diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b6f95fb3..6df6e6a6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -156,6 +156,15 @@ jobs:
           node-version: 20
           cache: npm
 
+      - name: Install Linux native USB build dependency
+        if: runner.os == 'Linux'
+        # node-hid builds against libudev (hidraw) and libusb; install both.
+        # `apt-get update` first — the image's pre-seeded index can name a
+        # build the mirrors already rotated out (install 404s).
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libudev-dev libusb-1.0-0-dev
+
       - name: Install dependencies
         run: npm ci
 
@@ -222,6 +231,15 @@ jobs:
           node-version: 20
           cache: npm
 
+      - name: Install Linux native USB build dependency
+        if: runner.os == 'Linux'
+        # node-hid builds against libudev (hidraw) and libusb; install both.
+        # `apt-get update` first — the image's pre-seeded index can name a
+        # build the mirrors already rotated out (install 404s).
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libudev-dev libusb-1.0-0-dev
+
       - name: Install dependencies
         run: npm ci
 
@@ -272,6 +290,15 @@ jobs:
           node-version: 20
           cache: npm
 
+      - name: Install Linux native USB build dependency
+        if: runner.os == 'Linux'
+        # node-hid builds against libudev (hidraw) and libusb; install both.
+        # `apt-get update` first — the image's pre-seeded index can name a
+        # build the mirrors already rotated out (install 404s).
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libudev-dev libusb-1.0-0-dev
+
       - name: Install dependencies
         run: npm ci
 
@@ -320,6 +347,15 @@ jobs:
           node-version: 20
           cache: npm
 
+      - name: Install Linux native USB build dependency
+        if: runner.os == 'Linux'
+        # node-hid builds against libudev (hidraw) and libusb; install both.
+        # `apt-get update` first — the image's pre-seeded index can name a
+        # build the mirrors already rotated out (install 404s).
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libudev-dev libusb-1.0-0-dev
+
       - name: Install dependencies
         run: npm ci
 
diff --git a/package-lock.json b/package-lock.json
index 2b61fd7c..ca580b2f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15,6 +15,8 @@
         "@ensdomains/content-hash": "^3.0.0",
         "@ethersphere/bee-js": "^12.2.1",
         "@ghostery/adblocker": "^2.18.1",
+        "@ledgerhq/hw-app-eth": "^7.8.8",
+        "@ledgerhq/hw-transport-node-hid": "^6.33.5",
         "@metamask/browser-passworder": "^6.0.0",
         "@scure/bip39": "^2.2.0",
         "@x402/core": "^2.12.0",
@@ -1523,9 +1525,9 @@
       "license": "MIT"
     },
     "node_modules/@corpus-core/colibri-stateless": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@corpus-core/colibri-stateless/-/colibri-stateless-2.0.1.tgz",
-      "integrity": "sha512-gXh5TI2BsjZ/6CpZfs2YEzOPisr8flbtpSXgxzX0Yw8YmBdjFBS+4RKMg795eskjhvZiHdLDIRp+vRgidxHkqQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@corpus-core/colibri-stateless/-/colibri-stateless-2.0.4.tgz",
+      "integrity": "sha512-zezKWKQ3JVLtUcIleZ2Axf0UzEfAaaHDkseDIHuHOuIp6bpdryy/mLkO77ikryLphW5XYM9ODkUhdxOBPeRj7w==",
       "license": "MIT"
     },
     "node_modules/@electron-internal/extract-zip": {
@@ -1793,45 +1795,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/@electron/windows-sign": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/@electron/windows-sign/-/windows-sign-1.2.2.tgz",
-      "integrity": "sha512-dfZeox66AvdPtb2lD8OsIIQh12Tp0GNCRUDfBHIKGpbmopZto2/A8nSpYYLoedPIHpqkeblZ/k8OV0Gy7PYuyQ==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "cross-dirname": "^0.1.0",
-        "debug": "^4.3.4",
-        "fs-extra": "^11.1.1",
-        "minimist": "^1.2.8",
-        "postject": "^1.0.0-alpha.6"
-      },
-      "bin": {
-        "electron-windows-sign": "bin/electron-windows-sign.js"
-      },
-      "engines": {
-        "node": ">=14.14"
-      }
-    },
-    "node_modules/@electron/windows-sign/node_modules/fs-extra": {
-      "version": "11.3.6",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.6.tgz",
-      "integrity": "sha512-w8ZNZr2mKIc7qeNaQ9AVPT1+iFaI+Avd4xudVOvdDJ8VytREi1Ft5Ih7hd9jjehod8vAM5GMsfQ/TpPf4EyoEA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=14.14"
-      }
-    },
     "node_modules/@emnapi/core": {
       "version": "1.10.0",
       "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
@@ -2076,34 +2039,432 @@
         "beeApiVersion": "7.2.0"
       }
     },
+    "node_modules/@ethersproject/abi": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/abi/-/abi-5.8.0.tgz",
+      "integrity": "sha512-b9YS/43ObplgyV6SlyQsG53/vkSal0MNA1fskSC4mbnCMi8R+NkcH8K9FPYNESf6jUefBUniE4SOKms0E/KK1Q==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/address": "^5.8.0",
+        "@ethersproject/bignumber": "^5.8.0",
+        "@ethersproject/bytes": "^5.8.0",
+        "@ethersproject/constants": "^5.8.0",
+        "@ethersproject/hash": "^5.8.0",
+        "@ethersproject/keccak256": "^5.8.0",
+        "@ethersproject/logger": "^5.8.0",
+        "@ethersproject/properties": "^5.8.0",
+        "@ethersproject/strings": "^5.8.0"
+      }
+    },
+    "node_modules/@ethersproject/abstract-provider": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/abstract-provider/-/abstract-provider-5.8.0.tgz",
+      "integrity": "sha512-wC9SFcmh4UK0oKuLJQItoQdzS/qZ51EJegK6EmAWlh+OptpQ/npECOR3QqECd8iGHC0RJb4WKbVdSfif4ammrg==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/bignumber": "^5.8.0",
+        "@ethersproject/bytes": "^5.8.0",
+        "@ethersproject/logger": "^5.8.0",
+        "@ethersproject/networks": "^5.8.0",
+        "@ethersproject/properties": "^5.8.0",
+        "@ethersproject/transactions": "^5.8.0",
+        "@ethersproject/web": "^5.8.0"
+      }
+    },
+    "node_modules/@ethersproject/abstract-signer": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/abstract-signer/-/abstract-signer-5.8.0.tgz",
+      "integrity": "sha512-N0XhZTswXcmIZQdYtUnd79VJzvEwXQw6PK0dTl9VoYrEBxxCPXqS0Eod7q5TNKRxe1/5WUMuR0u0nqTF/avdCA==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/abstract-provider": "^5.8.0",
+        "@ethersproject/bignumber": "^5.8.0",
+        "@ethersproject/bytes": "^5.8.0",
+        "@ethersproject/logger": "^5.8.0",
+        "@ethersproject/properties": "^5.8.0"
+      }
+    },
+    "node_modules/@ethersproject/address": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/address/-/address-5.8.0.tgz",
+      "integrity": "sha512-GhH/abcC46LJwshoN+uBNoKVFPxUuZm6dA257z0vZkKmU1+t8xTn8oK7B9qrj8W2rFRMch4gbJl6PmVxjxBEBA==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/bignumber": "^5.8.0",
+        "@ethersproject/bytes": "^5.8.0",
+        "@ethersproject/keccak256": "^5.8.0",
+        "@ethersproject/logger": "^5.8.0",
+        "@ethersproject/rlp": "^5.8.0"
+      }
+    },
+    "node_modules/@ethersproject/base64": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/base64/-/base64-5.8.0.tgz",
+      "integrity": "sha512-lN0oIwfkYj9LbPx4xEkie6rAMJtySbpOAFXSDVQaBnAzYfB4X2Qr+FXJGxMoc3Bxp2Sm8OwvzMrywxyw0gLjIQ==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/bytes": "^5.8.0"
+      }
+    },
+    "node_modules/@ethersproject/bignumber": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/bignumber/-/bignumber-5.8.0.tgz",
+      "integrity": "sha512-ZyaT24bHaSeJon2tGPKIiHszWjD/54Sz8t57Toch475lCLljC6MgPmxk7Gtzz+ddNN5LuHea9qhAe0x3D+uYPA==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/bytes": "^5.8.0",
+        "@ethersproject/logger": "^5.8.0",
+        "bn.js": "^5.2.1"
+      }
+    },
+    "node_modules/@ethersproject/bytes": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/bytes/-/bytes-5.8.0.tgz",
+      "integrity": "sha512-vTkeohgJVCPVHu5c25XWaWQOZ4v+DkGoC42/TS2ond+PARCxTJvgTFUNDZovyQ/uAQ4EcpqqowKydcdmRKjg7A==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/logger": "^5.8.0"
+      }
+    },
+    "node_modules/@ethersproject/constants": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/constants/-/constants-5.8.0.tgz",
+      "integrity": "sha512-wigX4lrf5Vu+axVTIvNsuL6YrV4O5AXl5ubcURKMEME5TnWBouUh0CDTWxZ2GpnRn1kcCgE7l8O5+VbV9QTTcg==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/bignumber": "^5.8.0"
+      }
+    },
+    "node_modules/@ethersproject/hash": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/hash/-/hash-5.8.0.tgz",
+      "integrity": "sha512-ac/lBcTbEWW/VGJij0CNSw/wPcw9bSRgCB0AIBz8CvED/jfvDoV9hsIIiWfvWmFEi8RcXtlNwp2jv6ozWOsooA==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/abstract-signer": "^5.8.0",
+        "@ethersproject/address": "^5.8.0",
+        "@ethersproject/base64": "^5.8.0",
+        "@ethersproject/bignumber": "^5.8.0",
+        "@ethersproject/bytes": "^5.8.0",
+        "@ethersproject/keccak256": "^5.8.0",
+        "@ethersproject/logger": "^5.8.0",
+        "@ethersproject/properties": "^5.8.0",
+        "@ethersproject/strings": "^5.8.0"
+      }
+    },
+    "node_modules/@ethersproject/keccak256": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/keccak256/-/keccak256-5.8.0.tgz",
+      "integrity": "sha512-A1pkKLZSz8pDaQ1ftutZoaN46I6+jvuqugx5KYNeQOPqq+JZ0Txm7dlWesCHB5cndJSu5vP2VKptKf7cksERng==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/bytes": "^5.8.0",
+        "js-sha3": "0.8.0"
+      }
+    },
+    "node_modules/@ethersproject/keccak256/node_modules/js-sha3": {
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/js-sha3/-/js-sha3-0.8.0.tgz",
+      "integrity": "sha512-gF1cRrHhIzNfToc802P800N8PpXS+evLLXfsVpowqmAFR9uwbi89WvXg2QspOmXL8QL86J4T1EpFu+yUkwJY3Q==",
+      "license": "MIT"
+    },
+    "node_modules/@ethersproject/logger": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/logger/-/logger-5.8.0.tgz",
+      "integrity": "sha512-Qe6knGmY+zPPWTC+wQrpitodgBfH7XoceCGL5bJVejmH+yCS3R8jJm8iiWuvWbG76RUmyEG53oqv6GMVWqunjA==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/@ethersproject/networks": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/networks/-/networks-5.8.0.tgz",
+      "integrity": "sha512-egPJh3aPVAzbHwq8DD7Po53J4OUSsA1MjQp8Vf/OZPav5rlmWUaFLiq8cvQiGK0Z5K6LYzm29+VA/p4RL1FzNg==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/logger": "^5.8.0"
+      }
+    },
+    "node_modules/@ethersproject/properties": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/properties/-/properties-5.8.0.tgz",
+      "integrity": "sha512-PYuiEoQ+FMaZZNGrStmN7+lWjlsoufGIHdww7454FIaGdbe/p5rnaCXTr5MtBYl3NkeoVhHZuyzChPeGeKIpQw==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/logger": "^5.8.0"
+      }
+    },
+    "node_modules/@ethersproject/rlp": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/rlp/-/rlp-5.8.0.tgz",
+      "integrity": "sha512-LqZgAznqDbiEunaUvykH2JAoXTT9NV0Atqk8rQN9nx9SEgThA/WMx5DnW8a9FOufo//6FZOCHZ+XiClzgbqV9Q==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/bytes": "^5.8.0",
+        "@ethersproject/logger": "^5.8.0"
+      }
+    },
+    "node_modules/@ethersproject/signing-key": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/signing-key/-/signing-key-5.8.0.tgz",
+      "integrity": "sha512-LrPW2ZxoigFi6U6aVkFN/fa9Yx/+4AtIUe4/HACTvKJdhm0eeb107EVCIQcrLZkxaSIgc/eCrX8Q1GtbH+9n3w==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/bytes": "^5.8.0",
+        "@ethersproject/logger": "^5.8.0",
+        "@ethersproject/properties": "^5.8.0",
+        "bn.js": "^5.2.1",
+        "elliptic": "6.6.1",
+        "hash.js": "1.1.7"
+      }
+    },
+    "node_modules/@ethersproject/strings": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/strings/-/strings-5.8.0.tgz",
+      "integrity": "sha512-qWEAk0MAvl0LszjdfnZ2uC8xbR2wdv4cDabyHiBh3Cldq/T8dPH3V4BbBsAYJUeonwD+8afVXld274Ls+Y1xXg==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/bytes": "^5.8.0",
+        "@ethersproject/constants": "^5.8.0",
+        "@ethersproject/logger": "^5.8.0"
+      }
+    },
+    "node_modules/@ethersproject/transactions": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/transactions/-/transactions-5.8.0.tgz",
+      "integrity": "sha512-UglxSDjByHG0TuU17bDfCemZ3AnKO2vYrL5/2n2oXvKzvb7Cz+W9gOWXKARjp2URVwcWlQlPOEQyAviKwT4AHg==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/address": "^5.8.0",
+        "@ethersproject/bignumber": "^5.8.0",
+        "@ethersproject/bytes": "^5.8.0",
+        "@ethersproject/constants": "^5.8.0",
+        "@ethersproject/keccak256": "^5.8.0",
+        "@ethersproject/logger": "^5.8.0",
+        "@ethersproject/properties": "^5.8.0",
+        "@ethersproject/rlp": "^5.8.0",
+        "@ethersproject/signing-key": "^5.8.0"
+      }
+    },
+    "node_modules/@ethersproject/web": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/@ethersproject/web/-/web-5.8.0.tgz",
+      "integrity": "sha512-j7+Ksi/9KfGviws6Qtf9Q7KCqRhpwrYKQPs+JBA/rKVFF/yaWLHJEH3zfVP2plVu+eys0d2DlFmhoQJayFewcw==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://gitcoin.co/grants/13/ethersjs-complete-simple-and-tiny-2"
+        },
+        {
+          "type": "individual",
+          "url": "https://www.buymeacoffee.com/ricmoo"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@ethersproject/base64": "^5.8.0",
+        "@ethersproject/bytes": "^5.8.0",
+        "@ethersproject/logger": "^5.8.0",
+        "@ethersproject/properties": "^5.8.0",
+        "@ethersproject/strings": "^5.8.0"
+      }
+    },
     "node_modules/@ghostery/adblocker": {
-      "version": "2.18.1",
-      "resolved": "https://registry.npmjs.org/@ghostery/adblocker/-/adblocker-2.18.1.tgz",
-      "integrity": "sha512-pWMJqpXpuqIlcF3ZZQ2E7ixnC7xhtYn/bpOn3N69vFrAm4wrZCIbKzz1+xSxKWCmJvDT4fg7rN2R6jQwFXm5BA==",
+      "version": "2.18.2",
+      "resolved": "https://registry.npmjs.org/@ghostery/adblocker/-/adblocker-2.18.2.tgz",
+      "integrity": "sha512-x6zEkf1dHSN0t4ExLmuN6nIgH0oAi6laoKe5yGsiIB4jkEvutea1PJgxgRUIjWfNbDRmkf4GjUtuqQFZgvQG1w==",
       "license": "MPL-2.0",
       "dependencies": {
-        "@ghostery/adblocker-content": "^2.18.1",
-        "@ghostery/adblocker-extended-selectors": "^2.18.1",
+        "@ghostery/adblocker-content": "^2.18.2",
+        "@ghostery/adblocker-extended-selectors": "^2.18.2",
         "@ghostery/url-parser": "^1.3.1",
         "@remusao/guess-url-type": "^2.1.0",
         "@remusao/small": "^2.1.0",
         "@remusao/smaz": "^2.2.0",
-        "tldts-experimental": "^7.4.3"
+        "tldts-experimental": "^7.4.9"
       }
     },
     "node_modules/@ghostery/adblocker-content": {
-      "version": "2.18.1",
-      "resolved": "https://registry.npmjs.org/@ghostery/adblocker-content/-/adblocker-content-2.18.1.tgz",
-      "integrity": "sha512-7OwXvqssrSqceXDMccq1SG2LEp0P899TWv0J52kA4PCjCgdsffdj7wMO98LbiVWEKJ9e00X4V2ZptC4VGYsX/w==",
+      "version": "2.18.2",
+      "resolved": "https://registry.npmjs.org/@ghostery/adblocker-content/-/adblocker-content-2.18.2.tgz",
+      "integrity": "sha512-TOe/b4KOBFEc9OjLG+wvgamGcSTIPSDBAL5YSa8lzjBsoSl8IDnfOjeJDldlLacsC/JEUMLkZIDDNknEolJVqg==",
       "license": "MPL-2.0",
       "dependencies": {
-        "@ghostery/adblocker-extended-selectors": "^2.18.1"
+        "@ghostery/adblocker-extended-selectors": "^2.18.2"
       }
     },
     "node_modules/@ghostery/adblocker-extended-selectors": {
-      "version": "2.18.1",
-      "resolved": "https://registry.npmjs.org/@ghostery/adblocker-extended-selectors/-/adblocker-extended-selectors-2.18.1.tgz",
-      "integrity": "sha512-FruZMMUhdi0KG8GTTS9hs4njeQu1FyrzVtm9p3JKY6GpCNspy3kioP48JU3ASNzSDYZb5Xu8xbwPoSHJ4RQBeg==",
+      "version": "2.18.2",
+      "resolved": "https://registry.npmjs.org/@ghostery/adblocker-extended-selectors/-/adblocker-extended-selectors-2.18.2.tgz",
+      "integrity": "sha512-doKNShBk3+czQL08UkrysHkCPeG/kNPlXvz3DH7SXxD9Y78ovWkEAhjeR+upoan3fomJJuK3dD+IrlofnjckYw==",
       "license": "MPL-2.0"
     },
     "node_modules/@ghostery/url-parser": {
@@ -2955,93 +3316,336 @@
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "yallist": "^3.0.2"
+        "yallist": "^3.0.2"
+      }
+    },
+    "node_modules/@jest/transform/node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/@jest/transform/node_modules/yallist": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
+      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/@jest/types": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.4.1.tgz",
+      "integrity": "sha512-f1x/vJXIfjOlEmejYpbkbgw1gOqpPECwMvMEtBqe47j7H2Hg8h8w3o3ikhSXq3MI15kg+oQ0exWO0uCtTNJLoQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/pattern": "30.4.0",
+        "@jest/schemas": "30.4.1",
+        "@types/istanbul-lib-coverage": "^2.0.6",
+        "@types/istanbul-reports": "^3.0.4",
+        "@types/node": "*",
+        "@types/yargs": "^17.0.33",
+        "chalk": "^4.1.2"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
+    },
+    "node_modules/@ledgerhq/client-ids": {
+      "version": "0.11.0",
+      "resolved": "https://registry.npmjs.org/@ledgerhq/client-ids/-/client-ids-0.11.0.tgz",
+      "integrity": "sha512-/lXsAdtu3kuR+lWP94fiNT9BE4pXtqFE/j3wKAWXuPoLsZ5VYwrj2NcvKtUgNzzoSGOpernfLP/8ys4xlv18JQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@ledgerhq/live-env": "^2.40.0",
+        "@reduxjs/toolkit": "2.11.2",
+        "uuid": "^9.0.0"
+      }
+    },
+    "node_modules/@ledgerhq/client-ids/node_modules/uuid": {
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
+      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
+      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
+    },
+    "node_modules/@ledgerhq/devices": {
+      "version": "8.16.0",
+      "resolved": "https://registry.npmjs.org/@ledgerhq/devices/-/devices-8.16.0.tgz",
+      "integrity": "sha512-brXLPzkvGM3D5YNsWQ25P5G4SmWdSNBed9W8wKoOIRLGdRfvE+bg9mzFty0iZ+aRLBkLoXwX7xKIL9zUi6LBKQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "semver": "7.7.3"
+      }
+    },
+    "node_modules/@ledgerhq/devices/node_modules/semver": {
+      "version": "7.7.3",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
+      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@ledgerhq/domain-service": {
+      "version": "1.8.8",
+      "resolved": "https://registry.npmjs.org/@ledgerhq/domain-service/-/domain-service-1.8.8.tgz",
+      "integrity": "sha512-n/ikZTLEx5ssmnbu6YnzjcjC/9W80x6Q41wwzes7QoV2GqjWscy6dqKTMpa4DOoe85w0KgVNDiFnJh7XXjQHMg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@ledgerhq/errors": "^6.37.0",
+        "@ledgerhq/logs": "^6.17.0",
+        "@ledgerhq/types-live": "^6.113.0",
+        "axios": "1.13.5",
+        "eip55": "^2.1.1",
+        "react": "19.0.0",
+        "react-dom": "19.0.0"
+      }
+    },
+    "node_modules/@ledgerhq/domain-service/node_modules/axios": {
+      "version": "1.13.5",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.5.tgz",
+      "integrity": "sha512-cz4ur7Vb0xS4/KUN0tPWe44eqxrIu31me+fbang3ijiNscE129POzipJJA6zniq2C/Z6sJCjMimjS8Lc/GAs8Q==",
+      "license": "MIT",
+      "dependencies": {
+        "follow-redirects": "^1.15.11",
+        "form-data": "^4.0.5",
+        "proxy-from-env": "^1.1.0"
+      }
+    },
+    "node_modules/@ledgerhq/domain-service/node_modules/proxy-from-env": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
+      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
+      "license": "MIT"
+    },
+    "node_modules/@ledgerhq/errors": {
+      "version": "6.37.0",
+      "resolved": "https://registry.npmjs.org/@ledgerhq/errors/-/errors-6.37.0.tgz",
+      "integrity": "sha512-T5yiKI5UX7ugeocdTF3TUsCIN2BH41Bio4ZeN410YFjFOf3es08n/5JyMzzKwzRgP0blG3HfBf7s7vJKqCSAeg==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/@ledgerhq/evm-tools": {
+      "version": "1.12.11",
+      "resolved": "https://registry.npmjs.org/@ledgerhq/evm-tools/-/evm-tools-1.12.11.tgz",
+      "integrity": "sha512-qh+uM7DNBOsPMv0SJmM97xmAHtrwHAwDGpgEJMpIZYKYoAcbt7Fusw0QK7hgEahopphjcMh34CNBCEMSb/2nQw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@ethersproject/constants": "^5.7.0",
+        "@ethersproject/hash": "^5.7.0",
+        "@ledgerhq/live-env": "^2.40.0",
+        "axios": "1.13.5",
+        "crypto-js": "4.2.0"
+      }
+    },
+    "node_modules/@ledgerhq/evm-tools/node_modules/axios": {
+      "version": "1.13.5",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.5.tgz",
+      "integrity": "sha512-cz4ur7Vb0xS4/KUN0tPWe44eqxrIu31me+fbang3ijiNscE129POzipJJA6zniq2C/Z6sJCjMimjS8Lc/GAs8Q==",
+      "license": "MIT",
+      "dependencies": {
+        "follow-redirects": "^1.15.11",
+        "form-data": "^4.0.5",
+        "proxy-from-env": "^1.1.0"
+      }
+    },
+    "node_modules/@ledgerhq/evm-tools/node_modules/proxy-from-env": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
+      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
+      "license": "MIT"
+    },
+    "node_modules/@ledgerhq/hw-app-eth": {
+      "version": "7.8.8",
+      "resolved": "https://registry.npmjs.org/@ledgerhq/hw-app-eth/-/hw-app-eth-7.8.8.tgz",
+      "integrity": "sha512-EUT8J9g/QaYZDhdQtMfFJoTN1PEVHgZtpp0heU+vWmQotOGWpjXlT8fjkh02n45hym6irdJob3vYrt3qOCAUlg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@ethersproject/abi": "^5.7.0",
+        "@ethersproject/rlp": "^5.7.0",
+        "@ethersproject/transactions": "^5.7.0",
+        "@ledgerhq/domain-service": "^1.8.8",
+        "@ledgerhq/errors": "^6.37.0",
+        "@ledgerhq/evm-tools": "^1.12.11",
+        "@ledgerhq/hw-transport": "6.35.5",
+        "@ledgerhq/hw-transport-mocker": "^6.34.5",
+        "@ledgerhq/logs": "^6.17.0",
+        "@ledgerhq/types-live": "^6.113.0",
+        "axios": "1.13.5",
+        "bignumber.js": "^9.1.2",
+        "semver": "7.7.3"
+      }
+    },
+    "node_modules/@ledgerhq/hw-app-eth/node_modules/axios": {
+      "version": "1.13.5",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.5.tgz",
+      "integrity": "sha512-cz4ur7Vb0xS4/KUN0tPWe44eqxrIu31me+fbang3ijiNscE129POzipJJA6zniq2C/Z6sJCjMimjS8Lc/GAs8Q==",
+      "license": "MIT",
+      "dependencies": {
+        "follow-redirects": "^1.15.11",
+        "form-data": "^4.0.5",
+        "proxy-from-env": "^1.1.0"
       }
     },
-    "node_modules/@jest/transform/node_modules/semver": {
-      "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
-      "dev": true,
+    "node_modules/@ledgerhq/hw-app-eth/node_modules/proxy-from-env": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
+      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
+      "license": "MIT"
+    },
+    "node_modules/@ledgerhq/hw-app-eth/node_modules/semver": {
+      "version": "7.7.3",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
+      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
       }
     },
-    "node_modules/@jest/transform/node_modules/yallist": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
-      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
-      "dev": true,
-      "license": "ISC"
+    "node_modules/@ledgerhq/hw-transport": {
+      "version": "6.35.5",
+      "resolved": "https://registry.npmjs.org/@ledgerhq/hw-transport/-/hw-transport-6.35.5.tgz",
+      "integrity": "sha512-P4+wtLewLWgxPtIb90h5kjpzXVlC6f4IBQBmvowVFkInvZt34ffXkX7wa5KfMzu4l3cqCcpNSqtPSCMp+0vuqg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@ledgerhq/devices": "8.16.0",
+        "@ledgerhq/errors": "^6.37.0",
+        "@ledgerhq/logs": "^6.17.0",
+        "events": "^3.3.0"
+      }
     },
-    "node_modules/@jest/types": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.4.1.tgz",
-      "integrity": "sha512-f1x/vJXIfjOlEmejYpbkbgw1gOqpPECwMvMEtBqe47j7H2Hg8h8w3o3ikhSXq3MI15kg+oQ0exWO0uCtTNJLoQ==",
-      "dev": true,
-      "license": "MIT",
+    "node_modules/@ledgerhq/hw-transport-mocker": {
+      "version": "6.34.5",
+      "resolved": "https://registry.npmjs.org/@ledgerhq/hw-transport-mocker/-/hw-transport-mocker-6.34.5.tgz",
+      "integrity": "sha512-CSo8bRkyzYgrIpMIP7jgP+tB3+meC+orUJSnKwmLL1eT5XdOKlYc3Xl3yB6CRNUZ6LAqQPas0a/Oi9krwkCV1A==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "@jest/pattern": "30.4.0",
-        "@jest/schemas": "30.4.1",
-        "@types/istanbul-lib-coverage": "^2.0.6",
-        "@types/istanbul-reports": "^3.0.4",
-        "@types/node": "*",
-        "@types/yargs": "^17.0.33",
-        "chalk": "^4.1.2"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+        "@ledgerhq/hw-transport": "6.35.5",
+        "@ledgerhq/logs": "^6.17.0",
+        "rxjs": "7.8.2"
       }
     },
-    "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.13",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
-      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
-      "dev": true,
-      "license": "MIT",
+    "node_modules/@ledgerhq/hw-transport-node-hid": {
+      "version": "6.33.5",
+      "resolved": "https://registry.npmjs.org/@ledgerhq/hw-transport-node-hid/-/hw-transport-node-hid-6.33.5.tgz",
+      "integrity": "sha512-uJ7VztZEDdhCAmCByMltH9Zg6qrU1CrTjVpLrO7IQD5paQbMhZNOLSrtBhWSoP8LYNo/gx5VtLTdtUIIedjsVA==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.0",
-        "@jridgewell/trace-mapping": "^0.3.24"
+        "@ledgerhq/devices": "8.16.0",
+        "@ledgerhq/errors": "^6.37.0",
+        "@ledgerhq/hw-transport": "6.35.5",
+        "@ledgerhq/hw-transport-node-hid-noevents": "^6.36.0",
+        "@ledgerhq/logs": "^6.17.0",
+        "lodash": "^4.17.21",
+        "node-hid": "2.1.2",
+        "usb": "2.9.0"
       }
     },
-    "node_modules/@jridgewell/remapping": {
-      "version": "2.3.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
-      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
-      "dev": true,
-      "license": "MIT",
+    "node_modules/@ledgerhq/hw-transport-node-hid-noevents": {
+      "version": "6.36.0",
+      "resolved": "https://registry.npmjs.org/@ledgerhq/hw-transport-node-hid-noevents/-/hw-transport-node-hid-noevents-6.36.0.tgz",
+      "integrity": "sha512-hsqybDCDtpNWeWVY2b/emrsFDqVfc3Rkv4+2b6h5ubPGsKWFd+7t0u6oy0sJEl5v6C+V/uxl03shBjWEcSoxgw==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "@jridgewell/gen-mapping": "^0.3.5",
-        "@jridgewell/trace-mapping": "^0.3.24"
+        "@ledgerhq/devices": "8.16.0",
+        "@ledgerhq/errors": "^6.37.0",
+        "@ledgerhq/hw-transport": "6.35.5",
+        "@ledgerhq/logs": "^6.17.0",
+        "node-hid": "2.1.2"
       }
     },
-    "node_modules/@jridgewell/resolve-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
-      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6.0.0"
+    "node_modules/@ledgerhq/live-env": {
+      "version": "2.40.0",
+      "resolved": "https://registry.npmjs.org/@ledgerhq/live-env/-/live-env-2.40.0.tgz",
+      "integrity": "sha512-TwiFiw+eLk/ONCp1v89j8fddzgohLqVlnclbLjDvkrkpZ6h2tigGstuzd+pgNfHi5ixEapg3WJF4naZgu40TSg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "rxjs": "7.8.2",
+        "utility-types": "^3.10.0"
       }
     },
-    "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
-      "dev": true,
-      "license": "MIT"
+    "node_modules/@ledgerhq/logs": {
+      "version": "6.17.0",
+      "resolved": "https://registry.npmjs.org/@ledgerhq/logs/-/logs-6.17.0.tgz",
+      "integrity": "sha512-yra33g5q/AU7+PwAws+GaVpQGUuxnDREjVBnviJjcaJLVKuLzI4pnj8Bd3nY3fypM5k1yZEYKEXfUuGFUjP2+w==",
+      "license": "Apache-2.0"
     },
-    "node_modules/@jridgewell/trace-mapping": {
-      "version": "0.3.31",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
-      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
-      "dev": true,
-      "license": "MIT",
+    "node_modules/@ledgerhq/types-live": {
+      "version": "6.113.0",
+      "resolved": "https://registry.npmjs.org/@ledgerhq/types-live/-/types-live-6.113.0.tgz",
+      "integrity": "sha512-gfCGfCl1yUBmJ35AqKbVy4nKIVPQXK0Hd+F8tPRNhJ2C8Y8SsKlYoG/SJOMRLYDPgckUqc0BCVWBhSBQC4TKBQ==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "@jridgewell/resolve-uri": "^3.1.0",
-        "@jridgewell/sourcemap-codec": "^1.4.14"
+        "@ledgerhq/client-ids": "0.11.0",
+        "bignumber.js": "^9.1.2",
+        "rxjs": "7.8.2"
       }
     },
     "node_modules/@malept/cross-spawn-promise": {
@@ -3317,6 +3921,32 @@
         "node": ">=18"
       }
     },
+    "node_modules/@reduxjs/toolkit": {
+      "version": "2.11.2",
+      "resolved": "https://registry.npmjs.org/@reduxjs/toolkit/-/toolkit-2.11.2.tgz",
+      "integrity": "sha512-Kd6kAHTA6/nUpp8mySPqj3en3dm0tdMIgbttnQ1xFMVpufoj+ADi8pXLBsd4xzTRHQa7t/Jv8W5UnCuW4kuWMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/spec": "^1.0.0",
+        "@standard-schema/utils": "^0.3.0",
+        "immer": "^11.0.0",
+        "redux": "^5.0.1",
+        "redux-thunk": "^3.1.0",
+        "reselect": "^5.1.0"
+      },
+      "peerDependencies": {
+        "react": "^16.9.0 || ^17.0.0 || ^18 || ^19",
+        "react-redux": "^7.2.1 || ^8.1.3 || ^9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "react": {
+          "optional": true
+        },
+        "react-redux": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@remusao/guess-url-type": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/@remusao/guess-url-type/-/guess-url-type-2.1.0.tgz",
@@ -3478,6 +4108,18 @@
         "@sinonjs/commons": "^3.0.1"
       }
     },
+    "node_modules/@standard-schema/spec": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
+      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+      "license": "MIT"
+    },
+    "node_modules/@standard-schema/utils": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/utils/-/utils-0.3.0.tgz",
+      "integrity": "sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==",
+      "license": "MIT"
+    },
     "node_modules/@szmarczak/http-timer": {
       "version": "4.0.6",
       "resolved": "https://registry.npmjs.org/@szmarczak/http-timer/-/http-timer-4.0.6.tgz",
@@ -3865,6 +4507,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@types/w3c-web-usb": {
+      "version": "1.0.14",
+      "resolved": "https://registry.npmjs.org/@types/w3c-web-usb/-/w3c-web-usb-1.0.14.tgz",
+      "integrity": "sha512-Qu3Nn6JFuF4+sHKYl+IcX9vYiI40ogleXzFFSxoE1W94rG98o/kXs8uJ0QSfFzuwBCZWlGfUGpPkgwuuX4PchA==",
+      "license": "MIT"
+    },
     "node_modules/@types/yargs": {
       "version": "17.0.35",
       "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.35.tgz",
@@ -5124,6 +5772,15 @@
         "node": "20.x || 22.x || 23.x || 24.x || 25.x || 26.x"
       }
     },
+    "node_modules/bignumber.js": {
+      "version": "9.3.1",
+      "resolved": "https://registry.npmjs.org/bignumber.js/-/bignumber.js-9.3.1.tgz",
+      "integrity": "sha512-Ko0uX15oIUS7wJ3Rb30Fs6SkVbLmPBAKdlm7q9+ak9bbIeFf0MwuBsQV6z7+X768/cHsfg+WlysDWJcmthjsjQ==",
+      "license": "MIT",
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/bindings": {
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
@@ -5151,6 +5808,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/bn.js": {
+      "version": "5.2.4",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-5.2.4.tgz",
+      "integrity": "sha512-QL7sb18rJ1PbdsKsqPA0guxL563vIMwRHgzNrW/uzQuRGN1Cjqd/wonUBAVqHox9KwzHA6vCbM0lXx3k4iQMow==",
+      "license": "MIT"
+    },
     "node_modules/boolean": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/boolean/-/boolean-3.2.0.tgz",
@@ -5173,6 +5836,12 @@
         "node": "18 || 20 || >=22"
       }
     },
+    "node_modules/brorand": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/brorand/-/brorand-1.1.0.tgz",
+      "integrity": "sha512-cKV8tMCEpQs4hK/ik71d6LrPOnpkpGBR0wzxqr68g2m/LB2GxVYQroAjMJZRVM1Y4BCjCKc3vAamxSzOY2RP+w==",
+      "license": "MIT"
+    },
     "node_modules/browserslist": {
       "version": "4.28.4",
       "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.4.tgz",
@@ -5665,15 +6334,6 @@
         "node": ">=0.8"
       }
     },
-    "node_modules/cross-dirname": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/cross-dirname/-/cross-dirname-0.1.0.tgz",
-      "integrity": "sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true
-    },
     "node_modules/cross-spawn": {
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
@@ -5689,6 +6349,12 @@
         "node": ">= 8"
       }
     },
+    "node_modules/crypto-js": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/crypto-js/-/crypto-js-4.2.0.tgz",
+      "integrity": "sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==",
+      "license": "MIT"
+    },
     "node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -6068,6 +6734,15 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/eip55": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/eip55/-/eip55-2.1.1.tgz",
+      "integrity": "sha512-WcagVAmNu2Ww2cDUfzuWVntYwFxbvZ5MvIyLZpMjTTkjD6sCvkGOiS86jTppzu9/gWsc8isLHAeMBWK02OnZmA==",
+      "license": "MIT",
+      "dependencies": {
+        "keccak": "^3.0.3"
+      }
+    },
     "node_modules/ejs": {
       "version": "3.1.10",
       "resolved": "https://registry.npmjs.org/ejs/-/ejs-3.1.10.tgz",
@@ -6309,6 +6984,27 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/elliptic": {
+      "version": "6.6.1",
+      "resolved": "https://registry.npmjs.org/elliptic/-/elliptic-6.6.1.tgz",
+      "integrity": "sha512-RaddvvMatK2LJHqFJ+YA4WysVN5Ita9E35botqIYspQ4TkRAlCicdzKOjlyv/1Za5RyTNn7di//eEV0uTAfe3g==",
+      "license": "MIT",
+      "dependencies": {
+        "bn.js": "^4.11.9",
+        "brorand": "^1.1.0",
+        "hash.js": "^1.0.0",
+        "hmac-drbg": "^1.0.1",
+        "inherits": "^2.0.4",
+        "minimalistic-assert": "^1.0.1",
+        "minimalistic-crypto-utils": "^1.0.1"
+      }
+    },
+    "node_modules/elliptic/node_modules/bn.js": {
+      "version": "4.12.4",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.4.tgz",
+      "integrity": "sha512-njR1b+ixG2ufvL9Zn9JGneW+b5GV6jqpYyPPpg4QVt723b5kJPGUczkUyWEH9BwEA74UakJZ43I4FDLBF7ci0g==",
+      "license": "MIT"
+    },
     "node_modules/emittery": {
       "version": "0.13.1",
       "resolved": "https://registry.npmjs.org/emittery/-/emittery-0.13.1.tgz",
@@ -6820,6 +7516,15 @@
       "integrity": "sha512-GWkBvjiSZK87ELrYOSESUYeVIc9mvLLf/nXalMOS5dYrgZq9o5OVkbZAVM06CVxYsCwH9BDZFPlQTlPA1j4ahA==",
       "license": "MIT"
     },
+    "node_modules/events": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
+      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8.x"
+      }
+    },
     "node_modules/execa": {
       "version": "5.1.1",
       "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
@@ -7460,6 +8165,16 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/hash.js": {
+      "version": "1.1.7",
+      "resolved": "https://registry.npmjs.org/hash.js/-/hash.js-1.1.7.tgz",
+      "integrity": "sha512-taOaskGt4z4SOANNseOviYDvjEJinIkRgmp7LbKP2YTTmVxWBl87s/uzK9r+44BclBSp2X7K1hqeNfz9JbBeXA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "minimalistic-assert": "^1.0.1"
+      }
+    },
     "node_modules/hasown": {
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
@@ -7472,6 +8187,17 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/hmac-drbg": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/hmac-drbg/-/hmac-drbg-1.0.1.tgz",
+      "integrity": "sha512-Tti3gMqLdZfhOQY1Mzf/AanLiqh1WTiJgEj26ZuYQ9fbkLomzGchCws4FyrSd4VkpBfiNhaE1On+lOz894jvXg==",
+      "license": "MIT",
+      "dependencies": {
+        "hash.js": "^1.0.3",
+        "minimalistic-assert": "^1.0.0",
+        "minimalistic-crypto-utils": "^1.0.1"
+      }
+    },
     "node_modules/hosted-git-info": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-4.1.0.tgz",
@@ -7612,6 +8338,16 @@
         "node": ">= 4"
       }
     },
+    "node_modules/immer": {
+      "version": "11.1.11",
+      "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.11.tgz",
+      "integrity": "sha512-qzXuyXAkPySAGYkfsAwodDPWT8Zm7/Uo5BNt4BjhMhG5WlWyZZ4wQqnWwdS8kjlQ1Cwu6gjw3A6+0gTQwlyYtw==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/immer"
+      }
+    },
     "node_modules/import-local": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.2.0.tgz",
@@ -9623,6 +10359,21 @@
         "graceful-fs": "^4.1.6"
       }
     },
+    "node_modules/keccak": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/keccak/-/keccak-3.0.4.tgz",
+      "integrity": "sha512-3vKuW0jV8J3XNTzvfyicFR5qvxrSAGl7KIhvgOu5cmWwM7tZRj3fMbj/pfIf4be7aznbc+prBWGjywox/g2Y6Q==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "node-addon-api": "^2.0.0",
+        "node-gyp-build": "^4.2.0",
+        "readable-stream": "^3.6.0"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/keyv": {
       "version": "4.5.4",
       "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
@@ -9925,6 +10676,18 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/minimalistic-assert": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz",
+      "integrity": "sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==",
+      "license": "ISC"
+    },
+    "node_modules/minimalistic-crypto-utils": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/minimalistic-crypto-utils/-/minimalistic-crypto-utils-1.0.1.tgz",
+      "integrity": "sha512-JIYlbt6g8i5jKfJ3xz7rF0LXmv2TkDxBLUkiBeZ7bAx4GnnNMr8xFpGnOxn6GhTEHx3SjRrZEoU+j04prX1ktg==",
+      "license": "MIT"
+    },
     "node_modules/minimatch": {
       "version": "10.2.5",
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
@@ -10047,6 +10810,12 @@
         "node": ">=22.12.0"
       }
     },
+    "node_modules/node-addon-api": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-2.0.2.tgz",
+      "integrity": "sha512-Ntyt4AIXyaLIuMHF6IOoTakB3K+RWxwtsHNRxllEoA6vPwP9o4866g6YWDLUdnucilZhmkxiHwHr11gAENw+QA==",
+      "license": "MIT"
+    },
     "node_modules/node-api-version": {
       "version": "0.2.1",
       "resolved": "https://registry.npmjs.org/node-api-version/-/node-api-version-0.2.1.tgz",
@@ -10082,6 +10851,17 @@
         "node": "^20.17.0 || >=22.9.0"
       }
     },
+    "node_modules/node-gyp-build": {
+      "version": "4.8.4",
+      "resolved": "https://registry.npmjs.org/node-gyp-build/-/node-gyp-build-4.8.4.tgz",
+      "integrity": "sha512-LA4ZjwlnUblHVgq0oBF3Jl/6h/Nvs5fzBLwdEF4nuxnFdsfajde4WfxtJr3CaiH+F6ewcIB/q4jQ4UzPyid+CQ==",
+      "license": "MIT",
+      "bin": {
+        "node-gyp-build": "bin.js",
+        "node-gyp-build-optional": "optional.js",
+        "node-gyp-build-test": "build-test.js"
+      }
+    },
     "node_modules/node-gyp/node_modules/env-paths": {
       "version": "2.2.1",
       "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz",
@@ -10128,6 +10908,30 @@
         "node": "^20.17.0 || >=22.9.0"
       }
     },
+    "node_modules/node-hid": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/node-hid/-/node-hid-2.1.2.tgz",
+      "integrity": "sha512-qhCyQqrPpP93F/6Wc/xUR7L8mAJW0Z6R7HMQV8jCHHksAxNDe/4z4Un/H9CpLOT+5K39OPyt9tIQlavxWES3lg==",
+      "hasInstallScript": true,
+      "license": "(MIT OR X11)",
+      "dependencies": {
+        "bindings": "^1.5.0",
+        "node-addon-api": "^3.0.2",
+        "prebuild-install": "^7.1.1"
+      },
+      "bin": {
+        "hid-showdevices": "src/show-devices.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/node-hid/node_modules/node-addon-api": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-3.2.1.tgz",
+      "integrity": "sha512-mmcei9JghVNDYydghQmeDX8KoAm0FAiYyIcUt/N4nhyAipB17pllZQDOJD2fotxABnt4Mdz+dKTO7eftLg4d0A==",
+      "license": "MIT"
+    },
     "node_modules/node-int64": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
@@ -10691,36 +11495,6 @@
         "node": ">=12.0.0"
       }
     },
-    "node_modules/postject": {
-      "version": "1.0.0-alpha.6",
-      "resolved": "https://registry.npmjs.org/postject/-/postject-1.0.0-alpha.6.tgz",
-      "integrity": "sha512-b9Eb8h2eVqNE8edvKdwqkrY6O7kAwmI8kcnBv1NScolYJbo59XUF0noFq+lxbC1yN20bmC0WBEbDC5H/7ASb0A==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "commander": "^9.4.0"
-      },
-      "bin": {
-        "postject": "dist/cli.js"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
-    "node_modules/postject/node_modules/commander": {
-      "version": "9.5.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-9.5.0.tgz",
-      "integrity": "sha512-KRs7WVDKg86PWiuAqhDrAQnTXZKraVcCc6vFdL14qrZ/DcWwuRo7VoiYXalXO7S5GKpqYiVEwCbgFDfxNHKJBQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "engines": {
-        "node": "^12.20.0 || >=14"
-      }
-    },
     "node_modules/prebuild-install": {
       "version": "7.1.3",
       "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
@@ -11053,6 +11827,27 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/react": {
+      "version": "19.0.0",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.0.0.tgz",
+      "integrity": "sha512-V8AVnmPIICiWpGfm6GLzCR/W5FXLchHop40W4nXBmdlEceh16rCN8O8LNWm5bh5XUX91fh7KpA+W0TgMKmgTpQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/react-dom": {
+      "version": "19.0.0",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.0.0.tgz",
+      "integrity": "sha512-4GV5sHFG0e/0AD4X+ySy6UJd3jVl1iNsNHdpad0qhABJ11twS3TTBnseqsKurKcsNqCEFeGL3uLpVChpIO3QfQ==",
+      "license": "MIT",
+      "dependencies": {
+        "scheduler": "^0.25.0"
+      },
+      "peerDependencies": {
+        "react": "^19.0.0"
+      }
+    },
     "node_modules/react-is-18": {
       "name": "react-is",
       "version": "18.3.1",
@@ -11096,6 +11891,21 @@
         "node": ">= 6"
       }
     },
+    "node_modules/redux": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/redux/-/redux-5.0.1.tgz",
+      "integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==",
+      "license": "MIT"
+    },
+    "node_modules/redux-thunk": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/redux-thunk/-/redux-thunk-3.1.0.tgz",
+      "integrity": "sha512-NW2r5T6ksUKXCabzhL9z+h206HQw/NJkcLm1GPImRQ8IzfXwRGqjVhKJGauHirT0DAuyy6hjdnMZaRoAcy0Klw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "redux": "^5.0.0"
+      }
+    },
     "node_modules/regenerate": {
       "version": "1.4.2",
       "resolved": "https://registry.npmjs.org/regenerate/-/regenerate-1.4.2.tgz",
@@ -11197,6 +12007,12 @@
         "url": "https://github.com/sponsors/jet2jet"
       }
     },
+    "node_modules/reselect": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/reselect/-/reselect-5.2.0.tgz",
+      "integrity": "sha512-AgZ3UOZm3YndfrJ4OYjgrT7bmCm/1iqkjvEfH/oYjzh6PD2qw4QuT3jjnXIrpdt4MTpMXclMT3lXbmRY+XRakw==",
+      "license": "MIT"
+    },
     "node_modules/resolve-alpn": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/resolve-alpn/-/resolve-alpn-1.2.1.tgz",
@@ -11291,6 +12107,15 @@
       "license": "BSD-3-Clause",
       "optional": true
     },
+    "node_modules/rxjs": {
+      "version": "7.8.2",
+      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
+      "integrity": "sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.1.0"
+      }
+    },
     "node_modules/safe-buffer": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
@@ -11330,6 +12155,12 @@
         "node": ">=11.0.0"
       }
     },
+    "node_modules/scheduler": {
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.25.0.tgz",
+      "integrity": "sha512-xFVuu11jh+xcO7JOAGJNOXld8/TcEHK/4CituBUeUb5hqxJLj9YuemAEuvm9gQ/+pgXYfbQuqAkiYu+u7YEsNA==",
+      "license": "MIT"
+    },
     "node_modules/semver": {
       "version": "7.8.5",
       "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
@@ -11866,18 +12697,18 @@
       }
     },
     "node_modules/tldts-core": {
-      "version": "7.4.6",
-      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.6.tgz",
-      "integrity": "sha512-TkQNGJIhlEphpHCjKodMTSe23egUZr/g+flI2qkLgiJ/maAzSgXypSLRTNH3nCmqgayEmtcJBiLcfODSAr1xoA==",
+      "version": "7.4.10",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.10.tgz",
+      "integrity": "sha512-KnQjp53ZekKgm/r3l+u8kJGGzYgrWdP8+Mql7a4vijh2WE0IrZWspQj/TpTxDho/YxO+AnOZnIjQcCD+q6iJsw==",
       "license": "MIT"
     },
     "node_modules/tldts-experimental": {
-      "version": "7.4.6",
-      "resolved": "https://registry.npmjs.org/tldts-experimental/-/tldts-experimental-7.4.6.tgz",
-      "integrity": "sha512-229vm2Ce4YwD/Tys0Y9WEfKG8gSAfuH9n22rntRvFqfzydJSLk/ihl1aD2kp0Q7d0dktwf1YzYhZ5FmVQwGCCQ==",
+      "version": "7.4.10",
+      "resolved": "https://registry.npmjs.org/tldts-experimental/-/tldts-experimental-7.4.10.tgz",
+      "integrity": "sha512-l+FUGTqw3cYLnM6uL45IhdIG1ue9N7ZnMe9ZFC0S3/ROTL6xkJrUFQvsjfqSD9YzywDvgWj9uRZTXib3v3bnHw==",
       "license": "MIT",
       "dependencies": {
-        "tldts-core": "^7.4.6"
+        "tldts-core": "^7.4.10"
       }
     },
     "node_modules/tmp": {
@@ -11921,7 +12752,6 @@
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "dev": true,
       "license": "0BSD"
     },
     "node_modules/tunnel-agent": {
@@ -12151,6 +12981,27 @@
         "punycode": "^2.1.0"
       }
     },
+    "node_modules/usb": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/usb/-/usb-2.9.0.tgz",
+      "integrity": "sha512-G0I/fPgfHUzWH8xo2KkDxTTFruUWfppgSFJ+bQxz/kVY2x15EQ/XDB7dqD1G432G4gBG4jYQuF3U7j/orSs5nw==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/w3c-web-usb": "^1.0.6",
+        "node-addon-api": "^6.0.0",
+        "node-gyp-build": "^4.5.0"
+      },
+      "engines": {
+        "node": ">=10.20.0 <11.x || >=12.17.0 <13.0 || >=14.0.0"
+      }
+    },
+    "node_modules/usb/node_modules/node-addon-api": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-6.1.0.tgz",
+      "integrity": "sha512-+eawOlIgy680F0kBzPUNFhMZGtJ1YmqM6l4+Crf4IkImjYrO/mqPwRMh352g23uIaQKFItcQ64I7KMaJxHgAVA==",
+      "license": "MIT"
+    },
     "node_modules/utf8-byte-length": {
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/utf8-byte-length/-/utf8-byte-length-1.0.5.tgz",
@@ -12164,6 +13015,15 @@
       "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
       "license": "MIT"
     },
+    "node_modules/utility-types": {
+      "version": "3.11.0",
+      "resolved": "https://registry.npmjs.org/utility-types/-/utility-types-3.11.0.tgz",
+      "integrity": "sha512-6Z7Ma2aVEWisaL6TvBCy7P8rm2LQoPv6dJ7ecIaIixHcwfbJ0x7mWdbcwlIM5IGQxPZSFYeqRCqlOOeKoJYMkw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
     "node_modules/uuid": {
       "version": "14.0.1",
       "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.1.tgz",
diff --git a/package.json b/package.json
index 299dc343..fc1b8a64 100644
--- a/package.json
+++ b/package.json
@@ -201,6 +201,8 @@
     "@ensdomains/content-hash": "^3.0.0",
     "@ethersphere/bee-js": "^12.2.1",
     "@ghostery/adblocker": "^2.18.1",
+    "@ledgerhq/hw-app-eth": "^7.8.8",
+    "@ledgerhq/hw-transport-node-hid": "^6.33.5",
     "@metamask/browser-passworder": "^6.0.0",
     "@scure/bip39": "^2.2.0",
     "@x402/core": "^2.12.0",
diff --git a/src/main/identity-manager.js b/src/main/identity-manager.js
index ac56e0ff..5b56dd4f 100644
--- a/src/main/identity-manager.js
+++ b/src/main/identity-manager.js
@@ -281,10 +281,13 @@ async function getUserWalletKey(walletIndex) {
     throw new Error('Wallet index must be a non-negative integer');
   }
 
