: sha512-8mam4H1NHLtu7nmtalF7eyBH14QyOASmcxHhSfEoRyr0nP/YdoesEtU+uSRvMe96TW/HPTtkoKqQLl53N7UXMQ==}
+
   '@types/trusted-types@2.0.7':
     resolution: {integrity: sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==}
 
@@ -1850,10 +1899,30 @@ packages:
       zod:
         optional: true
 
+  accepts@1.3.8:
+    resolution: {integrity: sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==}
+    engines: {node: '>= 0.6'}
+
   accepts@2.0.0:
     resolution: {integrity: sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==}
     engines: {node: '>= 0.6'}
 
+  ajv-draft-04@1.0.0:
+    resolution: {integrity: sha512-mv00Te6nmYbRp5DCwclxtt7yV/joXJPGS7nM+97GdxvuttCOfgI3K4U25zboyeX0O+myI8ERluxQe5wljMmVIw==}
+    peerDependencies:
+      ajv: ^8.5.0
+    peerDependenciesMeta:
+      ajv:
+        optional: true
+
+  ajv-formats@3.0.1:
+    resolution: {integrity: sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==}
+    peerDependencies:
+      ajv: ^8.0.0
+    peerDependenciesMeta:
+      ajv:
+        optional: true
+
   ajv@8.20.0:
     resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==}
 
@@ -1885,6 +1954,9 @@ packages:
     resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
     engines: {node: '>= 8'}
 
+  append-field@1.0.0:
+    resolution: {integrity: sha512-klpgFSWLW1ZEs8svjfb7g4qWY0YS5imI82dTg+QahUvJ8YqAY0P10Uk8tTyh9ZGuYEZEMaeJYCF5BFuX552hsw==}
+
   argparse@2.0.1:
     resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
 
@@ -1899,6 +1971,9 @@ packages:
     resolution: {integrity: sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==}
     engines: {node: '>= 0.4'}
 
+  array-flatten@1.1.1:
+    resolution: {integrity: sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==}
+
   assertion-error@2.0.1:
     resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
     engines: {node: '>=12'}
@@ -1926,6 +2001,10 @@ packages:
   blakejs@1.2.1:
     resolution: {integrity: sha512-QXUSXI3QVc/gJME0dBpXrag1kbzOqCjCX8/b54ntNyW6sjtoqxqRk3LTmXzaJoh71zMsDCjM+47jS7XiwN/+fQ==}
 
+  body-parser@1.20.8:
+    resolution: {integrity: sha512-JNcyFQ64OiijEkPzUBTCe+hyPXUD/3LEldGQ6iF5LR1w00mx9o7xtDWHXBY2iItjdCFGoilOLNQbH943ut7pHA==}
+    engines: {node: '>= 0.8', npm: 1.2.8000 || >= 1.4.16}
+
   body-parser@2.3.0:
     resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==}
     engines: {node: '>=18'}
@@ -1945,6 +2024,13 @@ packages:
     resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==}
     engines: {node: 20 || >=22}
 
+  buffer-from@1.1.2:
+    resolution: {integrity: sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==}
+
+  busboy@1.6.0:
+    resolution: {integrity: sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==}
+    engines: {node: '>=10.16.0'}
+
   bytes@3.1.2:
     resolution: {integrity: sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==}
     engines: {node: '>= 0.8'}
@@ -2006,6 +2092,14 @@ packages:
   colorette@2.0.20:
     resolution: {integrity: sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==}
 
+  concat-stream@2.0.0:
+    resolution: {integrity: sha512-MWufYdFw53ccGjCA+Ol7XJYpAlW6/prSMzuPOTRnJGcGzuhLn4Scrz7qf6o8bROZ514ltazcIFJZevcfbo0x7A==}
+    engines: {'0': node >= 6.0}
+
+  content-disposition@0.5.4:
+    resolution: {integrity: sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==}
+    engines: {node: '>= 0.6'}
+
   content-disposition@1.1.0:
     resolution: {integrity: sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==}
     engines: {node: '>=18'}
@@ -2037,6 +2131,9 @@ packages:
   cookie-es@1.2.3:
     resolution: {integrity: sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw==}
 
+  cookie-signature@1.0.7:
+    resolution: {integrity: sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==}
+
   cookie-signature@1.2.2:
     resolution: {integrity: sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==}
     engines: {node: '>=6.6.0'}
@@ -2098,6 +2195,14 @@ packages:
   dayjs@1.11.23:
     resolution: {integrity: sha512-QDTCU0M0MxR3hQfnlDJfwekQiaanm1ubOD231u73WBckQ/fsamwRLiE2GBz6D3a/xF1NgfiDLJjXBa1hYOYTtQ==}
 
+  debug@2.6.9:
+    resolution: {integrity: sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
   debug@4.4.3:
     resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
     engines: {node: '>=6.0'}
@@ -2128,6 +2233,10 @@ packages:
   destr@2.0.5:
     resolution: {integrity: sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==}
 
+  destroy@1.2.0:
+    resolution: {integrity: sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==}
+    engines: {node: '>= 0.8', npm: 1.2.8000 || >= 1.4.16}
+
   detect-browser@5.3.0:
     resolution: {integrity: sha512-53rsFbGdwMwlF7qvCt0ypLM5V5/Mbl0szB7GPN8y9NCcbknYOeVVXdrXEq+90IwAfrrzt6Hd+u2E2ntakICU8w==}
 
@@ -2144,6 +2253,10 @@ packages:
   dom-accessibility-api@0.6.3:
     resolution: {integrity: sha512-7ZgogeTnjuHbo+ct10G9Ffp0mif17idi0IyWNVA/wcwcm7NPOD/WEHVP3n7n3MhXqxoIYm8d6MuZohYWIZ4T3w==}
 
+  dotenv@16.6.1:
+    resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
+    engines: {node: '>=12'}
+
   dotenv@17.4.2:
     resolution: {integrity: sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==}
     engines: {node: '>=12'}
@@ -2249,6 +2362,15 @@ packages:
     resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==}
     engines: {node: '>=12.0.0'}
 
+  express-openapi-validator@5.6.2:
+    resolution: {integrity: sha512-fkDn4+ImUC4HTJ1g0cek/ItqYhmEO19AglJd2Iw2OJco0jLIbxIlDGVazmXbvvYeziU4Bnah2h+S2tb6NtWg8w==}
+    peerDependencies:
+      express: '*'
+
+  express@4.22.2:
+    resolution: {integrity: sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==}
+    engines: {node: '>= 0.10.0'}
+
   express@5.2.1:
     resolution: {integrity: sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==}
     engines: {node: '>= 18'}
@@ -2277,6 +2399,10 @@ packages:
       picomatch:
         optional: true
 
+  finalhandler@1.3.2:
+    resolution: {integrity: sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==}
+    engines: {node: '>= 0.8'}
+
   finalhandler@2.1.1:
     resolution: {integrity: sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==}
     engines: {node: '>= 18.0.0'}
@@ -2294,6 +2420,10 @@ packages:
     resolution: {integrity: sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==}
     engines: {node: '>= 0.6'}
 
+  fresh@0.5.2:
+    resolution: {integrity: sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==}
+    engines: {node: '>= 0.6'}
+
   fresh@2.0.0:
     resolution: {integrity: sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==}
     engines: {node: '>= 0.8'}
@@ -2381,6 +2511,10 @@ packages:
     engines: {node: '>=18'}
     hasBin: true
 
+  iconv-lite@0.4.24:
+    resolution: {integrity: sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==}
+    engines: {node: '>=0.10.0'}
+
   iconv-lite@0.7.3:
     resolution: {integrity: sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==}
     engines: {node: '>=0.10.0'}
@@ -2669,6 +2803,13 @@ packages:
   lodash.camelcase@4.3.0:
     resolution: {integrity: sha512-TwuEnCnxbc3rAvhf/LbG7tJUDzhqXyFnv3dtzLOPgCG/hODL7WFnsbwktkD7yUV0RrreP/l1PALq/YSg6VvjlA==}
 
+  lodash.clonedeep@4.5.0:
+    resolution: {integrity: sha512-H5ZhCF25riFd9uB5UCkVKo61m3S/xZk1x4wA6yp/L3RFP6Z/eHH1ymQcGLo7J3GMPfm0V/7m1tryHuGVxpqEBQ==}
+
+  lodash.get@4.4.2:
+    resolution: {integrity: sha512-z+Uw/vLuy6gQe8cfaFWD7p0wVv8fJl3mbzXh33RS+0oW2wvUqiRXiQ69gLWSLpgB5/6sU+r6BlQR0MBILadqTQ==}
+    deprecated: This package is deprecated. Use the optional chaining (?.) operator instead.
+
   lodash.isequal@4.5.0:
     resolution: {integrity: sha512-pDo3lu8Jhfjqls6GkMgpahsF9kCyayhgykjyLMNFTKWrpVdAQtYyB4muAMWozBB4ig/dtWAmsMxLEI8wuz+DYQ==}
     deprecated: This package is deprecated. Use require('node:util').isDeepStrictEqual instead.
@@ -2723,25 +2864,49 @@ packages:
   mdurl@2.1.0:
     resolution: {integrity: sha512-1+HBaOx0zi/dQWht8rNv9MYf9qqpqL/kxI0hXImU6Y547zM6Sni8BQibt7ifgMcYtQg41ao3Ivd6cnSM86inpg==}
 
+  media-typer@0.3.0:
+    resolution: {integrity: sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==}
+    engines: {node: '>= 0.6'}
+
   media-typer@1.1.1:
     resolution: {integrity: sha512-yz3xRaG20c6/BOzvYoDaGtPmGscs7YivItZEEqe6GbwNfHuxu9YNmvnEkMzKldAGY4/80pRcQRZSEnhquk9XuQ==}
     engines: {node: '>= 0.8'}
 
+  merge-descriptors@1.0.3:
+    resolution: {integrity: sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==}
+
   merge-descriptors@2.0.0:
     resolution: {integrity: sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==}
     engines: {node: '>=18'}
 
+  methods@1.1.2:
+    resolution: {integrity: sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==}
+    engines: {node: '>= 0.6'}
+
   micro-ftch@0.3.1:
     resolution: {integrity: sha512-/0LLxhzP0tfiR5hcQebtudP56gUurs2CLkGarnCiB/OqEyUFQ6U3paQi/tgLv0hBJYt2rnr9MNpxz4fiiugstg==}
 
+  mime-db@1.52.0:
+    resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
+    engines: {node: '>= 0.6'}
+
   mime-db@1.54.0:
     resolution: {integrity: sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==}
     engines: {node: '>= 0.6'}
 
+  mime-types@2.1.35:
+    resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
+    engines: {node: '>= 0.6'}
+
   mime-types@3.0.2:
     resolution: {integrity: sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==}
     engines: {node: '>=18'}
 
+  mime@1.6.0:
+    resolution: {integrity: sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==}
+    engines: {node: '>=4'}
+    hasBin: true
+
   min-indent@1.0.1:
     resolution: {integrity: sha512-I9jwMn07Sy/IwOj3zVkVik2JTvgpaykDZEigL6Rx6N9LbMywwUSMtxET+7lVoDLLd3O3IXwJwvuuns8UB/HeAg==}
     engines: {node: '>=4'}
@@ -2753,9 +2918,16 @@ packages:
   minimist@1.2.8:
     resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
 
+  ms@2.0.0:
+    resolution: {integrity: sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==}
+
   ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
 
