diff --git a/extension/src/service-worker/router/popup-only.ts b/extension/src/service-worker/router/popup-only.ts
index febff18..0be5e5b 100644
--- a/extension/src/service-worker/router/popup-only.ts
+++ b/extension/src/service-worker/router/popup-only.ts
@@ -627,6 +627,12 @@ export async function handle(
         return { ok: false, error: (e as Error).message };
       }
     }
+
+    // create_vault / attach_vault land in Phase 3 Tasks 3.2-3.3; get_vault_status
+    // in Phase 6 (Dev-C). Until each case lands, an unhandled popup message
+    // returns an explicit error rather than falling through with no return.
+    default:
+      return { ok: false, error: `unhandled popup message: ${(msg as { type: string }).type}` };
   }
 }
 
diff --git a/extension/src/shared/messages.ts b/extension/src/shared/messages.ts
index 4ffb8b7..3c59bc4 100644
--- a/extension/src/shared/messages.ts
+++ b/extension/src/shared/messages.ts
@@ -63,7 +63,12 @@ export type PopupMessage =
   | { type: 'import_lastpass_commit'; items: Item[] }
   | { type: 'preview_totp_from_secret'; secret_b32: string }
   | { type: 'generate_recovery_qr'; passphrase: string }
-  | { type: 'unwrap_recovery_qr'; payload_b64: string; passphrase: string };
+  | { type: 'unwrap_recovery_qr'; payload_b64: string; passphrase: string }
+  | { type: 'create_vault'; config: VaultConfig; passphrase: string;
+      carrierImageBytes: ArrayBuffer; deviceName: string }
+  | { type: 'attach_vault'; config: VaultConfig; passphrase: string;
+      referenceImageBytes: ArrayBuffer; deviceName: string }
+  | { type: 'get_vault_status' };
 
 // --- Messages a content script may send ---
 
@@ -176,6 +181,7 @@ export const POPUP_ONLY_TYPES: ReadonlySet<PopupMessage['type']> = new Set([
   'parse_lastpass_csv', 'import_lastpass_commit',
   'preview_totp_from_secret',
   'generate_recovery_qr', 'unwrap_recovery_qr',
+  'create_vault', 'attach_vault', 'get_vault_status',
 ] as PopupMessage['type'][]);
 
 export interface ExportBackupResponse extends Extract<Response, { ok: true }> {
@@ -201,6 +207,20 @@ export interface ImportLastPassCommitResponse extends Extract<Response, { ok: tr
   };
 }
 
+export interface CreateVaultResponse extends Extract<Response, { ok: true }> {
+  data: { referenceImageBytes: Uint8Array; deviceName: string;
+          recoveryQrAvailable: true };
+}
+
+export interface AttachVaultResponse extends Extract<Response, { ok: true }> {
+  data: { deviceName: string };
+}
+
+export interface GetVaultStatusResponse extends Extract<Response, { ok: true }> {
+  data: { ahead: number; behind: number; lastSyncAt: number | null;
+          pendingItems: number };
+}
+
 export const CONTENT_CALLABLE_TYPES: ReadonlySet<ContentMessage['type']> = new Set([
   'get_autofill_candidates', 'get_credentials', 'check_credential', 'blacklist_site',
   'capture_save_login',