-  const wallets = await getDerivedWallets();
-  if (!wallets.some((wallet) => wallet.index === walletIndex)) {
+  const record = getWalletRecord(walletIndex);
+  if (!record) {
     throw new Error(`Wallet with index ${walletIndex} does not exist`);
   }
+  if (record.type !== WALLET_TYPES.MNEMONIC) {
+    throw new Error('Hardware wallet accounts have no derivable private key');
+  }
 
   const identity = await loadIdentityModule();
   const mnemonic = identity.getMnemonic();
@@ -783,9 +786,113 @@ async function exportMnemonic() {
 // Multi-Wallet Support
 // ============================================
 
+/**
+ * Wallet account types. Entries in vault-meta's `derivedWallets[]` without
+ * a `type` field predate hardware-wallet support and are mnemonic-derived.
+ */
+const WALLET_TYPES = {
+  MNEMONIC: 'mnemonic',
+  LEDGER: 'ledger',
+};
+
+/**
+ * Hardware accounts are allocated from a disjoint, never-reused slice of
+ * the wallet index space, starting here.
+ *
+ * A wallet's `index` is two things at once: the account id every
+ * persisted reference stores (dApp permissions, Swarm publisher
+ * identities, `activeWalletIndex`) and — for mnemonic accounts — the
+ * BIP-44 account index its key is derived at. Letting hardware accounts
+ * take ids from that same pool breaks both roles: the mnemonic account
+ * at the squatted derivation index can never be re-created (the hardware
+ * guards block derivation at that index), stranding any funds it holds,
+ * and every persisted reference to that index silently rebinds to a
+ * different address and signing backend.
+ *
+ * @see nextHardwareWalletIndex
+ */
+const HARDWARE_INDEX_BASE = 1000000;
+
+function isHardwareWalletIndex(index) {
+  return Number.isInteger(index) && index >= HARDWARE_INDEX_BASE;
+}
+
+/**
+ * Allocate the index for a new hardware account: monotonic and never
+ * reused, so deleting a Ledger does not hand its index — and with it
+ * every dApp permission and publisher identity pinned to that index — to
+ * the next device account that gets added.
+ *
+ * The counter lives in vault-meta; the on-disk wallet list is used as a
+ * high-water mark so a missing or stale counter can never produce a
+ * collision.
+ *
+ * @param {Object} meta - Parsed vault-meta
+ * @param {Array<Object>} wallets - Current wallet list
+ * @returns {number}
+ */
+function nextHardwareWalletIndex(meta, wallets) {
+  const counter = Number.isInteger(meta.nextHardwareWalletIndex)
+    ? meta.nextHardwareWalletIndex
+    : HARDWARE_INDEX_BASE;
+  const highWater = wallets.reduce(
+    (max, wallet) => (isHardwareWalletIndex(wallet.index) ? Math.max(max, wallet.index + 1) : max),
+    HARDWARE_INDEX_BASE
+  );
+  return Math.max(counter, highWater);
+}
+
+/**
+ * The wallet list stored in vault-meta, with the implicit pre-multi-wallet
+ * default (just the main wallet) when `derivedWallets` was never written.
+ *
+ * @param {Object} meta - Parsed vault-meta
+ * @returns {Array<Object>} Raw derivedWallets entries
+ */
+function getWalletList(meta) {
+  return (
+    meta.derivedWallets || [
+      { index: 0, name: 'Main Wallet', address: meta.addresses?.userWallet || null },
+    ]
+  );
+}
+
+/**
+ * Look up a single wallet account record by index, normalized: `type`
+ * always present, address falling back to the stored main-wallet address
+ * for index 0. Returns null when the index is unknown.
+ *
+ * Used by the signer factory and the vault-access guard to decide which
+ * signing backend an index resolves to — must stay synchronous and cheap.
+ *
+ * @param {number} walletIndex
+ * @param {Object} [meta] - Already-loaded vault-meta, to skip the disk read
+ * @returns {{index: number, name: string, address: string|null, type: string, path?: string}|null}
+ */
+function getWalletRecord(walletIndex, meta = getVaultMeta()) {
+  if (!meta) {
+    return null;
+  }
+  const record = getWalletList(meta).find((wallet) => wallet.index === walletIndex);
+  if (!record) {
+    return null;
+  }
+  let address = record.address || null;
+  if (!address && record.index === 0) {
+    address = meta.addresses?.userWallet || null;
+  }
+  return {
+    index: record.index,
+    name: record.name,
+    address,
+    type: record.type || WALLET_TYPES.MNEMONIC,
+    ...(record.path ? { path: record.path } : {}),
+  };
+}
+
 /**
  * Get list of derived user wallets
- * @returns {Array<{index: number, name: string, address: string}>}
+ * @returns {Array<{index: number, name: string, address: string, type: string}>}
  */
 async function getDerivedWallets() {
   const identity = await loadIdentityModule();
@@ -813,7 +920,7 @@ async function getDerivedWallets() {
       activeWalletIndex: 0,
     });
 
-    return wallets;
+    return wallets.map((wallet) => ({ ...wallet, type: WALLET_TYPES.MNEMONIC }));
   }
 
   // If vault is unlocked, derive addresses; otherwise use stored addresses
@@ -821,9 +928,14 @@ async function getDerivedWallets() {
   const wallets = [];
 
   for (const wallet of meta.derivedWallets) {
+    const type = wallet.type || WALLET_TYPES.MNEMONIC;
     let address = null;
 
-    if (mnemonic) {
+    if (type === WALLET_TYPES.LEDGER) {
+      // Hardware accounts: the address was read from the device when the
+      // account was added; there is nothing to derive locally.
+      address = wallet.address || null;
+    } else if (mnemonic) {
       // Derive address from mnemonic
       const derived = identity.deriveUserWallet(mnemonic, wallet.index);
       address = derived.address;
@@ -840,12 +952,70 @@ async function getDerivedWallets() {
       index: wallet.index,
       name: wallet.name,
       address,
+      type,
+      ...(wallet.path ? { path: wallet.path } : {}),
     });
   }
 
   return wallets;
 }
 
+/**
+ * Add a Ledger hardware-wallet account to the wallet list.
+ *
+ * The address comes from the device during account discovery and is
+ * persisted — it can never be re-derived locally. Does not require the
+ * vault to be unlocked (no mnemonic involved), only that a vault exists
+ * so there is a wallet list to add to.
+ *
+ * @param {string} name - Display name ('' → auto "Ledger N")
+ * @param {string} address - Checksummed address read from the device
+ * @param {string} path - Derivation path in device format (e.g. "44'/60'/0'/0/0")
+ * @returns {Promise<{index: number, name: string, address: string, type: string, path: string}>}
+ */
+async function addLedgerWallet(name, address, path) {
+  const { isAddress } = require('ethers');
+  if (typeof address !== 'string' || !isAddress(address)) {
+    throw new Error('Invalid Ledger account address');
+  }
+  if (typeof path !== 'string' || !path) {
+    throw new Error('Missing derivation path for Ledger account');
+  }
+
+  const meta = getVaultMeta();
+  if (!meta) {
+    throw new Error('No vault found');
+  }
+
+  const wallets = getWalletList(meta);
+
+  const duplicate = wallets.find(
+    (wallet) => wallet.address && wallet.address.toLowerCase() === address.toLowerCase()
+  );
+  if (duplicate) {
+    throw new Error(`This account is already in your wallet list as "${duplicate.name}"`);
+  }
+
+  const newIndex = nextHardwareWalletIndex(meta, wallets);
+  const ledgerCount = wallets.filter((w) => w.type === WALLET_TYPES.LEDGER).length;
+  const newWallet = {
+    index: newIndex,
+    name: (name || '').trim() || `Ledger ${ledgerCount + 1}`,
+    address,
+    type: WALLET_TYPES.LEDGER,
+    path,
+  };
+  wallets.push(newWallet);
+
+  saveVaultMeta({
+    ...meta,
+    derivedWallets: wallets,
+    nextHardwareWalletIndex: newIndex + 1,
+  });
+
+  return { ...newWallet };
+}
+
 /**
  * Get the active wallet index
  * @returns {number}
@@ -866,7 +1036,7 @@ async function setActiveWalletIndex(index) {
   }
 
   // Verify wallet exists
-  const wallets = meta.derivedWallets || [{ index: 0, name: 'Main Wallet' }];
+  const wallets = getWalletList(meta);
   const walletExists = wallets.some((w) => w.index === index);
 
   if (!walletExists) {
@@ -898,11 +1068,23 @@ async function createDerivedWallet(name) {
   }
 
   // Get current wallets
-  const wallets = meta.derivedWallets || [{ index: 0, name: 'Main Wallet' }];
-
-  // Find next available index (use account index, starting from max + 1)
-  const maxIndex = wallets.reduce((max, w) => Math.max(max, w.index), -1);
-  const newIndex = maxIndex + 1;
+  const wallets = getWalletList(meta);
+
+  // Find next available index (use account index, starting from max + 1).
+  // Only mnemonic accounts constrain it — this index *is* the BIP-44
+  // account index the key is derived at, and hardware accounts live in
+  // their own range (see HARDWARE_INDEX_BASE). The taken-index skip is a
+  // safety net for vault-meta written before that split, where a Ledger
+  // may still sit on a low index.
+  const taken = new Set(wallets.map((w) => w.index));
+  const maxIndex = wallets.reduce(
+    (max, w) => (isHardwareWalletIndex(w.index) ? max : Math.max(max, w.index)),
+    -1
+  );
+  let newIndex = maxIndex + 1;
+  while (taken.has(newIndex)) {
+    newIndex += 1;
+  }
 
   // Derive the new wallet
   const derived = identity.deriveUserWallet(mnemonic, newIndex);
@@ -939,7 +1121,7 @@ async function renameDerivedWallet(index, newName) {
     throw new Error('No vault found');
   }
 
-  const wallets = meta.derivedWallets || [{ index: 0, name: 'Main Wallet' }];
+  const wallets = getWalletList(meta);
   const walletIndex = wallets.findIndex((w) => w.index === index);
 
   if (walletIndex === -1) {
@@ -981,7 +1163,7 @@ async function deleteDerivedWallet(index) {
     throw new Error('No vault found');
   }
 
-  const wallets = meta.derivedWallets || [{ index: 0, name: 'Main Wallet' }];
+  const wallets = getWalletList(meta);
   const walletIndex = wallets.findIndex((w) => w.index === index);
 
   if (walletIndex === -1) {
@@ -1010,6 +1192,15 @@ async function deleteDerivedWallet(index) {
     derivedWallets: wallets,
     activeWalletIndex: activeIndex,
   });
+
+  // A dApp permission is a standing authorisation to sign with this one
+  // account (plus any auto-approve rules on top). It cannot outlive the
+  // account: the stored index would dangle, and for a hardware account it
+  // would dangle into an index that has no signer at all.
+  // Lazy require: dapp-permissions pulls in electron's `app` for its
+  // storage path, which identity-manager must not need at load time.
+  const { revokePermissionsForWalletIndex } = require('./wallet/dapp-permissions');
+  revokePermissionsForWalletIndex(index);
 }
 
 /**
@@ -1025,6 +1216,14 @@ async function getActiveWalletAddress() {
   }
 
   const activeIndex = meta.activeWalletIndex ?? 0;
+
+  // Hardware accounts always use the stored device address — there is
+  // no local derivation, unlocked vault or not.
+  const record = getWalletRecord(activeIndex, meta);
+  if (record && record.type !== WALLET_TYPES.MNEMONIC) {
+    return record.address;
+  }
+
   const mnemonic = identity.getMnemonic();
 
   if (mnemonic) {
@@ -1033,11 +1232,7 @@ async function getActiveWalletAddress() {
   }
 
   // Vault locked - can only return main wallet address from stored meta
-  if (activeIndex === 0) {
-    return meta.addresses?.userWallet || null;
-  }
-
-  return null;
+  return activeIndex === 0 ? (record?.address ?? null) : null;
 }
 