+  multer@2.3.0:
+    resolution: {integrity: sha512-cjNbm3sttszgZeGfJR124D+jFEfkXCVAsoPBmFn9X7UxmDSFHWqE2CoEj0vrmSpuAFnqWR1Szcm9QTsiHr60Xw==}
+    engines: {node: '>= 10.16.0'}
+
   multiformats@9.9.0:
     resolution: {integrity: sha512-HoMUjhH9T8DDBNT+6xzkrd9ga/XiBI4xLr58LJACwK6G3HTOPeMz4nB4KJs33L2BelrIJa7P0VuNaVF3hMYfjg==}
 
@@ -2764,6 +2936,10 @@ packages:
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
+  negotiator@0.6.3:
+    resolution: {integrity: sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==}
+    engines: {node: '>= 0.6'}
+
   negotiator@1.1.0:
     resolution: {integrity: sha512-NMPBRMJgiQHjbd8phG3Vebdx4kZ1H121rbl5IkMqeOsahptB9BKo/d7oJ3zTXqTgagn2bWlNSXkh0QUGM31RYg==}
     engines: {node: '>=18'}
@@ -2804,6 +2980,9 @@ packages:
   once@1.4.0:
     resolution: {integrity: sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==}
 
+  ono@7.1.3:
+    resolution: {integrity: sha512-9jnfVriq7uJM4o5ganUY54ntUm+5EK21EGaQ5NWnkWg3zz5ywbbonlBguRcnmF1/HDiIe3zxNxXcO1YPBmPcQQ==}
+
   openapi-fetch@0.15.2:
     resolution: {integrity: sha512-rdYTzUmSsJevmNqg7fwUVGuKc2Gfb9h6ph74EVPkPfIGJaZTfqdIbJahtbJ3qg1LKinln30hqZniLnKpH0RJBg==}
 
@@ -2865,6 +3044,9 @@ packages:
     resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
     engines: {node: '>=8'}
 
+  path-to-regexp@0.1.13:
+    resolution: {integrity: sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==}
+
   path-to-regexp@8.4.2:
     resolution: {integrity: sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==}
 
@@ -2955,6 +3137,10 @@ packages:
     engines: {node: '>=10.13.0'}
     hasBin: true
 
+  qs@6.15.3:
+    resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==}
+    engines: {node: '>=0.6'}
+
   qs@6.16.0:
     resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==}
     engines: {node: '>=0.6'}
@@ -2972,10 +3158,18 @@ packages:
   radix3@1.1.2:
     resolution: {integrity: sha512-b484I/7b8rDEdSDKckSSBA8knMpcdsXudlE/LNL639wFoHKwLbEkQFZHWEYwDC0wa0FKUcCY+GAF73Z7wxNVFA==}
 
+  range-parser@1.2.1:
+    resolution: {integrity: sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==}
+    engines: {node: '>= 0.6'}
+
   range-parser@1.3.0:
     resolution: {integrity: sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==}
     engines: {node: '>= 0.6'}
 
+  raw-body@2.5.3:
+    resolution: {integrity: sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==}
+    engines: {node: '>= 0.8'}
+
   raw-body@3.0.2:
     resolution: {integrity: sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==}
     engines: {node: '>= 0.10'}
@@ -3009,6 +3203,10 @@ packages:
     resolution: {integrity: sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==}
     engines: {node: '>=0.10.0'}
 
+  readable-stream@3.6.2:
+    resolution: {integrity: sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==}
+    engines: {node: '>= 6'}
+
   readdirp@5.1.1:
     resolution: {integrity: sha512-Kko+Y5XQ6fM+Ce3dq3m9YGxnacYZYl9cA1wZjaF3Vbry2L3i1qVg8+CAgNPsXRArPMUMCaOR7oa9Nqntc43JKA==}
     engines: {node: '>= 20.19.0'}
@@ -3074,6 +3272,9 @@ packages:
     resolution: {integrity: sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==}
     engines: {node: '>= 18'}
 
+  safe-buffer@5.2.1:
+    resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
+
   safe-stable-stringify@2.5.0:
     resolution: {integrity: sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==}
     engines: {node: '>=10'}
@@ -3096,10 +3297,18 @@ packages:
     engines: {node: '>=10'}
     hasBin: true
 
+  send@0.19.2:
+    resolution: {integrity: sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==}
+    engines: {node: '>= 0.8.0'}
+
   send@1.2.1:
     resolution: {integrity: sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==}
     engines: {node: '>= 18'}
 
+  serve-static@1.16.3:
+    resolution: {integrity: sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==}
+    engines: {node: '>= 0.8.0'}
+
   serve-static@2.2.1:
     resolution: {integrity: sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==}
     engines: {node: '>= 18'}
@@ -3160,6 +3369,10 @@ packages:
   std-env@4.2.0:
     resolution: {integrity: sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==}
 
+  streamsearch@1.1.0:
+    resolution: {integrity: sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==}
+    engines: {node: '>=10.0.0'}
+
   string-argv@0.3.2:
     resolution: {integrity: sha512-aqD2Q0144Z+/RqG52NeHEkZauTAUWJO8c6yTftGJKO3Tja5tUgIfmIl6kExvhtxSDP7fXB6DvzkfMpCd/F3G+Q==}
     engines: {node: '>=0.6.19'}
@@ -3176,6 +3389,9 @@ packages:
     resolution: {integrity: sha512-GaPUh5gfdrYzqeVNZvUfT23vYYxXzKYidUcnMtJg/3rxRV63EFZy3k6xfKlmfeJD0176lnUV/Usr3XcwSvFzpg==}
     engines: {node: '>=20'}
 
+  string_decoder@1.3.0:
+    resolution: {integrity: sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==}
+
   strip-ansi@6.0.1:
     resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
     engines: {node: '>=8'}
@@ -3305,10 +3521,17 @@ packages:
     resolution: {integrity: sha512-YGYEVz3Fm5iy/AybuA0oyNFq7H4CgQNfRp/qfe8nurE1kuCeNm3/vfm9X4Mtl+qLyaKJUh5xrFZwogr41SMjYA==}
     engines: {node: '>=20'}
 
+  type-is@1.6.18:
+    resolution: {integrity: sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==}
+    engines: {node: '>= 0.6'}
+
   type-is@2.1.0:
     resolution: {integrity: sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==}
     engines: {node: '>= 18'}
 
+  typedarray@0.0.6:
+    resolution: {integrity: sha512-/aCDEGatGvZ2BIk+HmLf4ifCJFwvKFNb9/JeZPMulfgFracn9QFcAf5GO8B/mweUjSoblS5In0cWhqpfs/5PQA==}
+
   typedoc@0.28.20:
     resolution: {integrity: sha512-uSKqkh8Cr48vllnEy+jdaAgOeR6Y+QCBW7usgUsKj7gJEfR7stw9U/fE49LBnj2tPRKPY0c0EBJSWe9Appmplg==}
     engines: {node: '>= 18', pnpm: '>= 10'}
@@ -3440,6 +3663,13 @@ packages:
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
+  util-deprecate@1.0.2:
+    resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
+
+  utils-merge@1.0.1:
+    resolution: {integrity: sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==}
+    engines: {node: '>= 0.4.0'}
+
   uuid@14.0.2:
     resolution: {integrity: sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==}
     hasBin: true
@@ -3682,6 +3912,11 @@ snapshots:
 
   '@adraffy/ens-normalize@1.11.1': {}
 
+  '@apidevtools/json-schema-ref-parser@14.2.1(@types/json-schema@7.0.15)':
+    dependencies:
+      '@types/json-schema': 7.0.15
+      js-yaml: 4.3.2
+
   '@ark-ui/react@5.39.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@internationalized/date': 3.12.3
@@ -3834,6 +4069,17 @@ snapshots:
       js-yaml: 4.3.2
       zod: 4.5.4
 
+  '@bootnodedev/canton-token-forge@https://codeload.github.com/BootNodeDev/canton-token-forge/tar.gz/1639372eb66941e505aa52399d00b8b4121953f7(@types/json-schema@7.0.15)(supports-color@7.2.0)':
+    dependencies:
+      cors: 2.8.6
+      dotenv: 16.6.1
+      express: 4.22.2(supports-color@7.2.0)
+      express-openapi-validator: 5.6.2(@types/json-schema@7.0.15)(express@4.22.2(supports-color@7.2.0))
+      pino: 10.3.1
+    transitivePeerDependencies:
+      - '@types/json-schema'
+      - supports-color
+
   '@bootnodedev/canton-wallet-service@0.3.0(supports-color@7.2.0)':
     dependencies:
       '@canton-network/core-splice-client': 1.10.1(supports-color@7.2.0)
@@ -4456,6 +4702,8 @@ snapshots:
 
   '@js-sdsl/ordered-map@4.4.2': {}
 
+  '@jsdevtools/ono@7.1.3': {}
+
   '@lit-labs/ssr-dom-shim@1.6.0': {}
 
   '@lit/reactive-element@2.1.2':
@@ -4897,11 +5145,20 @@ snapshots:
 
   '@types/aria-query@5.0.4': {}
 
+  '@types/body-parser@1.19.6':
+    dependencies:
+      '@types/connect': 3.4.38
+      '@types/node': 26.4.0
+
   '@types/chai@5.2.3':
     dependencies:
       '@types/deep-eql': 4.0.2
       assertion-error: 2.0.1
 
+  '@types/connect@3.4.38':
+    dependencies:
+      '@types/node': 26.4.0
+
   '@types/debug@4.1.13':
     dependencies:
       '@types/ms': 2.1.0
@@ -4910,14 +5167,35 @@ snapshots:
 
   '@types/estree@1.0.9': {}
 
+  '@types/express-serve-static-core@5.1.3':
+    dependencies:
+      '@types/node': 26.4.0
+      '@types/qs': 6.15.1
+      '@types/range-parser': 1.2.7
+      '@types/send': 1.2.1
+
+  '@types/express@5.0.6':
+    dependencies:
+      '@types/body-parser': 1.19.6
+      '@types/express-serve-static-core': 5.1.3
+      '@types/serve-static': 2.2.0
+
   '@types/hast@3.0.5':
     dependencies:
       '@types/unist': 3.0.3
 
+  '@types/http-errors@2.0.5': {}
+
+  '@types/json-schema@7.0.15': {}
+
   '@types/lodash@4.17.25': {}
 
   '@types/ms@2.1.0': {}
 
+  '@types/multer@2.2.0':
+    dependencies:
+      '@types/express': 5.0.6
+
   '@types/node@25.9.5':
     dependencies:
       undici-types: 7.24.6
@@ -4926,6 +5204,10 @@ snapshots:
     dependencies:
       undici-types: 8.3.0
 
+  '@types/qs@6.15.1': {}
+
+  '@types/range-parser@1.2.7': {}
+
   '@types/react-dom@19.2.5(@types/react@19.2.18)':
     dependencies:
       '@types/react': 19.2.18
@@ -4934,6 +5216,15 @@ snapshots:
     dependencies:
       csstype: 3.2.3
 
+  '@types/send@1.2.1':
+    dependencies:
+      '@types/node': 26.4.0
+
+  '@types/serve-static@2.2.0':
+    dependencies:
+      '@types/http-errors': 2.0.5
+      '@types/node': 26.4.0
+
   '@types/trusted-types@2.0.7': {}
 
   '@types/unist@3.0.3': {}
@@ -5915,11 +6206,24 @@ snapshots:
       typescript: 5.9.3
       zod: 4.5.4
 
+  accepts@1.3.8:
+    dependencies:
+      mime-types: 2.1.35
+      negotiator: 0.6.3
+
   accepts@2.0.0:
     dependencies:
       mime-types: 3.0.2
       negotiator: 1.1.0
 
