docs: sync STATUS / ROADMAP / extension ARCHITECTURE with shipped work

Punch items from doc audit:
- STATUS: "in progress" section was carrying ghost items (vault
  container max-width, README name fix) with no matching commits or
  working-tree changes; trimmed to the one real in-flight item.
- STATUS + ROADMAP: trash/history/devices/settings management-surfaces
  revamp shipped 2026-05-24..05-30 (commits c943a06..88d7228) but was
  still listed as "up next" / medium-term; moved to shipped with
  per-commit SHAs.
- STATUS: v0.5.0 was described as the current tag, but only v0.2.0 and
  four plan-1* tags exist; rephrased as "v0.5.0 train on main, untagged".
- ROADMAP: "Vault lock screen + container polish (in progress)"
  collapsed to just the lock-screen logo (the only real in-flight item).
- extension/ARCHITECTURE: module map missing four shipped components —
  popup/components/form-header.ts, popup/components/settings-security.ts,
  vault/components/backup-panel.ts (#backup route),
  vault/components/import-panel.ts (#import route); all added with
  matching #backup / #import route entries.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ROADMAP.md

@@ -7,17 +7,25 @@
 
 | Version | Highlights |
 |---|---|
-| v0.5.0 (2026-05-02) | Security audit fixes, device auth, backup/restore, LastPass import, fullscreen UX phases 1+2A |
+| v0.5.0 train *(on main, untagged)* | Security audit fixes, device auth, backup/restore, LastPass import, fullscreen UX phases 1+2A, vault-tab management surfaces revamp |
+| v0.2.0 | Last tagged release — typed-item rewrite (Plans 1A/1B/1C-α/β₁/β₂) |
 
-See `CHANGELOG.md` for full details.
+Also shipped on main since the v0.5.0 version bump:
+
+- **Vault-tab management surfaces revamp** (2026-05-24 → 2026-05-30) — settings synced/local split with session-timeout UI, devices fingerprint + inline two-step revoke, trash per-item purge countdown, field-history visual polish, new item-history-index pane, `#history/<id>` route normalization. Shared `relative-time.ts` + `ssh-fingerprint.ts` utilities.  
+  Spec: `docs/superpowers/specs/2026-05-23-vault-tab-management-surfaces-revamp-design.md`  
+  Plan: `docs/superpowers/plans/2026-05-24-vault-tab-management-surfaces-revamp.md`
+
+See `CHANGELOG.md` for full details and `STATUS.md` for the current commit list.
 
 ## Up next (v0.5.x)
 
 These are specced and either in progress or immediately queued:
 
-- **Vault lock screen + container polish** — logo on lock screen, max-width viewport constraint *(in progress)*
+- **Vault lock screen logo** — small `<img>` insertion in the lock-screen render *(in progress, uncommitted)*
 - **Phase 2B: form layout** — spacing, section headers, attachment previews in detail pane  
-  Spec: `docs/superpowers/specs/2026-05-02-phase-2b-form-layout-design.md`
+  Spec: `docs/superpowers/specs/2026-05-02-phase-2b-form-layout-design.md`  
+  Plan: `docs/superpowers/plans/2026-05-02-phase-2b-polish-and-form-layout.md`
 - **1C-γ: attachments + Document type** — attachment UI in popup + vault tab; Document item add/view/edit/extract  
   Specs: `docs/superpowers/specs/2026-04-24-relicario-extension-1c-gamma1-design.md`,  
          `docs/superpowers/specs/2026-04-26-relicario-extension-1c-gamma2-design.md`
@@ -29,13 +37,12 @@ These are specced and either in progress or immediately queued:
 - **Phase 3: vault-tab shell** — fullscreen sidebar with nav sections, pane routing  
   Spec: `docs/superpowers/specs/2026-04-27-relicario-vault-tab-design.md`
 - **Phase 4: command palette** — ⌘K global search + action dispatch across the vault tab
-- **Vault-tab management surfaces revamp** — UX revamp of all four in-vault admin panes (Settings, Devices, Trash, History) to match the fullscreen visual language; closes functional gaps (session-timeout UI, revoke button surfacing, fingerprint display, purge countdown, history index). Aggregates existing `field_history` per item — no new core storage. Ships in v0.5.x.  
-  Spec: `docs/superpowers/specs/2026-05-23-vault-tab-management-surfaces-revamp-design.md`
 - **CLI restructure** — subcommand reorganisation, interactive TUI mode  
   Spec: `docs/superpowers/specs/2026-05-04-cli-restructure-design.md`
 - **Extension restructure** — bundle / message-routing cleanup  
   Spec: `docs/superpowers/specs/2026-05-04-extension-restructure-design.md`
-- **Security polish** — `docs/superpowers/specs/2026-05-04-security-polish-design.md`
+- **Security polish**  
+  Spec: `docs/superpowers/specs/2026-05-04-security-polish-design.md`
 