 /**
@@ -1190,6 +1385,16 @@ function registerIdentityIpc() {
       if (!password) {
         return { success: false, error: 'Password is required to export private key' };
       }
+      // Same two-part guard as withVaultPrivateKey: the index range alone
+      // is decisive, so a deleted device account (no record) cannot export
+      // a phantom mnemonic key derived at its index.
+      const record = getWalletRecord(accountIndex);
+      if (isHardwareWalletIndex(accountIndex) || (record && record.type !== WALLET_TYPES.MNEMONIC)) {
+        return {
+          success: false,
+          error: 'Hardware wallet accounts have no exportable private key — the key never leaves the device',
+        };
+      }
       const identity = await loadIdentityModule();
       const dataDir = getIdentityDataDir();
       await identity.verifyPassword(dataDir, password);
@@ -1274,6 +1479,16 @@ function registerIdentityIpc() {
     }
   });
 
+  // Add a Ledger hardware-wallet account (address read from the device)
+  ipcMain.handle('wallet:add-ledger-wallet', async (_event, name, address, path) => {
+    try {
+      const wallet = await addLedgerWallet(name, address, path);
+      return { success: true, wallet };
+    } catch (err) {
+      return { success: false, error: err.message };
+    }
+  });
+
   // Rename wallet
   ipcMain.handle('wallet:rename-wallet', async (_event, index, newName) => {
     try {
@@ -1329,10 +1544,15 @@ module.exports = {
   getUserWalletKey,
 
   // Multi-wallet operations
+  WALLET_TYPES,
+  HARDWARE_INDEX_BASE,
+  isHardwareWalletIndex,
+  getWalletRecord,
   getDerivedWallets,
   getActiveWalletIndex,
   setActiveWalletIndex,
   createDerivedWallet,
+  addLedgerWallet,
   renameDerivedWallet,
   deleteDerivedWallet,
   getActiveWalletAddress,
diff --git a/src/main/identity-manager.test.js b/src/main/identity-manager.test.js
index 2382cbec..34758ecd 100644
--- a/src/main/identity-manager.test.js
+++ b/src/main/identity-manager.test.js
@@ -234,6 +234,324 @@ describe('identity-manager wallet deletion', () => {
     expect(readVaultMeta().derivedWallets.map((wallet) => wallet.index)).toEqual([0]);
     expect(readVaultMeta().activeWalletIndex).toBe(0);
   });
+
+  test('revokes dApp permissions bound to the deleted wallet', async () => {
+    // A permission is a standing authorisation to sign with one account
+    // (plus its auto-approve rules). Left behind, its walletIndex dangles
+    // — for a deleted hardware account, at an index with no signer at all.
+    fs.writeFileSync(
+      path.join(tmpDir, 'dapp-permissions.json'),
+      JSON.stringify({
+        'https://swap.example': {
+          origin: 'https://swap.example',
+          walletIndex: 2,
+          chainId: 1,
+          autoApprove: { signing: true, transactions: [] },
+        },
+        'https://keep.example': {
+          origin: 'https://keep.example',
+          walletIndex: 0,
+          chainId: 1,
+          autoApprove: { signing: false, transactions: [] },
+        },
+      }, null, 2),
+      'utf-8'
+    );
+
+    writeVaultMeta({
+      activeWalletIndex: 0,
+      derivedWallets: [
+        { index: 0, name: 'Main Wallet', address: '0x0' },
+        { index: 2, name: 'Trading Wallet', address: '0x2' },
+      ],
+    });
+
+    await identityManager.deleteDerivedWallet(2);
+
+    const stored = JSON.parse(
+      fs.readFileSync(path.join(tmpDir, 'dapp-permissions.json'), 'utf-8')
+    );
+    expect(Object.keys(stored)).toEqual(['https://keep.example']);
+  });
+});
+
+describe('identity-manager ledger accounts', () => {
+  let tmpDir;
+  let envSnapshot;
+  let identityManager;
+
+  const LEDGER_ADDRESS = '0x209693Bc6afc0C5328bA36FaF03C514EF312287C';
+  const LEDGER_PATH = "44'/60'/0'/0/0";
+  const HARDWARE_INDEX_BASE = 1000000;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'identity-manager-ledger-'));
+    envSnapshot = snapshotEnv();
+    process.env.FREEDOM_IDENTITY_DATA = tmpDir;
+    identityManager = loadMainModule(require.resolve('./identity-manager'), {
+      userDataDir: tmpDir,
+      extraMocks: {
+        [require.resolve('./identity')]: () => ({
+          getMnemonic: jest.fn(() => null), // vault locked — ledger ops must not need it
+          isUnlocked: jest.fn(() => false),
+        }),
+      },
+    }).mod;
+  });
+
+  afterEach(() => {
+    restoreEnv(envSnapshot);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  function writeVaultMeta(meta) {
+    fs.writeFileSync(path.join(tmpDir, 'vault-meta.json'), JSON.stringify(meta, null, 2), 'utf-8');
+  }
+
+  function readVaultMeta() {
+    return JSON.parse(fs.readFileSync(path.join(tmpDir, 'vault-meta.json'), 'utf-8'));
+  }
+
+  function seedMainWallet() {
+    writeVaultMeta({
+      activeWalletIndex: 0,
+      addresses: { userWallet: '0x0000000000000000000000000000000000000001' },
+      derivedWallets: [
+        { index: 0, name: 'Main Wallet', address: '0x0000000000000000000000000000000000000001' },
+      ],
+    });
+  }
+
+  test('addLedgerWallet appends a typed record with device address and path', async () => {
+    seedMainWallet();
+
+    const wallet = await identityManager.addLedgerWallet('My Stax', LEDGER_ADDRESS, LEDGER_PATH);
+
+    expect(wallet).toEqual({
+      index: HARDWARE_INDEX_BASE,
+      name: 'My Stax',
+      address: LEDGER_ADDRESS,
+      type: 'ledger',
+      path: LEDGER_PATH,
+    });
+    expect(readVaultMeta().derivedWallets).toHaveLength(2);
+    expect(readVaultMeta().derivedWallets[1]).toMatchObject({ type: 'ledger', path: LEDGER_PATH });
+  });
+
+  test('addLedgerWallet auto-names and works with the vault locked', async () => {
+    seedMainWallet();
+    const wallet = await identityManager.addLedgerWallet('', LEDGER_ADDRESS, LEDGER_PATH);
+    expect(wallet.name).toBe('Ledger 1');
+  });
+
+  test('addLedgerWallet rejects duplicates and bad input', async () => {
+    seedMainWallet();
+    await identityManager.addLedgerWallet('My Stax', LEDGER_ADDRESS, LEDGER_PATH);
+
+    await expect(identityManager.addLedgerWallet('Again', LEDGER_ADDRESS.toLowerCase(), LEDGER_PATH))
+      .rejects.toThrow(/already in your wallet list/);
+    await expect(identityManager.addLedgerWallet('Bad', '0x123', LEDGER_PATH))
+      .rejects.toThrow('Invalid Ledger account address');
+    // Mixed-case address with a broken EIP-55 checksum must be rejected too
+    await expect(identityManager.addLedgerWallet('Bad', LEDGER_ADDRESS.replace('9', 'a'), LEDGER_PATH))
+      .rejects.toThrow('Invalid Ledger account address');
+    await expect(identityManager.addLedgerWallet('Bad', '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913', ''))
+      .rejects.toThrow('Missing derivation path');
+  });
+
+  test('getDerivedWallets returns the stored device address without derivation', async () => {
+    seedMainWallet();
+    await identityManager.addLedgerWallet('My Stax', LEDGER_ADDRESS, LEDGER_PATH);
+
+    const wallets = await identityManager.getDerivedWallets();
+
+    expect(wallets).toEqual([
+      expect.objectContaining({ index: 0, type: 'mnemonic' }),
+      expect.objectContaining({
+        index: HARDWARE_INDEX_BASE,
+        type: 'ledger',
+        address: LEDGER_ADDRESS,
+        path: LEDGER_PATH,
+      }),
+    ]);
+  });
+
+  test('getWalletRecord normalizes type and exposes the ledger path', async () => {
+    seedMainWallet();
+    await identityManager.addLedgerWallet('My Stax', LEDGER_ADDRESS, LEDGER_PATH);
+
+    expect(identityManager.getWalletRecord(0)).toMatchObject({ type: 'mnemonic' });
+    expect(identityManager.getWalletRecord(HARDWARE_INDEX_BASE)).toMatchObject({
+      type: 'ledger',
+      address: LEDGER_ADDRESS,
+      path: LEDGER_PATH,
+    });
+    expect(identityManager.getWalletRecord(99)).toBeNull();
+  });
+
+  test('getUserWalletKey refuses to derive for a ledger account', async () => {
+    seedMainWallet();
+    await identityManager.addLedgerWallet('My Stax', LEDGER_ADDRESS, LEDGER_PATH);
+
+    await expect(identityManager.getUserWalletKey(HARDWARE_INDEX_BASE))
+      .rejects.toThrow('Hardware wallet accounts have no derivable private key');
+  });
+
+  test('getActiveWalletAddress returns the device address for an active ledger account', async () => {
+    seedMainWallet();
+    const wallet = await identityManager.addLedgerWallet('My Stax', LEDGER_ADDRESS, LEDGER_PATH);
+    await identityManager.setActiveWalletIndex(wallet.index);
+
+    await expect(identityManager.getActiveWalletAddress()).resolves.toBe(LEDGER_ADDRESS);
+  });
+});
+
+/**
+ * A wallet's `index` is both the account id every persisted reference
+ * stores (dApp permissions, Swarm publisher identities, activeWalletIndex)
+ * and — for mnemonic accounts — the BIP-44 account index the key is
+ * derived at. Hardware accounts must therefore never take an index out of
+ * the mnemonic range, and a freed hardware index must never be handed to
+ * another device account: either would silently rebind persisted
+ * references to a different address and signing backend, and squatting a
+ * derivation index strands whatever the mnemonic account there holds.
+ */
+describe('identity-manager wallet index allocation', () => {
+  let tmpDir;
+  let envSnapshot;
+  let identityManager;
+
+  const LEDGER_A = '0x209693Bc6afc0C5328bA36FaF03C514EF312287C';
+  const LEDGER_B = '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913';
+  const LEDGER_PATH = "44'/60'/0'/0/0";
+  const HARDWARE_INDEX_BASE = 1000000;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'identity-manager-index-'));
+    envSnapshot = snapshotEnv();
+    process.env.FREEDOM_IDENTITY_DATA = tmpDir;
+    identityManager = loadMainModule(require.resolve('./identity-manager'), {
+      userDataDir: tmpDir,
+      extraMocks: {
+        [require.resolve('./identity')]: () => ({
+          getMnemonic: jest.fn(() => 'test mnemonic'),
+          isUnlocked: jest.fn(() => true),
+          deriveUserWallet: jest.fn((_mnemonic, index) => ({
+            address: `0xderived${index}`,
+          })),
+        }),
+        [require.resolve('./swarm/feed-store')]: () => ({
+          getEthereumWalletIdentityReferences: jest.fn(() => []),
+        }),
+      },
+    }).mod;
+  });
+
+  afterEach(() => {
+    restoreEnv(envSnapshot);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  function readVaultMeta() {
+    return JSON.parse(fs.readFileSync(path.join(tmpDir, 'vault-meta.json'), 'utf-8'));
+  }
+
+  function seedMainWallet() {
+    fs.writeFileSync(
+      path.join(tmpDir, 'vault-meta.json'),
+      JSON.stringify({
+        activeWalletIndex: 0,
+        addresses: { userWallet: '0xderived0' },
+        derivedWallets: [{ index: 0, name: 'Main Wallet', address: '0xderived0' }],
+      }, null, 2),
+      'utf-8'
+    );
+  }
+
+  test('a ledger never takes a freed mnemonic derivation index', async () => {
+    seedMainWallet();
+    const second = await identityManager.createDerivedWallet('Wallet 2');
+    expect(second.index).toBe(1);
+
+    await identityManager.deleteDerivedWallet(1);
+    const ledger = await identityManager.addLedgerWallet('', LEDGER_A, LEDGER_PATH);
+
+    expect(ledger.index).toBe(HARDWARE_INDEX_BASE);
+
+    // Derivation index 1 is still mintable, so funds sent to it before the
+    // delete stay reachable.
+    const recreated = await identityManager.createDerivedWallet('Wallet 2 again');
+    expect(recreated.index).toBe(1);
+    expect(recreated.address).toBe(second.address);
+    expect(identityManager.getWalletRecord(1)).toMatchObject({ type: 'mnemonic' });
+  });
+
+  test('mnemonic accounts keep allocating from the low range once a ledger exists', async () => {
+    seedMainWallet();
+    await identityManager.addLedgerWallet('', LEDGER_A, LEDGER_PATH);
+
+    const next = await identityManager.createDerivedWallet('Wallet 2');
+
+    expect(next.index).toBe(1);
+    expect(readVaultMeta().derivedWallets.map((wallet) => wallet.index))
+      .toEqual([0, HARDWARE_INDEX_BASE, 1]);
+  });
+
+  test('a deleted ledger does not hand its index to the next device account', async () => {
+    seedMainWallet();
+    const first = await identityManager.addLedgerWallet('', LEDGER_A, LEDGER_PATH);
+    await identityManager.deleteDerivedWallet(first.index);
+
+    const second = await identityManager.addLedgerWallet('', LEDGER_B, LEDGER_PATH);
+
+    expect(second.index).toBe(HARDWARE_INDEX_BASE + 1);
+    expect(readVaultMeta().nextHardwareWalletIndex).toBe(HARDWARE_INDEX_BASE + 2);
+  });
+
+  test('stays above ledger indexes already on disk when the counter is missing', async () => {
+    fs.writeFileSync(
+      path.join(tmpDir, 'vault-meta.json'),
+      JSON.stringify({
+        activeWalletIndex: 0,
+        addresses: { userWallet: '0xderived0' },
+        derivedWallets: [
+          { index: 0, name: 'Main Wallet', address: '0xderived0' },
+          {
+            index: HARDWARE_INDEX_BASE + 4,
+            name: 'Ledger 1',
+            address: LEDGER_A,
+            type: 'ledger',
+            path: LEDGER_PATH,
+          },
+        ],
+      }, null, 2),
+      'utf-8'
+    );
+
+    const added = await identityManager.addLedgerWallet('', LEDGER_B, LEDGER_PATH);
+
+    expect(added.index).toBe(HARDWARE_INDEX_BASE + 5);
+  });
+
+  test('skips a legacy low-index ledger when minting a mnemonic wallet', async () => {
+    fs.writeFileSync(
+      path.join(tmpDir, 'vault-meta.json'),
+      JSON.stringify({
+        activeWalletIndex: 0,
+        addresses: { userWallet: '0xderived0' },
+        derivedWallets: [
+          { index: 0, name: 'Main Wallet', address: '0xderived0' },
+          { index: 1, name: 'Ledger 1', address: LEDGER_A, type: 'ledger', path: LEDGER_PATH },
+        ],
+      }, null, 2),
+      'utf-8'
+    );
+
+    const next = await identityManager.createDerivedWallet('Wallet 2');
+
+    expect(next.index).toBe(2);
+    expect(identityManager.getWalletRecord(1)).toMatchObject({ type: 'ledger' });
+  });
 });
 
 /**
diff --git a/src/main/index.js b/src/main/index.js
index 27b87826..c1a04fb5 100644
--- a/src/main/index.js
+++ b/src/main/index.js
@@ -207,6 +207,7 @@ const {
 const { registerIdentityIpc, hasVault, setBeeLifecycle } = require('./identity-manager');
 const { registerQuickUnlockIpc } = require('./quick-unlock');
 const { registerWalletIpc } = require('./wallet/wallet-ipc');
+const { registerLedgerIpc } = require('./wallet/ledger/ipc');
 const { registerTokenRegistryIpc } = require('./token-registry');
 const { registerRpcManagerIpc } = require('./wallet/rpc-manager');
 const { registerNetworkConfigIpc } = require('./networks/network-ipc');
@@ -289,6 +290,7 @@ async function bootstrap() {
   registerIdentityIpc();
   registerQuickUnlockIpc();
   registerWalletIpc();
+  registerLedgerIpc();
 
   // Let identity (re)injection stop the Bee node before wiping its statestore
   // (which it holds a LevelDB lock on) and restart it with the new key. Without
diff --git a/src/main/preload.js b/src/main/preload.js
index e4704578..81d047dd 100644
--- a/src/main/preload.js
+++ b/src/main/preload.js
@@ -441,6 +441,11 @@ contextBridge.exposeInMainWorld('wallet', {
     ipcRenderer.invoke('wallet:proxy-rpc', { rpcUrl, method, params }),
 });
 
+contextBridge.exposeInMainWorld('ledger', {
+  getAccounts: (options) => ipcRenderer.invoke('ledger:get-accounts', options),
+  addAccount: (name, address, path) => ipcRenderer.invoke('wallet:add-ledger-wallet', name, address, path),
+});
+
 contextBridge.exposeInMainWorld('swarmNode', {
   getStamps: () => ipcRenderer.invoke('swarm:get-stamps'),
   getStorageCost: (sizeGB, durationDays) =>
diff --git a/src/main/preload.test.js b/src/main/preload.test.js
index a47cb3c5..4056b8b7 100644
--- a/src/main/preload.test.js
+++ b/src/main/preload.test.js
@@ -83,7 +83,7 @@ describe('preload', () => {
       beeApiEnv: 'http://127.0.0.1:1700',
     });
 
-    expect(contextBridge.exposeInMainWorld).toHaveBeenCalledTimes(23);
+    expect(contextBridge.exposeInMainWorld).toHaveBeenCalledTimes(24);
     expect(Object.keys(exposures)).toEqual([
       'nodeConfig',
       'internalPages',
@@ -96,6 +96,7 @@ describe('preload', () => {
       'identity',
       'quickUnlock',
       'wallet',
+      'ledger',
       'swarmNode',
       'networks',
       'payments',
diff --git a/src/main/swarm/feed-store.js b/src/main/swarm/feed-store.js
index 1c5665cb..e4c7c88b 100644
--- a/src/main/swarm/feed-store.js
+++ b/src/main/swarm/feed-store.js
@@ -28,7 +28,12 @@ const path = require('path');
 const fs = require('fs');
 const IPC = require('../../shared/ipc-channels');
 const { normalizeOrigin } = require('../../shared/origin-utils');
-const { getDerivedKeys, getPublisherKey, getDerivedWallets } = require('../identity-manager');
+const {
+  getDerivedKeys,
+  getPublisherKey,
+  getDerivedWallets,
+  WALLET_TYPES,
+} = require('../identity-manager');
 const log = require('electron-log');
 
 const FEEDS_FILE = 'swarm-feeds.json';
@@ -49,6 +54,19 @@ class PreserveFeedStoreError extends Error {
   }
 }
 
+/**
+ * Swarm feed/SOC signing needs a raw private key (see
+ * swarm-provider-ipc.js resolveSignerKey), which hardware accounts can
+ * never hand out — the device signs, it does not export. Such wallets are
+ * therefore not usable as publisher identities and must never be offered
+ * or persisted as one.
+ * @param {{type?: string}} wallet
+ * @returns {boolean}
+ */
+function isSwarmSignableWallet(wallet) {
+  return !!wallet && (wallet.type || WALLET_TYPES.MNEMONIC) === WALLET_TYPES.MNEMONIC;
+}
+
 function getFeedsPath() {
   return path.join(app.getPath('userData'), FEEDS_FILE);
 }
@@ -527,7 +545,10 @@ async function enrichIdentityOwner(identity, options = {}) {
       label: wallet?.name || identity.label || getIdentityLabel('ethereum-wallet', null, identity.walletIndex),
       owner: wallet?.address || null,
       stored,
-      unavailable: !wallet,
+      // Hardware-backed accounts can't sign feeds; flag them so an entry
+      // persisted before this guard existed renders as unusable instead of
+      // failing with an opaque error on every feed write.
+      unavailable: !wallet || !isSwarmSignableWallet(wallet),
     };
   }
 
@@ -566,7 +587,7 @@ async function getOriginIdentityStateWithOwners(origin) {
 
   const knownIds = new Set(identities.map((identity) => identity.id));
   const wallets = await getDerivedWallets();
-  for (const wallet of wallets) {
+  for (const wallet of wallets.filter(isSwarmSignableWallet)) {
     const walletIdentity = createIdentity(
       'ethereum-wallet',
       null,
@@ -656,6 +677,12 @@ async function ensureEthereumWalletIdentity(origin, walletIndex, options = {}) {
   if (!wallet) {
     throw new Error(`Wallet with index ${walletIndex} does not exist`);
   }
+  if (!isSwarmSignableWallet(wallet)) {
+    throw new Error(
+      'Hardware wallet accounts cannot be used as a Swarm publisher identity. '
+      + 'Choose an app-scoped identity or a wallet account held in this browser.'
+    );
+  }
 
   const store = loadFeeds();
   const key = normalizeOrigin(origin);
diff --git a/src/main/swarm/feed-store.test.js b/src/main/swarm/feed-store.test.js
index 8bc2dc38..f90e5246 100644
--- a/src/main/swarm/feed-store.test.js
+++ b/src/main/swarm/feed-store.test.js
@@ -27,6 +27,7 @@ jest.mock('../identity-manager', () => ({
   getDerivedKeys: (...args) => mockGetDerivedKeys(...args),
   getPublisherKey: (...args) => mockGetPublisherKey(...args),
   getDerivedWallets: (...args) => mockGetDerivedWallets(...args),
+  WALLET_TYPES: { MNEMONIC: 'mnemonic', LEDGER: 'ledger' },
 }));
 
 const { app } = require('electron');
@@ -49,6 +50,7 @@ const {
   setOriginEntry,
   allocatePublisherKeyIndex,
   getOriginIdentityState,
+  getOriginIdentityStateWithOwners,
   previewAppScopedIdentity,
   createAppScopedIdentity,
   ensureAntWalletIdentity,
@@ -252,6 +254,53 @@ describe('feed-store', () => {
         .rejects.toThrow('Wallet with index 99 does not exist');
     });
 
+    test('ensureEthereumWalletIdentity rejects hardware wallet accounts', async () => {
+      mockGetDerivedWallets.mockResolvedValue([
+        { index: 0, name: 'Main Wallet', address: '0xWallet000000000000000000000000000000000000', type: 'mnemonic' },
+        { index: 1, name: 'Ledger 1', address: '0xLedger11111111111111111111111111111111111', type: 'ledger' },
+      ]);
+
+      await expect(ensureEthereumWalletIdentity('myapp.eth', 1, { activate: true }))
+        .rejects.toThrow('Hardware wallet accounts cannot be used as a Swarm publisher identity');
+      // Nothing persisted: the origin never gets a broken active identity.
+      expect(getOriginEntry('myapp.eth')).toBeNull();
+    });
+
+    test('hardware wallet accounts are not offered as publisher identities', async () => {
+      mockGetDerivedWallets.mockResolvedValue([
+        { index: 0, name: 'Main Wallet', address: '0xWallet000000000000000000000000000000000000', type: 'mnemonic' },
+        { index: 1, name: 'Ledger 1', address: '0xLedger11111111111111111111111111111111111', type: 'ledger' },
+      ]);
+      setOriginEntry('myapp.eth', { identityMode: 'app-scoped', publisherKeyIndex: 0 });
+
+      const state = await getOriginIdentityStateWithOwners('myapp.eth');
+      const walletIndexes = state.identities
+        .filter((identity) => identity.mode === 'ethereum-wallet')
+        .map((identity) => identity.walletIndex);
+
+      expect(walletIndexes).toEqual([0]);
+    });
+
+    test('an already-stored hardware wallet identity is reported as unavailable', async () => {
+      mockGetDerivedWallets.mockResolvedValue([
+        { index: 0, name: 'Main Wallet', address: '0xWallet000000000000000000000000000000000000', type: 'mnemonic' },
+        { index: 1, name: 'Ledger 1', address: '0xLedger11111111111111111111111111111111111', type: 'mnemonic' },
+      ]);
+      setOriginEntry('myapp.eth', { identityMode: 'app-scoped', publisherKeyIndex: 0 });
+      await ensureEthereumWalletIdentity('myapp.eth', 1, { activate: true });
+
+      // The account later turns out to be (or is replaced by) a Ledger one.
+      mockGetDerivedWallets.mockResolvedValue([
+        { index: 0, name: 'Main Wallet', address: '0xWallet000000000000000000000000000000000000', type: 'mnemonic' },
+        { index: 1, name: 'Ledger 1', address: '0xLedger11111111111111111111111111111111111', type: 'ledger' },
+      ]);
+
+      const state = await getOriginIdentityStateWithOwners('myapp.eth');
+      const stored = state.identities.find((identity) => identity.id === 'ethereum-wallet:1');
+
+      expect(stored).toMatchObject({ unavailable: true });
+    });
+
     test('getEthereumWalletIdentityReferences lists active and feed-pinned identities', async () => {
       setOriginEntry('myapp.eth', { identityMode: 'app-scoped', publisherKeyIndex: 0 });
       await ensureEthereumWalletIdentity('myapp.eth', 2, { activate: true });
diff --git a/src/main/wallet/dapp-permissions.js b/src/main/wallet/dapp-permissions.js
index 2385c54d..c1099927 100644
--- a/src/main/wallet/dapp-permissions.js
+++ b/src/main/wallet/dapp-permissions.js
@@ -124,6 +124,44 @@ function revokePermission(origin) {
   return false;
 }
 