+  ajv-draft-04@1.0.0(ajv@8.20.0):
+    optionalDependencies:
+      ajv: 8.20.0
+
+  ajv-formats@3.0.1(ajv@8.20.0):
+    optionalDependencies:
+      ajv: 8.20.0
+
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
@@ -5946,6 +6250,8 @@ snapshots:
       normalize-path: 3.0.0
       picomatch: 2.3.2
 
+  append-field@1.0.0: {}
+
   argparse@2.0.1: {}
 
   argue-cli@3.1.0: {}
@@ -5956,6 +6262,8 @@ snapshots:
 
   aria-query@5.3.2: {}
 
+  array-flatten@1.1.1: {}
+
   assertion-error@2.0.1: {}
 
   ast-v8-to-istanbul@1.0.5:
@@ -5978,6 +6286,23 @@ snapshots:
 
   blakejs@1.2.1: {}
 
+  body-parser@1.20.8(supports-color@7.2.0):
+    dependencies:
+      bytes: 3.1.2
+      content-type: 1.0.5
+      debug: 2.6.9(supports-color@7.2.0)
+      depd: 2.0.0
+      destroy: 1.2.0
+      http-errors: 2.0.1
+      iconv-lite: 0.4.24
+      on-finished: 2.4.1
+      qs: 6.16.0
+      raw-body: 2.5.3
+      type-is: 1.6.18
+      unpipe: 1.0.0
+    transitivePeerDependencies:
+      - supports-color
+
   body-parser@2.3.0(supports-color@7.2.0):
     dependencies:
       bytes: 3.1.2
@@ -6005,6 +6330,12 @@ snapshots:
     dependencies:
       balanced-match: 4.0.4
 
+  buffer-from@1.1.2: {}
+
+  busboy@1.6.0:
+    dependencies:
+      streamsearch: 1.1.0
+
   bytes@3.1.2: {}
 
   cac@7.0.0: {}
@@ -6064,6 +6395,17 @@ snapshots:
 
   colorette@2.0.20: {}
 
+  concat-stream@2.0.0:
+    dependencies:
+      buffer-from: 1.1.2
+      inherits: 2.0.4
+      readable-stream: 3.6.2
+      typedarray: 0.0.6
+
+  content-disposition@0.5.4:
+    dependencies:
+      safe-buffer: 5.2.1
+
   content-disposition@1.1.0: {}
 
   content-type@1.0.5: {}
@@ -6087,6 +6429,8 @@ snapshots:
 
   cookie-es@1.2.3: {}
 
+  cookie-signature@1.0.7: {}
+
   cookie-signature@1.2.2: {}
 
   cookie@0.7.2: {}
@@ -6140,6 +6484,12 @@ snapshots:
 
   dayjs@1.11.23: {}
 
+  debug@2.6.9(supports-color@7.2.0):
+    dependencies:
+      ms: 2.0.0
+    optionalDependencies:
+      supports-color: 7.2.0
+
   debug@4.4.3(supports-color@7.2.0):
     dependencies:
       ms: 2.1.3
@@ -6158,6 +6508,8 @@ snapshots:
 
   destr@2.0.5: {}
 
+  destroy@1.2.0: {}
+
   detect-browser@5.3.0: {}
 
   detect-libc@2.1.2: {}
@@ -6168,6 +6520,8 @@ snapshots:
 
   dom-accessibility-api@0.6.3: {}
 
+  dotenv@16.6.1: {}
+
   dotenv@17.4.2: {}
 
   dts-resolver@3.0.0(oxc-resolver@11.24.2):
@@ -6246,6 +6600,62 @@ snapshots:
 
   expect-type@1.4.0: {}
 
+  express-openapi-validator@5.6.2(@types/json-schema@7.0.15)(express@4.22.2(supports-color@7.2.0)):
+    dependencies:
+      '@apidevtools/json-schema-ref-parser': 14.2.1(@types/json-schema@7.0.15)
+      '@types/multer': 2.2.0
+      ajv: 8.20.0
+      ajv-draft-04: 1.0.0(ajv@8.20.0)
+      ajv-formats: 3.0.1(ajv@8.20.0)
+      content-type: 1.0.5
+      express: 4.22.2(supports-color@7.2.0)
+      json-schema-traverse: 1.0.0
+      lodash.clonedeep: 4.5.0
+      lodash.get: 4.4.2
+      media-typer: 1.1.1
+      multer: 2.3.0
+      ono: 7.1.3
+      path-to-regexp: 8.4.2
+      qs: 6.16.0
+    transitivePeerDependencies:
+      - '@types/json-schema'
+
+  express@4.22.2(supports-color@7.2.0):
+    dependencies:
+      accepts: 1.3.8
+      array-flatten: 1.1.1
+      body-parser: 1.20.8(supports-color@7.2.0)
+      content-disposition: 0.5.4
+      content-type: 1.0.5
+      cookie: 0.7.2
+      cookie-signature: 1.0.7
+      debug: 2.6.9(supports-color@7.2.0)
+      depd: 2.0.0
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      etag: 1.8.1
+      finalhandler: 1.3.2(supports-color@7.2.0)
+      fresh: 0.5.2
+      http-errors: 2.0.1
+      merge-descriptors: 1.0.3
+      methods: 1.1.2
+      on-finished: 2.4.1
+      parseurl: 1.3.3
+      path-to-regexp: 0.1.13
+      proxy-addr: 2.0.7
+      qs: 6.15.3
+      range-parser: 1.2.1
+      safe-buffer: 5.2.1
+      send: 0.19.2(supports-color@7.2.0)
+      serve-static: 1.16.3(supports-color@7.2.0)
+      setprototypeof: 1.2.0
+      statuses: 2.0.2
+      type-is: 1.6.18
+      utils-merge: 1.0.1
+      vary: 1.1.2
+    transitivePeerDependencies:
+      - supports-color
+
   express@5.2.1(supports-color@7.2.0):
     dependencies:
       accepts: 2.0.0
@@ -6295,6 +6705,18 @@ snapshots:
     optionalDependencies:
       picomatch: 4.0.7
 
+  finalhandler@1.3.2(supports-color@7.2.0):
+    dependencies:
+      debug: 2.6.9(supports-color@7.2.0)
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      on-finished: 2.4.1
+      parseurl: 1.3.3
+      statuses: 2.0.2
+      unpipe: 1.0.0
+    transitivePeerDependencies:
+      - supports-color
+
   finalhandler@2.1.1(supports-color@7.2.0):
     dependencies:
       debug: 4.4.3(supports-color@7.2.0)
@@ -6318,6 +6740,8 @@ snapshots:
 
   forwarded@0.2.0: {}
 
+  fresh@0.5.2: {}
+
   fresh@2.0.0: {}
 
   fs-extra@11.4.0:
@@ -6411,6 +6835,10 @@ snapshots:
 
   husky@9.1.7: {}
 
+  iconv-lite@0.4.24:
+    dependencies:
+      safer-buffer: 2.1.2
+
   iconv-lite@0.7.3:
     dependencies:
       safer-buffer: 2.1.2
@@ -6661,6 +7089,10 @@ snapshots:
 
   lodash.camelcase@4.3.0: {}
 
+  lodash.clonedeep@4.5.0: {}
+
+  lodash.get@4.4.2: {}
+
   lodash.isequal@4.5.0: {}
 
   lodash@4.18.1: {}
@@ -6708,18 +7140,32 @@ snapshots:
 
   mdurl@2.1.0: {}
 
+  media-typer@0.3.0: {}
+
   media-typer@1.1.1: {}
 
+  merge-descriptors@1.0.3: {}
+
   merge-descriptors@2.0.0: {}
 
+  methods@1.1.2: {}
+
   micro-ftch@0.3.1: {}
 
+  mime-db@1.52.0: {}
+
   mime-db@1.54.0: {}
 
+  mime-types@2.1.35:
+    dependencies:
+      mime-db: 1.52.0
+
   mime-types@3.0.2:
     dependencies:
       mime-db: 1.54.0
 
+  mime@1.6.0: {}
+
   min-indent@1.0.1: {}
 
   minimatch@10.2.6:
@@ -6728,12 +7174,23 @@ snapshots:
 
   minimist@1.2.8: {}
 
+  ms@2.0.0: {}
+
   ms@2.1.3: {}
 
+  multer@2.3.0:
+    dependencies:
+      append-field: 1.0.0
+      busboy: 1.6.0
+      concat-stream: 2.0.0
+      type-is: 1.6.18
+
   multiformats@9.9.0: {}
 
   nanoid@3.3.18: {}
 
+  negotiator@0.6.3: {}
+
   negotiator@1.1.0:
     dependencies:
       content-type: 2.1.0
@@ -6766,6 +7223,10 @@ snapshots:
     dependencies:
       wrappy: 1.0.2
 
+  ono@7.1.3:
+    dependencies:
+      '@jsdevtools/ono': 7.1.3
+
   openapi-fetch@0.15.2:
     dependencies:
       openapi-typescript-helpers: 0.0.15
@@ -6870,6 +7331,8 @@ snapshots:
 
   path-exists@4.0.0: {}
 
+  path-to-regexp@0.1.13: {}
+
   path-to-regexp@8.4.2: {}
 
   pathe@2.0.3: {}
@@ -6994,6 +7457,11 @@ snapshots:
       pngjs: 5.0.0
       yargs: 15.4.1
 
+  qs@6.15.3:
+    dependencies:
+      es-define-property: 1.0.1
+      side-channel: 1.1.1
+
   qs@6.16.0:
     dependencies:
       es-define-property: 1.0.1
@@ -7007,8 +7475,17 @@ snapshots:
 
   radix3@1.1.2: {}
 
+  range-parser@1.2.1: {}
+
   range-parser@1.3.0: {}
 
+  raw-body@2.5.3:
+    dependencies:
+      bytes: 3.1.2
+      http-errors: 2.0.1
+      iconv-lite: 0.4.24
+      unpipe: 1.0.0
+
   raw-body@3.0.2:
     dependencies:
       bytes: 3.1.2
@@ -7039,6 +7516,12 @@ snapshots:
 
   react@19.2.8: {}
 
+  readable-stream@3.6.2:
+    dependencies:
+      inherits: 2.0.4
+      string_decoder: 1.3.0
+      util-deprecate: 1.0.2
+
   readdirp@5.1.1: {}
 
   real-require@0.2.0: {}
@@ -7107,6 +7590,8 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  safe-buffer@5.2.1: {}
+
   safe-stable-stringify@2.5.0: {}
 
   safer-buffer@2.1.2: {}
@@ -7121,6 +7606,24 @@ snapshots:
 
   semver@7.8.5: {}
 
+  send@0.19.2(supports-color@7.2.0):
+    dependencies:
+      debug: 2.6.9(supports-color@7.2.0)
+      depd: 2.0.0
+      destroy: 1.2.0
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      etag: 1.8.1
+      fresh: 0.5.2
+      http-errors: 2.0.1
+      mime: 1.6.0
+      ms: 2.1.3
+      on-finished: 2.4.1
+      range-parser: 1.2.1
+      statuses: 2.0.2
+    transitivePeerDependencies:
+      - supports-color
+
   send@1.2.1(supports-color@7.2.0):
     dependencies:
       debug: 4.4.3(supports-color@7.2.0)
@@ -7137,6 +7640,15 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  serve-static@1.16.3(supports-color@7.2.0):
+    dependencies:
+      encodeurl: 2.0.0
+      escape-html: 1.0.3
+      parseurl: 1.3.3
+      send: 0.19.2(supports-color@7.2.0)
+    transitivePeerDependencies:
+      - supports-color
+
   serve-static@2.2.1(supports-color@7.2.0):
     dependencies:
       encodeurl: 2.0.0
@@ -7200,6 +7712,8 @@ snapshots:
 
   std-env@4.2.0: {}
 
+  streamsearch@1.1.0: {}
+
   string-argv@0.3.2: {}
 
   string-width@4.2.3:
@@ -7219,6 +7733,10 @@ snapshots:
       get-east-asian-width: 1.6.0
       strip-ansi: 7.2.0
 
