docs: STATUS + extension ARCHITECTURE update for management-surfaces revamp

STATUS.md

@@ -37,6 +37,15 @@ Three release trains merged into one tag:
 - `base32` module extracted from core, two duplicate RFC-4648 impls deduplicated
 - License switched to GPL-3.0-or-later
 
+**Vault-tab management surfaces revamp (2026-05-24+):**
+- Fullscreen visual language applied to Settings, Devices, Trash, and History panes
+- Settings: synced/local section grouping + per-device session-timeout UI (radio + minutes)
+- Devices: SHA256 fingerprint + added-by display; glyph revoke button + inline two-step confirm
+- Trash: per-item purge countdown via `daysUntilPurge`; glyph restore + bottom-right empty-trash
+- History: new "items with history" index pane reachable from sidebar `◷ history` slot; per-item view gets section headers + glyph reveal/copy
+- Shared `relative-time.ts` consolidates 5 duplicate inline copies; `ssh-fingerprint.ts` (webcrypto) added
+- New hash route `#history/<id>` with `#field-history/<id>` legacy normalization
+
 ## In progress (uncommitted on main)
 
 - Vault lock screen logo (`extension/src/vault/vault.ts`)

extension/ARCHITECTURE.md

@@ -154,19 +154,35 @@ before any new render.
 - `settings-vault.ts` — vault-wide settings (retention, generator
   defaults, autofill origin acks). Reads/writes via the SW's
   `get_vault_settings` / `update_vault_settings`.
-- `trash.ts` — soft-delete listing with restore + purge buttons.
+- `trash.ts` — soft-delete listing with per-item purge countdown
-- `devices.ts` — device list with revoke. Inline "register this device"
+  (via `shared/relative-time.ts::daysUntilPurge`), glyph restore (`⤺`),
-  flow lives here (banner shown when current device is not in the list);
+  and a bottom-right destructive "empty trash" button.
-  see commit `a7dbf35`.
+- `devices.ts` — device list. Three-line rhythm per row: name + revoke
+  glyph (`⊘` with inline two-step confirm — no browser modal), full
+  SHA256 fingerprint (computed in-popup via `shared/ssh-fingerprint.ts`
+  — no SW round-trip), `added X ago · by Y` meta. Inline "register this
+  device" banner shown when current device is not in the list.
 - `field-history.ts` — audit-log of value changes on a single item;
   driven by the SW's `get_field_history` which calls into WASM
-  `get_field_history(item_json)`.
+  `get_field_history(item_json)`. Section header per field
+  (`PASSWORD · N entries`); reveal/copy via explicit glyph buttons
+  (decoupled from row click); revealed values colorized via
+  `shared/password-coloring.ts`.
+- `item-history-index.ts` — top-level history pane: iterates the
+  manifest and fans out one `get_field_history` per item, lists those
+  with ≥1 entry sorted by recency. Click drills into `field-history.ts`
+  for the per-item view. Reachable via `#history` (the sidebar slot)
+  and from the URL.
 
 ### `src/vault/`
 
 - `vault.ts` — fullscreen tab entry. Hash-based router (`#detail/<id>`,
   `#add/<type>`, `#trash`, `#devices`, `#settings`, `#settings-vault`,
-  `#field-history`). Registers itself as the StateHost so all
+  `#history`, `#history/<id>`). Legacy `#field-history/<id>` URLs are
+  normalized to `#history/<id>` on `parseHash`; the internal view value
+  stays `'field-history'` so the per-item pane renders unchanged.
+  Sidebar bottom-nav: `+ new item · ▦ trash · ⌬ devices · ⚙ settings ·
+  ◷ history · ⏻ lock`. Registers itself as the StateHost so all
   `popup/components/*` renderers run unchanged. Maintains its own
   `selectedItem` cache so hash navigation between already-loaded items
   doesn't refetch.