+/**
+ * Revoke every permission bound to a wallet index.
+ *
+ * Called when an account is deleted: a permission is a standing
+ * authorisation to sign with one specific account, so it cannot outlive
+ * that account. Left behind, the stored `walletIndex` becomes a dangling
+ * reference — for a deleted hardware account it points at an index with
+ * no device and no vault key, for a deleted mnemonic account at an
+ * account the user believes is gone. Either way the origin keeps its
+ * auto-approve rules and would sign against an account the user can no
+ * longer see. Origins must reconnect and pick a live account.
+ *
+ * @param {number} walletIndex
+ * @returns {string[]} Origins whose permission was revoked
+ */
+function revokePermissionsForWalletIndex(walletIndex) {
+  const permissions = loadPermissions();
+  const revoked = Object.keys(permissions).filter(
+    (origin) => permissions[origin]?.walletIndex === walletIndex
+  );
+
+  if (revoked.length === 0) {
+    return [];
+  }
+
+  for (const origin of revoked) {
+    delete permissions[origin];
+  }
+  permissionsCache = permissions;
+  savePermissions();
+
+  console.log(
+    `[DAppPermissions] Revoked ${revoked.length} permission(s) for deleted wallet ${walletIndex}:`,
+    revoked.join(', ')
+  );
+  return revoked;
+}
+
 /**
  * Get all granted permissions
  * @returns {Object[]} Array of permission objects
@@ -366,6 +404,7 @@ module.exports = {
   getPermission,
   grantPermission,
   revokePermission,
+  revokePermissionsForWalletIndex,
   getAllPermissions,
   updateLastUsed,
   updateWalletIndex,
diff --git a/src/main/wallet/dapp-permissions.test.js b/src/main/wallet/dapp-permissions.test.js
index ddcbc864..0290ea27 100644
--- a/src/main/wallet/dapp-permissions.test.js
+++ b/src/main/wallet/dapp-permissions.test.js
@@ -31,6 +31,7 @@ const {
   getPermission,
   grantPermission,
   revokePermission,
+  revokePermissionsForWalletIndex,
   getAllPermissions,
   _resetCache,
 } = require('./dapp-permissions');
@@ -159,3 +160,34 @@ describe('dapp-permissions — basic CRUD round-trip', () => {
     expect(getPermission('ens://vitalik.eth')).toBeNull();
   });
 });
+
+describe('dapp-permissions — revoke by wallet index', () => {
+  const LEDGER_INDEX = 1000000;
+
+  test('drops every origin bound to the deleted account and keeps the rest', () => {
+    grantPermission('https://swap.example', LEDGER_INDEX, 8453);
+    grantPermission('vitalik.eth', LEDGER_INDEX, 1);
+    grantPermission('https://other.example', 0, 1);
+
+    const revoked = revokePermissionsForWalletIndex(LEDGER_INDEX);
+
+    expect(revoked.sort()).toEqual(['https://swap.example', 'vitalik.eth']);
+    expect(getPermission('https://swap.example')).toBeNull();
+    expect(getPermission('vitalik.eth')).toBeNull();
+    expect(getPermission('https://other.example')).not.toBeNull();
+  });
+
+  test('persists the removal to disk, so a stale index cannot survive a restart', () => {
+    grantPermission('https://swap.example', LEDGER_INDEX, 8453);
+    revokePermissionsForWalletIndex(LEDGER_INDEX);
+
+    _resetCache();
+    expect(getPermission('https://swap.example')).toBeNull();
+  });
+
+  test('is a no-op when no origin uses the index', () => {
+    grantPermission('https://other.example', 0, 1);
+    expect(revokePermissionsForWalletIndex(7)).toEqual([]);
+    expect(getPermission('https://other.example')).not.toBeNull();
+  });
+});
diff --git a/src/main/wallet/ledger/errors.js b/src/main/wallet/ledger/errors.js
new file mode 100644
index 00000000..230d43d1
--- /dev/null
+++ b/src/main/wallet/ledger/errors.js
@@ -0,0 +1,129 @@
+/**
+ * Ledger error mapping.
+ *
+ * Transport and app errors from `@ledgerhq/*` come as TransportStatusError
+ * (with a `statusCode` APDU status word), named transport errors, or plain
+ * node-hid failures. Map them to stable machine codes + user-facing
+ * messages so the renderer can drive the connect/sign UX ("unlock your
+ * Ledger", "open the Ethereum app", "request rejected on device") without
+ * string-matching library internals.
+ */
+
+const LEDGER_ERROR_CODES = {
+  DEVICE_NOT_FOUND: 'LEDGER_DEVICE_NOT_FOUND',
+  DEVICE_LOCKED: 'LEDGER_DEVICE_LOCKED',
+  ETH_APP_NOT_OPEN: 'LEDGER_ETH_APP_NOT_OPEN',
+  USER_REJECTED: 'LEDGER_USER_REJECTED',
+  DISCONNECTED: 'LEDGER_DISCONNECTED',
+  BUSY: 'LEDGER_BUSY',
+  WRONG_DEVICE: 'LEDGER_WRONG_DEVICE',
+  BLIND_SIGNING_REQUIRED: 'LEDGER_BLIND_SIGNING_REQUIRED',
+  UNKNOWN: 'LEDGER_UNKNOWN',
+};
+
+const MESSAGES = {
+  [LEDGER_ERROR_CODES.DEVICE_NOT_FOUND]: 'No Ledger device found. Connect it via USB and unlock it.',
+  [LEDGER_ERROR_CODES.DEVICE_LOCKED]: 'Ledger is locked. Unlock it with your PIN.',
+  [LEDGER_ERROR_CODES.ETH_APP_NOT_OPEN]: 'Open the Ethereum app on your Ledger.',
+  [LEDGER_ERROR_CODES.USER_REJECTED]: 'Request rejected on the Ledger device.',
+  [LEDGER_ERROR_CODES.DISCONNECTED]: 'Ledger was disconnected. Reconnect it and try again.',
+  [LEDGER_ERROR_CODES.BUSY]: 'Ledger is busy with another request. Finish or dismiss it on the device.',
+  [LEDGER_ERROR_CODES.WRONG_DEVICE]:
+    'This Ledger does not hold the selected account. Connect the device this account was added from.',
+  [LEDGER_ERROR_CODES.BLIND_SIGNING_REQUIRED]:
+    'Ledger cannot display this contract call. Enable "Blind signing" (called "Contract data" on older app versions) in the Ethereum app settings, then try again.',
+  [LEDGER_ERROR_CODES.UNKNOWN]: 'Ledger error. Reconnect the device and try again.',
+};
+
+/**
+ * Mint an error from the code registry — the only way LEDGER_* errors
+ * should be created outside of `mapLedgerError`.
+ *
+ * @param {string} code - One of LEDGER_ERROR_CODES
+ * @returns {Error & {code: string}}
+ */
+function createLedgerError(code) {
+  const err = new Error(MESSAGES[code] || MESSAGES[LEDGER_ERROR_CODES.UNKNOWN]);
+  err.code = code;
+  return err;
+}
+
+// APDU status words (TransportStatusError.statusCode)
+const STATUS_TO_CODE = {
+  0x5515: LEDGER_ERROR_CODES.DEVICE_LOCKED,
+  0x6982: LEDGER_ERROR_CODES.DEVICE_LOCKED, // security not satisfied (locked mid-session)
+  0x6985: LEDGER_ERROR_CODES.USER_REJECTED, // conditions of use not satisfied
+  0x5501: LEDGER_ERROR_CODES.USER_REJECTED, // user refused on device
+  // "incorrect data" from the Ethereum app while signing means it refused
+  // to sign data it cannot decode: blind signing is off. Unavoidable here
+  // because we never resolve clear-signing metadata (see signer.js), and
+  // it is the factory default, so it needs its own actionable message.
+  0x6a80: LEDGER_ERROR_CODES.BLIND_SIGNING_REQUIRED,
+  0x6511: LEDGER_ERROR_CODES.ETH_APP_NOT_OPEN, // app not started
+  0x6d00: LEDGER_ERROR_CODES.ETH_APP_NOT_OPEN, // INS not supported (wrong app)
+  0x6e00: LEDGER_ERROR_CODES.ETH_APP_NOT_OPEN, // CLA not supported (wrong app)
+  0x6e01: LEDGER_ERROR_CODES.ETH_APP_NOT_OPEN,
+};
+
+// Named errors from @ledgerhq/errors / node-hid
+const NAME_TO_CODE = {
+  TransportOpenUserCancelled: LEDGER_ERROR_CODES.DEVICE_NOT_FOUND,
+  CantOpenDevice: LEDGER_ERROR_CODES.DEVICE_NOT_FOUND,
+  NoDeviceFound: LEDGER_ERROR_CODES.DEVICE_NOT_FOUND,
+  DisconnectedDevice: LEDGER_ERROR_CODES.DISCONNECTED,
+  DisconnectedDeviceDuringOperation: LEDGER_ERROR_CODES.DISCONNECTED,
+  TransportRaceCondition: LEDGER_ERROR_CODES.BUSY,
+  TransportInterfaceNotAvailable: LEDGER_ERROR_CODES.BUSY,
+  LockedDeviceError: LEDGER_ERROR_CODES.DEVICE_LOCKED,
+  // hw-app-eth rewrites 0x6a80 from the tx-signing path into this named
+  // error (it carries no statusCode of its own).
+  EthAppPleaseEnableContractData: LEDGER_ERROR_CODES.BLIND_SIGNING_REQUIRED,
+};
+
+/**
+ * Classify a raw `@ledgerhq/*` / node-hid error into a stable code.
+ *
+ * @param {unknown} err
+ * @returns {string} One of LEDGER_ERROR_CODES
+ */
+function classifyLedgerError(err) {
+  if (!err || typeof err !== 'object') return LEDGER_ERROR_CODES.UNKNOWN;
+  if (typeof err.statusCode === 'number' && STATUS_TO_CODE[err.statusCode]) {
+    return STATUS_TO_CODE[err.statusCode];
+  }
+  if (err.name && NAME_TO_CODE[err.name]) {
+    return NAME_TO_CODE[err.name];
+  }
+  const message = String(err.message || '');
+  if (/cannot open device|no device/i.test(message)) {
+    return LEDGER_ERROR_CODES.DEVICE_NOT_FOUND;
+  }
+  if (/disconnected/i.test(message)) {
+    return LEDGER_ERROR_CODES.DISCONNECTED;
+  }
+  return LEDGER_ERROR_CODES.UNKNOWN;
+}
+
+/**
+ * Wrap a raw Ledger error into an Error with a stable `.code` and a
+ * user-facing message. Errors that already carry a LEDGER_* code pass
+ * through unchanged.
+ *
+ * @param {unknown} err
+ * @returns {Error & {code: string}}
+ */
+function mapLedgerError(err) {
+  if (err && typeof err === 'object' && typeof err.code === 'string' && err.code.startsWith('LEDGER_')) {
+    return err;
+  }
+  const code = classifyLedgerError(err);
+  const mapped = new Error(MESSAGES[code], { cause: err });
+  mapped.code = code;
+  return mapped;
+}
+
+function isLedgerUserRejection(err) {
+  return mapLedgerError(err).code === LEDGER_ERROR_CODES.USER_REJECTED;
+}
+
+module.exports = { LEDGER_ERROR_CODES, createLedgerError, mapLedgerError, isLedgerUserRejection };
diff --git a/src/main/wallet/ledger/errors.test.js b/src/main/wallet/ledger/errors.test.js
new file mode 100644
index 00000000..2acca54e
--- /dev/null
+++ b/src/main/wallet/ledger/errors.test.js
@@ -0,0 +1,95 @@
+const { LEDGER_ERROR_CODES, createLedgerError, mapLedgerError, isLedgerUserRejection } = require('./errors');
+
+function statusError(statusCode) {
+  const err = new Error(`status ${statusCode.toString(16)}`);
+  err.statusCode = statusCode;
+  return err;
+}
+
+function namedError(name) {
+  const err = new Error(name);
+  err.name = name;
+  return err;
+}
+
+describe('mapLedgerError', () => {
+  test.each([
+    [0x6985, LEDGER_ERROR_CODES.USER_REJECTED],
+    [0x5501, LEDGER_ERROR_CODES.USER_REJECTED],
+    [0x5515, LEDGER_ERROR_CODES.DEVICE_LOCKED],
+    [0x6982, LEDGER_ERROR_CODES.DEVICE_LOCKED],
+    [0x6511, LEDGER_ERROR_CODES.ETH_APP_NOT_OPEN],
+    [0x6d00, LEDGER_ERROR_CODES.ETH_APP_NOT_OPEN],
+    [0x6e00, LEDGER_ERROR_CODES.ETH_APP_NOT_OPEN],
+    [0x6a80, LEDGER_ERROR_CODES.BLIND_SIGNING_REQUIRED],
+  ])('maps APDU status 0x%s to a stable code', (statusCode, expected) => {
+    const mapped = mapLedgerError(statusError(statusCode));
+    expect(mapped.code).toBe(expected);
+    expect(mapped.message).not.toMatch(/status/); // user-facing, not raw
+    expect(mapped.cause).toBeDefined();
+  });
+
+  test.each([
+    ['CantOpenDevice', LEDGER_ERROR_CODES.DEVICE_NOT_FOUND],
+    ['DisconnectedDeviceDuringOperation', LEDGER_ERROR_CODES.DISCONNECTED],
+    ['TransportRaceCondition', LEDGER_ERROR_CODES.BUSY],
+    ['LockedDeviceError', LEDGER_ERROR_CODES.DEVICE_LOCKED],
+  ])('maps named transport error %s', (name, expected) => {
+    expect(mapLedgerError(namedError(name)).code).toBe(expected);
+  });
+
+  // Signing without hosted clear-signing resolution means a factory-
+  // default device (blind signing off) refuses every contract call —
+  // the instruction has to name the setting, not "reconnect the device".
+  test('blind-signing refusals tell the user which setting to enable', () => {
+    const mapped = mapLedgerError(statusError(0x6a80));
+    expect(mapped.code).toBe(LEDGER_ERROR_CODES.BLIND_SIGNING_REQUIRED);
+    expect(mapped.message).toMatch(/blind signing/i);
+    expect(mapped.message).not.toMatch(/reconnect/i);
+  });
+
+  test('maps the blind-signing error class hw-app-eth actually throws', () => {
+    // The tx-signing path rewrites 0x6a80 into this named error, which
+    // carries no statusCode of its own.
+    const { EthAppPleaseEnableContractData } = require('@ledgerhq/hw-app-eth/lib/errors');
+    const err = new EthAppPleaseEnableContractData(
+      'Please enable Blind signing or Contract data in the Ethereum app Settings'
+    );
+    expect(err.statusCode).toBeUndefined();
+    expect(mapLedgerError(err).code).toBe(LEDGER_ERROR_CODES.BLIND_SIGNING_REQUIRED);
+  });
+
+  test('maps node-hid "cannot open device" message', () => {
+    expect(mapLedgerError(new Error('cannot open device with path X')).code)
+      .toBe(LEDGER_ERROR_CODES.DEVICE_NOT_FOUND);
+  });
+
+  test('unknown errors get the UNKNOWN code, never throw', () => {
+    expect(mapLedgerError(new Error('wat')).code).toBe(LEDGER_ERROR_CODES.UNKNOWN);
+    expect(mapLedgerError(undefined).code).toBe(LEDGER_ERROR_CODES.UNKNOWN);
+    expect(mapLedgerError('string').code).toBe(LEDGER_ERROR_CODES.UNKNOWN);
+  });
+
+  test('already-mapped errors pass through unchanged', () => {
+    const mapped = mapLedgerError(statusError(0x6985));
+    expect(mapLedgerError(mapped)).toBe(mapped);
+  });
+});
+
+describe('createLedgerError', () => {
+  test('mints an error with the registry code and message', () => {
+    const err = createLedgerError(LEDGER_ERROR_CODES.WRONG_DEVICE);
+    expect(err.code).toBe('LEDGER_WRONG_DEVICE');
+    expect(err.message).toMatch(/does not hold/i);
+    // Round-trips through mapLedgerError unchanged (LEDGER_ prefix pass-through)
+    expect(mapLedgerError(err)).toBe(err);
+  });
+});
+
+describe('isLedgerUserRejection', () => {
+  test('true only for user rejection', () => {
+    expect(isLedgerUserRejection(statusError(0x6985))).toBe(true);
+    expect(isLedgerUserRejection(statusError(0x6511))).toBe(false);
+    expect(isLedgerUserRejection(new Error('x'))).toBe(false);
+  });
+});
diff --git a/src/main/wallet/ledger/ipc.js b/src/main/wallet/ledger/ipc.js
new file mode 100644
index 00000000..9013b6a2
--- /dev/null
+++ b/src/main/wallet/ledger/ipc.js
@@ -0,0 +1,29 @@
+/**
+ * Ledger IPC handlers.
+ *
+ * Device discovery for the "Connect hardware wallet" flow. Adding the
+ * chosen account to the wallet list goes through identity-manager's
+ * `wallet:add-ledger-wallet` handler, next to the other wallet-list
+ * mutations.
+ */
+
+const { ipcMain } = require('electron');
+const { listAccounts } = require('./transport');
+
+function registerLedgerIpc() {
+  // Requires an attached, unlocked device with the Ethereum app open;
+  // errors carry a stable LEDGER_* code the renderer turns into
+  // instructions ("plug it in", "open the app", …). The connect screen
+  // polls this while waiting for the user to get the device ready.
+  ipcMain.handle('ledger:get-accounts', async (_event, options = {}) => {
+    try {
+      const accounts = await listAccounts(options);
+      return { success: true, accounts };
+    } catch (err) {
+      console.error('[LedgerIPC] Account discovery failed:', err.message);
+      return { success: false, error: err.message, code: err.code };
+    }
+  });
+}
+
+module.exports = { registerLedgerIpc };
diff --git a/src/main/wallet/ledger/signer.js b/src/main/wallet/ledger/signer.js
new file mode 100644
index 00000000..1b503d49
--- /dev/null
+++ b/src/main/wallet/ledger/signer.js
@@ -0,0 +1,120 @@
+/**
+ * Ledger signing backend for the wallet signer factory.
+ *
+ * getAddress serves the address stored on the account record (read from
+ * the device when the account was added) — no device round-trip, no vault.
+ *
+ * Every signing method opens the device (serialized via withEthApp),
+ * verifies the attached device still derives the account's address at
+ * the stored path (a different Ledger with a different seed would
+ * otherwise silently sign from an address the user never approved),
+ * then asks for an on-device confirmation. Errors surface with stable
+ * LEDGER_* codes (see ./errors.js) — user rejection included.
+ *
+ * Transactions and typed data are signed WITHOUT @ledgerhq's hosted
+ * clear-signing resolution: resolving token/plugin/EIP-712 metadata posts
+ * the transaction contents (or the typed-data schema hash, chain id and
+ * verifying contract) to Ledger's registry before signing, which violates
+ * this project's rule against routing user data through hosted services.
+ * `signTransaction` passes a null resolution; the typed-data path is
+ * covered by the offline load config the transport builds Eth with.
+ * Consequence: plain ETH transfers display normally on the device, but
+ * contract calls (e.g. ERC-20 transfers) show as raw data and may
+ * require "blind signing" to be enabled in the device's Ethereum app.
+ * An opt-in setting (or a bundled offline token registry) can lift this
+ * later — that decision belongs to the user, not this module.
+ */
+
+const { Transaction, Signature, TypedDataEncoder } = require('ethers');
+
+const { withEthApp } = require('./transport');
+const { LEDGER_ERROR_CODES, createLedgerError } = require('./errors');
+
+/** hw-app-eth returns r/s as bare hex and v as hex string or number. */
+function toEthersSignature(sig) {
+  return Signature.from({
+    r: '0x' + sig.r,
+    s: '0x' + sig.s,
+    v: typeof sig.v === 'string' ? BigInt('0x' + sig.v) : BigInt(sig.v),
+  });
+}
+
+/** Types with EIP712Domain stripped, as ethers' hashing helpers expect. */
+function withoutDomainType(types) {
+  const stripped = { ...types };
+  delete stripped.EIP712Domain;
+  return stripped;
+}
+
+/**
+ * @param {{address: string, path: string}} record - Ledger wallet record from vault-meta
+ * @returns {import('../signers').Signer}
+ */
+function createLedgerBackend(record) {
+  /**
+   * Run a device task after verifying the attached Ledger derives this
+   * account's address at the stored path — signing with a different
+   * device/seed must fail, not silently produce a foreign signature.
+   */
+  const withVerifiedDevice = (task) =>
+    withEthApp(async (eth) => {
+      const { address } = await eth.getAddress(record.path, false);
+      if (address.toLowerCase() !== record.address.toLowerCase()) {
+        throw createLedgerError(LEDGER_ERROR_CODES.WRONG_DEVICE);
+      }
+      return task(eth);
+    });
+
+  return {
+    getAddress: async () => record.address,
+
+    signTransaction: async (tx) => {
+      // Serialize outside the device session — nothing here needs the
+      // transport, and withEthApp holds the exclusive device queue.
+      const unsigned = Transaction.from(tx);
+      const rawHex = unsigned.unsignedSerialized.slice(2);
+
+      return withVerifiedDevice(async (eth) => {
+        const sig = await eth.signTransaction(record.path, rawHex, null);
+        unsigned.signature = toEthersSignature(sig);
+        return unsigned.serialized;
+      });
+    },
+
+    signMessage: async (message) => {
+      const messageHex = Buffer.isBuffer(message)
+        ? message.toString('hex')
+        : Buffer.from(String(message), 'utf8').toString('hex');
+
+      return withVerifiedDevice(async (eth) => {
+        const sig = await eth.signPersonalMessage(record.path, messageHex);
+        return toEthersSignature(sig).serialized;
+      });
+    },
+
+    signTypedData: async (typedData) => {
+      // The device wants the full EIP-712 wire payload (EIP712Domain in
+      // types + explicit primaryType); ethers-style callers may omit
+      // both, and getPayload reconstructs them canonically.
+      const strippedTypes = withoutDomainType(typedData.types);
+      const payload = TypedDataEncoder.getPayload(typedData.domain || {}, strippedTypes, typedData.message);
+
+      return withVerifiedDevice(async (eth) => {
+        let sig;
+        try {
+          sig = await eth.signEIP712Message(record.path, payload);
+        } catch (err) {
+          // Older Ethereum apps only support signing the pre-hashed
+          // struct (no field-by-field review). 0x6d00 = INS not supported.
+          if (err?.statusCode !== 0x6d00) throw err;
+          const domainSeparator = TypedDataEncoder.hashDomain(payload.domain);
+          const structHash = TypedDataEncoder.from(strippedTypes).hash(typedData.message);
+          sig = await eth.signEIP712HashedMessage(record.path, domainSeparator.slice(2), structHash.slice(2));
+        }
+        return toEthersSignature(sig).serialized;
+      });
+    },
+  };
+}
+
+module.exports = { createLedgerBackend };
diff --git a/src/main/wallet/ledger/signer.test.js b/src/main/wallet/ledger/signer.test.js
new file mode 100644
index 00000000..7238c554
--- /dev/null
+++ b/src/main/wallet/ledger/signer.test.js
@@ -0,0 +1,208 @@
+/**
+ * The fake device signs with a real (well-known test) key, so every
+ * assertion verifies actual cryptographic round-trips: what the backend
+ * hands to hw-app-eth, and that the reassembled signature recovers to
+ * the device address.
+ */
+
+const {
+  Wallet,
+  Transaction,
+  Signature,
+  TypedDataEncoder,
+  verifyMessage,
+  verifyTypedData,
+  hashMessage,
+} = require('ethers');
+
+// Anvil/Hardhat-default test key — well-known, never funded on mainnet.
+const TEST_PRIVATE_KEY = '0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d';
+const deviceWallet = new Wallet(TEST_PRIVATE_KEY);
+
+const RECORD = {
+  index: 2,
+  name: 'My Stax',
+  address: deviceWallet.address,
+  type: 'ledger',
+  path: "44'/60'/0'/0/0",
+};
+
+/** Split an ethers Signature into the {r, s, v} shape hw-app-eth returns. */
+function toDeviceSig(signature, { vAsHexString = false } = {}) {
+  const sig = Signature.from(signature);
+  return {
+    r: sig.r.slice(2),
+    s: sig.s.slice(2),
+    v: vAsHexString ? sig.v.toString(16) : sig.v,
+  };
+}
+
+// Fake hw-app-eth instance backed by the test key.
+const mockEth = {
+  getAddress: jest.fn(),
+  signTransaction: jest.fn(),
+  signPersonalMessage: jest.fn(),
+  signEIP712Message: jest.fn(),
+  signEIP712HashedMessage: jest.fn(),
+};
+
+jest.mock('./transport', () => ({
+  withEthApp: (task) => task(mockEth),
+}));
+
+const { createLedgerBackend } = require('./signer');
+
+beforeEach(() => {
+  mockEth.getAddress.mockReset().mockResolvedValue({ address: deviceWallet.address });
+  mockEth.signTransaction.mockReset();
+  mockEth.signPersonalMessage.mockReset();
+  mockEth.signEIP712Message.mockReset();
+  mockEth.signEIP712HashedMessage.mockReset();
+});
+
+describe('createLedgerBackend / signTransaction', () => {
+  const TX = {
+    to: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+    value: '1000',
+    gasLimit: '21000',
+    maxFeePerGas: '2000000000',
+    maxPriorityFeePerGas: '1000000000',
+    nonce: 7,
+    chainId: 8453,
+    type: 2,
+  };
+
+  test('sends the unsigned serialization to the device and reassembles a valid signed tx', async () => {
+    mockEth.signTransaction.mockImplementation(async (path, rawHex) => {
+      expect(path).toBe(RECORD.path);
+      // The device signs exactly what ethers considers the unsigned tx.
+      expect('0x' + rawHex).toBe(Transaction.from(TX).unsignedSerialized);
+      const signed = Transaction.from(await deviceWallet.signTransaction(TX));
+      return toDeviceSig(signed.signature, { vAsHexString: true });
+    });
+
+    const backend = createLedgerBackend(RECORD);
+    const signedTx = await backend.signTransaction(TX);
+
+    const parsed = Transaction.from(signedTx);
+    expect(parsed.from).toBe(deviceWallet.address);
+    expect(parsed.nonce).toBe(7);
+    expect(parsed.chainId).toBe(8453n);
+  });
+
+  test('refuses to sign when the attached device derives a different address', async () => {
+    mockEth.getAddress.mockResolvedValue({ address: '0x0000000000000000000000000000000000000bad' });
+
+    const backend = createLedgerBackend(RECORD);
+    await expect(backend.signTransaction(TX)).rejects.toMatchObject({ code: 'LEDGER_WRONG_DEVICE' });
+    expect(mockEth.signTransaction).not.toHaveBeenCalled();
+  });
+
+  test('surfaces on-device rejection with its stable code', async () => {
+    const rejection = new Error('denied');
+    rejection.statusCode = 0x6985;
+    mockEth.signTransaction.mockRejectedValue(rejection);
+
+    const backend = createLedgerBackend(RECORD);
+    // withEthApp is mocked pass-through here, so the raw APDU error
+    // surfaces; in production the transport queue maps it. Assert the
+    // status code is preserved for that mapping.
+    await expect(backend.signTransaction(TX)).rejects.toMatchObject({ statusCode: 0x6985 });
+  });
+});
+
+describe('createLedgerBackend / signMessage', () => {
+  beforeEach(() => {
+    mockEth.signPersonalMessage.mockImplementation(async (path, messageHex) => {
+      expect(path).toBe(RECORD.path);
+      const bytes = Buffer.from(messageHex, 'hex');
+      const sig = deviceWallet.signingKey.sign(hashMessage(bytes));
+      return toDeviceSig(sig);
+    });
+  });
+
+  test('signs UTF-8 string messages (EIP-191)', async () => {
+    const backend = createLedgerBackend(RECORD);
+    const signature = await backend.signMessage('hello freedom');
+    expect(verifyMessage('hello freedom', signature)).toBe(deviceWallet.address);
+  });
+
+  test('signs raw bytes (pre-normalized 0x-hex dApp messages)', async () => {
+    const backend = createLedgerBackend(RECORD);
+    const bytes = Buffer.from('fffefd00010203deadbeef', 'hex');
+    const signature = await backend.signMessage(bytes);
+    expect(verifyMessage(bytes, signature)).toBe(deviceWallet.address);
+  });
+});
+
+describe('createLedgerBackend / signTypedData', () => {
+  const domain = {
+    name: 'USD Coin',
+    version: '2',
+    chainId: 8453,
+    verifyingContract: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
+  };
+  const types = {
+    TransferWithAuthorization: [
+      { name: 'from', type: 'address' },
+      { name: 'to', type: 'address' },
+      { name: 'value', type: 'uint256' },
+    ],
+  };
+  const message = {
+    from: deviceWallet.address,
+    to: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+    value: 10000n,
+  };
+
+  function deviceTypedSig() {
+    const sig = deviceWallet.signingKey.sign(TypedDataEncoder.hash(domain, types, message));
+    return toDeviceSig(sig);
+  }
+
+  test('passes the full payload (EIP712Domain + primaryType) to the device', async () => {
+    mockEth.signEIP712Message.mockImplementation(async (path, payload) => {
+      expect(path).toBe(RECORD.path);
+      expect(payload.primaryType).toBe('TransferWithAuthorization');
+      expect(payload.types.EIP712Domain).toEqual([
+        { name: 'name', type: 'string' },
+        { name: 'version', type: 'string' },
+        { name: 'chainId', type: 'uint256' },
+        { name: 'verifyingContract', type: 'address' },
+      ]);
+      return deviceTypedSig();
+    });
+
+    const backend = createLedgerBackend(RECORD);
+    // ethers-style payload: no EIP712Domain in types, no primaryType —
+    // the backend must fill both in for the device.
+    const signature = await backend.signTypedData({ domain, types, message });
+    expect(verifyTypedData(domain, types, message, signature)).toBe(deviceWallet.address);
+  });
+
+  test('falls back to hashed-message signing on apps without full EIP-712 support', async () => {
+    const noFullSupport = new Error('INS not supported');
+    noFullSupport.statusCode = 0x6d00;
+    mockEth.signEIP712Message.mockRejectedValue(noFullSupport);
+    mockEth.signEIP712HashedMessage.mockImplementation(async (path, domainSeparatorHex, structHashHex) => {
+      expect('0x' + domainSeparatorHex).toBe(TypedDataEncoder.hashDomain(domain));
+      expect('0x' + structHashHex).toBe(TypedDataEncoder.from(types).hash(message));
+      return deviceTypedSig();
+    });
+
+    const backend = createLedgerBackend(RECORD);
+    const signature = await backend.signTypedData({ domain, types, primaryType: 'TransferWithAuthorization', message });
+    expect(verifyTypedData(domain, types, message, signature)).toBe(deviceWallet.address);
+    expect(mockEth.signEIP712HashedMessage).toHaveBeenCalledTimes(1);
+  });
+
+  test('non-fallback device errors propagate', async () => {
+    const rejection = new Error('denied');
+    rejection.statusCode = 0x6985;
+    mockEth.signEIP712Message.mockRejectedValue(rejection);
+
+    const backend = createLedgerBackend(RECORD);
+    await expect(backend.signTypedData({ domain, types, message })).rejects.toMatchObject({ statusCode: 0x6985 });
+    expect(mockEth.signEIP712HashedMessage).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/main/wallet/ledger/transport.js b/src/main/wallet/ledger/transport.js
new file mode 100644
index 00000000..d6cf387b
--- /dev/null
+++ b/src/main/wallet/ledger/transport.js
@@ -0,0 +1,131 @@
+/**
+ * Ledger device transport (main process).
+ *
+ * Wraps `@ledgerhq/hw-transport-node-hid` + `@ledgerhq/hw-app-eth` behind
+ * a small API. The device speaks one APDU exchange at a time, so all
+ * access is serialized through a queue — concurrent IPC calls (e.g. a
+ * dApp signing request racing account discovery) wait their turn instead
+ * of corrupting the exchange.
+ *
+ * The transport is opened per operation and closed afterwards: cheap,
+ * and it keeps the device usable by other apps (Ledger Live) between
+ * our calls.
+ *
+ * Every Eth instance is built with hosted clear-signing DISABLED (see
+ * OFFLINE_LOAD_CONFIG) — same rule as the signer's null transaction
+ * resolution: no user data leaves the machine to sign.
+ */
+
+const { mapLedgerError } = require('./errors');
+
+// Lazy-required so the app doesn't pay node-hid's native-module load cost
+// (or crash on unsupported platforms) until a Ledger feature is touched.
+let TransportNodeHid = null;
+let EthApp = null;
+function loadLedgerLibs() {
+  if (!TransportNodeHid) {
+    TransportNodeHid = require('@ledgerhq/hw-transport-node-hid').default;
+    EthApp = require('@ledgerhq/hw-app-eth').default;
+  }
+}
+
+// Derivation path schemes offered during account discovery. Paths are in
+// device format (no leading "m/") — exactly what hw-app-eth consumes and
+// what we persist on the account record.
+const PATH_SCHEMES = {
+  live: {
+    label: 'Ledger Live',
+    buildPath: (i) => `44'/60'/${i}'/0/0`,
+  },
+  legacy: {
+    label: 'Legacy (MEW / MyCrypto)',
+    buildPath: (i) => `44'/60'/0'/${i}`,
+  },
+};
+
+// hw-app-eth resolves clear-signing metadata through Ledger's hosted
+// services by default (crypto-assets-service.api.ledger.com,
+// cdn.live.ledger.com, nft.api.live.ledger.com). Those lookups are not
+// limited to `signTransaction`'s opt-in resolution: `signEIP712Message`
+// posts the chain id, the verifying contract and a schema hash of the
+// typed data to the registry on every EIP-712 signature, from the user's
+// IP, before the device is touched — and it does so while this module
+// holds the exclusive device queue, so a hung request stalls all device
+// access. Nulling every service URL makes the library skip the lookups
+// entirely (each call site is guarded by its URL), keeping signing
+// fully offline. Consequence is the same as the signer's null
+// resolution: contract calls show as raw data on the device.
+const OFFLINE_LOAD_CONFIG = {
+  nftExplorerBaseURL: null,
+  pluginBaseURL: null,
+  extraPlugins: null,
+  cryptoassetsBaseURL: null,
+  calServiceURL: null,
+};
+
+let deviceQueue = Promise.resolve();
+
+/**
+ * Run `task` with an open Ethereum app instance, serialized against all
+ * other device access. The transport is always closed afterwards.
+ *
+ * @template T
+ * @param {(eth: import('@ledgerhq/hw-app-eth').default) => Promise<T>} task
+ * @returns {Promise<T>}
+ */
+function withEthApp(task) {
+  const run = deviceQueue.then(async () => {
+    loadLedgerLibs();
+    let transport;
+    try {
+      transport = await TransportNodeHid.open('');
+    } catch (err) {
+      throw mapLedgerError(err);
+    }
+    try {
+      // scrambleKey stays at hw-app-eth's default; the third argument is
+      // the load config that keeps clear-signing lookups offline.
+      return await task(new EthApp(transport, undefined, OFFLINE_LOAD_CONFIG));
+    } catch (err) {
+      throw mapLedgerError(err);
+    } finally {
+      await transport.close().catch(() => {});
+    }
+  });
+  // Keep the queue alive after failures; errors surface to the caller only.
+  deviceQueue = run.catch(() => {});
+  return run;
+}
+
+/**
+ * List addresses on the device for a derivation-path scheme.
+ *
+ * Requires the device to be unlocked with the Ethereum app open;
+ * otherwise rejects with a mapped LEDGER_* error the UI can act on.
+ * Addresses are NOT shown on the device screen during discovery
+ * (`display: false`) — verification on-device happens when the user
+ * confirms their first signature.
+ *
+ * @param {{scheme?: string, start?: number, count?: number}} [options]
+ * @returns {Promise<Array<{path: string, address: string}>>}
+ */
+async function listAccounts({ scheme = 'live', start = 0, count = 5 } = {}) {
+  const pathScheme = PATH_SCHEMES[scheme];
+  if (!pathScheme) {
+    throw new Error(`Unknown derivation scheme: ${scheme}`);
+  }
+  const safeStart = Math.max(0, Math.trunc(start));
+  const safeCount = Math.min(20, Math.max(1, Math.trunc(count)));
+
+  return withEthApp(async (eth) => {
+    const accounts = [];
+    for (let i = safeStart; i < safeStart + safeCount; i++) {
+      const path = pathScheme.buildPath(i);
+      const { address } = await eth.getAddress(path, false);
+      accounts.push({ path, address });
+    }
+    return accounts;
+  });
+}
+
+module.exports = { withEthApp, listAccounts, PATH_SCHEMES, OFFLINE_LOAD_CONFIG };
diff --git a/src/main/wallet/ledger/transport.test.js b/src/main/wallet/ledger/transport.test.js
new file mode 100644
index 00000000..64a85298
--- /dev/null
+++ b/src/main/wallet/ledger/transport.test.js
@@ -0,0 +1,147 @@
+const mockGetAddress = jest.fn();
+const mockClose = jest.fn(async () => {});
+const mockOpen = jest.fn();
+const mockList = jest.fn();
+const mockEthConstructed = jest.fn();
+
+jest.mock('@ledgerhq/hw-transport-node-hid', () => ({
+  default: {
+    open: (...args) => mockOpen(...args),
+    list: (...args) => mockList(...args),
+  },
+}));
+jest.mock('@ledgerhq/hw-app-eth', () => ({
+  default: class MockEth {
+    constructor(transport, scrambleKey, loadConfig) {
+      this.transport = transport;
+      mockEthConstructed({ scrambleKey, loadConfig });
+    }
+    getAddress(...args) {
+      return mockGetAddress(...args);
+    }
+  },
+}));
+
+const { listAccounts, withEthApp, OFFLINE_LOAD_CONFIG } = require('./transport');
+const { LEDGER_ERROR_CODES } = require('./errors');
+
+beforeEach(() => {
+  mockOpen.mockReset().mockResolvedValue({ close: mockClose });
+  mockList.mockReset();
+  mockGetAddress.mockReset();
+  mockClose.mockClear();
+  mockEthConstructed.mockClear();
+});
+
+describe('listAccounts', () => {
+  test('walks the Ledger Live path scheme without on-device display', async () => {
+    mockGetAddress.mockImplementation(async (path) => ({ address: `0xaddr:${path}` }));
+
+    const accounts = await listAccounts({ scheme: 'live', start: 0, count: 3 });
+
+    expect(accounts).toEqual([
+      { path: "44'/60'/0'/0/0", address: "0xaddr:44'/60'/0'/0/0" },
+      { path: "44'/60'/1'/0/0", address: "0xaddr:44'/60'/1'/0/0" },
+      { path: "44'/60'/2'/0/0", address: "0xaddr:44'/60'/2'/0/0" },
+    ]);
+    expect(mockGetAddress).toHaveBeenCalledWith("44'/60'/0'/0/0", false);
+    expect(mockClose).toHaveBeenCalledTimes(1);
+  });
+
+  test('supports the legacy path scheme and paging', async () => {
+    mockGetAddress.mockImplementation(async (path) => ({ address: `0xaddr:${path}` }));
+
+    const accounts = await listAccounts({ scheme: 'legacy', start: 5, count: 2 });
+
+    expect(accounts.map((a) => a.path)).toEqual(["44'/60'/0'/5", "44'/60'/0'/6"]);
+  });
+
+  test('rejects unknown schemes before touching the device', async () => {
+    await expect(listAccounts({ scheme: 'nope' })).rejects.toThrow('Unknown derivation scheme');
+    expect(mockOpen).not.toHaveBeenCalled();
+  });
+
+  test('maps app-not-open APDU errors and still closes the transport', async () => {
+    const apduError = new Error('0x6511');
+    apduError.statusCode = 0x6511;
+    mockGetAddress.mockRejectedValue(apduError);
+
+    await expect(listAccounts()).rejects.toMatchObject({
+      code: LEDGER_ERROR_CODES.ETH_APP_NOT_OPEN,
+    });
+    expect(mockClose).toHaveBeenCalledTimes(1);
+  });
+
+  test('maps transport-open failures to DEVICE_NOT_FOUND', async () => {
+    mockOpen.mockRejectedValue(new Error('cannot open device with path'));
+    await expect(listAccounts()).rejects.toMatchObject({
+      code: LEDGER_ERROR_CODES.DEVICE_NOT_FOUND,
+    });
+  });
+});
+
+describe('hosted clear-signing services', () => {
+  test('every Eth app is built with the offline load config', async () => {
+    mockGetAddress.mockResolvedValue({ address: '0xok' });
+
+    await withEthApp((eth) => eth.getAddress('x', false));
+
+    expect(mockEthConstructed).toHaveBeenCalledTimes(1);
+    expect(mockEthConstructed.mock.calls[0][0].loadConfig).toBe(OFFLINE_LOAD_CONFIG);
+    // scrambleKey stays at hw-app-eth's own default.
+    expect(mockEthConstructed.mock.calls[0][0].scrambleKey).toBeUndefined();
+  });
+
+  test('the offline config nulls every service URL the installed hw-app-eth would call', () => {
+    // Resolved against the library's own defaults: a URL we forget to
+    // null (or one a future version adds) falls back to Ledger's hosted
+    // endpoint and would leak signing metadata off the machine.
+    const { getLoadConfig } = require('@ledgerhq/hw-app-eth/lib/services/ledger/loadConfig');
+    const resolved = getLoadConfig(OFFLINE_LOAD_CONFIG);
+
+    const urlKeys = Object.keys(resolved).filter((key) => /URL$/.test(key));
+    expect(urlKeys.length).toBeGreaterThan(0);
+    for (const key of urlKeys) {
+      expect(resolved[key]).toBeNull();
+    }
+  });
+});
+
+describe('withEthApp serialization', () => {
+  test('device operations run one at a time, in order', async () => {
+    const events = [];
+    let releaseFirst;
+    const firstGate = new Promise((resolve) => {
+      releaseFirst = resolve;
+    });
+
+    const first = withEthApp(async () => {
+      events.push('first:start');
+      await firstGate;
+      events.push('first:end');
+      return 1;
+    });
+    const second = withEthApp(async () => {
+      events.push('second:start');
+      return 2;
+    });
+
+    // Give the second task a chance to (incorrectly) start early.
+    await new Promise((resolve) => setImmediate(resolve));
+    expect(events).toEqual(['first:start']);
+
+    releaseFirst();
+    await expect(Promise.all([first, second])).resolves.toEqual([1, 2]);
+    expect(events).toEqual(['first:start', 'first:end', 'second:start']);
+  });
+
+  test('a failed operation does not wedge the queue', async () => {
+    mockGetAddress.mockRejectedValueOnce(Object.assign(new Error('rejected'), { statusCode: 0x6985 }));
+    await expect(withEthApp((eth) => eth.getAddress('x', false))).rejects.toMatchObject({
+      code: LEDGER_ERROR_CODES.USER_REJECTED,
+    });
+
+    mockGetAddress.mockResolvedValueOnce({ address: '0xok' });
+    await expect(withEthApp((eth) => eth.getAddress('x', false))).resolves.toEqual({ address: '0xok' });
+  });
+});
diff --git a/src/main/wallet/signers.js b/src/main/wallet/signers.js
new file mode 100644
index 00000000..bace7be2
--- /dev/null
+++ b/src/main/wallet/signers.js
@@ -0,0 +1,131 @@
+/**
+ * Signer factory.
+ *
+ * Resolves a wallet index to a signer object so callers never touch raw
+ * private keys. The account's `type` (from vault-meta, see
+ * identity-manager's WALLET_TYPES) picks the backend: vault-backed
+ * mnemonic accounts sign locally with a borrowed key, Ledger accounts
+ * sign on the device.
+ *
+ * Input normalization (0x-hex personal messages → raw bytes, JSON-string
+ * typed data → object) happens once in the factory, so backends always
+ * receive the same shapes. The EIP-712 payload keeps its full dApp wire
+ * shape (EIP712Domain in types) because backends genuinely diverge there:
+ * ethers wants the domain stripped, a Ledger app consumes the full payload.
+ *
+ * Error contract: vault-locked errors keep their identity (check with
+ * `isVaultLockedError`); hardware backends must surface user-rejection
+ * distinctly so approval UIs can tell "declined on device" from failure.
+ */
+
+const { Wallet, computeAddress } = require('ethers');
+
+const { withVaultPrivateKey, isValidWalletIndex } = require('./vault-access');
+const { getWalletRecord, isHardwareWalletIndex, WALLET_TYPES } = require('../identity-manager');
+const { createLedgerBackend } = require('./ledger/signer');
+
+/**
+ * @typedef {Object} Signer
+ * @property {() => Promise<string>} getAddress
+ *   Checksummed address of the account (cached after first resolution).
+ * @property {(tx: object) => Promise<string>} signTransaction
+ *   Complete unsigned tx (nonce, gas, fees, chainId — no population) →
+ *   serialized signed tx.
+ * @property {(message: string|Uint8Array) => Promise<string>} signMessage
+ *   EIP-191 signature over raw bytes (0x-hex is pre-decoded by the factory).
+ * @property {(typedData: object) => Promise<string>} signTypedData
+ *   EIP-712 signature; receives the parsed full payload
+ *   ({domain, types, message}, EIP712Domain in types allowed).
+ */
+
+/** 0x-hex dApp messages are signatures over the bytes, not the hex text. */
+function normalizeMessage(message) {
+  if (typeof message === 'string' && message.startsWith('0x')) {
+    return Buffer.from(message.slice(2), 'hex');
+  }
+  return message;
+}
+
+/** dApps send typed data either as an object or a JSON string. */
+function normalizeTypedData(typedData) {
+  return typeof typedData === 'string' ? JSON.parse(typedData) : typedData;
+}
+
+function createVaultBackend(walletIndex) {
+  return {
+    getAddress: () => withVaultPrivateKey(walletIndex, (privateKey) => computeAddress(privateKey)),
+    signTransaction: (tx) =>
+      withVaultPrivateKey(walletIndex, (privateKey) => new Wallet(privateKey).signTransaction(tx)),
+    signMessage: (message) =>
+      withVaultPrivateKey(walletIndex, async (privateKey) => {
+        try {
+          // signMessage applies the EIP-191 prefix
+          return await new Wallet(privateKey).signMessage(message);
+        } catch (err) {
+          throw new Error(`Message signing failed: ${err.message}`, { cause: err });
+        }
+      }),
+    signTypedData: (typedData) =>
+      withVaultPrivateKey(walletIndex, async (privateKey) => {
+        try {
+          const { domain, types, message } = typedData;
+          // ethers computes the domain separator itself
+          const typesWithoutDomain = { ...types };
+          delete typesWithoutDomain.EIP712Domain;
+          return await new Wallet(privateKey).signTypedData(domain, typesWithoutDomain, message);
+        } catch (err) {
+          throw new Error(`Typed data signing failed: ${err.message}`, { cause: err });
+        }
+      }),
+  };
+}
+
+/**
+ * Build a signer for the given wallet index.
+ *
+ * Construction is cheap and does not touch the vault; each method borrows
+ * the key per call, so a locked vault fails at signing time with
+ * `VAULT_LOCKED_MESSAGE` (same behaviour callers relied on before). The
+ * address is memoized after the first successful resolution — it is public
+ * and immutable for a given index, and callers like the send flow need it
+ * (for the nonce) right before signing.
+ *
+ * @param {number} walletIndex
+ * @returns {Signer}
+ */
+function getSigner(walletIndex) {
+  if (!isValidWalletIndex(walletIndex)) {
+    throw new Error('Invalid wallet index');
+  }
+
+  // Unknown mnemonic-range indexes fall through to the vault backend,
+  // which fails with its own vault-derivation errors — the
+  // pre-hardware-wallet behaviour. An unknown index in the *hardware*
+  // range is different: it is a stale reference to a device account that
+  // was deleted (dApp permission, publisher identity, an index replayed
+  // by a dApp), and the vault backend would happily derive a mnemonic key
+  // there. Fail loudly instead.
+  const record = getWalletRecord(walletIndex);
+  if (!record && isHardwareWalletIndex(walletIndex)) {
+    throw new Error('Hardware wallet account no longer exists; reconnect the device');
+  }
+  const backend =
+    record && record.type === WALLET_TYPES.LEDGER
+      ? createLedgerBackend(record)
+      : createVaultBackend(walletIndex);
+
+  let address = null;
+  return {
+    getAddress: async () => {
+      if (address === null) {
+        address = await backend.getAddress();
+      }
+      return address;
+    },
+    signTransaction: (tx) => backend.signTransaction(tx),
+    signMessage: (message) => backend.signMessage(normalizeMessage(message)),
+    signTypedData: (typedData) => backend.signTypedData(normalizeTypedData(typedData)),
+  };
+}
+
+module.exports = { getSigner };
diff --git a/src/main/wallet/signers.test.js b/src/main/wallet/signers.test.js
new file mode 100644
index 00000000..87ed8222
--- /dev/null
+++ b/src/main/wallet/signers.test.js
@@ -0,0 +1,199 @@
+const { Wallet, Transaction, verifyMessage, verifyTypedData, getBytes } = require('ethers');
+
+// Anvil/Hardhat-default test key — well-known, never funded on mainnet.
+const TEST_PRIVATE_KEY = '0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d';
+const testWallet = new Wallet(TEST_PRIVATE_KEY);
+
+const mockIdentity = {
+  isUnlocked: jest.fn(),
+  exportPrivateKey: jest.fn(),
+};
+const mockResetVaultAutoLockTimer = jest.fn();
+
+const mockGetWalletRecord = jest.fn();
+const mockLedgerBackend = {
+  getAddress: jest.fn(),
+  signTransaction: jest.fn(),
+  signMessage: jest.fn(),
+  signTypedData: jest.fn(),
+};
+const mockCreateLedgerBackend = jest.fn(() => mockLedgerBackend);
+
+jest.mock('../identity-manager', () => ({
+  loadIdentityModule: jest.fn(async () => mockIdentity),
+  getWalletRecord: (...args) => mockGetWalletRecord(...args),
+  // Mirrors identity-manager's HARDWARE_INDEX_BASE (inlined: jest.mock
+  // factories may not close over out-of-scope constants).
+  isHardwareWalletIndex: (index) => Number.isInteger(index) && index >= 1000000,
+  WALLET_TYPES: { MNEMONIC: 'mnemonic', LEDGER: 'ledger' },
+}));
+jest.mock('../vault-timer', () => ({
+  resetVaultAutoLockTimer: mockResetVaultAutoLockTimer,
+}));
+jest.mock('./ledger/signer', () => ({
+  createLedgerBackend: (...args) => mockCreateLedgerBackend(...args),
+}));
+
+const { getSigner } = require('./signers');
+
+beforeEach(() => {
+  mockIdentity.isUnlocked.mockReset().mockReturnValue(true);
+  mockIdentity.exportPrivateKey.mockReset().mockReturnValue(TEST_PRIVATE_KEY);
+  mockGetWalletRecord.mockReset().mockReturnValue({ index: 0, name: 'Main Wallet', type: 'mnemonic' });
+  mockResetVaultAutoLockTimer.mockClear();
+});
+
+describe('getSigner (vault-backed)', () => {
+  test('rejects an invalid wallet index up front', () => {
+    expect(() => getSigner(-1)).toThrow('Invalid wallet index');
+    expect(() => getSigner('0')).toThrow('Invalid wallet index');
+  });
+
+  test('getAddress resolves the address for the wallet index', async () => {
+    const signer = getSigner(0);
+    await expect(signer.getAddress()).resolves.toBe(testWallet.address);
+    expect(mockIdentity.exportPrivateKey).toHaveBeenCalledWith(0);
+  });
+
+  test('signMessage matches ethers Wallet.signMessage for plain text', async () => {
+    const signer = getSigner(0);
+    const signature = await signer.signMessage('hello freedom');
+    expect(signature).toBe(await testWallet.signMessage('hello freedom'));
+    expect(verifyMessage('hello freedom', signature)).toBe(testWallet.address);
+  });
+
+  test.each([
+    ['hex-encoded text', '0x48656c6c6f'],
+    ['binary data that is not valid UTF-8', '0xfffefd00010203deadbeef'],
+    ['a 32-byte hash', '0x' + 'ab'.repeat(32)],
+  ])('signMessage treats 0x-hex input as raw bytes: %s', async (_label, hexMessage) => {
+    const signer = getSigner(0);
+    const signature = await signer.signMessage(hexMessage);
+    expect(signature).toBe(await testWallet.signMessage(getBytes(hexMessage)));
+    expect(verifyMessage(getBytes(hexMessage), signature)).toBe(testWallet.address);
+  });
+
+  test('signTypedData accepts a full EIP-712 payload including EIP712Domain in types', async () => {
+    const signer = getSigner(0);
+    const domain = { name: 'Test', version: '1', chainId: 1 };
+    const types = {
+      EIP712Domain: [
+        { name: 'name', type: 'string' },
+        { name: 'version', type: 'string' },
+        { name: 'chainId', type: 'uint256' },
+      ],
+      Mail: [
+        { name: 'contents', type: 'string' },
+      ],
+    };
+    const message = { contents: 'gm' };
+
+    const signature = await signer.signTypedData({ domain, types, primaryType: 'Mail', message });
+    expect(verifyTypedData(domain, { Mail: types.Mail }, message, signature)).toBe(testWallet.address);
+
+    // dApps also send the payload as a JSON string (eth_signTypedData_v4)
+    const fromJson = await signer.signTypedData(JSON.stringify({ domain, types, primaryType: 'Mail', message }));
+    expect(fromJson).toBe(signature);
+  });
+
+  test('getAddress memoizes: repeated calls borrow the vault key once', async () => {
+    const signer = getSigner(0);
+    await signer.getAddress();
+    await signer.getAddress();
+    expect(mockIdentity.exportPrivateKey).toHaveBeenCalledTimes(1);
+  });
+
+  test('signTransaction returns a serialized signed tx recoverable to the wallet', async () => {
+    const signer = getSigner(0);
+    const signedTx = await signer.signTransaction({
+      to: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+      value: '1000',
+      gasLimit: '21000',
+      maxFeePerGas: '2000000000',
+      maxPriorityFeePerGas: '1000000000',
+      nonce: 7,
+      chainId: 8453,
+      type: 2,
+    });
+
+    const parsed = Transaction.from(signedTx);
+    expect(parsed.from).toBe(testWallet.address);
+    expect(parsed.nonce).toBe(7);
+    expect(parsed.chainId).toBe(8453n);
+    expect(parsed.to).toBe('0x209693Bc6afc0C5328bA36FaF03C514EF312287C');
+  });
+
+  test('every method rejects when the vault is locked', async () => {
+    mockIdentity.isUnlocked.mockReturnValue(false);
+    const signer = getSigner(0);
+    await expect(signer.getAddress()).rejects.toThrow(/locked/i);
+    await expect(signer.signMessage('x')).rejects.toThrow(/locked/i);
+    await expect(signer.signTypedData({ domain: {}, types: {}, message: {} })).rejects.toThrow(/locked/i);
+    await expect(signer.signTransaction({ chainId: 1 })).rejects.toThrow(/locked/i);
+    expect(mockResetVaultAutoLockTimer).not.toHaveBeenCalled();
+  });
+
+  test('successful signing resets the vault auto-lock timer', async () => {
+    const signer = getSigner(0);
+    await signer.signMessage('keep the vault alive');
+    expect(mockResetVaultAutoLockTimer).toHaveBeenCalledTimes(1);
+  });
+
+  test('an unknown wallet record falls through to the vault backend', async () => {
+    mockGetWalletRecord.mockReturnValue(null);
+    const signer = getSigner(3);
+    await expect(signer.getAddress()).resolves.toBe(testWallet.address);
+    expect(mockIdentity.exportPrivateKey).toHaveBeenCalledWith(3);
+  });
+});
+
+describe('getSigner (ledger-backed dispatch)', () => {
+  const LEDGER_RECORD = {
+    index: 2,
+    name: 'My Stax',
+    address: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+    type: 'ledger',
+    path: "44'/60'/0'/0/0",
+  };
+
+  beforeEach(() => {
+    mockGetWalletRecord.mockReturnValue(LEDGER_RECORD);
+    mockLedgerBackend.getAddress.mockReset().mockResolvedValue(LEDGER_RECORD.address);
+    mockLedgerBackend.signTransaction.mockReset().mockResolvedValue('0xsignedtx');
+    mockLedgerBackend.signMessage.mockReset().mockResolvedValue('0xsig');
+    mockLedgerBackend.signTypedData.mockReset().mockResolvedValue('0xsig712');
+    mockCreateLedgerBackend.mockClear();
+  });
+
+  test('routes to the ledger backend built from the wallet record, never the vault', async () => {
+    const signer = getSigner(2);
+    await expect(signer.getAddress()).resolves.toBe(LEDGER_RECORD.address);
+    await expect(signer.signTransaction({ chainId: 1 })).resolves.toBe('0xsignedtx');
+    expect(mockCreateLedgerBackend).toHaveBeenCalledWith(LEDGER_RECORD);
+    expect(mockIdentity.isUnlocked).not.toHaveBeenCalled();
+    expect(mockIdentity.exportPrivateKey).not.toHaveBeenCalled();
+  });
+
+  test('factory-level normalization applies to ledger backends too', async () => {
+    const signer = getSigner(2);
+
+    // 0x-hex message reaches the backend as raw bytes
+    await signer.signMessage('0x48656c6c6f');
+    expect(mockLedgerBackend.signMessage).toHaveBeenCalledWith(Buffer.from('Hello', 'utf8'));
+
+    // JSON-string typed data reaches the backend parsed
+    await signer.signTypedData('{"domain":{},"types":{},"message":{}}');
+    expect(mockLedgerBackend.signTypedData).toHaveBeenCalledWith({ domain: {}, types: {}, message: {} });
+  });
+
+  test('a deleted hardware account fails loudly instead of falling through to the vault', async () => {
+    // Deleting a Ledger leaves no record, so the type check can't fire.
+    // A stale reference to its index (dApp permission, publisher identity)
+    // must not reach the vault backend, which would derive and sign with a
+    // phantom mnemonic key at that index.
+    mockGetWalletRecord.mockReturnValue(null);
+    expect(() => getSigner(1000000)).toThrow('Hardware wallet account no longer exists');
+    expect(mockIdentity.exportPrivateKey).not.toHaveBeenCalled();
+    expect(mockCreateLedgerBackend).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/main/wallet/transaction-service.js b/src/main/wallet/transaction-service.js
index 79fc770b..9c81ba30 100644
--- a/src/main/wallet/transaction-service.js
+++ b/src/main/wallet/transaction-service.js
@@ -1,11 +1,12 @@
 /**
  * Transaction Service
  *
- * Handles gas estimation, transaction building, signing, and broadcasting.
- * Uses the vault's derived keys for signing.
+ * Handles gas estimation, transaction building, and broadcasting.
+ * Signing is delegated to a Signer (see ./signers.js), so this module
+ * never touches key material.
  */
 