+  string_decoder@1.3.0:
+    dependencies:
+      safe-buffer: 5.2.1
+
   strip-ansi@6.0.1:
     dependencies:
       ansi-regex: 5.0.1
@@ -7319,12 +7837,19 @@ snapshots:
     dependencies:
       tagged-tag: 1.0.0
 
+  type-is@1.6.18:
+    dependencies:
+      media-typer: 0.3.0
+      mime-types: 2.1.35
+
   type-is@2.1.0:
     dependencies:
       content-type: 2.1.0
       media-typer: 1.1.1
       mime-types: 3.0.2
 
+  typedarray@0.0.6: {}
+
   typedoc@0.28.20(typescript@5.9.3):
     dependencies:
       '@gerrit0/mini-shiki': 3.23.0
@@ -7390,6 +7915,10 @@ snapshots:
     dependencies:
       react: 19.2.8
 
+  util-deprecate@1.0.2: {}
+
+  utils-merge@1.0.1: {}
+
   uuid@14.0.2: {}
 
   uuid@9.0.1: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 74413231..30338a6c 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -5,9 +5,17 @@ packages:
   - canton-connect
   - canton-dappbooster
   - canton-theme
-  - dapp/daml
   - dapp/frontend
 
+# Dependencies allowed to run install/build scripts (pnpm blocks them by default).
+# esbuild: needed by Vite/tsx.
+# @bootnodedev/canton-token-forge: a git dependency whose `prepare` compiles
+# registry/src into the registry/dist its bin points at; upstream gitignores that
+# directory, so without this entry the bin exists but resolves to nothing. pnpm
+# matches a git dependency only by its resolved tarball id, so moving the ref in
+# package.json means replacing the commit sha below; `pnpm approve-builds` prints
+# the new key.
 allowBuilds:
+  '@bootnodedev/canton-token-forge@https://codeload.github.com/BootNodeDev/canton-token-forge/tar.gz/1639372eb66941e505aa52399d00b8b4121953f7': true
   esbuild: true
   protobufjs: true
diff --git a/scripts/bootstrap-vesting.mjs b/scripts/bootstrap-vesting.mjs
index a637e5a1..383abcbe 100644
--- a/scripts/bootstrap-vesting.mjs
+++ b/scripts/bootstrap-vesting.mjs
@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // Bootstrap the vesting demo: create the backstage operator and pre-create the observer-less
-// AmuletVestingFactory it signs. Funder and receiver are wallet accounts, so no other party is
-// created here.
+// VestingFactory it signs, plus the instrument admin and its DBT InstrumentConfig. Funder and
+// receiver are wallet accounts, so no other party is created here.
 //
 // Nothing is written out. The dApp finds both by reading this operator's rights and its factory
 // back off the ledger, so a run that ends here is a run the dApp can already see.
@@ -9,9 +9,43 @@
 // Run with the local stack up and the DAR deployed.
 
 const RPC_URL = process.env.RPC_URL ?? 'http://localhost:3010/rpc'
-const PACKAGE_NAME = 'amulet-vesting'
+const PACKAGE_NAME = 'vesting'
 const STAMP = Date.now()
 
+const TOKEN_FORGE_PACKAGE = 'canton-token-forge'
+const INSTRUMENT = {
+  instrumentId: 'DBT',
+  name: 'dAppBooster Token',
+  symbol: 'DBT',
+  decimals: 10,
+  maxPerTap: '1000.0',
+}
+
+export const REGISTRY_PORT = 3013
+
+// Spelled out rather than built from a helper, so these read the same here, in
+// the registry's own .env.example, and in a grep.
+export const REGISTRY_TEMPLATE_IDS = {
+  INSTRUMENT_CONFIG_TEMPLATE_ID: '#canton-token-forge:Canton.TokenForge.Registry:InstrumentConfig',
+  PREAPPROVAL_TEMPLATE_ID:
+    '#canton-token-forge:Canton.TokenForge.Registry:TokenTransferPreapproval',
+  LOCKED_TOKEN_TEMPLATE_ID: '#canton-token-forge:Canton.TokenForge.Locked:LockedToken',
+  TRANSFER_INSTRUCTION_TEMPLATE_ID:
+    '#canton-token-forge:Canton.TokenForge.Instruction:TokenTransferInstruction',
+  ALLOCATION_TEMPLATE_ID: '#canton-token-forge:Canton.TokenForge.Allocation:TokenAllocation',
+}
+
+// Every template id is single-quoted: a value starting with `#` is otherwise read
+// as a comment and the variable parses as empty.
+export const formatRegistryEnv = ({ ledgerApiUrl, adminParty, port }) =>
+  [
+    `LEDGER_API_URL=${ledgerApiUrl}`,
+    'LEDGER_API_TOKEN=<the CANTON_BACKEND_TOKEN from .env>',
+    `ADMIN_PARTY=${adminParty}`,
+    ...Object.entries(REGISTRY_TEMPLATE_IDS).map(([key, id]) => `${key}='${id}'`),
+    `PORT=${port}`,
+  ].join('\n')
+
 const rpc = async (method, params) => {
   const response = await fetch(RPC_URL, {
     method: 'POST',
@@ -44,11 +78,59 @@ const ledger = (requestMethod, resource, body, query) =>
     ...(query === undefined ? {} : { query }),
   })
 
-const createOperator = async (hint) => {
-  const result = await ledger('post', '/v2/parties', { partyIdHint: hint })
-  const party = result?.partyDetails?.party
-  if (typeof party !== 'string' || party.length === 0) {
-    throw new Error(`no party id for hint ${hint}: ${JSON.stringify(result)}`)
+const PARTY_PAGES = 20
+
+// A party this participant hosts under this hint, or undefined. Party ids are
+// `<hint>::<fingerprint>`, so the hint is a prefix and not the id itself, and
+// `isLocal` is what separates a party this participant hosts from one it merely
+// knows about: allocating rights on somebody else's party succeeds and every
+// command as that party then fails.
+const findParty = async (hint) => {
+  let pageToken
+  for (let page = 0; page < PARTY_PAGES; page++) {
+    const result = await ledger(
+      'get',
+      '/v2/parties',
+      undefined,
+      pageToken === undefined ? undefined : { pageToken },
+    )
+    const details = result?.partyDetails
+    if (!Array.isArray(details)) {
+      throw new Error(`/v2/parties did not answer with a party list: ${JSON.stringify(result)}`)
+    }
+    const found = details.find(
+      (one) =>
+        typeof one?.party === 'string' &&
+        one.party.startsWith(`${hint}::`) &&
+        one.isLocal !== false,
+    )
+    if (found !== undefined) {
+      return found.party
+    }
+    pageToken = result?.nextPageToken
+    if (typeof pageToken !== 'string' || pageToken === '') {
+      return undefined
+    }
+  }
+  // Never "not allocated": the next step would allocate the hint again and the participant would
+  // refuse a party it already hosts, naming nothing about the pages this stopped short of.
+  throw new Error(`gave up looking for ${hint} after ${PARTY_PAGES} pages of parties`)
+}
+
+// Allocates the party if the participant does not already know it, and grants the
+// authenticated user rights over it either way. That user is whoever the participant
+// authenticated CANTON_BACKEND_TOKEN as, which is also the token the registry reads
+// with, so this grant is what lets it read as the admin. Granting again is harmless
+// and is what makes a re-run against a party from an earlier run complete.
+const ensureParty = async (hint) => {
+  const existing = await findParty(hint)
+  let party = existing
+  if (party === undefined) {
+    const result = await ledger('post', '/v2/parties', { partyIdHint: hint })
+    party = result?.partyDetails?.party
+    if (typeof party !== 'string' || party.length === 0) {
+      throw new Error(`no party id for hint ${hint}: ${JSON.stringify(result)}`)
+    }
   }
   // wallet-service keeps its bearer token private, so ask the participant who it authenticated as.
   const userId = (await ledger('get', '/v2/authenticated-user'))?.user?.id
@@ -60,44 +142,91 @@ const createOperator = async (hint) => {
     identityProviderId: '',
     rights: [{ kind: { CanActAs: { value: { party } } } }],
   })
-  return party
+  return { party, reused: existing !== undefined }
 }
 
 // Ask the participant which package it would pick for the name, so a stale id cannot silently
 // produce an empty dashboard. Fails loudly with PACKAGE_NAMES_NOT_FOUND if the DAR is not deployed.
-const resolvePackage = async (party) => {
+const resolvePackage = async (party, packageName = PACKAGE_NAME) => {
   const result = await ledger(
     'get',
     '/v2/interactive-submission/preferred-package-version',
     undefined,
-    { 'package-name': PACKAGE_NAME, parties: party },
+    { 'package-name': packageName, parties: party },
   )
   const pkg = result?.packagePreference?.packageReference?.packageId
   if (typeof pkg !== 'string' || pkg.length === 0) {
-    throw new Error(`participant returned no package id for ${PACKAGE_NAME}`)
+    throw new Error(`participant returned no package id for ${packageName}`)
   }
   return pkg
 }
 
-const main = async () => {
-  // A fresh operator per run, so the config always matches a factory this run created. Earlier
-  // operators and factories stay active on the local ledger and are simply superseded.
-  const operator = await createOperator(`vesting-operator-${STAMP}`)
-  console.log(`operator   ${operator}`)
-
-  const pkg = process.env.PKG ?? (await resolvePackage(operator))
-  const factoryTid = `${pkg}:AmuletVesting:AmuletVestingFactory`
-  console.log(`package    ${pkg}${process.env.PKG === undefined ? '' : ' (from PKG)'}`)
-
-  await ledger('post', '/v2/commands/submit-and-wait-for-transaction-tree', {
-    commandId: `vesting-factory-${STAMP}`,
-    actAs: [operator],
-    readAs: [operator],
-    commands: [
-      { CreateCommand: { templateId: factoryTid, createArguments: { factoryOwner: operator } } },
-    ],
+// Read back from the ACS rather than out of the submission response, so this does not
+// depend on where a given Canton version puts a create result in the envelope. The
+// filter takes the package-name reference; the participant rejects a package id here.
+const findInstrumentConfig = async (admin) => {
+  const end = await ledger('get', '/v2/state/ledger-end')
+  if (end?.offset === undefined) {
+    throw new Error('participant returned no ledger-end offset')
+  }
+  const rows = await ledger('post', '/v2/state/active-contracts', {
+    filter: {
+      filtersByParty: {
+        [admin]: {
+          cumulative: [
+            {
+              identifierFilter: {
+                TemplateFilter: {
+                  value: {
+                    templateId: REGISTRY_TEMPLATE_IDS.INSTRUMENT_CONFIG_TEMPLATE_ID,
+                    includeCreatedEventBlob: false,
+                  },
+                },
+              },
+            },
+          ],
+        },
+      },
+    },
+    activeAtOffset: end.offset,
+    verbose: true,
   })
+  const configs = (Array.isArray(rows) ? rows : [])
+    .map((row) => row?.contractEntry?.JsActiveContract?.createdEvent)
+    .filter((event) => event?.createArgument?.instrumentId === INSTRUMENT.instrumentId)
+  // More than one is the state the registry cannot serve, since it scopes every route to its
+  // admin and would find two configs for one instrument. None is an admin with nothing created
+  // yet, which is the caller's cue to create it.
+  if (configs.length > 1) {
+    throw new Error(
+      `expected at most one ${INSTRUMENT.instrumentId} InstrumentConfig for ${admin}, found ${configs.length}`,
+    )
+  }
+  return configs[0]
+}
+
+// How the config on the ledger differs from what INSTRUMENT above asks for. The contract is
+// admin-signed and created once, so an edit here reaches a ledger that already carries one only
+// through a reset: creating a second is the state findInstrumentConfig refuses just above.
+export const instrumentDrift = (createArgument) => {
+  const arg = createArgument ?? {}
+  const exactly = (found, wanted) => found === wanted
+  // A Daml Decimal comes back padded to its full scale, so 1000.0 reads as 1000.0000000000.
+  const sameNumber = (found, wanted) => Number(found) === Number(wanted)
+  return [
+    ['name', arg.name, INSTRUMENT.name, exactly],
+    ['symbol', arg.symbol, INSTRUMENT.symbol, exactly],
+    ['decimals', arg.decimals, String(INSTRUMENT.decimals), exactly],
+    ['maxPerTap', arg.faucet?.maxPerTap, INSTRUMENT.maxPerTap, sameNumber],
+  ]
+    .filter(([, found, wanted, matches]) => !matches(found, wanted))
+    .map(([field, found, wanted]) => `${field} is ${found}, this script asks for ${wanted}`)
+}
 