 ## Long-term / backlog
 

STATUS.md

@@ -4,10 +4,10 @@
 
 ## Version
 
-**Current tag:** v0.5.0 (2026-05-02)  
+**Last release tagged:** v0.2.0 — v0.5.0 train (crate + extension versions bumped to 0.5.0 in `cf66bd9`, 2026-05-04) is on `main` but **untagged**. Tag when the v0.5.x polish slate clears.  
 **Active track:** v0.5.x UX polish + Plan B refactor continuation
 
-## What shipped in v0.5.0 (2026-05-02)
+## What landed in the v0.5.0 train (2026-05-02 → 2026-05-04, untagged)
 
 Three release trains merged into one tag:
 
@@ -37,29 +37,32 @@ Three release trains merged into one tag:
 - `base32` module extracted from core, two duplicate RFC-4648 impls deduplicated
 - License switched to GPL-3.0-or-later
 
-**Vault-tab management surfaces revamp (2026-05-24+):**
+**Vault-tab management surfaces revamp (2026-05-24 → 2026-05-30):**
-- Fullscreen visual language applied to Settings, Devices, Trash, and History panes
+Spec: `docs/superpowers/specs/2026-05-23-vault-tab-management-surfaces-revamp-design.md`  
-- Settings: synced/local section grouping + per-device session-timeout UI (radio + minutes)
+Plan: `docs/superpowers/plans/2026-05-24-vault-tab-management-surfaces-revamp.md`
-- Devices: SHA256 fingerprint + added-by display; glyph revoke button + inline two-step confirm
+- Shared utilities first: `relative-time.ts` consolidating 5 duplicate inline copies (`9da45dd`, `a587965`), webcrypto `ssh-fingerprint.ts` (`1edfa67`), shared section-header / glyph-btn / kv-row / fingerprint CSS (`367adce`), history/revoke/restore glyph constants (`c943a06`)
-- Trash: per-item purge countdown via `daysUntilPurge`; glyph restore + bottom-right empty-trash
+- Settings pane revamp — synced/local split + session timeout UI (`299e7db`)
-- History: new "items with history" index pane reachable from sidebar `◷ history` slot; per-item view gets section headers + glyph reveal/copy
+- Devices pane revamp — SHA256 fingerprint + added-by display + glyph revoke with inline two-step confirm (`047df6e`)
-- Shared `relative-time.ts` consolidates 5 duplicate inline copies; `ssh-fingerprint.ts` (webcrypto) added
+- Trash pane revamp — per-item purge countdown via `daysUntilPurge` + glyph restore + bottom-right empty-trash (`ed6e218`)
-- New hash route `#history/<id>` with `#field-history/<id>` legacy normalization
+- Field-history pane visual polish — section headers + glyph reveal/copy buttons (`32e674e`)
+- Item-history-index pane — top-level "items with history" list (`32e1632`)
+- Sidebar slot wiring + `#history/<id>` route with `#field-history/<id>` legacy normalization (`88d7228`)
 
 ## In progress (uncommitted on main)
 
-- Vault lock screen logo (`extension/src/vault/vault.ts`)
+- Vault lock screen logo — 1-line `<img class="brand-logo">` insertion in `extension/src/vault/vault.ts` lock-screen render (verified via `git diff`)
-- Vault container max-width constraint + list-pane width fix (`extension/src/vault/vault.css`)
-- README name fix (Aaron D. Lee)
 
 ## Up next
 
+The vault-tab management surfaces revamp closes the trash / devices / history / settings gap that previously sat under "Up next". What's genuinely next, per `ROADMAP.md`:
+
 1. **Phase 2B: form layout polish** — spacing, density, section headers, attachment previews  
-   Spec: `docs/superpowers/specs/2026-05-02-phase-2b-form-layout-design.md`
+   Spec: `docs/superpowers/specs/2026-05-02-phase-2b-form-layout-design.md`  
+   Plan: `docs/superpowers/plans/2026-05-02-phase-2b-polish-and-form-layout.md`
 2. **1C-γ: attachments + Document type** — attachment UI in popup + vault tab; Document item add/view/edit  
-   Specs: `docs/superpowers/specs/2026-04-24-relicario-extension-1c-gamma{1,2}-design.md`
+   Specs: `docs/superpowers/specs/2026-04-24-relicario-extension-1c-gamma1-design.md`, `2026-04-26-relicario-extension-1c-gamma2-design.md`
 3. **Phase 3: vault-tab shell** — sidebar nav + command palette stub  
    Spec: `docs/superpowers/specs/2026-04-27-relicario-vault-tab-design.md`
-4. **Trash & history UI** — trash view, item/field-history viewer in vault tab
+4. **v0.5.0 tag** — once the v0.5.x polish slate (lock-screen logo, Phase 2B) settles, cut the tag.
 