-const { parseUnits, formatUnits, Interface, Wallet } = require('ethers');
+const { parseUnits, formatUnits, Interface } = require('ethers');
 const { getProvider, withRetry } = require('./provider-manager');
 const { getTxExplorerUrl } = require('./chains');
 
@@ -178,7 +179,54 @@ function buildTransaction({
 }
 
 /**
- * Sign and broadcast a transaction
+ * Fill in fee parameters the caller didn't supply.
+ *
+ * ethers' Wallet.sendTransaction used to populate missing fees from the
+ * network before signing. Now that signing and broadcasting are separate
+ * steps nothing does, so an unpriced tx would be signed with
+ * maxFeePerGas = 0 and rejected by every node as underpriced — on a
+ * hardware wallet, only after the user confirmed it on-device. Populate
+ * (or refuse) here, before the signer is ever asked to sign.
+ *
+ * @param {Object} params
+ * @returns {Promise<{maxFeePerGas?: string, maxPriorityFeePerGas?: string, gasPrice?: string}>}
+ */
+async function resolveFeeParams({ maxFeePerGas, maxPriorityFeePerGas, gasPrice, chainId }) {
+  if ((maxFeePerGas && maxPriorityFeePerGas) || gasPrice) {
+    return { maxFeePerGas, maxPriorityFeePerGas, gasPrice };
+  }
+
+  const fees = await getGasPrices(chainId);
+
+  if (fees.type === 'eip1559' && isPositiveFee(fees.maxFeePerGas) && isPositiveFee(fees.maxPriorityFeePerGas)) {
+    return { maxFeePerGas: fees.maxFeePerGas, maxPriorityFeePerGas: fees.maxPriorityFeePerGas };
+  }
+  if (isPositiveFee(fees.gasPrice)) {
+    return { gasPrice: fees.gasPrice };
+  }
+
+  throw new Error('Unable to determine a gas price for this transaction. Please try again.');
+}
+
+function isPositiveFee(value) {
+  try {
+    return value !== undefined && value !== null && BigInt(value) > 0n;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Sign and broadcast a transaction.
+ *
+ * Signing and broadcasting are separate steps so the signer can be
+ * anything implementing the signer interface (vault key, hardware
+ * device) — the provider only ever sees the serialized signed tx.
+ *
+ * Fee parameters are optional: when the caller supplies none they are
+ * fetched from the network (see resolveFeeParams) rather than signed as
+ * zero.
+ *
  * @param {Object} params - Transaction parameters
  * @param {string} params.to - Recipient (or token contract for ERC-20)
  * @param {string} params.value - Value in wei
@@ -188,10 +236,10 @@ function buildTransaction({
  * @param {string} [params.maxPriorityFeePerGas] - Max priority fee (EIP-1559)
  * @param {string} [params.gasPrice] - Gas price (legacy)
  * @param {number} params.chainId - Chain ID
- * @param {string} privateKey - Private key for signing (0x-prefixed)
+ * @param {import('./signers').Signer} signer - Signer for the sending account
  * @returns {Promise<Object>} Transaction result
  */
-async function signAndSendTransaction(params, privateKey) {
+async function signAndSendTransaction(params, signer) {
   const { to, value, data, gasLimit, maxFeePerGas, maxPriorityFeePerGas, gasPrice, chainId } = params;
 
   const provider = getProvider(chainId);
@@ -199,12 +247,15 @@ async function signAndSendTransaction(params, privateKey) {
     throw new Error(`No provider available for chain ${chainId}`);
   }
 
+  // Outside the try: fee-resolution failures should surface as-is instead
+  // of being remapped to the generic "gas estimation" message below.
+  const fees = await resolveFeeParams({ maxFeePerGas, maxPriorityFeePerGas, gasPrice, chainId });
+
   try {
-    // Create wallet from private key
-    const wallet = new Wallet(privateKey, provider);
+    const from = await signer.getAddress();
 
     // Get nonce
-    const nonce = await withRetry(() => provider.getTransactionCount(wallet.address, 'pending'), 2, chainId);
+    const nonce = await withRetry(() => provider.getTransactionCount(from, 'pending'), 2, chainId);
 
     // Build transaction
     const tx = buildTransaction({
@@ -212,9 +263,9 @@ async function signAndSendTransaction(params, privateKey) {
       value,
       data,
       gasLimit,
-      maxFeePerGas,
-      maxPriorityFeePerGas,
-      gasPrice,
+      maxFeePerGas: fees.maxFeePerGas,
+      maxPriorityFeePerGas: fees.maxPriorityFeePerGas,
+      gasPrice: fees.gasPrice,
       nonce,
       chainId,
     });
@@ -227,8 +278,8 @@ async function signAndSendTransaction(params, privateKey) {
       nonce: tx.nonce,
     });
 
-    // Sign and send
-    const txResponse = await wallet.sendTransaction(tx);
+    const signedTx = await signer.signTransaction(tx);
+    const txResponse = await provider.broadcastTransaction(signedTx);
 
     console.log('[TransactionService] Transaction sent:', txResponse.hash);
 
@@ -339,64 +390,6 @@ async function waitForTransaction(txHash, chainId, confirmations = 1) {
   }
 }
 
-/**
- * Sign a personal message (EIP-191)
- * @param {string} message - Message to sign (hex string or UTF-8)
- * @param {string} privateKey - Private key for signing
- * @returns {Promise<string>} Signature (hex string)
- */
-async function signPersonalMessage(message, privateKey) {
-  try {
-    const wallet = new Wallet(privateKey);
-
-    // If message is hex-encoded, convert to raw bytes (not UTF-8 string)
-    let messageToSign = message;
-    if (message.startsWith('0x')) {
-      messageToSign = Buffer.from(message.slice(2), 'hex');
-    }
-
-    // signMessage automatically applies EIP-191 prefix
-    const signature = await wallet.signMessage(messageToSign);
-
-    console.log('[TransactionService] Message signed');
-    return signature;
-  } catch (err) {
-    console.error('[TransactionService] Message signing failed:', err);
-    throw new Error(`Message signing failed: ${err.message}`, { cause: err });
-  }
-}
-
-/**
- * Sign typed data (EIP-712)
- * @param {Object} typedData - EIP-712 typed data object
- * @param {string} privateKey - Private key for signing
- * @returns {Promise<string>} Signature (hex string)
- */
-async function signTypedData(typedData, privateKey) {
-  try {
-    const wallet = new Wallet(privateKey);
-
-    // Parse if string
-    const data = typeof typedData === 'string' ? JSON.parse(typedData) : typedData;
-
-    // Extract domain, types, and message from EIP-712 structure
-    const { domain, types, message } = data;
-
-    // Remove EIP712Domain from types (ethers handles it internally)
-    const typesWithoutDomain = { ...types };
-    delete typesWithoutDomain.EIP712Domain;
-
-    // Sign using ethers' signTypedData
-    const signature = await wallet.signTypedData(domain, typesWithoutDomain, message);
-
-    console.log('[TransactionService] Typed data signed');
-    return signature;
-  } catch (err) {
-    console.error('[TransactionService] Typed data signing failed:', err);
-    throw new Error(`Typed data signing failed: ${err.message}`, { cause: err });
-  }
-}
-
 module.exports = {
   estimateGas,
   getGasPrices,
@@ -407,6 +400,4 @@ module.exports = {
   signAndSendTransaction,
   getTransactionStatus,
   waitForTransaction,
-  signPersonalMessage,
-  signTypedData,
 };
diff --git a/src/main/wallet/transaction-service.test.js b/src/main/wallet/transaction-service.test.js
index 585f9a9d..7bd9efaf 100644
--- a/src/main/wallet/transaction-service.test.js
+++ b/src/main/wallet/transaction-service.test.js
@@ -1,71 +1,165 @@
-const { Wallet, verifyMessage, getBytes } = require('ethers');
-const { signPersonalMessage } = require('./transaction-service');
+const mockGetProvider = jest.fn();
+jest.mock('./provider-manager', () => ({
+  getProvider: (...args) => mockGetProvider(...args),
+  withRetry: (fn) => fn(),
+}));
+jest.mock('./chains', () => ({
+  getTxExplorerUrl: (chainId, hash) => `https://explorer.test/${chainId}/${hash}`,
+}));
+
+const { Wallet, Transaction } = require('ethers');
+const { signAndSendTransaction } = require('./transaction-service');
 
 // Deterministic test key (not a real wallet)
 const TEST_PRIVATE_KEY = '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80';
 const testWallet = new Wallet(TEST_PRIVATE_KEY);
 
-describe('signPersonalMessage', () => {
-  it('signs a plain text message', async () => {
-    const message = 'Hello, this is a test message';
-    const signature = await signPersonalMessage(message, TEST_PRIVATE_KEY);
+describe('signAndSendTransaction (signer-based)', () => {
+  // A signer that signs locally with the test key — mirrors what the
+  // vault signer produces, without the vault plumbing. Ledger signers
+  // implement the same interface, so this proves the sign/broadcast
+  // split works for any signer that can't hand out a raw key.
+  const signer = {
+    getAddress: async () => testWallet.address,
+    signTransaction: (tx) => testWallet.signTransaction(tx),
+  };
 
-    expect(signature).toMatch(/^0x[0-9a-f]{130}$/);
-    // Verify the signature recovers to the correct address
-    const recovered = verifyMessage(message, signature);
-    expect(recovered.toLowerCase()).toBe(testWallet.address.toLowerCase());
+  let broadcastedRaw;
+  beforeEach(() => {
+    broadcastedRaw = null;
+    mockGetProvider.mockReset().mockReturnValue({
+      getTransactionCount: async () => 5,
+      broadcastTransaction: async (raw) => {
+        broadcastedRaw = raw;
+        const parsed = Transaction.from(raw);
+        return {
+          hash: parsed.hash,
+          nonce: parsed.nonce,
+          from: parsed.from,
+          to: parsed.to,
+          value: parsed.value,
+        };
+      },
+    });
   });
 
-  it('signs a hex-encoded text message (0x prefix)', async () => {
-    // "Hello" in hex
-    const hexMessage = '0x48656c6c6f';
-    const signature = await signPersonalMessage(hexMessage, TEST_PRIVATE_KEY);
+  it('fetches the nonce for the signer address, signs, and broadcasts', async () => {
+    const result = await signAndSendTransaction(
+      {
+        to: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+        value: '1000',
+        gasLimit: '21000',
+        maxFeePerGas: '2000000000',
+        maxPriorityFeePerGas: '1000000000',
+        chainId: 8453,
+      },
+      signer,
+    );
+
+    const parsed = Transaction.from(broadcastedRaw);
+    expect(parsed.from).toBe(testWallet.address);
+    expect(parsed.nonce).toBe(5);
+    expect(parsed.chainId).toBe(8453n);
 
-    expect(signature).toMatch(/^0x[0-9a-f]{130}$/);
-    // Verify: ethers.verifyMessage with raw bytes should recover the same address
-    const rawBytes = getBytes(hexMessage);
-    const recovered = verifyMessage(rawBytes, signature);
-    expect(recovered.toLowerCase()).toBe(testWallet.address.toLowerCase());
+    expect(result).toMatchObject({
+      hash: parsed.hash,
+      nonce: 5,
+      from: testWallet.address,
+      to: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+      value: '1000',
+      chainId: 8453,
+      explorerUrl: `https://explorer.test/8453/${parsed.hash}`,
+    });
   });
 
-  it('signs hex-encoded binary data containing non-UTF-8 bytes', async () => {
-    // Arbitrary binary data that is NOT valid UTF-8
-    // 0xff 0xfe are invalid UTF-8 lead bytes
-    const hexMessage = '0xfffefd00010203deadbeef';
-    const signature = await signPersonalMessage(hexMessage, TEST_PRIVATE_KEY);
-
-    expect(signature).toMatch(/^0x[0-9a-f]{130}$/);
-    // Verify the signature matches signing the raw bytes directly
-    const rawBytes = getBytes(hexMessage);
-    const recovered = verifyMessage(rawBytes, signature);
-    expect(recovered.toLowerCase()).toBe(testWallet.address.toLowerCase());
+  it('populates EIP-1559 fees from the network when the caller supplies none', async () => {
+    const provider = mockGetProvider();
+    provider.getFeeData = async () => ({
+      maxFeePerGas: 4_000_000_000n,
+      maxPriorityFeePerGas: 1_000_000_000n,
+      gasPrice: 3_000_000_000n,
+    });
+    provider.getBlock = async () => ({ baseFeePerGas: 2_000_000_000n });
+
+    await signAndSendTransaction(
+      {
+        to: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+        value: '1000',
+        gasLimit: '21000',
+        chainId: 8453,
+      },
+      signer,
+    );
+
+    const parsed = Transaction.from(broadcastedRaw);
+    expect(parsed.type).toBe(2);
+    // 2 * baseFee + priority — never the zero-fee tx every node rejects.
+    expect(parsed.maxFeePerGas).toBe(5_000_000_000n);
+    expect(parsed.maxPriorityFeePerGas).toBe(1_000_000_000n);
   });
 
-  it('signs a hex-encoded hash (32 bytes)', async () => {
-    // A keccak256 hash — common in dApp signing flows
-    const hashMessage = '0x' + 'ab'.repeat(32);
-    const signature = await signPersonalMessage(hashMessage, TEST_PRIVATE_KEY);
+  it('falls back to the legacy gas price when the chain has no EIP-1559 fee data', async () => {
+    const provider = mockGetProvider();
+    provider.getFeeData = async () => ({ maxFeePerGas: null, maxPriorityFeePerGas: null, gasPrice: 7_000_000_000n });
+    provider.getBlock = async () => ({ baseFeePerGas: null });
+
+    await signAndSendTransaction(
+      { to: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C', value: '1', gasLimit: '21000', chainId: 100 },
+      signer,
+    );
+
+    const parsed = Transaction.from(broadcastedRaw);
+    expect(parsed.type).toBe(0);
+    expect(parsed.gasPrice).toBe(7_000_000_000n);
+  });
+
+  it('refuses to sign when the network reports no usable gas price', async () => {
+    const signTransaction = jest.fn();
+    const provider = mockGetProvider();
+    provider.getFeeData = async () => ({ maxFeePerGas: null, maxPriorityFeePerGas: null, gasPrice: 0n });
+    provider.getBlock = async () => ({ baseFeePerGas: null });
+
+    await expect(
+      signAndSendTransaction(
+        { to: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C', value: '1', gasLimit: '21000', chainId: 100 },
+        { ...signer, signTransaction },
+      ),
+    ).rejects.toThrow('Unable to determine a gas price');
 