+// The operator's own factory, if this operator already signed one. Observer-less, so only the
+// operator can see it, which is also why the dApp reads it back as the operator and not as a
+// funder.
+const findFactory = async (operator) => {
   const end = await ledger('get', '/v2/state/ledger-end')
   if (end?.offset === undefined) {
     throw new Error('participant returned no ledger-end offset')
@@ -110,10 +239,10 @@ const main = async () => {
             {
               identifierFilter: {
                 // A filter takes the package-name reference; a participant rejects the package id
-                // the CreateCommand above carries.
+                // the CreateCommand carries.
                 TemplateFilter: {
                   value: {
-                    templateId: `#${PACKAGE_NAME}:AmuletVesting:AmuletVestingFactory`,
+                    templateId: `#${PACKAGE_NAME}:Vesting:VestingFactory`,
                     includeCreatedEventBlob: true,
                   },
                 },
@@ -126,13 +255,120 @@ const main = async () => {
     activeAtOffset: end.offset,
     verbose: true,
   })
-  const active = (Array.isArray(rows) ? rows : [])
+  return (Array.isArray(rows) ? rows : [])
     .map((row) => row?.contractEntry?.JsActiveContract)
     .find((entry) => entry?.createdEvent?.createdEventBlob !== undefined)
+}
+
+// The whole contract with scripts/dev-stack.sh, which reads these keys back off stdout. Both exits
+// print it, because a reused deployment configures the registry exactly as a fresh one does.
+const printRegistryEnv = (adminParty) => {
+  console.log('\nregistry env')
+  console.log(
+    formatRegistryEnv({
+      ledgerApiUrl: process.env.CANTON_JSON_API_URL || 'http://localhost:2975',
+      adminParty,
+      port: REGISTRY_PORT,
+    }),
+  )
+}
+
+const main = async () => {
+  // Stable hints, and everything below is created only where it is missing. `dev-stack.sh up` runs
+  // this on every start and the LocalNet's volumes outlive a `down`, so minting a fresh operator and
+  // admin each time left every holding and every grant of the previous run on a ledger where
+  // nothing in the dApp matches their (admin, instrumentId) any more: an empty dashboard, a zero
+  // balance, and no error to read. A reset drops the parties with the ledger, so a genuinely fresh
+  // stack still gets fresh ones.
+  const { party: operator, reused: hadOperator } = await ensureParty('vesting-operator')
+  console.log(`operator   ${operator}${hadOperator ? ' (existing)' : ''}`)
+
+  const pkg = process.env.PKG ?? (await resolvePackage(operator))
+  const factoryTid = `${pkg}:Vesting:VestingFactory`
+  console.log(`package    ${pkg}${process.env.PKG === undefined ? '' : ' (from PKG)'}`)
+
+  let active = await findFactory(operator)
+  const hadFactory = active !== undefined
+  if (!hadFactory) {
+    await ledger('post', '/v2/commands/submit-and-wait-for-transaction-tree', {
+      commandId: `vesting-factory-${STAMP}`,
+      actAs: [operator],
+      readAs: [operator],
+      commands: [
+        { CreateCommand: { templateId: factoryTid, createArguments: { factoryOwner: operator } } },
+      ],
+    })
+    // Read back from the ACS rather than out of the submission response, so this does not depend
+    // on where a given Canton version puts a create result in the envelope.
+    active = await findFactory(operator)
+  }
   if (active === undefined) {
     throw new Error('factory created but no createdEventBlob came back from the ACS read')
   }
-  console.log(`factory    ${active.createdEvent.contractId}`)
+  console.log(`factory    ${active.createdEvent.contractId}${hadFactory ? ' (existing)' : ''}`)
+  // The filter above takes the package *name*, so a factory signed under a superseded version of it
+  // is reused like any other, and the dApp takes its package id from this very contract.
+  const factoryPkg = active.createdEvent.templateId?.split(':')[0]
+  if (hadFactory && factoryPkg !== pkg) {
+    console.warn(`warning:   that factory is on package ${factoryPkg}, not the preferred ${pkg}.`)
+    console.warn('           The dApp follows the contract, so a newly deployed DAR takes effect')
+    console.warn('           only after `canton-barebones reset`.')
+  }
+
+  // Preflight before the admin exists, so an undeployed vendor/canton-token-forge.dar fails
+  // with PACKAGE_NAMES_NOT_FOUND rather than a raw create error and a stray party.
+  await resolvePackage(operator, TOKEN_FORGE_PACKAGE)
+
+  const { party: admin } = await ensureParty('instrument-admin')
+
+  const existingConfig = await findInstrumentConfig(admin)
+  if (existingConfig !== undefined) {
+    console.log(`admin      ${admin}`)
+    console.log(
+      `instrument ${INSTRUMENT.instrumentId} (${INSTRUMENT.symbol}) ${existingConfig.contractId} (existing)`,
+    )
+    for (const line of instrumentDrift(existingConfig.createArgument)) {
+      console.warn(`warning:   ${line}; reset the ledger to pick that up.`)
+    }
+    printRegistryEnv(admin)
+    return
+  }
+
+  await ledger('post', '/v2/commands/submit-and-wait-for-transaction-tree', {
+    commandId: `instrument-config-${STAMP}`,
+    actAs: [admin],
+    readAs: [admin],
+    commands: [
+      {
+        CreateCommand: {
+          templateId: REGISTRY_TEMPLATE_IDS.INSTRUMENT_CONFIG_TEMPLATE_ID,
+          createArguments: {
+            admin,
+            instrumentId: INSTRUMENT.instrumentId,
+            name: INSTRUMENT.name,
+            symbol: INSTRUMENT.symbol,
+            // Int64 is encoded as a JSON string; a bare number is rejected.
+            decimals: String(INSTRUMENT.decimals),
+            faucet: { maxPerTap: INSTRUMENT.maxPerTap },
+            meta: { values: {} },
+          },
+        },
+      },
+    ],
+  })
+
+  const created = await findInstrumentConfig(admin)
+  if (created === undefined) {
+    throw new Error(`created the ${INSTRUMENT.instrumentId} InstrumentConfig but it is not active`)
+  }
+  console.log(`admin      ${admin}`)
+  console.log(`instrument ${INSTRUMENT.instrumentId} (${INSTRUMENT.symbol}) ${created.contractId}`)
+  printRegistryEnv(admin)
 }
 