 See `ROADMAP.md` for the longer arc.

extension/ARCHITECTURE.md

@@ -138,6 +138,10 @@ before any new render.
   `renderConcealedRow`, `renderSignatureBlock`, `renderSections*`)
   consumed by every type. Mounting is the caller's job; after mount,
   `wireFieldHandlers(scope)` binds the reveal/copy click handlers once.
+- `form-header.ts` — extracted `renderFormHeader({ title, subtitle, ...})`
+  helper used by every type's `renderForm` (shared `.form-header` CSS,
+  static "esc to cancel" subtitle in fullscreen mode). Takes an options
+  object so callers don't need to remember positional argument order.
 - `generator-panel.ts` — inline password / passphrase generator. Mounts
   inside any host element; round-trips knob changes through the SW's
   `generate_password` / `generate_passphrase` (debounced 150ms). Has two
@@ -150,10 +154,17 @@ before any new render.
   bytes via WASM (defense in depth — see
   `router/popup-only.ts:223-228`).
 - `settings.ts` — device-local UX settings (capture toggle, prompt
-  style), trash/devices/sync-now buttons, blacklist editor.
+  style), trash/devices/sync-now buttons, blacklist editor. Revamped in
+  commit `299e7db` to split synced (vault) vs local (device) sections
+  and surface the per-device session-timeout UI (radio + minutes input).
 - `settings-vault.ts` — vault-wide settings (retention, generator
   defaults, autofill origin acks). Reads/writes via the SW's
   `get_vault_settings` / `update_vault_settings`.
+- `settings-security.ts` — security sub-pane of the vault-tab settings
+  shell: three-state recovery QR display (hidden → revealed → printed)
+  and an inline devices summary. Mounted from the settings left-nav.
+  Restored from main in commit `8baef5b` after the Stream C real
+  implementation landed.
 - `trash.ts` — soft-delete listing with per-item purge countdown
   (via `shared/relative-time.ts::daysUntilPurge`), glyph restore (`⤺`),
   and a bottom-right destructive "empty trash" button.
@@ -178,16 +189,30 @@ before any new render.
 
 - `vault.ts` — fullscreen tab entry. Hash-based router (`#detail/<id>`,
   `#add/<type>`, `#trash`, `#devices`, `#settings`, `#settings-vault`,
-  `#history`, `#history/<id>`). Legacy `#field-history/<id>` URLs are
+  `#history`, `#history/<id>`, `#backup`, `#import`). Legacy
-  normalized to `#history/<id>` on `parseHash`; the internal view value
+  `#field-history/<id>` URLs are normalized to `#history/<id>` on
-  stays `'field-history'` so the per-item pane renders unchanged.
+  `parseHash` (`vault.ts:139-173`); the internal view value stays
-  Sidebar bottom-nav: `+ new item · ▦ trash · ⌬ devices · ⚙ settings ·
+  `'field-history'` so the per-item pane renders unchanged. Sidebar
-  ◷ history · ⏻ lock`. Registers itself as the StateHost so all
+  bottom-nav: `+ new item · ▦ trash · ⌬ devices · ⚙ settings · ◷ history
+  · ⏻ lock`. Registers itself as the StateHost so all
   `popup/components/*` renderers run unchanged. Maintains its own
   `selectedItem` cache so hash navigation between already-loaded items
   doesn't refetch.
 - `vault.html` / `vault.css` — sidebar + pane layout.
 
+### `src/vault/components/`
+
+Vault-tab-only panes (popup is too small for these workflows). Each
+exports `render…(app)` and a `teardown()`, same convention as
+`popup/components/*`.
+
+- `backup-panel.ts` — `.relbak` export / restore UI. Routable as
+  `#backup` (vault.ts case at :167). Drives the SW's backup handlers;
+  the actual tar packing happens in `relicario-core` via WASM exports.
+- `import-panel.ts` — LastPass CSV importer surface. Routable as
+  `#import` (vault.ts case at :168). Parses CSV client-side and pipes
+  parsed rows through `add_item` SW messages.
+
 ### `src/setup/`
 
 - `setup.ts` (1137 lines) — the wizard state machine. Six steps