-    expect(signature).toMatch(/^0x[0-9a-f]{130}$/);
-    const rawBytes = getBytes(hashMessage);
-    const recovered = verifyMessage(rawBytes, signature);
-    expect(recovered.toLowerCase()).toBe(testWallet.address.toLowerCase());
+    // Critically: the device is never asked to confirm an unbroadcastable tx.
+    expect(signTransaction).not.toHaveBeenCalled();
+    expect(broadcastedRaw).toBeNull();
   });
 
-  it('produces matching signatures for hex and equivalent raw bytes', async () => {
-    // Sign "Hello" as plain text hex
-    const hexSig = await signPersonalMessage('0x48656c6c6f', TEST_PRIVATE_KEY);
-    // Sign "Hello" by passing the same bytes through ethers directly
-    const directSig = await testWallet.signMessage(getBytes('0x48656c6c6f'));
+  it('maps insufficient-funds broadcast errors to a friendly message', async () => {
+    mockGetProvider.mockReturnValue({
+      getTransactionCount: async () => 0,
+      broadcastTransaction: async () => {
+        throw new Error('insufficient funds for gas * price + value');
+      },
+    });
 
-    expect(hexSig).toBe(directSig);
+    await expect(
+      signAndSendTransaction(
+        { to: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C', value: '1', gasLimit: '21000', gasPrice: '7', chainId: 1 },
+        signer,
+      ),
+    ).rejects.toThrow('Insufficient funds for transaction');
   });
 
-  it('treats non-0x messages as plain strings', async () => {
-    const message = 'no hex prefix here';
-    const signature = await signPersonalMessage(message, TEST_PRIVATE_KEY);
+  it('surfaces signer rejection (e.g. user declined on device) unchanged', async () => {
+    const decliningSigner = {
+      ...signer,
+      signTransaction: async () => {
+        throw new Error('User rejected on device');
+      },
+    };
 
-    const recovered = verifyMessage(message, signature);
-    expect(recovered.toLowerCase()).toBe(testWallet.address.toLowerCase());
+    await expect(
+      signAndSendTransaction(
+        { to: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C', value: '1', gasLimit: '21000', gasPrice: '7', chainId: 1 },
+        decliningSigner,
+      ),
+    ).rejects.toThrow(/User rejected on device/);
   });
 });
diff --git a/src/main/wallet/tx-recorder.js b/src/main/wallet/tx-recorder.js
index 1e0ea87d..9c1f9c18 100644
--- a/src/main/wallet/tx-recorder.js
+++ b/src/main/wallet/tx-recorder.js
@@ -20,7 +20,7 @@ function toAtomicDecimal(value) {
 
 /**
  * @param {object} params       Same shape as signAndSendTransaction.
- * @param {string} privateKey
+ * @param {import('./signers').Signer} signer
  * @param {object} context
  * @param {string} context.kind         paymentHistory.KINDS member
  * @param {string} [context.origin]     normalised origin (dapp sends only)
@@ -36,8 +36,8 @@ function toAtomicDecimal(value) {
  *                                      you have the real recipient)
  * @param {object} [context.metadata]   free-form per-kind extras
  */
-async function signAndRecord(params, privateKey, context) {
-  const response = await signAndSendTransaction(params, privateKey);
+async function signAndRecord(params, signer, context) {
+  const response = await signAndSendTransaction(params, signer);
 
   let row;
   try {
diff --git a/src/main/wallet/tx-recorder.test.js b/src/main/wallet/tx-recorder.test.js
index bda382db..5277be65 100644
--- a/src/main/wallet/tx-recorder.test.js
+++ b/src/main/wallet/tx-recorder.test.js
@@ -23,6 +23,8 @@ jest.mock('../payment-history', () => ({
 
 const { signAndRecord } = require('./tx-recorder');
 
+const fakeSigner = { getAddress: async () => '0xfrom' };
+
 describe('tx-recorder', () => {
   beforeEach(() => {
     mockSignAndSendTransaction.mockReset().mockResolvedValue({
@@ -44,7 +46,7 @@ describe('tx-recorder', () => {
       to: '0xtoken',
       value: '0',
       chainId: 8453,
-    }, '0xprivate', {
+    }, fakeSigner, {
       kind: 'dapp-send',
       origin: 'https://app.example',
       asset: '0xtoken',
@@ -74,7 +76,7 @@ describe('tx-recorder', () => {
       to: '0xrecipient',
       value: '0x2a',
       chainId: 1,
-    }, '0xprivate', {
+    }, fakeSigner, {
       kind: 'wallet-send',
     });
 
diff --git a/src/main/wallet/vault-access.js b/src/main/wallet/vault-access.js
index 1aa9d70f..4a75e9cc 100644
--- a/src/main/wallet/vault-access.js
+++ b/src/main/wallet/vault-access.js
@@ -16,7 +16,12 @@
  * incidentally by the consolidation.
  */
 
-const { loadIdentityModule } = require('../identity-manager');
+const {
+  loadIdentityModule,
+  getWalletRecord,
+  isHardwareWalletIndex,
+  WALLET_TYPES,
+} = require('../identity-manager');
 const { resetVaultAutoLockTimer } = require('../vault-timer');
 const { VAULT_LOCKED_MESSAGE } = require('./vault-errors');
 
@@ -54,6 +59,19 @@ async function withVaultPrivateKey(walletIndex, callback) {
   if (!isValidWalletIndex(walletIndex)) {
     throw new Error('Invalid wallet index');
   }
+  // Hard stop for non-mnemonic accounts at the key-derivation chokepoint:
+  // deriving a mnemonic key at a hardware account's index would silently
+  // sign with a key whose address the user has never seen.
+  //
+  // The index-range half of the check stands on its own and must come
+  // first: a *deleted* device account has no record at all, and a stale
+  // reference to it (dApp permission, publisher identity, an index from
+  // untrusted renderer code) would otherwise fall through to derivation
+  // at m/44'/60'/<hardware index>'/0/0 — a phantom account.
+  const record = getWalletRecord(walletIndex);
+  if (isHardwareWalletIndex(walletIndex) || (record && record.type !== WALLET_TYPES.MNEMONIC)) {
+    throw new Error('Hardware wallet accounts have no vault key; sign via their device signer');
+  }
   const identity = await loadIdentityModule();
   if (!identity.isUnlocked()) {
     throw new Error(VAULT_LOCKED_MESSAGE);
diff --git a/src/main/wallet/vault-access.test.js b/src/main/wallet/vault-access.test.js
index 6e075695..a49df580 100644
--- a/src/main/wallet/vault-access.test.js
+++ b/src/main/wallet/vault-access.test.js
@@ -3,9 +3,15 @@ const mockIdentity = {
   exportPrivateKey: jest.fn(),
 };
 const mockResetVaultAutoLockTimer = jest.fn();
+const mockGetWalletRecord = jest.fn();
 
 jest.mock('../identity-manager', () => ({
   loadIdentityModule: jest.fn(async () => mockIdentity),
+  getWalletRecord: (...args) => mockGetWalletRecord(...args),
+  // Mirrors identity-manager's HARDWARE_INDEX_BASE (inlined: jest.mock
+  // factories may not close over out-of-scope constants).
+  isHardwareWalletIndex: (index) => Number.isInteger(index) && index >= 1000000,
+  WALLET_TYPES: { MNEMONIC: 'mnemonic', LEDGER: 'ledger' },
 }));
 jest.mock('../vault-timer', () => ({
   resetVaultAutoLockTimer: mockResetVaultAutoLockTimer,
@@ -22,6 +28,7 @@ beforeEach(() => {
   // test's tampering to leak into the next.
   mockIdentity.isUnlocked.mockReset().mockReturnValue(true);
   mockIdentity.exportPrivateKey.mockReset().mockReturnValue(TEST_KEY);
+  mockGetWalletRecord.mockReset().mockReturnValue(null);
   mockResetVaultAutoLockTimer.mockClear();
 });
 
@@ -68,6 +75,28 @@ describe('withVaultPrivateKey', () => {
     expect(mockIdentity.exportPrivateKey).toHaveBeenCalledWith(3);
   });
 
+  test('refuses to derive a vault key for a hardware-wallet index', async () => {
+    // The chokepoint guard: even a caller that bypasses the signer
+    // factory must never get a mnemonic key at a ledger account's index.
+    mockGetWalletRecord.mockReturnValue({ index: 3, type: 'ledger', address: '0xstax' });
+    await expect(withVaultPrivateKey(3, () => 'unreachable'))
+      .rejects.toThrow('Hardware wallet accounts have no vault key');
+    expect(mockIdentity.exportPrivateKey).not.toHaveBeenCalled();
+  });
+
+  test('refuses to derive a vault key for a deleted hardware account', async () => {
+    // Deleting a Ledger removes its record, so the record-type guard above
+    // no longer fires. The index range must be decisive on its own —
+    // otherwise a stale reference (dApp permission, publisher identity)
+    // derives a phantom mnemonic key at m/44'/60'/1000000'/0/0 and signs
+    // with an address the user has never seen.
+    mockGetWalletRecord.mockReturnValue(null);
+    await expect(withVaultPrivateKey(1000000, () => 'unreachable'))
+      .rejects.toThrow('Hardware wallet accounts have no vault key');
+    expect(mockIdentity.exportPrivateKey).not.toHaveBeenCalled();
+    expect(mockIdentity.isUnlocked).not.toHaveBeenCalled();
+  });
+
   test.each([
     ['negative', -1],
     ['non-integer', 1.5],
diff --git a/src/main/wallet/wallet-ipc.js b/src/main/wallet/wallet-ipc.js
index 9552f77f..87980bf0 100644
--- a/src/main/wallet/wallet-ipc.js
+++ b/src/main/wallet/wallet-ipc.js
@@ -16,13 +16,11 @@ const {
   parseAmount,
   getTransactionStatus,
   waitForTransaction,
-  signPersonalMessage,
-  signTypedData,
 } = require('./transaction-service');
 const { signAndRecord, KINDS: PAYMENT_KINDS } = require('./tx-recorder');
 const { getActiveWalletIndex } = require('../identity-manager');
 const { getEffectiveRpcUrls } = require('./rpc-manager');
-const { withVaultPrivateKey } = require('./vault-access');
+const { getSigner } = require('./signers');
 
 /**
  * Validate that an RPC URL is a known, trusted endpoint.
@@ -63,12 +61,10 @@ async function handleSendTransaction(walletIndex, params, kind, context = {}) {
     if (!to || chainId === undefined || !gasLimit) {
       return { success: false, error: 'Missing required parameters: to, chainId, gasLimit' };
     }
-    const result = await withVaultPrivateKey(walletIndex, (privateKey) =>
-      signAndRecord(
-        { to, value, data, gasLimit, maxFeePerGas, maxPriorityFeePerGas, gasPrice, chainId },
-        privateKey,
-        buildTxRecordContext(kind, context),
-      )
+    const result = await signAndRecord(
+      { to, value, data, gasLimit, maxFeePerGas, maxPriorityFeePerGas, gasPrice, chainId },
+      getSigner(walletIndex),
+      buildTxRecordContext(kind, context),
     );
     return { success: true, ...result };
   } catch (err) {
@@ -282,9 +278,7 @@ function registerWalletIpc() {
         return { success: false, error: 'Message is required' };
       }
 
-      const signature = await withVaultPrivateKey(walletIndex, (privateKey) =>
-        signPersonalMessage(message, privateKey)
-      );
+      const signature = await getSigner(walletIndex).signMessage(message);
 
       return { success: true, signature };
     } catch (err) {
@@ -300,9 +294,7 @@ function registerWalletIpc() {
         return { success: false, error: 'Typed data is required' };
       }
 
-      const signature = await withVaultPrivateKey(walletIndex, (privateKey) =>
-        signTypedData(typedData, privateKey)
-      );
+      const signature = await getSigner(walletIndex).signTypedData(typedData);
 
       return { success: true, signature };
     } catch (err) {
diff --git a/src/main/wallet/wallet-ipc.test.js b/src/main/wallet/wallet-ipc.test.js
index 40572add..405e421c 100644
--- a/src/main/wallet/wallet-ipc.test.js
+++ b/src/main/wallet/wallet-ipc.test.js
@@ -13,7 +13,7 @@ jest.mock('./tx-recorder', () => ({
 }));
 jest.mock('../identity-manager', () => ({}));
 jest.mock('./rpc-manager', () => ({}));
-jest.mock('./vault-access', () => ({}));
+jest.mock('./signers', () => ({}));
 
 const { buildTxRecordContext } = require('./wallet-ipc');
 
diff --git a/src/main/x402/client.js b/src/main/x402/client.js
index a66cf4a3..e49a5408 100644
--- a/src/main/x402/client.js
+++ b/src/main/x402/client.js
@@ -1,24 +1,23 @@
 /**
- * x402 vault-backed payment client.
+ * x402 payment client.
  *
- * Wires `@x402/core`'s `x402Client` to the freedom-browser vault so payment
- * authorizations get signed inside the existing wallet — no raw keys leave
- * the main process, and the same auto-lock UX that protects dApp signing
- * protects x402 payments.
+ * Wires `@x402/core`'s `x402Client` to the wallet's signer factory so
+ * payment authorizations are signed by whatever backend the wallet index
+ * resolves to (vault key today, hardware wallet later) — no raw keys
+ * leave the main process, and the same auto-lock UX that protects dApp
+ * signing protects x402 payments.
  *
- * Higher layers (the navigation interceptor / interstitial in WP3) call
- * `createVaultBackedX402Client(walletIndex)` after the user has approved a
- * payment, then drive the returned client to produce the `PAYMENT-SIGNATURE`
+ * Higher layers (the navigation interceptor / interstitial) call
+ * `createX402Client(walletIndex)` after the user has approved a payment,
+ * then drive the returned client to produce the `PAYMENT-SIGNATURE`
  * header value.
  */
 
 const { x402Client } = require('@x402/core/client');
 const { ExactEvmScheme } = require('@x402/evm/exact/client');
 const { ExactEvmSchemeV1 } = require('@x402/evm/exact/v1/client');
-const { Wallet } = require('ethers');
 
-const { withVaultPrivateKey } = require('../wallet/vault-access');
-const { signTypedData: signTypedDataWithKey } = require('../wallet/transaction-service');
+const { getSigner } = require('../wallet/signers');
 
 // V1 servers use string network names (not CAIP-2); unknown ones fall
 // through to whichever V2 `accepts[]` entry the server also exposed.
@@ -30,46 +29,30 @@ const { signTypedData: signTypedDataWithKey } = require('../wallet/transaction-s
 const V1_NETWORKS = ['base', 'ethereum'];
 
 /**
- * Build a vault-backed `ClientEvmSigner` for the given wallet index.
- *
- * The returned signer matches `@x402/evm`'s `ClientEvmSigner` shape — just
- * `address` + `signTypedData`. No `readContract` etc., so EIP-2612 / ERC-20-
- * approval extensions aren't supported on this signer; the base USDC /
- * EIP-3009 flow doesn't need them.
- *
- * @param {number} walletIndex
- * @returns {Promise<{ address: string, signTypedData: (msg: object) => Promise<string> }>}
- */
-async function buildVaultSigner(walletIndex) {
-  // Resolve the address once at construction. withVaultPrivateKey also
-  // resets the auto-lock timer, so the typical "build then immediately
-  // sign" flow doesn't race the timeout. Each subsequent signTypedData
-  // call re-runs the same unlock check in case the vault re-locked.
-  const address = await withVaultPrivateKey(walletIndex, (privateKey) =>
-    new Wallet(privateKey).address
-  );
-
-  return {
-    address,
-    signTypedData: (msg) =>
-      withVaultPrivateKey(walletIndex, (privateKey) =>
-        signTypedDataWithKey(msg, privateKey)
-      ),
-  };
-}
-
-/**
- * Construct an `x402Client` whose signing flows through the vault.
+ * Construct an `x402Client` whose signing flows through the wallet's
+ * signer for the given index.
  *
  * Both V2 (CAIP-2, registered with the `eip155:*` glob) and V1 (legacy
  * string network names) schemes are wired so the client can produce
  * payment payloads against either flavour of x402 server.
  *
+ * The schemes receive `@x402/evm`'s `ClientEvmSigner` shape — just
+ * `address` + `signTypedData`. No `readContract` etc., so EIP-2612 /
+ * ERC-20-approval extensions aren't supported; the base USDC / EIP-3009
+ * flow doesn't need them. The address is resolved once at construction —
+ * this also resets the vault auto-lock timer, so the typical "build then
+ * immediately sign" flow doesn't race the timeout; each signTypedData
+ * call re-runs the unlock check in case the vault re-locked.
+ *
  * @param {number} [walletIndex=0]
  * @returns {Promise<import('@x402/core/client').x402Client>}
  */
-async function createVaultBackedX402Client(walletIndex = 0) {
-  const signer = await buildVaultSigner(walletIndex);
+async function createX402Client(walletIndex = 0) {
+  const walletSigner = getSigner(walletIndex);
+  const signer = {
+    address: await walletSigner.getAddress(),
+    signTypedData: walletSigner.signTypedData,
+  };
 
   const client = new x402Client();
   client.register('eip155:*', new ExactEvmScheme(signer));
@@ -83,7 +66,6 @@ async function createVaultBackedX402Client(walletIndex = 0) {
 }
 
 module.exports = {
-  buildVaultSigner,
-  createVaultBackedX402Client,
+  createX402Client,
   V1_NETWORKS,
 };
diff --git a/src/main/x402/client.test.js b/src/main/x402/client.test.js
index a2d3b015..f6b82182 100644
--- a/src/main/x402/client.test.js
+++ b/src/main/x402/client.test.js
@@ -12,14 +12,16 @@ const mockResetVaultAutoLockTimer = jest.fn();
 
 jest.mock('../identity-manager', () => ({
   loadIdentityModule: jest.fn(async () => mockIdentity),
+  getWalletRecord: jest.fn(() => null),
+  isHardwareWalletIndex: (index) => Number.isInteger(index) && index >= 1000000,
+  WALLET_TYPES: { MNEMONIC: 'mnemonic', LEDGER: 'ledger' },
 }));
 jest.mock('../vault-timer', () => ({
   resetVaultAutoLockTimer: mockResetVaultAutoLockTimer,
 }));
 
 const {
-  buildVaultSigner,
-  createVaultBackedX402Client,
+  createX402Client,
   V1_NETWORKS,
 } = require('./client');
 
@@ -29,77 +31,43 @@ beforeEach(() => {
   mockResetVaultAutoLockTimer.mockClear();
 });
 
-// === buildVaultSigner ====================================================
-
-describe('buildVaultSigner', () => {
+describe('createX402Client', () => {
   test('rejects when the vault is locked', async () => {
     mockIdentity.isUnlocked.mockReturnValue(false);
-    await expect(buildVaultSigner(0)).rejects.toThrow(/locked/i);
+    await expect(createX402Client(0)).rejects.toThrow(/locked/i);
   });
 
-  test('exposes the address derived from the wallet index', async () => {
-    const signer = await buildVaultSigner(0);
-    expect(signer.address).toBe(TEST_ADDRESS);
+  test('exposes the signer address on the client so callers can stamp from_address', async () => {
+    const client = await createX402Client(0);
+    expect(client.address).toBe(TEST_ADDRESS);
     expect(mockIdentity.exportPrivateKey).toHaveBeenCalledWith(0);
   });
 
-  test('signTypedData produces a signature recoverable to the wallet address', async () => {
-    // Mirrors the EIP-3009 shape `@x402/evm`'s exact/eip3009 client emits —
-    // the round-trip proves bigint values flow through ethers.signTypedData
-    // without us needing a stringification shim.
-    const signer = await buildVaultSigner(0);
-    const domain = {
-      name: 'USD Coin',
-      version: '2',
-      chainId: 8453,
-      verifyingContract: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
-    };
-    const types = {
-      TransferWithAuthorization: [
-        { name: 'from', type: 'address' },
-        { name: 'to', type: 'address' },
-        { name: 'value', type: 'uint256' },
-        { name: 'validAfter', type: 'uint256' },
-        { name: 'validBefore', type: 'uint256' },
-        { name: 'nonce', type: 'bytes32' },
-      ],
-    };
-    const message = {
-      from: TEST_ADDRESS,
-      to: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
-      value: 10000n,
-      validAfter: 1700000000n,
-      validBefore: 1700000600n,
-      nonce: '0xf3746613c2d920b5fdabc0856f2aeb2d4f88ee6037b8cc5d04a71a4462f13480',
-    };
-
-    const sig = await signer.signTypedData({ domain, types, primaryType: 'TransferWithAuthorization', message });
-    expect(sig).toMatch(/^0x[0-9a-f]{130}$/);
-    expect(verifyTypedData(domain, types, message, sig)).toBe(TEST_ADDRESS);
-    // Twice: once at signer construction (address derivation), once on sign.
-    expect(mockResetVaultAutoLockTimer).toHaveBeenCalledTimes(2);
-  });
-
-  test('signTypedData throws if the vault re-locks between construction and signing', async () => {
-    const signer = await buildVaultSigner(0);
+  test('payment signing throws if the vault re-locks after client construction', async () => {
+    const client = await createX402Client(0);
     mockResetVaultAutoLockTimer.mockClear(); // ignore the construction reset
     mockIdentity.isUnlocked.mockReturnValue(false);
-    await expect(signer.signTypedData({ domain: {}, types: {}, primaryType: 'X', message: {} }))
-      .rejects.toThrow(/locked/i);
+    await expect(client.createPaymentPayload({
+      x402Version: 2,
+      resource: 'https://api.example/article',
+      accepts: [
+        {
+          scheme: 'exact',
+          network: 'eip155:8453',
+          amount: '10000',
+          asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
+          payTo: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+          maxTimeoutSeconds: 60,
+          resource: 'https://api.example/article',
+          extra: { name: 'USD Coin', version: '2' },
+        },
+      ],
+    })).rejects.toThrow(/locked/i);
     expect(mockResetVaultAutoLockTimer).not.toHaveBeenCalled();
   });
-});
-
-// === createVaultBackedX402Client =========================================
-
-describe('createVaultBackedX402Client', () => {
-  test('exposes the signer address on the client so callers can stamp from_address', async () => {
-    const client = await createVaultBackedX402Client(0);
-    expect(client.address).toBe(TEST_ADDRESS);
-  });
 
   test('returns an x402Client with V2 and V1 schemes wired', async () => {
-    const client = await createVaultBackedX402Client(0);
+    const client = await createX402Client(0);
 
     // selectPaymentRequirements returns the picked accepts[] entry; assert
     // on its scheme + network to prove the right scheme was matched, not
@@ -142,7 +110,7 @@ describe('createVaultBackedX402Client', () => {
   });
 
   test('produces a verifiable V2 payment payload end-to-end (Base / USDC)', async () => {
-    const client = await createVaultBackedX402Client(0);
+    const client = await createX402Client(0);
 
     // Shape of the parsed `PAYMENT-REQUIRED` header for a Base USDC 402.
     const paymentRequired = {
diff --git a/src/main/x402/intercept.js b/src/main/x402/intercept.js
index 0ad94d74..d256f37f 100644
--- a/src/main/x402/intercept.js
+++ b/src/main/x402/intercept.js
@@ -423,6 +423,9 @@ function setPendingApproval(detectionId, ctx) {
       webContentsId: ctx.webContentsId,
       url: ctx.url,
       requirements: ctx.requirements,
+      // Bound while the webview is alive so the TTL message still reaches
+      // the sidebar if the tab has gone in the meantime.
+      notifyHost: ctx.notifyHost ?? hostSenderFor(ctx.webContentsId),
       timer,
     });
   });
@@ -467,7 +470,7 @@ function expirePendingApproval(detectionId) {
   }
   const reason = new Error('approval expired');
   entry.reject(reason);
-  sendToHost(entry.webContentsId, 'x402:approval-result', {
+  entry.notifyHost('x402:approval-result', {
     detectionId,
     success: false,
     error: 'Approval expired. Reload the resource to retry.',
@@ -537,7 +540,39 @@ function finalizeAwaitingResponsesForWebContents(webContentsId, cleanupReason) {
   }
 }
 
+/**
+ * Tell the sidebar that every approval card bound to this tab is dead.
+ *
+ * Aborting the pending-approval entries is not enough: a card whose Pay
+ * click already went through has NO entry left (the IPC settled it) and
+ * is sitting on an open-ended device confirmation, holding the sidebar's
+ * signature-flight lock. That lock is released only by an
+ * `x402:approval-result`, so if the tab dies mid-signature the sidebar
+ * stays locked for the rest of the session. `cancelled` tells the card
+ * the request itself is gone — tear down rather than offer a retry
+ * against a detection nothing can settle.
+ */
+function notifyApprovalCardsCancelled(webContentsId, error) {
+  const detectionIds = new Set();
+  const detected = detectedPayments.get(webContentsId);
+  if (detected?.detectionId) detectionIds.add(detected.detectionId);
+  for (const [detectionId, entry] of pendingApprovals) {
+    if (entry.webContentsId === webContentsId) detectionIds.add(detectionId);
+  }
+  if (detectionIds.size === 0) return;
+  const notify = hostSenderFor(webContentsId);
+  for (const detectionId of detectionIds) {
+    notify('x402:approval-result', {
+      detectionId,
+      success: false,
+      cancelled: true,
+      error,
+    });
+  }
+}
+
 function cleanupWebContents(webContentsId) {
+  notifyApprovalCardsCancelled(webContentsId, 'The tab that requested this payment was closed.');
   detectedPayments.delete(webContentsId);
   pendingUnlockResume.delete(webContentsId);
   // Abort any in-flight awaits for this tab — without this the detector
@@ -552,6 +587,11 @@ function cleanupWebContents(webContentsId) {
   }
   finalizeAwaitingResponsesForWebContents(webContentsId, 'tab destroyed');
   deleteByWebContents(requestContext, webContentsId);
+  // Last event for this tab has gone out — drop the host binding so the
+  // map doesn't grow one entry per tab over the session. A signature
+  // still on the device keeps its own reference to the bound sender, so
+  // its result event survives this.
+  hostSenders.delete(webContentsId);
 }
 
 // === Header parsing ======================================================
@@ -641,14 +681,53 @@ function isStatus2xx(statusLine) {
 // owns the sidebar). The webview that hit the 402 is a child of the
 // host webContents; sending to host puts the event in front of the
 // wallet sidebar UI.
+//
+// The host is resolved THROUGH the webview, so once the tab is closed
+// `webContents.fromId()` returns nothing and every later event for that
+// tab is dropped — including `x402:approval-result`, the sidebar's only
+// release for a signature already sitting on the device. The shell that
+// owns the card outlives its tabs, so we remember the host we resolved
+// while the webview was alive and fall back to it once the live lookup
+// fails. Remembered hosts are dropped in `cleanupWebContents`, after the
+// tab's last event has gone out; a sender bound earlier (the detector's,
+// for a signature still on the device) keeps its own reference.
+const hostSenders = new Map();
+
+function resolveHost(webviewWebContentsId) {
+  return webContents.fromId(webviewWebContentsId)?.hostWebContents ?? null;
+}
+
+/**
+ * Bind a sender for one webview. Call it while the webview is still alive
+ * (the detector does, at detection time) and the events it fires later
+ * survive the tab being closed.
+ */
+function hostSenderFor(webviewWebContentsId) {
+  let remembered = resolveHost(webviewWebContentsId) ?? hostSenders.get(webviewWebContentsId);
+  if (remembered) hostSenders.set(webviewWebContentsId, remembered);
+  return (channel, payload) => {
+    // Live lookup wins — the remembered host is only a fallback for a
+    // webview that has since gone away.
+    const live = resolveHost(webviewWebContentsId);
+    if (live) {
+      remembered = live;
+      hostSenders.set(webviewWebContentsId, live);
+    }
+    const host = live ?? remembered;
+    if (!host || host.isDestroyed?.()) {
+      log.warn(`[x402] no host webContents for ${webviewWebContentsId}; ${channel} dropped`);
+      return;
+    }
+    host.send(channel, payload);
+  };
+}
+
 function sendToHost(webviewWebContentsId, channel, payload) {
-  const wc = webContents.fromId(webviewWebContentsId);
-  const host = wc?.hostWebContents;
-  if (!host) {
-    log.warn(`[x402] no host webContents for ${webviewWebContentsId}; ${channel} dropped`);
-    return;
-  }
-  host.send(channel, payload);
+  hostSenderFor(webviewWebContentsId)(channel, payload);
+}
+
+function clearAllHostSenders() {
+  hostSenders.clear();
 }
 
 // === Dispatcher handlers =================================================
@@ -891,10 +970,16 @@ async function detectPaymentRequiredHandler(details) {
     ...detectedPayments.get(details.webContentsId),
     detectionId,
   });
+  // Bind the sidebar's host once, here, while the webview is certainly
+  // alive: the sign below is an open-ended device confirmation and the
+  // card holds the sidebar's signature lock until its result event
+  // arrives, so that event must not be addressed through a tab the user
+  // can close in the meantime.
+  const notifyHost = hostSenderFor(details.webContentsId);
   // Event payload includes `resourceType` so the renderer can pick the
   // right teardown IPC (subresource → x402:reject; mainFrame → x402:cancel
   // which also goBacks the webview).
-  sendToHost(details.webContentsId, 'x402:approval-needed', {
+  notifyHost('x402:approval-needed', {
     webContentsId: details.webContentsId,
     detectionId,
     url: details.url,
@@ -924,6 +1009,7 @@ async function detectPaymentRequiredHandler(details) {
         webContentsId: details.webContentsId,
         url: details.url,
         requirements,
+        notifyHost,
       });
     } catch (err) {
       if (err?.message && /aborted|cancelled/i.test(err.message)) {
@@ -956,7 +1042,7 @@ async function detectPaymentRequiredHandler(details) {
         grant: decision.grant,
       });
       log.info(`[x402:approval] subresource ${sanitizeUrlForLog(details.url)} signed; returning 307`);
-      sendToHost(details.webContentsId, 'x402:approval-result', {
+      notifyHost('x402:approval-result', {
         detectionId,
         success: true,
       });
@@ -977,7 +1063,7 @@ async function detectPaymentRequiredHandler(details) {
           `${err.message}\n  stack: ${err.stack}`
         );
       }
-      sendToHost(details.webContentsId, 'x402:approval-result', {
+      notifyHost('x402:approval-result', {
         detectionId,
         success: false,
         error: err.message,
@@ -1185,5 +1271,6 @@ module.exports = {
   abortPendingApproval,
   abortPendingApprovalsForTab,
   clearAllPendingApprovals,
+  clearAllHostSenders,
   cleanupWebContents,
 };
diff --git a/src/main/x402/intercept.test.js b/src/main/x402/intercept.test.js
index b1cc30e9..f44a7e69 100644
--- a/src/main/x402/intercept.test.js
+++ b/src/main/x402/intercept.test.js
@@ -41,6 +41,7 @@ jest.mock('./permissions', () => ({
   tryConsume: (...args) => mockTryConsume(...args),
 }));
 
+const { webContents } = require('electron');
 const { VAULT_LOCKED_MESSAGE } = require('../wallet/vault-errors');
 const {
   X402_HEADERS,
@@ -67,6 +68,7 @@ const {
   settlePendingApproval,
   abortPendingApproval,
   clearAllPendingApprovals,
+  clearAllHostSenders,
   cleanupWebContents,
 } = require('./intercept');
 
@@ -87,6 +89,10 @@ beforeEach(() => {
   clearAllPendingUnlockResume();
   clearAllPendingUnlockWaits();
   clearAllPendingApprovals();
+  clearAllHostSenders();
+  webContents.fromId.mockReset().mockImplementation(() => ({
+    hostWebContents: { send: mockHostSend },
+  }));
   mockRegister.mockClear();
   mockAppendReceipt.mockReset();
   mockHostSend.mockClear();
@@ -649,6 +655,89 @@ describe('approval-card subresource path (await user decision, then 307)', () =>
     });
   });
 