-await main()
+// import.meta.main, not a comparison against argv[1]: the loader realpaths
+// import.meta.filename while argv[1] keeps symlinks, so a symlinked path made the
+// guard false and exited 0 having created nothing.
+if (import.meta.main) {
+  await main()
+}
diff --git a/scripts/bootstrap-vesting.test.mjs b/scripts/bootstrap-vesting.test.mjs
new file mode 100644
index 00000000..0610ce48
--- /dev/null
+++ b/scripts/bootstrap-vesting.test.mjs
@@ -0,0 +1,126 @@
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import path from 'node:path'
+import { describe, it } from 'node:test'
+import { fileURLToPath } from 'node:url'
+import {
+  formatRegistryEnv,
+  instrumentDrift,
+  REGISTRY_PORT,
+  REGISTRY_TEMPLATE_IDS,
+} from './bootstrap-vesting.mjs'
+
+const block = formatRegistryEnv({
+  ledgerApiUrl: 'http://localhost:2975',
+  adminParty: 'admin-1::abc',
+  port: REGISTRY_PORT,
+})
+
+const scriptsDir = path.dirname(fileURLToPath(import.meta.url))
+const devStack = readFileSync(path.join(scriptsDir, 'dev-stack.sh'), 'utf8')
+
+// Read from the array dev-stack.sh declares rather than a copy of it, so the two
+// files cannot drift apart while the test still passes.
+const devStackKeys = () => {
+  const declaration = devStack.match(/REGISTRY_ENV_KEYS=\(([^)]*)\)/)
+  assert.ok(declaration, 'dev-stack.sh no longer declares REGISTRY_ENV_KEYS')
+  return declaration[1].split(/\s+/).filter((key) => key !== '')
+}
+
+describe('the registry env block bootstrap prints', () => {
+  it('quotes every template id, because dotenv reads the leading # as a comment', () => {
+    const lines = block.split('\n')
+    for (const [key, id] of Object.entries(REGISTRY_TEMPLATE_IDS)) {
+      assert.ok(lines.includes(`${key}='${id}'`))
+      assert.ok(id.startsWith('#canton-token-forge:'), `${key} is not package-name form`)
+    }
+  })
+
+  it('carries the party and the url only this run knows', () => {
+    assert.match(block, /^ADMIN_PARTY=admin-1::abc$/m)
+    assert.match(block, /^LEDGER_API_URL=http:\/\/localhost:2975$/m)
+    assert.match(block, /^PORT=3013$/m)
+  })
+
+  it('never prints the bearer token', () => {
+    // The block is pasteable by hand, so it names the token rather than carrying
+    // it: bootstrap's stdout reaches terminal scrollback and a dev-stack log file.
+    assert.match(block, /^LEDGER_API_TOKEN=<[^>]+>$/m)
+    assert.doesNotMatch(block, /eyJ[A-Za-z0-9_-]+\./)
+  })
+
+  it('is a nine-line block pasteable into the registry .env as it stands', () => {
+    // dev-stack.sh parses this back out (see the contract tests below), and a human
+    // still copies it by hand, so a silently reordered or truncated block breaks both.
+    const lines = block.split('\n')
+    assert.equal(lines.length, 9)
+    assert.doesNotMatch(block, /\n$/)
+    assert.deepEqual(
+      lines.map((line) => line.split('=')[0]),
+      [
+        'LEDGER_API_URL',
+        'LEDGER_API_TOKEN',
+        'ADMIN_PARTY',
+        ...Object.keys(REGISTRY_TEMPLATE_IDS),
+        'PORT',
+      ],
+    )
+  })
+})
+
+describe('the contract between bootstrap and dev-stack.sh', () => {
+  it('prints every key dev-stack.sh reads back, exactly once', () => {
+    for (const key of devStackKeys()) {
+      const occurrences = block.split('\n').filter((line) => line.startsWith(`${key}=`))
+      assert.equal(
+        occurrences.length,
+        1,
+        `${key} is read by dev-stack.sh but printed ${occurrences.length} times`,
+      )
+    }
+  })
+
+  it('leaves the bearer token to dev-stack.sh', () => {
+    // The one registry variable bootstrap cannot supply: it never sees the token.
+    assert.ok(!devStackKeys().includes('LEDGER_API_TOKEN'))
+  })
+
+  it('strips to the same template ids the registry checks at boot', () => {
+    for (const [key, id] of Object.entries(REGISTRY_TEMPLATE_IDS)) {
+      assert.ok(devStackKeys().includes(key), `dev-stack.sh does not read ${key}`)
+      const printed = block.split('\n').find((line) => line.startsWith(`${key}=`))
+      assert.equal(printed.slice(key.length + 1).replace(/^'|'$/g, ''), id)
+    }
+  })
+})
+
+// The InstrumentConfig is admin-signed and created once, so a bootstrap that finds one reuses it
+// whatever this script now asks for, and saying nothing would make the constants write-once.
+describe('the drift between the ledger and the INSTRUMENT constants', () => {
+  const onLedger = {
+    admin: 'instrument-admin::ns',
+    instrumentId: 'DBT',
+    name: 'dAppBooster Token',
+    symbol: 'DBT',
+    decimals: '10',
+    faucet: { maxPerTap: '1000.0000000000' },
+  }
+
+  it('reports none for the config this script would have created', () => {
+    assert.deepEqual(instrumentDrift(onLedger), [])
+  })
+
+  it('compares the tap ceiling as a number, since Daml pads a Decimal to its full scale', () => {
+    assert.deepEqual(instrumentDrift({ ...onLedger, faucet: { maxPerTap: '5000.0000000000' } }), [
+      'maxPerTap is 5000.0000000000, this script asks for 1000.0',
+    ])
+  })
+
+  it('names every field that differs, and reports a missing faucet as one', () => {
+    const drift = instrumentDrift({ ...onLedger, symbol: 'OLD', faucet: undefined })
+    assert.deepEqual(drift, [
+      'symbol is OLD, this script asks for DBT',
+      'maxPerTap is undefined, this script asks for 1000.0',
+    ])
+  })
+})
diff --git a/scripts/dev-stack.sh b/scripts/dev-stack.sh
index 3f5ade23..baaba5a0 100755
--- a/scripts/dev-stack.sh
+++ b/scripts/dev-stack.sh
@@ -20,8 +20,8 @@
 #   ./scripts/dev-stack.sh menu [dir]  # same as above
 #   ./scripts/dev-stack.sh install     # install + link every workspace from the repo root (pnpm install)
 #   ./scripts/dev-stack.sh docker-up   # macOS only: launch Docker Desktop, wait for the daemon
-#   ./scripts/dev-stack.sh up [dir]    # start the stack (LocalNet, DAR, wallet-service, bootstrap, dApp)
-#   ./scripts/dev-stack.sh down [dir]  # stop wallet-service + the dApp dev server, stop the LocalNet
+#   ./scripts/dev-stack.sh up [dir]    # start the stack (LocalNet, DARs, wallet-service, bootstrap, registry, dApp)
+#   ./scripts/dev-stack.sh down [dir]  # stop the dApp dev server, the token registry and wallet-service, stop the LocalNet
 #   ./scripts/dev-stack.sh docker-down # macOS only: quit Docker Desktop
 #   ./scripts/dev-stack.sh status [dir] # show what is currently running
 #
@@ -29,12 +29,13 @@
 #
 # What `up` starts (in order; Docker must already be running):
 #   1. LocalNet containers           (canton-barebones start)
-#   2. Builds and deploys the vesting DAR (name derived from daml.yaml)
+#   2. Deploys the two vendored DARs
 #   3. wallet-service                -> http://localhost:3010  (background)
-#   4. Bootstraps the vesting operator and its factory
-#   5. dApp frontend dev server      -> http://localhost:3012  (background)
+#   4. Bootstraps the vesting operator, its factory and the DBT instrument
+#   5. Token registry                -> http://localhost:3013  (background)
+#   6. dApp frontend dev server      -> http://localhost:3012  (background)
 #
-# `down` reverses 5 and 3 (kills both background processes) and stops the
+# `down` reverses 6, 5 and 3 (kills the background processes) and stops the
 # LocalNet, keeping its volumes.
 
 set -euo pipefail
@@ -49,24 +50,47 @@ DAPP_LOG="$RUN_DIR/dapp-dev.log"
 DAPP_PID="$RUN_DIR/dapp-dev.pid"
 WS_LOG="$RUN_DIR/wallet-service.log"
 WS_PID="$RUN_DIR/wallet-service.pid"
+REGISTRY_LOG="$RUN_DIR/registry.log"
+REGISTRY_PID="$RUN_DIR/registry.pid"
+BOOTSTRAP_LOG="$RUN_DIR/bootstrap.log"
+
+# The registry variables bootstrap prints and this script reads back. LEDGER_API_TOKEN
+# is deliberately absent: bootstrap never sees the bearer, so it is supplied here from
+# .env instead. scripts/bootstrap-vesting.test.mjs holds the two lists together.
+REGISTRY_ENV_KEYS=(
+  LEDGER_API_URL
+  ADMIN_PARTY
+  INSTRUMENT_CONFIG_TEMPLATE_ID
+  PREAPPROVAL_TEMPLATE_ID
+  LOCKED_TOKEN_TEMPLATE_ID
+  TRANSFER_INSTRUCTION_TEMPLATE_ID
+  ALLOCATION_TEMPLATE_ID
+  PORT
+)
+
+# The registry's own options, which bootstrap knows nothing about. Passed through from the
+# environment or from .env when set, because the registry's dotenv is pointed at /dev/null
+# below and this is otherwise the one part of its configuration nothing can reach. CORS_ORIGINS
+# is the one that bites: it defaults to http://localhost:3012 exactly, so opening the dApp on
+# 127.0.0.1 instead is a different origin and every registry read is blocked.
+REGISTRY_OPTION_KEYS=(
+  CORS_ORIGINS
+  DIRECT_TRANSFER_MARGIN_MS
+  LEDGER_USER_ID
+  SHUTDOWN_TIMEOUT_MS
+)
 
 # Resolved in up(), once ./.env has been read.
 JSON_API_URL=""
 
-# Derive the DAR name from daml.yaml so renames and version bumps need no edit here.
-DAML_DIR="dapp/daml"
-DAR_NAME="$(awk '/^name:/{n=$2} /^version:/{v=$2} END{print n"-"v".dar"}' "$DAML_DIR/daml.yaml")"
-DAR_PATH="$DAML_DIR/.daml/dist/$DAR_NAME"
+# Vendored binaries, not built here. canton-token-forge goes first: vesting
+# data-depends on it. See vendor/PROVENANCE.md.
+VENDOR_DARS=(vendor/canton-token-forge.dar vendor/vesting.dar)
 
 log()  { printf '\033[1;36m==>\033[0m %s\n' "$*"; }
 warn() { printf '\033[1;33m[!]\033[0m %s\n' "$*"; }
 die()  { printf '\033[1;31m[x]\033[0m %s\n' "$*" >&2; exit 1; }
 
-# A half-parsed daml.yaml yields a name like '-.dar', which would deploy nothing.
-case "$DAR_NAME" in
-  -.dar | -*.dar | *-.dar) die "Could not derive DAR name from $DAML_DIR/daml.yaml (got '$DAR_NAME')" ;;
-esac
-
 ACTION="${1:-menu}"
 LOCALNET_ARG="${2:-}"
 
@@ -119,6 +143,18 @@ wait_for_http() { # wait_for_http <seconds> <url> <label> <any|ok>
   return 1
 }
 
+# `kill` returns before the process has released its socket, so a restart needs this
+# between the stop and the next bind.
+wait_for_port_free() { # wait_for_port_free <seconds> <port>
+  local timeout="$1" port="$2" deadline
+  deadline=$((SECONDS + timeout))
+  while [ "$SECONDS" -lt "$deadline" ]; do
+    lsof -nP -iTCP:"$port" -sTCP:LISTEN >/dev/null 2>&1 || return 0
+    sleep 1
+  done
+  return 1
+}
+
 # Returns non-zero rather than exiting, so `down` still stops the host processes and
 # `status` still prints the ports when the LocalNet itself is unreachable.
 localnet() { # localnet <start|stop|reset|status|logs> [args…]
@@ -184,6 +220,85 @@ start_wallet_service() {
     || die "wallet-service is not answering on 3010 (log: $WS_LOG)."
 }
 
+# Read one KEY=value line out of the block bootstrap printed, dropping the single
+# quotes the template ids carry for the paste-into-a-.env case. Keys come from
+# REGISTRY_ENV_KEYS and nowhere else, so the sed pattern is never caller data.
+read_bootstrap_env() { # read_bootstrap_env <key>
+  local value
+  value="$(sed -n "s/^$1=//p" "$BOOTSTRAP_LOG" | tail -n1)"
+  value="${value#\'}"
+  printf '%s' "${value%\'}"
+}
+
+# The port has one definition, in scripts/bootstrap-vesting.mjs, and reaches this
+# script only in the block bootstrap prints. 3013 is the fallback for a `down` that
+# never saw one.
+registry_port() {
+  local port=''
+  if [ -f "$BOOTSTRAP_LOG" ]; then
+    port="$(read_bootstrap_env PORT)"
+  fi
+  printf '%s' "${port:-3013}"
+}
+
+# Scoped to the port on purpose: matching the registry's path alone would also kill
+# one a developer is running on another port, from this checkout or another.
+kill_registry_on_port() { # kill_registry_on_port <port>
+  local port="$1" pid
+  for pid in $(lsof -t -nP -iTCP:"$port" -sTCP:LISTEN 2>/dev/null); do
+    if ps -p "$pid" -o args= 2>/dev/null | grep -q 'canton-token-forge/registry/dist'; then
+      kill "$pid" 2>/dev/null || true
+    fi
+  done
+}
+
+# The registry ships from BootNodeDev/canton-token-forge as a git dependency and runs
+# on the host. It is read-only and takes the same bearer the DAR upload does, so no
+# new secret is introduced.
+start_registry() {
+  local key value port
+  local -a registry_env=()
+  for key in "${REGISTRY_ENV_KEYS[@]}"; do
+    value="$(read_bootstrap_env "$key")"
+    [ -n "$value" ] || die "bootstrap printed no $key; cannot configure the registry (log: $BOOTSTRAP_LOG)"
+    registry_env+=("$key=$value")
+  done
+  # Set-but-empty is passed through rather than dropped: for CORS_ORIGINS it is the only way to ask
+  # for no allowed origin at all, where dropping it hands the registry its own localhost default.
+  for key in "${REGISTRY_OPTION_KEYS[@]}"; do
+    [ -n "${!key+set}" ] || continue
+    registry_env+=("$key=${!key}")
+  done
+  port="$(read_bootstrap_env PORT)"
+
+  # Restarted rather than skipped: a leftover registry was configured by an earlier run and
+  # still answers /readyz, so a reset that moved the admin party would go unnoticed.
+  if lsof -nP -iTCP:"$port" -sTCP:LISTEN >/dev/null 2>&1; then
+    log "Port $port in use; restarting the token registry."
+    stop_pidfile "$REGISTRY_PID" "token registry"
+    kill_registry_on_port "$port"
+    # Comfortably past the registry's own SHUTDOWN_TIMEOUT_MS, which is 8s by
+    # default: a shorter budget reports a draining registry as a foreign process.
+    wait_for_port_free 20 "$port" \
+      || die "Port $port is still held after 20s; free it, then run 'up'. A token registry draining an in-flight request takes up to SHUTDOWN_TIMEOUT_MS (8s by default)."
+  fi
+
+  log "Starting the token registry -> http://localhost:$port"
+  # The bearer goes in the environment rather than through `env`'s argv, where `ps`
+  # would show it to every local user for the life of the process.
+  # DOTENV_CONFIG_PATH points the registry's `import 'dotenv/config'` at an empty file:
+  # its cwd is the repo root, so it would otherwise read all of wallet-service's .env
+  # into itself, the CANTON_AUTH_SECRET signing key included, for no purpose.
+  LEDGER_API_TOKEN="$CANTON_BACKEND_TOKEN" \
+    nohup env DOTENV_CONFIG_PATH=/dev/null "${registry_env[@]}" pnpm exec canton-token-forge-registry >"$REGISTRY_LOG" 2>&1 &
+  echo $! >"$REGISTRY_PID"
+
+  # /readyz rather than /healthz: it reads the ledger end, so a 2xx proves the
+  # registry can reach the participant and not merely that something holds the port.
+  wait_for_http 60 "http://localhost:$port/readyz" "token registry" ok \
+    || die "The token registry is not ready on $port (log: $REGISTRY_LOG)."
+}
+
 up() {
   mkdir -p "$RUN_DIR"
 