+  // The sidebar's signature-flight lock is released ONLY by
+  // x402:approval-result. Addressing that event through the paying tab's
+  // webContents (the old sendToHost) meant closing the tab while the
+  // device prompt was up dropped it — leaking the lock and bricking the
+  // whole sidebar until restart. The host is bound at detection time and
+  // outlives the tab, so the settle always lands.
+  test('delivers approval-result after the paying tab is destroyed mid-signature', async () => {
+    let settleSign;
+    mockSignAndQueueRetry.mockReset().mockImplementation(
+      () => new Promise((resolve) => { settleSign = resolve; })
+    );
+
+    const handlerPromise = detectPaymentRequiredHandler(detail());
+    await Promise.resolve();
+    settlePendingApproval('req-1001', { approved: true });
+    await flushRetryMicrotasks();
+    // Signature is on the device: nothing left to abort in main.
+    expect(hasPendingApproval('req-1001')).toBe(false);
+
+    // User closes the paying tab. The guest webContents is gone, so the
+    // tab can no longer be used to find the sidebar's window.
+    cleanupWebContents(7);
+    webContents.fromId.mockReturnValue(undefined);
+    mockHostSend.mockClear();
+
+    settleSign();
+    await handlerPromise;
+
+    expect(mockHostSend).toHaveBeenCalledWith('x402:approval-result', {
+      detectionId: 'req-1001',
+      success: true,
+    });
+  });
+
+  test('destroying the paying tab cancels its card so a held signature lock is released', async () => {
+    let settleSign;
+    mockSignAndQueueRetry.mockReset().mockImplementation(
+      () => new Promise((resolve) => { settleSign = resolve; })
+    );
+
+    const handlerPromise = detectPaymentRequiredHandler(detail());
+    await Promise.resolve();
+    settlePendingApproval('req-1001', { approved: true });
+    await flushRetryMicrotasks();
+    mockHostSend.mockClear();
+
+    cleanupWebContents(7);
+
+    // `cancelled` tells the card to tear down rather than offer a retry
+    // against a detection nothing can settle — and that teardown is what
+    // releases the sidebar, without waiting on the device.
+    expect(mockHostSend).toHaveBeenCalledWith('x402:approval-result', {
+      detectionId: 'req-1001',
+      success: false,
+      cancelled: true,
+      error: 'The tab that requested this payment was closed.',
+    });
+
+    settleSign();
+    await handlerPromise;
+  });
+
+  test('destroying the tab while the user is still deciding cancels the card too', async () => {
+    const handlerPromise = detectPaymentRequiredHandler(detail());
+    await Promise.resolve();
+    expect(hasPendingApproval('req-1001')).toBe(true);
+    mockHostSend.mockClear();
+
+    cleanupWebContents(7);
+
+    expect(mockHostSend).toHaveBeenCalledWith('x402:approval-result', expect.objectContaining({
+      detectionId: 'req-1001',
+      cancelled: true,
+    }));
+    expect(hasPendingApproval('req-1001')).toBe(false);
+    await expect(handlerPromise).resolves.toBeNull();
+  });
+
+  test('a tab with no x402 card in play sends nothing on destroy', () => {
+    cleanupWebContents(99);
+    expect(mockHostSend).not.toHaveBeenCalled();
+  });
+
   test('manual approval preserves captured Range requestShape for the signed retry key', async () => {
     captureRequestContextHandler({
       id: 1001,
diff --git a/src/main/x402/ipc.test.js b/src/main/x402/ipc.test.js
index bd882b17..12653754 100644
--- a/src/main/x402/ipc.test.js
+++ b/src/main/x402/ipc.test.js
@@ -23,7 +23,7 @@ const mockClient = {
 };
 const mockCreateClient = jest.fn(async () => mockClient);
 jest.mock('./client', () => ({
-  createVaultBackedX402Client: (idx) => mockCreateClient(idx),
+  createX402Client: (idx) => mockCreateClient(idx),
 }));
 
 const mockGetActiveWalletIndex = jest.fn(() => 0);
diff --git a/src/main/x402/sign-flow.js b/src/main/x402/sign-flow.js
index 4cbcd920..b92c6859 100644
--- a/src/main/x402/sign-flow.js
+++ b/src/main/x402/sign-flow.js
@@ -18,7 +18,7 @@
 
 const { webContents } = require('electron');
 const log = require('../logger');
-const { createVaultBackedX402Client } = require('./client');
+const { createX402Client } = require('./client');
 const { getActiveWalletIndex } = require('../identity-manager');
 const { normalizeOrigin } = require('../../shared/origin-utils');
 const {
@@ -32,10 +32,38 @@ const {
 const { grant: grantPermission } = require('./permissions');
 const { tupleFromAccept } = require('./payment-utils');
 
+/**
+ * Runway an EIP-3009 authorization must still have when we hand it to the
+ * dispatcher. `@x402/evm`'s exact facilitator rejects anything with
+ * `validBefore < now + 6`, so a payload with less than that left is dead on
+ * arrival however valid the signature is. We gate on the *client's* clock at
+ * sign-completion, but the facilitator re-checks the same rule on *its* clock
+ * seconds later — after the mainFrame re-navigation, the server round-trip and
+ * the server→facilitator verify hop — so matching the bare 6 leaves no margin
+ * for transit or clock skew and can still be refused server-side (the exact
+ * burned-charge case this gate exists to prevent). Keep comfortably above it;
+ * a false positive only re-shows the same "try again" card.
+ */
+const MIN_AUTHORIZATION_RUNWAY_SECONDS = 20;
+
+/**
+ * Seconds left on the signed authorization, or `null` when the payload has
+ * no `validBefore` to check (non-EIP-3009 scheme, or a test double).
+ *
+ * Both the V1 and V2 exact schemes nest the authorization the same way:
+ * `{ payload: { authorization: { validBefore } } }`.
+ */
+function authorizationRunwaySeconds(payload) {
+  const validBefore = Number(payload?.payload?.authorization?.validBefore);
+  if (!Number.isFinite(validBefore)) return null;
+  return validBefore - Math.floor(Date.now() / 1000);
+}
+
 /**
  * Sign the currently-detected payment for `webContentsId` and queue a
  * retry of the original URL. Throws on any failure (vault locked, URL
- * unparseable, client error). Caller decides how to surface the error.
+ * unparseable, client error, an authorization that expired while it was
+ * being confirmed). Caller decides how to surface the error.
  *
  * `opts.detection` lets the caller pass an explicit snapshot of the
  * detection to sign — used by the auto-pay path so a second 402 firing
@@ -90,7 +118,7 @@ async function signAndQueueRetry(webContentsId, opts = {}) {
   catch { throw new Error('Refusing to pay: unparseable URL'); }
   if (!origin) throw new Error('Refusing to pay: unnormalisable origin');
 
-  const client = await createVaultBackedX402Client(getActiveWalletIndex());
+  const client = await createX402Client(getActiveWalletIndex());
   // Pre-filter `accepts[]` down to the chosen entry so the SDK's default
   // first-of-filtered selector signs the right one. Avoids registering a
   // custom paymentRequirementsSelector for what is effectively a one-
@@ -100,6 +128,37 @@ async function signAndQueueRetry(webContentsId, opts = {}) {
     accepts: [selectedAccept],
   });
 
+  // The SDK stamps `validBefore = now + maxTimeoutSeconds` BEFORE it asks the
+  // signer for a signature, and on a hardware wallet that call blocks for as
+  // long as the user takes to review the EIP-712 payload on the device. A
+  // confirmation slower than the server's window (often ~60s) therefore
+  // produces a perfectly valid signature over an already-expired
+  // authorization. Dispatching it burns the charge: the facilitator refuses
+  // it, the server re-402s, the loop guard in intercept.js declines to
+  // re-sign, and a `failed` row lands in payment history after the user
+  // physically confirmed on the device.
+  //
+  // Widening the window instead (inflating `maxTimeoutSeconds` on the accept
+  // we sign) is NOT an option: for x402 v2 the client echoes the selected
+  // requirements back as `payload.accepted`, and @x402/core's server does a
+  // deep-equal against its own advertised accepts — a padded window would be
+  // rejected as a non-matching requirement.
+  //
+  // So bail before anything is stashed or navigated. The detection is still
+  // in the map and no pending payment is armed, which means the caller's
+  // error surfaces on the approval card with Pay live again — a second
+  // device prompt, but no reload and no bogus failure row.
+  const runway = authorizationRunwaySeconds(payload);
+  if (runway !== null && runway < MIN_AUTHORIZATION_RUNWAY_SECONDS) {
+    log.warn(
+      `[x402:sign] authorization expired during signing (${runway}s of runway left); ` +
+      `not dispatching a payment the facilitator will refuse`
+    );
+    throw new Error(
+      'Payment authorization expired while it was being confirmed. Please try again.'
+    );
+  }
+
   const headerValue = Buffer.from(JSON.stringify(payload)).toString('base64');
   const headerName = outgoingHeaderForVersion(detected.requirements.x402Version);
   const tuple = tupleFromAccept(selectedAccept);
diff --git a/src/main/x402/sign-flow.test.js b/src/main/x402/sign-flow.test.js
index 7ff64686..3c4cedbd 100644
--- a/src/main/x402/sign-flow.test.js
+++ b/src/main/x402/sign-flow.test.js
@@ -17,7 +17,7 @@ const mockClient = {
 };
 const mockCreateClient = jest.fn(async () => mockClient);
 jest.mock('./client', () => ({
-  createVaultBackedX402Client: (idx) => mockCreateClient(idx),
+  createX402Client: (idx) => mockCreateClient(idx),
 }));
 
 jest.mock('../identity-manager', () => ({
@@ -164,3 +164,87 @@ describe('signAndQueueRetry — selectedAccept resolution', () => {
     );
   });
 });
+
+// The SDK stamps validBefore before it asks the signer to sign, so a slow
+// on-device confirmation can outlive the authorization. Anything the
+// facilitator would refuse (`validBefore < now + 6`) must not be dispatched.
+describe('signAndQueueRetry — authorization freshness', () => {
+  const nowSeconds = () => Math.floor(Date.now() / 1000);
+
+  function payloadValidUntil(validBefore) {
+    return {
+      x402Version: 2,
+      payload: { authorization: { validBefore: String(validBefore) }, signature: '0xsig' },
+    };
+  }
+
+  function detection() {
+    return {
+      url: 'https://api.example/article',
+      requirements: requirementsWith(baseAccept),
+      resourceType: 'mainFrame',
+    };
+  }
+
+  test('rejects — and stashes nothing — when the device confirmation outlived validBefore', async () => {
+    mockClient.createPaymentPayload.mockResolvedValue(payloadValidUntil(nowSeconds() - 5));
+
+    await expect(signAndQueueRetry(7, { detection: detection() }))
+      .rejects.toThrow(/expired while it was being confirmed/i);
+
+    // No signature armed for the injector, no re-navigation: the doomed
+    // retry that would trip the loop guard never goes out.
+    expect(consumePending(7, 'https://api.example/article')).toBeNull();
+    expect(mockLoadURL).not.toHaveBeenCalled();
+  });
+
+  test('rejects inside the facilitator skew window even though validBefore is future', async () => {
+    mockClient.createPaymentPayload.mockResolvedValue(payloadValidUntil(nowSeconds() + 2));
+
+    await expect(signAndQueueRetry(7, { detection: detection() }))
+      .rejects.toThrow(/expired while it was being confirmed/i);
+  });
+
+  test('keeps the detection so the user can retry from the same card', async () => {
+    // Seed through the real detector — there is no public setter for the
+    // detected-payments map, and this is the entry point production uses.
+    const requirements = {
+      x402Version: 2,
+      resource: { url: 'https://api.example/article' },
+      accepts: [{
+        scheme: 'exact',
+        network: 'eip155:8453',
+        amount: '10000',
+        asset: BASE_USDC,
+        payTo: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+        maxTimeoutSeconds: 60,
+        extra: { name: 'USD Coin', version: '2' },
+      }],
+    };
+    intercept.detectPaymentRequiredHandler({
+      webContentsId: 7,
+      url: 'https://api.example/article',
+      statusLine: 'HTTP/1.1 402 Payment Required',
+      responseHeaders: {
+        'PAYMENT-REQUIRED': [Buffer.from(JSON.stringify(requirements)).toString('base64')],
+      },
+    });
+    expect(intercept.getDetectedPayment(7)).toBeTruthy();
+
+    mockClient.createPaymentPayload.mockResolvedValue(payloadValidUntil(nowSeconds() - 1));
+
+    await expect(signAndQueueRetry(7)).rejects.toThrow(/expired while it was being confirmed/i);
+
+    expect(intercept.getDetectedPayment(7)).toBeTruthy();
+  });
+
+  test('dispatches normally when the authorization still has runway', async () => {
+    mockClient.createPaymentPayload.mockResolvedValue(payloadValidUntil(nowSeconds() + 60));
+
+    await signAndQueueRetry(7, { detection: detection() });
+
+    expect(consumePending(7, 'https://api.example/article')?.requestHeaders['PAYMENT-SIGNATURE'])
+      .toBeDefined();
+    expect(mockLoadURL).toHaveBeenCalledWith('https://api.example/article');
+  });
+});
diff --git a/src/renderer/index.html b/src/renderer/index.html
index 7c509343..85b217a7 100644
--- a/src/renderer/index.html
+++ b/src/renderer/index.html
@@ -1132,6 +1132,15 @@ <h3 class="setup-cta-title">Set Up Your Identity</h3>
                         </svg>
                         <span>Create New Wallet</span>
                       </button>
+                      <button type="button" class="wallet-selector-action" id="wallet-connect-ledger-btn">
+                        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                          <rect x="2" y="8" width="14" height="8" rx="2"/>
+                          <path d="M16 12h3"/>
+                          <path d="M19 10v4"/>
+                          <path d="M6 12h.01M10 12h.01"/>
+                        </svg>
+                        <span>Connect Hardware Wallet</span>
+                      </button>
                     </div>
                   </div>
 
@@ -1698,6 +1707,95 @@ <h4 class="create-wallet-success-title">Wallet Created!</h4>
               </div>
             </div>
 
+            <!-- Connect Ledger sub-screen -->
+            <div id="sidebar-connect-ledger" class="sidebar-subscreen hidden">
+              <div class="subscreen-header">
+                <button type="button" class="subscreen-back-btn" id="connect-ledger-back">
+                  <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                    <polyline points="15 18 9 12 15 6"/>
+                  </svg>
+                  <span>Back</span>
+                </button>
+                <h3 class="subscreen-title">Connect Ledger</h3>
+              </div>
+
+              <!-- Step 1: Detect device -->
+              <div id="connect-ledger-detect" class="subscreen-content hidden">
+                <div class="connect-ledger-illustration">
+                  <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5">
+                    <rect x="2" y="8" width="14" height="8" rx="2"/>
+                    <path d="M16 12h3"/>
+                    <path d="M19 10v4"/>
+                    <path d="M6 12h.01M10 12h.01"/>
+                  </svg>
+                </div>
+                <p class="create-wallet-message">
+                  Connect your Ledger via USB, unlock it with your PIN,
+                  and open the <strong>Ethereum</strong> app.
+                </p>
+                <div id="connect-ledger-status" class="connect-ledger-status">
+                  <span class="connect-ledger-status-spinner"></span>
+                  <span id="connect-ledger-status-text">Looking for your Ledger…</span>
+                </div>
+              </div>
+
+              <!-- Step 2: Pick account -->
+              <div id="connect-ledger-accounts-step" class="subscreen-content hidden">
+                <p class="create-wallet-message">Choose the account to add.</p>
+
+                <div class="connect-ledger-scheme-row">
+                  <label for="connect-ledger-scheme">Derivation path</label>
+                  <!-- Values must match PATH_SCHEMES in src/main/wallet/ledger/transport.js;
+                       main rejects unknown schemes, so drift fails loudly. -->
+                  <select id="connect-ledger-scheme" class="connect-ledger-scheme-select">
+                    <option value="live">Ledger Live</option>
+                    <option value="legacy">Legacy (MEW / MyCrypto)</option>
+                  </select>
+                </div>
+
+                <div id="connect-ledger-account-list" class="connect-ledger-account-list"></div>
+                <button type="button" id="connect-ledger-load-more" class="connect-ledger-load-more">
+                  Show more accounts
+                </button>
+
+                <input type="text" id="connect-ledger-name-input"
+                       class="create-wallet-input"
+                       placeholder="Name (e.g. Ledger Stax)"
+                       maxlength="32"
+                       autocomplete="off">
+
+                <button type="button" id="connect-ledger-submit" class="create-wallet-submit-btn" disabled>
+                  Add Account
+                </button>
+
+                <div id="connect-ledger-error" class="unlock-error hidden"></div>
+              </div>
+
+              <!-- Step 3: Success -->
+              <div id="connect-ledger-success" class="subscreen-content hidden">
+                <div class="create-wallet-success-icon">
+                  <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5">
+                    <circle cx="12" cy="12" r="10"/>
+                    <polyline points="8 12 11 15 16 9"/>
+                  </svg>
+                </div>
+                <h4 class="create-wallet-success-title">Ledger Account Added!</h4>
+
+                <div class="create-wallet-result">
+                  <span class="create-wallet-result-name" id="connect-ledger-result-name"></span>
+                  <code class="create-wallet-result-address" id="connect-ledger-result-address"></code>
+                </div>
+
+                <p class="create-wallet-message">
+                  Transactions from this account are confirmed on your Ledger's screen.
+                </p>
+
+                <button type="button" id="connect-ledger-done" class="create-wallet-done-btn">
+                  Done
+                </button>
+              </div>
+            </div>
+
             <!-- Receive sub-screen -->
             <div id="sidebar-receive" class="sidebar-subscreen hidden">
               <div class="subscreen-header">
@@ -2583,6 +2681,9 @@ <h3 class="subscreen-title">Payment Required</h3>
                       >Auto-pay future payments to this site</span
                     >
                   </label>
+                  <p class="x402-grant-ledger-note hidden" id="x402-approval-ledger-note">
+                    Auto-pay skips this dialog, but every payment still needs a confirmation on your Ledger.
+                  </p>
                   <div class="x402-grant-fields">
                     <div class="x402-grant-field">
                       <label class="x402-grant-field-label" for="x402-approval-grant-cap-input"
diff --git a/src/renderer/lib/sidebar.js b/src/renderer/lib/sidebar.js
index 67b4897a..a5573162 100644
--- a/src/renderer/lib/sidebar.js
+++ b/src/renderer/lib/sidebar.js
@@ -5,8 +5,12 @@
  * Fixed width (320px), toggle open/closed.
  */
 
+import { isSignatureInFlight, onSignatureFlightChange } from './wallet/signature-flight.js';
 import { matchesShortcut } from './shortcuts.js';
 
+// Shown on the disabled chrome so the user knows why it will not respond.
+const IN_FLIGHT_TITLE = 'Finish the confirmation on your device first';
+
 // State
 let isOpen = false;
 let featureEnabled = false;
@@ -62,6 +66,11 @@ export function initSidebar() {
   // Apply initial state (sidebar starts closed)
   applyState();
 
+  // Keep the close/toggle chrome in step with the shared signature lock, so
+  // it is visibly dead while a device confirmation owns the panel rather
+  // than looking clickable and silently refusing.
+  onSignatureFlightChange(applyFlightLock);
+
   // Setup event listeners
   toggleBtn.addEventListener('click', toggle);
 
@@ -94,6 +103,10 @@ function applyFeatureVisibility() {
  */
 export function toggle() {
   if (!featureEnabled) return;
+  // Collapsing is a close: it hides a live device confirmation just as the
+  // X does. Opening is always allowed (it is how the user gets back to a
+  // confirmation the panel is holding).
+  if (isOpen && refuseSidebarClose()) return;
   const wasOpen = isOpen;
   isOpen = !isOpen;
   applyState();
@@ -117,6 +130,22 @@ export function open() {
   }
 }
 
+/**
+ * Refuse a close while a signature is in flight.
+ *
+ * The panel is the surface the approval screen owns: a hardware signature
+ * is a device prompt the renderer cannot recall, so collapsing the sidebar
+ * over it strands the user with an un-recallable prompt and no UI — and the
+ * 'sidebar-closed' event it fires runs the coordinator's closeAllSubscreens()
+ * cascade, which tears the confirmation's neighbours down and un-hides the
+ * identity view underneath it. See wallet/signature-flight.js.
+ */
+function refuseSidebarClose() {
+  if (!isSignatureInFlight()) return false;
+  console.warn('[Sidebar] Not closing: a signature is in flight');
+  return true;
+}
+
 /**
  * Open the sidebar for a consent prompt. Unlike open(), this works when
  * any provider that hosts consent screens here is enabled — the Radicle
@@ -135,6 +164,7 @@ export function openForConsent() {
  * Close the sidebar
  */
 export function close() {
+  if (refuseSidebarClose()) return;
   if (isOpen) {
     isOpen = false;
     applyState();
@@ -157,12 +187,32 @@ export function isFeatureEnabled() {
   return featureEnabled;
 }
 
+/**
+ * Disable the chrome that would collapse the panel while a signature is in
+ * flight. Only while the panel is open: if it is closed the toggle is the
+ * user's way back to the confirmation and must keep working.
+ */
+function applyFlightLock() {
+  const locked = isOpen && isSignatureInFlight();
+
+  if (closeBtn) {
+    closeBtn.disabled = locked;
+    closeBtn.title = locked ? IN_FLIGHT_TITLE : '';
+  }
+  if (toggleBtn) {
+    toggleBtn.disabled = locked;
+    toggleBtn.title = locked ? IN_FLIGHT_TITLE : '';
+  }
+}
+
 /**
  * Apply current state to DOM
  */
 function applyState() {
   if (!sidebar || !toggleBtn) return;
 
+  applyFlightLock();
+
   if (isOpen) {
     sidebar.classList.remove('collapsed');
     toggleBtn.classList.add('active');
diff --git a/src/renderer/lib/sidebar.test.js b/src/renderer/lib/sidebar.test.js
new file mode 100644
index 00000000..5827160e
--- /dev/null
+++ b/src/renderer/lib/sidebar.test.js
@@ -0,0 +1,120 @@
+/**
+ * The sidebar panel is the surface an approval screen owns.
+ *
+ * While a hardware signature is in flight the device prompt cannot be
+ * recalled, so the chrome that would collapse the panel over it — the header
+ * X, the toolbar toggle, Cmd/Ctrl+Shift+W — has to refuse, and has to look
+ * refused. Collapsing also fires 'sidebar-closed', which runs the
+ * coordinator's closeAllSubscreens() cascade over the live confirmation.
+ */
+
+const { createDocument, createElement } = require('../../../test/helpers/fake-dom.js');
+
+const flush = () => new Promise((resolve) => setImmediate(resolve));
+
+async function loadSidebar() {
+  jest.resetModules();
+
+  const elements = {
+    sidebar: createElement('aside', { classes: ['sidebar', 'collapsed'] }),
+    'wallet-toggle-btn': createElement('button'),
+    'sidebar-close': createElement('button'),
+  };
+  const document = createDocument({ elementsById: elements });
+  document.dispatchEvent = jest.fn();
+  global.document = document;
+  global.window = {
+    electronAPI: { getSettings: jest.fn().mockResolvedValue({ enableIdentityWallet: true }) },
+    addEventListener: jest.fn(),
+  };
+  global.CustomEvent = class { constructor(type, init) { this.type = type; Object.assign(this, init); } };
+
+  // Imported after resetModules, so this is the same lock instance the
+  // sidebar module subscribes to.
+  const flight = await import('./wallet/signature-flight.js');
+  const sidebar = await import('./sidebar.js');
+  sidebar.initSidebar();
+  await flush(); // the feature flag resolves asynchronously
+
+  sidebar.open();
+  return { sidebar, flight, elements, document };
+}
+
+const closedEvents = (document) =>
+  document.dispatchEvent.mock.calls.filter(([event]) => event.type === 'sidebar-closed').length;
+
+describe('sidebar ownership during a signature flight', () => {
+  afterEach(() => {
+    delete global.document;
+    delete global.window;
+    delete global.CustomEvent;
+  });
+
+  test('the close button and toolbar toggle go dead for the flight', async () => {
+    const { flight, elements } = await loadSidebar();
+    const request = { id: 'ledger-send' };
+
+    expect(elements['sidebar-close'].disabled).toBe(false);
+    expect(elements['wallet-toggle-btn'].disabled).toBe(false);
+
+    flight.beginSignatureFlight(request);
+    expect(elements['sidebar-close'].disabled).toBe(true);
+    expect(elements['sidebar-close'].title).toMatch(/device/);
+    expect(elements['wallet-toggle-btn'].disabled).toBe(true);
+
+    flight.endSignatureFlight(request);
+    expect(elements['sidebar-close'].disabled).toBe(false);
+    expect(elements['wallet-toggle-btn'].disabled).toBe(false);
+  });
+
+  test('the X, the toggle and the keyboard shortcut cannot collapse a live confirmation', async () => {
+    const { sidebar, flight, elements, document } = await loadSidebar();
+    const warn = jest.spyOn(console, 'warn').mockImplementation(() => {});
+    const before = closedEvents(document);
+
+    flight.beginSignatureFlight({ id: 'ledger-send' });
+
+    elements['sidebar-close'].dispatch('click');
+    elements['wallet-toggle-btn'].dispatch('click');
+    sidebar.close();
+    sidebar.toggle();
+    document.handlers.keydown({ ctrlKey: true, shiftKey: true, key: 'W', preventDefault: jest.fn() });
+
+    expect(sidebar.isVisible()).toBe(true);
+    expect(elements.sidebar.classList.contains('collapsed')).toBe(false);
+    // 'sidebar-closed' is what runs closeAllSubscreens() over the pending
+    // approval screen, so it must not have fired either.
+    expect(closedEvents(document)).toBe(before);
+
+    warn.mockRestore();
+  });
+
+  test('the panel closes normally again once the device has answered', async () => {
+    const { sidebar, flight, elements, document } = await loadSidebar();
+    const request = { id: 'ledger-send' };
+    const before = closedEvents(document);
+
+    flight.beginSignatureFlight(request);
+    flight.endSignatureFlight(request);
+
+    elements['sidebar-close'].dispatch('click');
+
+    expect(sidebar.isVisible()).toBe(false);
+    expect(elements.sidebar.classList.contains('collapsed')).toBe(true);
+    expect(closedEvents(document)).toBe(before + 1);
+  });
+
+  test('a closed panel can still be reopened to reach the confirmation', async () => {
+    const { sidebar, flight, elements } = await loadSidebar();
+    sidebar.close();
+
+    flight.beginSignatureFlight({ id: 'ledger-send' });
+
+    // Nothing to protect while the panel is shut, and the toggle is the way
+    // back to the screen holding the device prompt.
+    expect(elements['wallet-toggle-btn'].disabled).toBe(false);
+    sidebar.toggle();
+    expect(sidebar.isVisible()).toBe(true);
+    expect(elements['wallet-toggle-btn'].disabled).toBe(true);
+  });
+});
diff --git a/src/renderer/lib/wallet-ui.js b/src/renderer/lib/wallet-ui.js
index c051dd71..c706c2d8 100644
--- a/src/renderer/lib/wallet-ui.js
+++ b/src/renderer/lib/wallet-ui.js
@@ -8,6 +8,7 @@
 import { showOnboarding } from './onboarding.js';
 import { open as openSidebarPanel, isFeatureEnabled as isSidebarFeatureEnabled } from './sidebar.js';
 import { walletState } from './wallet/wallet-state.js';
+import { isSignatureInFlight, onSignatureFlightChange } from './wallet/signature-flight.js';
 import { truncateAddress, timeAgo } from './wallet/wallet-utils.js';
 
 // Submodule imports
@@ -26,6 +27,7 @@ import { initChainSwitcher, updateChainSwitcherDisplay, getSelectedChainId, setS
 import { initReceive, closeReceive } from './wallet/receive.js';
 import { initWalletSettings, closeWalletSettings } from './wallet/wallet-settings.js';
 import { initCreateWallet, openCreateWallet, closeCreateWallet } from './wallet/create-wallet.js';
+import { initConnectLedger, openConnectLedger, closeConnectLedger } from './wallet/connect-ledger.js';
 import { initPublishSetup, openPublishSetup, closePublishSetup } from './wallet/publish-setup.js';
 import { initStampManager, closeStampManager } from './wallet/stamp-manager.js';
 import { initChequebookDeposit, closeChequebookDeposit } from './wallet/chequebook-deposit.js';
@@ -85,11 +87,12 @@ export function initWalletUi() {
   initDappSign();
   initSend();
   initExportMnemonic(switchTab);
-  initWalletSelector(openCreateWallet);
+  initWalletSelector(openCreateWallet, openConnectLedger);
   initChainSwitcher();
   initReceive();
   initWalletSettings(switchTab);
   initCreateWallet();
+  initConnectLedger();
   initPublishSetup();
   initStampManager();
   initChequebookDeposit();
@@ -148,6 +151,17 @@ function setupCoordinatorListeners() {
     });
   });
 
+  // The tab bar lives in the always-visible sidebar header, above whatever
+  // approval screen is up, so it gets the same treatment as the close
+  // button: visibly dead while a device confirmation owns the sidebar.
+  const tabs = Array.from(document.querySelectorAll('.sidebar-tab'));
+  onSignatureFlightChange((inFlight) => {
+    tabs.forEach(tab => {
+      tab.disabled = inFlight;
+      tab.title = inFlight ? 'Finish the confirmation on your device first' : '';
+    });
+  });
+
   // Tab switching
   document.querySelectorAll('.sidebar-tab').forEach(tab => {
     tab.addEventListener('click', () => {
@@ -363,6 +377,14 @@ export function openSendFlow({ recipient, chainId, amount } = {}) {
  */
 function switchTab(tabName) {
   if (walletState.viewMode === 'setup') return;
+  // Swapping panels puts the identity view back on screen alongside a live
+  // device confirmation the renderer cannot recall — and the cascade below
+  // would tear that confirmation's neighbours down. The approval screen owns
+  // the sidebar until the device answers (see signature-flight.js).
+  if (isSignatureInFlight()) {
+    console.warn('[WalletUI] Tab not switched: a signature is in flight');
+    return;
+  }
 
   closeAllSubscreens();
 
@@ -385,12 +407,24 @@ function switchTab(tabName) {
 
 /**
  * Close all open sub-screens (proper cleanup)
+ *
+ * Refuses while a signature is in flight. Only closeSend() carries its own
+ * ownership check; every other close* here un-hides the identity view
+ * unconditionally, so running the cascade over a live confirmation would
+ * stack an interactive identity view (with its own unguarded Receive /
+ * Settings / Ledger openers) on top of the device prompt — see
+ * wallet/signature-flight.js.
  */
 function closeAllSubscreens() {
   if (walletState.viewMode === 'setup') return;
+  if (isSignatureInFlight()) {
+    console.warn('[WalletUI] Sub-screens not closed: a signature is in flight');
+    return;
+  }
 
   closeExportMnemonic();
   closeCreateWallet();
+  closeConnectLedger();
   closeReceive();
   closeWalletSettings();
   closeSend();
diff --git a/src/renderer/lib/wallet/chequebook-deposit.js b/src/renderer/lib/wallet/chequebook-deposit.js
index 9b645ba8..422dbe69 100644
--- a/src/renderer/lib/wallet/chequebook-deposit.js
+++ b/src/renderer/lib/wallet/chequebook-deposit.js
@@ -6,6 +6,7 @@
  */
 
 import { walletState, registerScreenHider } from './wallet-state.js';
+import { refuseSubscreenWhileInFlight } from './signature-flight.js';
 import { formatRawTokenBalance } from './wallet-utils.js';
 import { fetchAntJson } from './ant-api.js';
 