@@ -196,11 +311,6 @@ up() {
   docker info >/dev/null 2>&1 \
     || die "Docker daemon not reachable. Start Docker first (menu: docker-up, the Docker app, or your CLI), then run 'up'."
 
-  # The DAR build needs dpm; check here so a missing SDK fails before the
-  # containers come up rather than after.
-  command -v dpm >/dev/null 2>&1 \
-    || die "dpm not found on PATH. Install the DAML SDK (3.4.11), then run 'up'."
-
   # ./.env is wallet-service's whole configuration, the mint recipe and the DAR
   # upload token. Minting is offline, so this needs nothing running.
   [ -f .env ] || { log "Creating .env from .env.example"; cp .env.example .env; }
@@ -232,8 +342,20 @@ up() {
   # matching deploy-dar.sh and mint-token.mjs; nothing is exported, because each step
   # reads .env for itself and only the mint recipe would travel.
   local preset_json_api_url="${CANTON_JSON_API_URL:-}"
+  # The same rule for the registry's own options, which `source` would otherwise overwrite with the
+  # file's, against what REGISTRY_OPTION_KEYS says about where they come from.
+  local -a preset_registry_options=()
+  local option
+  for option in "${REGISTRY_OPTION_KEYS[@]}"; do
+    if [ -n "${!option+set}" ]; then
+      preset_registry_options+=("$option=${!option}")
+    fi
+  done
   # shellcheck disable=SC1091
   source .env
+  for option in ${preset_registry_options[@]+"${preset_registry_options[@]}"}; do
+    export "${option?}"
+  done
   JSON_API_URL="${preset_json_api_url:-${CANTON_JSON_API_URL:-http://localhost:2975}}"
 
   # Nothing about the LocalNet config is committed: it is scaffolded from the pinned
@@ -251,21 +373,29 @@ up() {
   wait_for_http 300 "$JSON_API_URL/v2/version" "app-user JSON API" any \
     || die "The LocalNet is up but its JSON API never answered. Check 'canton-barebones logs' in $LOCALNET_DIR, then run 'up' again."
 
-  # 2. Build + deploy the DAR, which needs the participant but not wallet-service. The build
-  # fetches the Splice DARs amulet-vesting data-depends on the first time, and after a Splice bump.
-  log "Building the $DAR_NAME DAR..."
-  pnpm run build-dar
-  log "Deploying $DAR_PATH to Canton..."
-  pnpm run deploy-dar -- "$DAR_PATH"
+  # 2. Deploy the vendored DARs, which need the participant but not wallet-service.
+  local dar
+  for dar in "${VENDOR_DARS[@]}"; do
+    log "Deploying $dar to Canton..."
+    pnpm run deploy-dar -- "$dar"
+  done
 
   # 3. wallet-service (3010)
   start_wallet_service
 
-  # 4. Bootstrap, which goes through wallet-service's /rpc
-  log "Bootstrapping the vesting operator and factory..."
-  pnpm run bootstrap
+  # 4. Bootstrap, which goes through wallet-service's /rpc. Its stdout is teed rather
+  # than swallowed: the registry's whole non-secret configuration is in it, and a
+  # manual run still wants to read the block. `set -o pipefail` is on, so a failing
+  # bootstrap still fails here.
+  # The URL is passed explicitly, which bootstrap's own --env-file loses to: otherwise a
+  # caller override moves the upload and the probe but not what the registry points at.
+  log "Bootstrapping the vesting operator, factory and DBT instrument..."
+  CANTON_JSON_API_URL="$JSON_API_URL" pnpm run bootstrap | tee "$BOOTSTRAP_LOG"
+
+  # 5. Token registry (3013), which needs the admin party bootstrap just created
+  start_registry
 
-  # 5. dApp frontend dev server (3012)
+  # 6. dApp frontend dev server (3012)
   if lsof -nP -iTCP:3012 -sTCP:LISTEN >/dev/null 2>&1; then
     warn "Port 3012 already in use; skipping dApp dev server."
   else
@@ -279,6 +409,7 @@ up() {
   log "Stack is up:"
   cat <<EOF
    wallet-service          http://localhost:3010   (log: $WS_LOG)
+   token registry          http://localhost:3013   (log: $REGISTRY_LOG)
    dApp frontend           http://localhost:3012   (log: $DAPP_LOG)
    app-user wallet UI      http://wallet.localhost:2000
    app-user JSON API       $JSON_API_URL
@@ -310,6 +441,8 @@ down() {
   stop_pidfile "$DAPP_PID" "dApp dev server"
   # Belt-and-suspenders: kill any stray vite on our port.
   pkill -f "vite --host localhost --port 3012" 2>/dev/null || true
+  stop_pidfile "$REGISTRY_PID" "token registry"
+  kill_registry_on_port "$(registry_port)"
   stop_pidfile "$WS_PID" "wallet-service"
   pkill -f "canton-wallet-service" 2>/dev/null || true
 
@@ -324,9 +457,9 @@ down() {
   fi
 
   echo
-  log "Dev-server ports 3010-3012:"
-  if lsof -nP -iTCP:3010-3012 -sTCP:LISTEN >/dev/null 2>&1; then
-    lsof -nP -iTCP:3010-3012 -sTCP:LISTEN | awk 'NR>1{print "   "$1, $9}'
+  log "Dev-server ports 3010-3013:"
+  if lsof -nP -iTCP:3010-3013 -sTCP:LISTEN >/dev/null 2>&1; then
+    lsof -nP -iTCP:3010-3013 -sTCP:LISTEN | awk 'NR>1{print "   "$1, $9}'
   else
     echo "   (all free)"
   fi
@@ -344,8 +477,8 @@ menu() {
     "install + link every workspace"
     "start Docker Desktop (macOS)"
     "quit Docker Desktop (macOS)"
-    "start LocalNet, deploy DAR, wallet-service, bootstrap, dApp"
-    "stop wallet-service + dApp dev server, stop the LocalNet"
+    "start LocalNet, deploy DARs, wallet-service, bootstrap, registry, dApp"
+    "stop dApp dev server, token registry, wallet-service, stop the LocalNet"
     "exit"
   )
   local n=${#keys[@]} sel=0 key rest i num choice
@@ -416,9 +549,9 @@ status() {
   else
     echo "   (docker daemon not running)"
   fi
-  log "Dev-server ports 3010-3012:"
-  if lsof -nP -iTCP:3010-3012 -sTCP:LISTEN >/dev/null 2>&1; then
-    lsof -nP -iTCP:3010-3012 -sTCP:LISTEN | awk 'NR>1{print "   "$1, $9}'
+  log "Dev-server ports 3010-3013:"
+  if lsof -nP -iTCP:3010-3013 -sTCP:LISTEN >/dev/null 2>&1; then
+    lsof -nP -iTCP:3010-3013 -sTCP:LISTEN | awk 'NR>1{print "   "$1, $9}'
   else
     echo "   (none)"
   fi
diff --git a/scripts/fetch-daml-deps.mjs b/scripts/fetch-daml-deps.mjs
deleted file mode 100644
index 78c5e664..00000000
--- a/scripts/fetch-daml-deps.mjs
+++ /dev/null
@@ -1,113 +0,0 @@
-#!/usr/bin/env node
-//
-// Fetches the Splice DARs `dapp/daml` data-depends on into its gitignored deps/, so the Daml
-// source is what this repository carries and the artifacts are not.
-//
-// The version is not a choice: an Amulet-moving choice is exercised against the
-// AmuletRules the network is running, so the DAR has to be the one that network's Splice
-// release ships. `spliceTag` reads that release off the canton-barebones template the
-// LocalNet is scaffolded from, so the DAR and the LocalNet cannot disagree, and within a
-// release the current Amulet is the highest version in its dars/ directory.
-import { execFileSync } from 'node:child_process'
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { repoRoot } from './lib/gate.mjs'
-import { spliceTag } from './localnet-config.mjs'
-
-const DAML_DIR = path.join(repoRoot, 'dapp/daml')
-const DEPS_DIR = path.join(DAML_DIR, 'deps')
-const STAMP = path.join(DEPS_DIR, '.splice-tag')
-
-// Anonymous read of a public upstream, so https rather than ssh: a contributor without a
-// GitHub key still has to be able to build.
-const SPLICE_REPO = 'https://github.com/canton-network/splice.git'
-
-const git = (args, cwd) =>
-  execFileSync('git', args, { cwd, stdio: ['ignore', 'ignore', 'inherit'] })
-
-// daml.yaml is where dpm reads the dependency list, so it is the one place it is spelled; each
-// name is also the version-less filename the copy below lands on.
-export const targets = () =>
-  fs
-    .readFileSync(path.join(DAML_DIR, 'daml.yaml'), 'utf8')
-    .split('\n')
-    .flatMap((line) => line.match(/^\s*-\s*deps\/(\S+)\.dar\s*$/)?.slice(1) ?? [])
-
-// Which Amulet the whole DAR is built against, so it is tested rather than trusted: the version is
-// anchored at both ends, or `splice-amulet-name-service` answers for `splice-amulet`, and the sort
-// is numeric, or '0.1.9' wins over '0.1.21'.
-export const newest = (names, target) =>
-  names
-    .filter((name) => new RegExp(`^${target}-[\\d.]+\\.dar$`).test(name))
-    .sort((a, b) => a.localeCompare(b, undefined, { numeric: true }))
-    .at(-1)
-
-const main = () => {
-  const tag = spliceTag()
-  // Every target has to be on disk too, not just the right tag: adding a data-dependency moves
-  // daml.yaml without moving the tag, and a stamp alone would skip the fetch and leave `dpm build`
-  // to fail on a DAR nobody fetched.
-  const fetched =
-    fs.existsSync(STAMP) &&
-    fs.readFileSync(STAMP, 'utf8').trim() === tag &&
-    targets().every((target) => fs.existsSync(path.join(DEPS_DIR, `${target}.dar`)))
-  if (fetched) {
-    return
-  }
-
-  console.log(`fetch-daml-deps: fetching Splice ${tag} DARs`)
-  const checkout = fs.mkdtempSync(path.join(os.tmpdir(), 'splice-dars-'))
-  try {
-    git([
-      'clone',
-      '--filter=blob:none',
-      '--no-checkout',
-      '--depth=1',
-      '--branch',
-      tag,
-      SPLICE_REPO,
-      checkout,
-    ])
-
-    // Resolve each filename off the tree before checking anything out: a blobless clone
-    // knows every name and holds no content, so a `daml/dars/*.dar` checkout would fetch the
-    // release's ~150 MB of DARs to keep 3 MB of them.
-    const names = execFileSync('git', ['ls-tree', '-r', '--name-only', 'HEAD', '--', 'daml/dars'], {
-      cwd: checkout,
-      encoding: 'utf8',
-    })
-      .split('\n')
-      .map((line) => path.basename(line.trim()))
-      .filter(Boolean)
-    const picked = targets().map((target) => {
-      const name = newest(names, target)
-      if (name === undefined) {
-        throw new Error(`Splice ${tag} ships no ${target} DAR`)
-      }
-      return [target, name]
-    })
-
-    git(
-      ['sparse-checkout', 'set', '--no-cone', ...picked.map(([, name]) => `/daml/dars/${name}`)],
-      checkout,
-    )
-    git(['checkout'], checkout)
-
-    fs.rmSync(DEPS_DIR, { recursive: true, force: true })
-    fs.mkdirSync(DEPS_DIR, { recursive: true })
-    for (const [target, name] of picked) {
-      fs.copyFileSync(path.join(checkout, 'daml/dars', name), path.join(DEPS_DIR, `${target}.dar`))
-      console.log(`fetch-daml-deps: ${name} -> deps/${target}.dar`)
-    }
-    fs.writeFileSync(STAMP, `${tag}\n`)
-  } finally {
-    fs.rmSync(checkout, { recursive: true, force: true })
-  }
-}
-
-// `import.meta.filename` rather than a `file://` template around argv[1]: the two disagree the
-// moment the repo path holds a space, and then the fetch silently no-ops.
-if (import.meta.filename === process.argv[1]) {
-  main()
-}
diff --git a/scripts/fetch-daml-deps.test.mjs b/scripts/fetch-daml-deps.test.mjs
deleted file mode 100644
index c93bc69b..00000000
--- a/scripts/fetch-daml-deps.test.mjs
+++ /dev/null
@@ -1,45 +0,0 @@
-import assert from 'node:assert/strict'
-import { describe, it } from 'node:test'
-import { newest, targets } from './fetch-daml-deps.mjs'
-
-// The names a Splice release actually ships in daml/dars, trimmed to the interesting neighbours:
-// two Amulet versions whose ordering a string sort gets wrong, and a longer name that starts with
-// one of the targets.
-const RELEASE = [
-  'splice-amulet-0.1.9.dar',
-  'splice-amulet-0.1.21.dar',
-  'splice-amulet-name-service-0.1.21.dar',
-  'splice-api-token-holding-v1-1.0.0.dar',
-  'splice-util-0.1.7.dar',
-]
-
-describe('Splice DAR selection', () => {
-  it('takes the highest version rather than the highest string', () => {
-    assert.equal(newest(RELEASE, 'splice-amulet'), 'splice-amulet-0.1.21.dar')
-  })
-
-  it('does not answer for a longer name that starts with the target', () => {
-    assert.equal(
-      newest(RELEASE, 'splice-amulet-name-service'),
-      'splice-amulet-name-service-0.1.21.dar',
-    )
-    assert.equal(newest(['splice-amulet-name-service-0.1.21.dar'], 'splice-amulet'), undefined)
-  })
-
-  it('reports nothing rather than guessing when the release ships no such DAR', () => {
-    assert.equal(newest(RELEASE, 'splice-api-token-metadata-v1'), undefined)
-  })
-})
-
-describe('daml.yaml data-dependencies', () => {
-  // Read from the real daml.yaml, not a fixture: a dependency added there without a matching fetch
-  // is exactly the drift this reading exists to prevent, and a fixture would hide it.
-  it('names every deps/ DAR the package declares, and nothing else', () => {
-    assert.deepEqual(targets(), [
-      'splice-amulet',
-      'splice-api-token-holding-v1',
-      'splice-api-token-metadata-v1',
-      'splice-api-token-transfer-instruction-v1',
-    ])
-  })
-})
diff --git a/scripts/localnet-config.mjs b/scripts/localnet-config.mjs
index 6c4c50c6..11b9227b 100644
--- a/scripts/localnet-config.mjs
+++ b/scripts/localnet-config.mjs
@@ -30,17 +30,6 @@ const readJson = (filePath) => JSON.parse(fs.readFileSync(filePath, 'utf8'))
 
 const templatePath = () => require.resolve(`@bootnodedev/canton-barebones/templates/${CONFIG_NAME}`)
 
-// The Splice release the pinned canton-barebones scaffolds, which is also the one
-// scripts/fetch-daml-deps.mjs builds the DAR against: those two drifting apart is the whole
-// failure this is exported to prevent.
-export const spliceTag = () => {
-  const tag = readJson(templatePath()).splice?.tag
-  if (typeof tag !== 'string' || tag === '') {
-    throw new Error(`no splice.tag in ${templatePath()}`)
-  }
-  return tag
-}
-
 /**
  * Decides whether the scaffolded config has to be replaced rather than kept. Absent
  * or off the template's config version or Splice tag, it is replaced; anything else
diff --git a/scripts/mint-token.mjs b/scripts/mint-token.mjs
index 37e42886..ed51d7d3 100755
--- a/scripts/mint-token.mjs
+++ b/scripts/mint-token.mjs
@@ -79,6 +79,8 @@ const main = () => {
   )
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+// See scripts/bootstrap-vesting.mjs: neither a percent-encoded import.meta.url nor
+// a realpath-resolved import.meta.filename compares equal to argv[1] on every path.
+if (import.meta.main) {
   main()
 }
diff --git a/scripts/mint-token.test.mjs b/scripts/mint-token.test.mjs
index 3f1bc25d..5bc02ba2 100644
--- a/scripts/mint-token.test.mjs
+++ b/scripts/mint-token.test.mjs
@@ -1,5 +1,7 @@
 import assert from 'node:assert/strict'
 import { execFileSync } from 'node:child_process'
+import fs from 'node:fs'
+import os from 'node:os'
 import path from 'node:path'
 import { describe, it } from 'node:test'
 import { fileURLToPath } from 'node:url'
@@ -58,4 +60,29 @@ describe('Canton token generation', () => {
     assert.match(output, /CANTON_BACKEND_TOKEN=/)
     assert.match(output, /wallet LocalNet settings/)
   })
+
+  it('still runs when invoked through a symlinked path', () => {
+    // Scenario: a checkout reached through a symlink (macOS /tmp, a linked repo).
+    // The main-module guard is the same idiom bootstrap-vesting.mjs uses, and
+    // comparing argv[1] against a realpathed path made it false and exit 0 mutely.
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mint-token-'))
+    const linkedScripts = path.join(tmpDir, 'scripts')
+    fs.symlinkSync(__dirname, linkedScripts, 'dir')
+
+    try {
+      const output = execFileSync(process.execPath, [path.join(linkedScripts, 'mint-token.mjs')], {
+        cwd: tmpDir,
+        env: {
+          ...process.env,
+          CANTON_AUTH_AUDIENCE: 'https://canton.network.global',
+          CANTON_AUTH_SECRET: 'unsafe',
+        },
+        encoding: 'utf8',
+      })
+
+      assert.match(output, /CANTON_BACKEND_TOKEN=/)
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true })
+    }
+  })
 })
diff --git a/vendor/PROVENANCE.md b/vendor/PROVENANCE.md
new file mode 100644
index 00000000..1516bc09
--- /dev/null
+++ b/vendor/PROVENANCE.md
@@ -0,0 +1,66 @@
+# vendor/
+
+The two Daml packages this repository needs, committed as binaries. Neither is
+built here: `dpm` is not a requirement to run this repository, and both DARs are
+byte-reproducible from a clean tree at the tag below, so they can be rebuilt and
+compared rather than trusted.
+
+## `canton-token-forge.dar`
+
+| | |
+|---|---|
+| Source | https://github.com/BootNodeDev/canton-token-forge |
+| Release | `v0.3.0` |
+| Asset | `canton-token-forge-0.0.1.dar` |
+| Size | 725807 bytes |
+| sha256 | `147835e775e523f78c784996c43500c57e1ed97bcab97c97df6515b65f9332da` |
+| package-id | `20d54824dc4d76694c70ac51dd5f0b9e063ab789ffa02d07432abb848c8360cc` |
+| Built against Splice | `0.6.7` (commit `c8d8d977794c514ed2ee9eb64de322a6779898f3`) |
+| Daml SDK | 3.4.11 |
+| LF target | 2.1 |
+
+The asset is byte-identical to the ones on `v0.1.0` and `v0.2.0`. It is taken
+from `v0.3.0` because that is also the tag `package.json` pins the registry
+service to, so one tag governs both halves of the dependency.
+
+It bundles all six `splice-api-token-*` interface packages it links against, at
+the package-ids it was compiled with, so this repository vendors no Splice of
+its own.
+
+## `vesting.dar`
+
+| | |
+|---|---|
+| Source | https://github.com/BootNodeDev/canton-vesting-forge |
+| Release | `v0.2.0` |
+| Asset | `vesting-0.0.2.dar` |
+| Size | 688686 bytes |
+| sha256 | `b78439bafdfb4c2e38666d3d99ac73e8c27722dada41d52876d997f16858d5b3` |
+| package-id | `e96e3b9b70a12538cc3bba264480dca9e88e87593706cc3f2e638e877ff99f67` |
+| Bundled canton-token-forge | 0.0.1, package-id `20d54824dc4d76694c70ac51dd5f0b9e063ab789ffa02d07432abb848c8360cc` |
+| Daml SDK | 3.4.11 |
+| LF target | 2.1 |
+
+`vesting` data-depends on `canton-token-forge`, so the participant must have
+`canton-token-forge.dar` before this one: `scripts/dev-stack.sh` uploads them in
+that order.
+
+## Re-verifying
+
+    sha256sum vendor/canton-token-forge.dar vendor/vesting.dar
+
+## Updating
+
+There is no automated update path. To move to a later release of either: replace
+the binary, re-run the checksum, and update every row above by hand.
+
+A participant that already vetted an earlier version of the same package refuses
+the new one outright when the two are not a valid smart-contract upgrade:
+`vesting` 0.0.2 changed `VestingFactory_CreateVesting`'s return type, so a
+LocalNet carrying 0.0.1 answers the upload with
+`NOT_VALID_UPGRADE_PACKAGE`. Nothing can be uploaded past that; drop the ledger
+first and let the stack redeploy both DARs onto it:
+
+    ./scripts/dev-stack.sh down
+    ( cd .canton-localnet && ../node_modules/.bin/canton-barebones reset )
+    ./scripts/dev-stack.sh up
diff --git a/vendor/canton-token-forge.dar b/vendor/canton-token-forge.dar
new file mode 100644
index 00000000..3de300d1
Binary files /dev/null and b/vendor/canton-token-forge.dar differ
diff --git a/vendor/vesting.dar b/vendor/vesting.dar
new file mode 100644
index 00000000..a87ba086
Binary files /dev/null and b/vendor/vesting.dar differ