@@ -45,6 +46,8 @@ export function initChequebookDeposit() {
 }
 
 export function openChequebookDeposit() {
+  if (refuseSubscreenWhileInFlight('Chequebook deposit screen')) return;
+
   walletState.identityView?.classList.add('hidden');
   depositScreen?.classList.remove('hidden');
 
diff --git a/src/renderer/lib/wallet/connect-ledger.js b/src/renderer/lib/wallet/connect-ledger.js
new file mode 100644
index 00000000..8dfb7baf
--- /dev/null
+++ b/src/renderer/lib/wallet/connect-ledger.js
@@ -0,0 +1,286 @@
+/**
+ * Connect Ledger Module
+ *
+ * "Connect hardware wallet" subscreen: waits for a Ledger with the
+ * Ethereum app open, lists device accounts per derivation scheme, and
+ * adds the chosen one to the wallet list. No vault unlock involved —
+ * the key never leaves the device.
+ */
+
+import { walletState, registerScreenHider } from './wallet-state.js';
+import { refuseSubscreenWhileInFlight } from './signature-flight.js';
+import { loadDerivedWallets, updateWalletSelectorDisplay } from './wallet-selector.js';
+import { refreshBalances } from './balance-display.js';
+import { escapeHtml, truncateAddress } from './wallet-utils.js';
+
+const ACCOUNTS_PER_PAGE = 5;
+const DETECT_POLL_MS = 1500;
+
+// DOM references
+let screen;
+let backBtn;
+let detectView;
+let statusText;
+let accountsView;
+let schemeSelect;
+let accountList;
+let loadMoreBtn;
+let nameInput;
+let submitBtn;
+let errorEl;
+let successView;
+let resultName;
+let resultAddress;
+let doneBtn;
+
+// Flow state
+let detectTimer = null;
+let discoveredAccounts = [];
+let selectedAccount = null;
+let accountAdded = false;
+
+export function initConnectLedger() {
+  screen = document.getElementById('sidebar-connect-ledger');
+  backBtn = document.getElementById('connect-ledger-back');
+  detectView = document.getElementById('connect-ledger-detect');
+  statusText = document.getElementById('connect-ledger-status-text');
+  accountsView = document.getElementById('connect-ledger-accounts-step');
+  schemeSelect = document.getElementById('connect-ledger-scheme');
+  accountList = document.getElementById('connect-ledger-account-list');
+  loadMoreBtn = document.getElementById('connect-ledger-load-more');
+  nameInput = document.getElementById('connect-ledger-name-input');
+  submitBtn = document.getElementById('connect-ledger-submit');
+  errorEl = document.getElementById('connect-ledger-error');
+  successView = document.getElementById('connect-ledger-success');
+  resultName = document.getElementById('connect-ledger-result-name');
+  resultAddress = document.getElementById('connect-ledger-result-address');
+  doneBtn = document.getElementById('connect-ledger-done');
+
+  registerScreenHider(() => {
+    stopDetectLoop();
+    screen?.classList.add('hidden');
+  });
+
+  backBtn?.addEventListener('click', closeConnectLedger);
+  doneBtn?.addEventListener('click', closeConnectLedger);
+  schemeSelect?.addEventListener('change', () => reloadAccounts());
+  loadMoreBtn?.addEventListener('click', () => loadAccountsPage(false));
+  submitBtn?.addEventListener('click', handleAddAccount);
+}
+
+export async function openConnectLedger() {
+  if (refuseSubscreenWhileInFlight('Connect Ledger screen')) return;
+
+  walletState.identityView?.classList.add('hidden');
+  screen?.classList.remove('hidden');
+
+  resetFlowState();
+  showStep('detect');
+  detectTick();
+}
+
+export async function closeConnectLedger() {
+  if (!screen || screen.classList.contains('hidden')) return;
+
+  stopDetectLoop();
+  screen.classList.add('hidden');
+  walletState.identityView?.classList.remove('hidden');
+
+  if (accountAdded) {
+    await loadDerivedWallets();
+    if (walletState.fullAddresses.wallet) {
+      refreshBalances();
+    }
+  }
+}
+
+function resetFlowState() {
+  discoveredAccounts = [];
+  selectedAccount = null;
+  accountAdded = false;
+  if (nameInput) nameInput.value = '';
+  if (accountList) accountList.innerHTML = '';
+  if (submitBtn) {
+    submitBtn.disabled = true;
+    submitBtn.textContent = 'Add Account';
+  }
+  hideError();
+  setStatus('Looking for your Ledger…');
+}
+
+function showStep(step) {
+  detectView?.classList.toggle('hidden', step !== 'detect');
+  accountsView?.classList.toggle('hidden', step !== 'accounts');
+  successView?.classList.toggle('hidden', step !== 'success');
+}
+
+// --- Step 1: detection loop -------------------------------------------
+
+function stopDetectLoop() {
+  if (detectTimer) {
+    clearTimeout(detectTimer);
+    detectTimer = null;
+  }
+}
+
+async function detectTick() {
+  // The screen may have been closed while an IPC call was in flight.
+  if (!screen || screen.classList.contains('hidden')) return;
+
+  const loaded = await loadAccountsPage(true, setStatus);
+  if (loaded) {
+    showStep('accounts');
+  } else {
+    detectTimer = setTimeout(detectTick, DETECT_POLL_MS);
+  }
+}
+
+function setStatus(message) {
+  if (statusText) statusText.textContent = message;
+}
+
+// --- Step 2: account selection ----------------------------------------
+
+async function reloadAccounts() {
+  discoveredAccounts = [];
+  selectedAccount = null;
+  if (submitBtn) submitBtn.disabled = true;
+  if (accountList) accountList.innerHTML = '<div class="connect-ledger-loading">Reading accounts…</div>';
+  hideError();
+
+  const loaded = await loadAccountsPage(true, showError);
+  if (!loaded) {
+    // The device may have been unplugged mid-flow — fall back to detection.
+    showStep('detect');
+    detectTick();
+  }
+}
+
+/**
+ * Fetch one page of device accounts.
+ *
+ * @param {boolean} replace - true replaces the list (first page), false appends
+ * @param {(message: string) => void} [onFailure] - where a failure message goes
+ *   (detect step: status line; accounts step: error box)
+ * @returns {Promise<boolean>} whether the page loaded
+ */
+async function loadAccountsPage(replace, onFailure = showError) {
+  if (loadMoreBtn) loadMoreBtn.disabled = true;
+  try {
+    const result = await window.ledger.getAccounts({
+      scheme: schemeSelect?.value || 'live',
+      start: replace ? 0 : discoveredAccounts.length,
+      count: ACCOUNTS_PER_PAGE,
+    });
+    if (!result.success) {
+      onFailure(result.error || 'Failed to read accounts from the device');
+      return false;
+    }
+    discoveredAccounts = replace ? result.accounts : [...discoveredAccounts, ...result.accounts];
+    renderAccountList();
+    return true;
+  } catch (err) {
+    console.error('[ConnectLedger] Account load failed:', err);
+    onFailure(err.message);
+    return false;
+  } finally {
+    if (loadMoreBtn) loadMoreBtn.disabled = false;
+  }
+}
+
+function renderAccountList() {
+  if (!accountList) return;
+  accountList.innerHTML = '';
+
+  const existingAddresses = new Set(
+    walletState.derivedWallets
+      .filter((wallet) => wallet.address)
+      .map((wallet) => wallet.address.toLowerCase())
+  );
+
+  discoveredAccounts.forEach((account) => {
+    const alreadyAdded = existingAddresses.has(account.address.toLowerCase());
+    const item = document.createElement('button');
+    item.type = 'button';
+    item.className = 'connect-ledger-account';
+    if (alreadyAdded) item.classList.add('added');
+    if (selectedAccount?.address === account.address) item.classList.add('selected');
+    item.disabled = alreadyAdded;
+
+    item.innerHTML = `
+      <div class="connect-ledger-account-info">
+        <code class="connect-ledger-account-address">${escapeHtml(truncateAddress(account.address))}</code>
+        <span class="connect-ledger-account-path">m/${escapeHtml(account.path)}</span>
+      </div>
+      ${alreadyAdded ? '<span class="connect-ledger-account-added">Added</span>' : ''}
+    `;
+
+    if (!alreadyAdded) {
+      item.addEventListener('click', () => {
+        selectedAccount = account;
+        if (submitBtn) submitBtn.disabled = false;
+        renderAccountList();
+      });
+    }
+
+    accountList.appendChild(item);
+  });
+}
+
+async function handleAddAccount() {
+  if (!selectedAccount) return;
+
+  if (submitBtn) {
+    submitBtn.disabled = true;
+    submitBtn.textContent = 'Adding…';
+  }
+  hideError();
+
+  try {
+    const result = await window.ledger.addAccount(
+      nameInput?.value?.trim() || '',
+      selectedAccount.address,
+      selectedAccount.path
+    );
+    if (!result.success) {
+      throw new Error(result.error);
+    }
+
+    accountAdded = true;
+    walletState.derivedWallets.push(result.wallet);
+
+    if (resultName) resultName.textContent = result.wallet.name;
+    if (resultAddress) resultAddress.textContent = result.wallet.address;
+
+    // Switch to the new account, mirroring the create-wallet flow.
+    const activated = await window.wallet.setActiveWallet(result.wallet.index);
+    if (activated.success) {
+      walletState.activeWalletIndex = result.wallet.index;
+      updateWalletSelectorDisplay(result.wallet);
+      walletState.fullAddresses.wallet = result.wallet.address || '';
+    }
+
+    showStep('success');
+  } catch (err) {
+    console.error('[ConnectLedger] Failed to add account:', err);
+    showError(err.message || 'Failed to add the Ledger account');
+    if (submitBtn) {
+      submitBtn.disabled = false;
+      submitBtn.textContent = 'Add Account';
+    }
+  }
+}
+
+function showError(message) {
+  if (errorEl) {
+    errorEl.textContent = message;
+    errorEl.classList.remove('hidden');
+  }
+}
+
+function hideError() {
+  if (errorEl) {
+    errorEl.classList.add('hidden');
+    errorEl.textContent = '';
+  }
+}
diff --git a/src/renderer/lib/wallet/create-wallet.js b/src/renderer/lib/wallet/create-wallet.js
index 09118473..35be56a8 100644
--- a/src/renderer/lib/wallet/create-wallet.js
+++ b/src/renderer/lib/wallet/create-wallet.js
@@ -5,6 +5,7 @@
  */
 
 import { walletState, registerScreenHider } from './wallet-state.js';
+import { refuseSubscreenWhileInFlight } from './signature-flight.js';
 import { loadDerivedWallets, updateWalletSelectorDisplay } from './wallet-selector.js';
 import { refreshBalances } from './balance-display.js';
 
@@ -69,6 +70,8 @@ function setupCreateWalletSubscreen() {
 }
 
 export async function openCreateWallet() {
+  if (refuseSubscreenWhileInFlight('Create wallet screen')) return;
+
   walletState.identityView?.classList.add('hidden');
   createWalletScreen?.classList.remove('hidden');
 
diff --git a/src/renderer/lib/wallet/dapp-connect.js b/src/renderer/lib/wallet/dapp-connect.js
index 41549d40..4217afcd 100644
--- a/src/renderer/lib/wallet/dapp-connect.js
+++ b/src/renderer/lib/wallet/dapp-connect.js
@@ -5,6 +5,7 @@
  */
 
 import { walletState, registerScreenHider, hideAllSubscreens } from './wallet-state.js';
+import { isSignatureInFlight, signatureInFlightError } from './signature-flight.js';
 import { escapeHtml } from './wallet-utils.js';
 import { open as openSidebarPanel, isVisible as isSidebarVisible } from '../sidebar.js';
 import { getActiveWebview, emitAccountsChanged, getPermissionKey } from '../dapp-provider.js';
@@ -202,8 +203,18 @@ function selectDappConnectWallet(index) {
 
 /**
  * Show dApp connect screen
+ *
+ * A permissionless request like eth_requestAccounts must not paint over a
+ * live device confirmation with a fresh Connect/Reject pair — see
+ * signature-flight.js. Refuse the newcomer; the dApp can retry once the
+ * device is done.
  */
 export function showDappConnect(displayUrl, permissionKey, resolve, reject, webview) {
+  if (isSignatureInFlight()) {
+    reject(signatureInFlightError());
+    return;
+  }
+
   dappConnectPending = { permissionKey, resolve, reject, webview };
 
   if (dappConnectSite) {
diff --git a/src/renderer/lib/wallet/dapp-sign.js b/src/renderer/lib/wallet/dapp-sign.js
index f950fdb3..be0f0da8 100644
--- a/src/renderer/lib/wallet/dapp-sign.js
+++ b/src/renderer/lib/wallet/dapp-sign.js
@@ -5,8 +5,16 @@
  */
 
 import { walletState, registerScreenHider, hideAllSubscreens } from './wallet-state.js';
+import {
+  assertNoSignatureInFlight,
+  isSignatureInFlight,
+  signatureInFlightError,
+  beginSignatureFlight,
+  endSignatureFlight,
+} from './signature-flight.js';
 import { open as openSidebarPanel } from '../sidebar.js';
 import { executeSign } from '../dapp-provider.js';
+import { bypassUnlockGateForHardware, signingButtonLabel } from './wallet-utils.js';
 
 // DOM references
 let dappSignScreen;
@@ -26,7 +34,10 @@ let dappSignRejectBtn;
 let dappSignApproveBtn;
 let dappSignAutoApproveCheckbox;
 
-// Local state
+// Local state. `dappSignPending.signing` is true while the signature is
+// in flight: a hardware signature is a device prompt we cannot recall, so
+// there is no cancellation path once it starts — rejecting behind it
+// would settle the dApp promise with 4001 while the device still signs.
 let dappSignPending = null;
 
 export function initDappSign() {
@@ -56,6 +67,7 @@ export function initDappSign() {
 function setupDappSignScreen() {
   if (dappSignBackBtn) {
     dappSignBackBtn.addEventListener('click', () => {
+      if (dappSignPending?.signing) return;
       rejectDappSign();
       closeDappSign();
     });
@@ -63,6 +75,7 @@ function setupDappSignScreen() {
 
   if (dappSignRejectBtn) {
     dappSignRejectBtn.addEventListener('click', () => {
+      if (dappSignPending?.signing) return;
       rejectDappSign();
       closeDappSign();
     });
@@ -97,16 +110,32 @@ function setupDappSignScreen() {
 
 /**
  * Show dApp signing screen
+ *
+ * The sidebar is a single shared surface, and an in-flight signature owns
+ * it: the device prompt it produced cannot be recalled, so a later request
+ * must not repaint the screen, reset `dappSignPending` and re-enable
+ * Reject/Back/Sign underneath it — the user would then be cancelling (or
+ * confirming) request B while the device is still showing request A. The
+ * lock is global (see signature-flight.js), so this refuses the newcomer
+ * whichever surface is holding the device: a sibling dapp-sign request,
+ * dapp-tx, or an x402 payment. The dApp can retry once the device is done.
  */
 export async function showDappSignApproval(webview, permissionKey, method, params) {
+  assertNoSignatureInFlight();
+
   const permission = await window.dappPermissions.getPermission(permissionKey);
   if (!permission) {
     throw Object.assign(new Error('Unauthorized - not connected'), { code: 4100 });
   }
 
   return new Promise((resolve, reject) => {
-    dappSignPending = { permissionKey, walletIndex: permission.walletIndex, method, params, resolve, reject, webview };
+    // Re-checked after the awaits above: the screen must still be free at
+    // the moment we take it over.
+    assertNoSignatureInFlight();
+    const request = { permissionKey, walletIndex: permission.walletIndex, method, params, resolve, reject, webview };
+    dappSignPending = request;
     if (dappSignAutoApproveCheckbox) dappSignAutoApproveCheckbox.checked = false;
+    setDappSignCancelEnabled(true);
 
     if (dappSignSite) {
       dappSignSite.textContent = permissionKey;
@@ -119,6 +148,15 @@ export async function showDappSignApproval(webview, permissionKey, method, param
     }
 
     checkDappSignUnlockStatus().then(() => {
+      // Another surface may have started a device signature while we were
+      // checking vault status (the user could still click Pay on an x402
+      // card, say). It owns the sidebar now — refuse rather than paint
+      // over a live confirmation.
+      if (isSignatureInFlight()) {
+        if (dappSignPending === request) dappSignPending = null;
+        reject(signatureInFlightError());
+        return;
+      }
       hideAllSubscreens();
       walletState.identityView?.classList.add('hidden');
       dappSignScreen?.classList.remove('hidden');
@@ -204,6 +242,10 @@ function formatTypedDataForDisplay(typedData) {
 
 async function checkDappSignUnlockStatus() {
   try {
+    if (bypassUnlockGateForHardware(dappSignPending?.walletIndex, dappSignUnlock, dappSignApproveBtn)) {
+      return;
+    }
+
     const status = await window.identity.getStatus();
 
     if (status.isUnlocked) {
@@ -289,26 +331,38 @@ async function handleDappSignPasswordUnlock() {
 }
 
 async function approveDappSign() {
-  if (!dappSignPending) return;
+  if (!dappSignPending || dappSignPending.signing) return;
 
-  const { permissionKey, walletIndex, method, params, resolve } = dappSignPending;
+  const request = dappSignPending;
+  const { permissionKey, walletIndex, method, params, resolve } = request;
+  // Snapshot the auto-approve intent now: the checkbox is shared DOM that
+  // a later request can repopulate while this signature is in flight.
+  const autoApprove = Boolean(dappSignAutoApproveCheckbox?.checked);
 
   try {
+    request.signing = true;
+    // Claim the sidebar for the whole flight: no other approval surface
+    // may repaint over or tear down a live device confirmation.
+    beginSignatureFlight(request);
     if (dappSignApproveBtn) {
       dappSignApproveBtn.disabled = true;
-      dappSignApproveBtn.textContent = 'Signing...';
+      dappSignApproveBtn.textContent = signingButtonLabel(walletIndex);
     }
+    setDappSignCancelEnabled(false);
 
     const signature = await executeSign(method, params, walletIndex);
 
-    if (dappSignAutoApproveCheckbox?.checked && permissionKey) {
+    if (autoApprove && permissionKey) {
       await window.dappPermissions.setSigningAutoApprove(permissionKey, true);
       console.log('[WalletUI] Signing auto-approve enabled for:', permissionKey);
     }
 
     console.log('[WalletUI] dApp message signed');
     resolve(signature);
-    closeDappSign();
+    // Only tear down the screen if it is still showing *this* request.
+    if (dappSignPending === request) {
+      closeDappSign();
+    }
   } catch (err) {
     console.error('[WalletUI] dApp signing failed:', err);
     showDappSignError(err.message || 'Signing failed');
@@ -316,9 +370,22 @@ async function approveDappSign() {
       dappSignApproveBtn.disabled = false;
       dappSignApproveBtn.textContent = 'Sign';
     }
+    setDappSignCancelEnabled(true);
+  } finally {
+    request.signing = false;
+    endSignatureFlight(request);
   }
 }
 
+/**
+ * Enable/disable the two ways out of the signing screen (Reject, Back).
+ * Both are disabled while a signature is in flight.
+ */
+function setDappSignCancelEnabled(enabled) {
+  if (dappSignRejectBtn) dappSignRejectBtn.disabled = !enabled;
+  if (dappSignBackBtn) dappSignBackBtn.disabled = !enabled;
+}
+
 function rejectDappSign() {
   if (dappSignPending?.reject) {
     dappSignPending.reject({ code: 4001, message: 'User rejected the request' });
@@ -331,10 +398,12 @@ function closeDappSign() {
   dappSignPending = null;
   hideDappSignError();
   if (dappSignPasswordInput) dappSignPasswordInput.value = '';
+  if (dappSignAutoApproveCheckbox) dappSignAutoApproveCheckbox.checked = false;
   if (dappSignApproveBtn) {
     dappSignApproveBtn.disabled = false;
     dappSignApproveBtn.textContent = 'Sign';
   }
+  setDappSignCancelEnabled(true);
 }
 
 function showDappSignError(message) {
diff --git a/src/renderer/lib/wallet/dapp-sign.test.js b/src/renderer/lib/wallet/dapp-sign.test.js
new file mode 100644
index 00000000..226b31af
--- /dev/null
+++ b/src/renderer/lib/wallet/dapp-sign.test.js
@@ -0,0 +1,196 @@
+const { createDocument, createElement } = require('../../../../test/helpers/fake-dom.js');
+
+const originalWindow = global.window;
+const originalDocument = global.document;
+
+const DAPP_SIGN_ELEMENT_IDS = [
+  'sidebar-dapp-sign',
+  'dapp-sign-back',
+  'dapp-sign-site',
+  'dapp-sign-message',
+  'dapp-sign-typed-data-section',
+  'dapp-sign-typed-data',
+  'dapp-sign-unlock',
+  'dapp-sign-touchid-btn',
+  'dapp-sign-password-link',
+  'dapp-sign-password-section',
+  'dapp-sign-password-input',
+  'dapp-sign-password-submit',
+  'dapp-sign-error',
+  'dapp-sign-reject',
+  'dapp-sign-approve',
+  'dapp-sign-auto-approve',
+];
+
+const LEDGER_INDEX = 1000000;
+
+function flush() {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+function deferred() {
+  let resolve;
+  const promise = new Promise((res) => {
+    resolve = res;
+  });
+  return { promise, resolve };
+}
+
+async function loadDappSign() {
+  jest.resetModules();
+
+  const elementsById = Object.fromEntries(
+    DAPP_SIGN_ELEMENT_IDS.map((id) => [id, createElement('button')])
+  );
+  elementsById['dapp-sign-auto-approve'].checked = false;
+  const messageParent = createElement('div');
+  messageParent.appendChild(elementsById['dapp-sign-message']);
+  global.document = createDocument({ elementsById });
+
+  const sign = deferred();
+  const setSigningAutoApprove = jest.fn().mockResolvedValue({ success: true });
+  global.window = {
+    dappPermissions: {
+      getPermission: jest.fn().mockResolvedValue({ walletIndex: LEDGER_INDEX, chainId: 8453 }),
+      setSigningAutoApprove,
+    },
+  };
+
+  const executeSign = jest.fn(() => sign.promise);
+  jest.doMock('../dapp-provider.js', () => ({ executeSign }));
+  // The Ledger account bypasses the vault-unlock gate, the same as in the app.
+  jest.doMock('./wallet-utils.js', () => ({
+    bypassUnlockGateForHardware: jest.fn((_index, _unlockEl, confirmBtn) => {
+      if (confirmBtn) confirmBtn.disabled = false;
+      return true;
+    }),
+    signingButtonLabel: jest.fn(() => 'Confirm on your Ledger…'),
+  }));
+  jest.doMock('./wallet-state.js', () => ({
+    walletState: { identityView: createElement('div') },
+    registerScreenHider: jest.fn(),
+    hideAllSubscreens: jest.fn(),
+  }));
+  jest.doMock('../sidebar.js', () => ({ open: jest.fn() }));
+
+  const mod = await import('./dapp-sign.js');
+  mod.initDappSign();
+
+  async function openApproval() {
+    const settled = { state: 'pending' };
+    const promise = mod
+      .showDappSignApproval({}, 'https://app.example', 'personal_sign', ['0xdeadbeef', '0xledger'])
+      .then(
+        (signature) => {
+          settled.state = 'resolved';
+          settled.value = signature;
+        },
+        (err) => {
+          settled.state = 'rejected';
+          settled.value = err;
+        }
+      );
+    await flush();
+    return { settled, promise };
+  }
+
+  return { mod, elements: elementsById, sign, setSigningAutoApprove, openApproval };
+}
+
+describe('dapp-sign approval lifecycle', () => {
+  afterEach(() => {
+    global.window = originalWindow;
+    global.document = originalDocument;
+    jest.restoreAllMocks();
+  });
+
+  test('reject and back are inert while a Ledger signature is in flight', async () => {
+    const { elements, sign, setSigningAutoApprove, openApproval } = await loadDappSign();
+    const { settled, promise } = await openApproval();
+
+    elements['dapp-sign-auto-approve'].checked = true;
+    elements['dapp-sign-approve'].dispatch('click');
+    await flush();
+
+    expect(elements['dapp-sign-approve'].textContent).toBe('Confirm on your Ledger…');
+    expect(elements['dapp-sign-reject'].disabled).toBe(true);
+    expect(elements['dapp-sign-back'].disabled).toBe(true);
+
+    elements['dapp-sign-reject'].dispatch('click');
+    elements['dapp-sign-back'].dispatch('click');
+    await flush();
+    expect(settled.state).toBe('pending');
+
+    sign.resolve('0xsignature');
+    await promise;
+
+    expect(settled).toMatchObject({ state: 'resolved', value: '0xsignature' });
+    expect(setSigningAutoApprove).toHaveBeenCalledTimes(1);
+    expect(elements['dapp-sign-auto-approve'].checked).toBe(false);
+  });
+
+  test('a second request cannot take the screen from an in-flight signature', async () => {
+    const { elements, sign, openApproval } = await loadDappSign();
+    const first = await openApproval();
+
+    elements['dapp-sign-approve'].dispatch('click');
+    await flush();
+    expect(elements['dapp-sign-reject'].disabled).toBe(true);
+
+    // The device prompt for the first message is still up: the newcomer is
+    // refused rather than repainting the screen and re-enabling the way
+    // out from under it.
+    const second = await openApproval();
+    expect(second.settled.state).toBe('rejected');
+    expect(second.settled.value).toMatchObject({ code: -32002 });
+    expect(elements['dapp-sign-reject'].disabled).toBe(true);
+    expect(elements['dapp-sign-back'].disabled).toBe(true);
+    expect(elements['dapp-sign-approve'].disabled).toBe(true);
+    expect(elements['dapp-sign-approve'].textContent).toBe('Confirm on your Ledger…');
+
+    elements['dapp-sign-reject'].dispatch('click');
+    await flush();
+    expect(first.settled.state).toBe('pending');
+
+    sign.resolve('0xsignature');
+    await first.promise;
+    expect(first.settled).toMatchObject({ state: 'resolved', value: '0xsignature' });
+  });
+
+  // The per-module guard above only stops a second *signing* request. Every
+  // other approval surface (dapp-tx, dapp-connect, x402, vault-unlock)
+  // shares the same sidebar and takes it over via hideAllSubscreens(), so
+  // the flight also has to hold the shared lock — that is what refuses
+  // them while the device prompt is up.
+  test('an in-flight signature holds the shared sidebar lock until it settles', async () => {
+    const { elements, sign, openApproval } = await loadDappSign();
+    // After loadDappSign's resetModules, so this is the same lock instance
+    // the module under test holds.
+    const flight = await import('./signature-flight.js');
+    const { promise } = await openApproval();
+
+    expect(flight.isSignatureInFlight()).toBe(false);
+
+    elements['dapp-sign-approve'].dispatch('click');
+    await flush();
+    expect(flight.isSignatureInFlight()).toBe(true);
+
+    sign.resolve('0xsignature');
+    await promise;
+    expect(flight.isSignatureInFlight()).toBe(false);
+  });
+
+  test('rejecting before confirming settles 4001 and enables no signing auto-approve', async () => {
+    const { elements, setSigningAutoApprove, openApproval } = await loadDappSign();
+    const { settled, promise } = await openApproval();
+
+    elements['dapp-sign-auto-approve'].checked = true;
+    elements['dapp-sign-reject'].dispatch('click');
+    await promise;
+
+    expect(settled.state).toBe('rejected');
+    expect(settled.value).toMatchObject({ code: 4001 });
+    expect(setSigningAutoApprove).not.toHaveBeenCalled();
+    expect(elements['dapp-sign-auto-approve'].checked).toBe(false);
+  });
+});
diff --git a/src/renderer/lib/wallet/dapp-tx.js b/src/renderer/lib/wallet/dapp-tx.js
index a5aaff7c..9fc7d33c 100644
--- a/src/renderer/lib/wallet/dapp-tx.js
+++ b/src/renderer/lib/wallet/dapp-tx.js
@@ -5,7 +5,15 @@
  */
 
 import { walletState, registerScreenHider, hideAllSubscreens } from './wallet-state.js';
+import {
+  assertNoSignatureInFlight,
+  isSignatureInFlight,
+  signatureInFlightError,
+  beginSignatureFlight,
+  endSignatureFlight,
+} from './signature-flight.js';
 import { open as openSidebarPanel } from '../sidebar.js';
+import { bypassUnlockGateForHardware, signingButtonLabel } from './wallet-utils.js';
 
 // DOM references
 let dappTxScreen;
@@ -30,7 +38,11 @@ let dappTxApproveBtn;
 let dappTxAutoApproveRow;
 let dappTxAutoApproveCheckbox;
 
-// Local state
+// Local state. `dappTxPending.signing` is true while the signature and
+// broadcast are in flight: a hardware signature is a device prompt we
+// cannot recall, so there is no cancellation path once it starts —
+// rejecting behind it would settle the dApp promise with 4001 while the
+// transaction still broadcasts.
 let dappTxPending = null;
 
 const ERC20_TRANSFER_SELECTOR = '0xa9059cbb';
@@ -68,6 +80,7 @@ export function initDappTx() {
 function setupDappTxScreen() {
   if (dappTxBackBtn) {
     dappTxBackBtn.addEventListener('click', () => {
+      if (dappTxPending?.signing) return;
       rejectDappTx();
       closeDappTx();
     });
@@ -75,6 +88,7 @@ function setupDappTxScreen() {
 
   if (dappTxRejectBtn) {
     dappTxRejectBtn.addEventListener('click', () => {
+      if (dappTxPending?.signing) return;
       rejectDappTx();
       closeDappTx();
     });
@@ -109,8 +123,20 @@ function setupDappTxScreen() {
 
 /**
  * Show dApp transaction approval screen
+ *
+ * The sidebar is a single shared surface, and an in-flight signature owns
+ * it: the device prompt it produced cannot be recalled, so a later request
+ * must not repaint the screen, reset `dappTxPending` and re-enable
+ * Reject/Back/Confirm underneath it — the user would then be cancelling
+ * (or confirming) request B while the device is still showing request A.
+ * The lock is global (see signature-flight.js), so this refuses the
+ * newcomer whichever surface is holding the device: a sibling transaction,
+ * a dapp-sign request, or an x402 payment. The dApp can retry once the
+ * device is done.
  */
 export async function showDappTxApproval(webview, permissionKey, txParams) {
+  assertNoSignatureInFlight();
+
   const permission = await window.dappPermissions.getPermission(permissionKey);
   if (!permission) {
     throw Object.assign(new Error('Unauthorized - not connected'), { code: 4100 });
@@ -120,7 +146,11 @@ export async function showDappTxApproval(webview, permissionKey, txParams) {
   const selector = extractSelector(txParams.data);
 
   return new Promise((resolve, reject) => {
-    dappTxPending = { permissionKey, walletIndex: permission.walletIndex, txParams, resolve, reject, webview, chainId, selector };
+    // Re-checked after the awaits above: the screen must still be free at
+    // the moment we take it over.
+    assertNoSignatureInFlight();
+    const request = { permissionKey, walletIndex: permission.walletIndex, txParams, resolve, reject, webview, chainId, selector };
+    dappTxPending = request;
 
     if (dappTxSite) {
       dappTxSite.textContent = permissionKey;
@@ -128,6 +158,7 @@ export async function showDappTxApproval(webview, permissionKey, txParams) {
 
     // Show auto-approve checkbox only for contract calls (has function selector)
     if (dappTxAutoApproveCheckbox) dappTxAutoApproveCheckbox.checked = false;
+    setDappTxCancelEnabled(true);
     if (dappTxAutoApproveRow) {
       dappTxAutoApproveRow.classList.toggle('hidden', !selector);
     }
@@ -136,6 +167,15 @@ export async function showDappTxApproval(webview, permissionKey, txParams) {
       populateDappTxDetails(txParams, chainId),
       checkDappTxUnlockStatus(),
     ]).then(() => {
+      // Another surface may have started a device signature while we were
+      // estimating fees / checking vault status (the user could still
+      // click Pay on an x402 card, say). It owns the sidebar now — refuse
+      // rather than paint over a live confirmation.
+      if (isSignatureInFlight()) {
+        if (dappTxPending === request) dappTxPending = null;
+        reject(signatureInFlightError());
+        return;
+      }
       hideAllSubscreens();
       walletState.identityView?.classList.add('hidden');
       dappTxScreen?.classList.remove('hidden');
@@ -224,6 +264,10 @@ async function populateDappTxDetails(txParams, chainId) {
 
 async function checkDappTxUnlockStatus() {
   try {
+    if (bypassUnlockGateForHardware(dappTxPending?.walletIndex, dappTxUnlock, dappTxApproveBtn)) {
+      return;
+    }
+
     const status = await window.identity.getStatus();
 
     if (status.isUnlocked) {
@@ -309,15 +353,24 @@ async function handleDappTxPasswordUnlock() {
 }
 
 async function approveDappTx() {
-  if (!dappTxPending) return;
+  if (!dappTxPending || dappTxPending.signing) return;
 
-  const { permissionKey, walletIndex, txParams, resolve, gasLimit, gasPrice, chainId, selector } = dappTxPending;
+  const request = dappTxPending;
+  const { permissionKey, walletIndex, txParams, resolve, gasLimit, gasPrice, chainId, selector } = request;
+  // Snapshot the auto-approve intent now: the checkbox is shared DOM that
+  // a later request can repopulate while this send is still in flight.
+  const autoApprove = Boolean(dappTxAutoApproveCheckbox?.checked);
 
   try {
+    request.signing = true;
+    // Claim the sidebar for the whole flight: no other approval surface
+    // may repaint over or tear down a live device confirmation.
+    beginSignatureFlight(request);
     if (dappTxApproveBtn) {
       dappTxApproveBtn.disabled = true;
-      dappTxApproveBtn.textContent = 'Signing...';
+      dappTxApproveBtn.textContent = signingButtonLabel(walletIndex);
     }
+    setDappTxCancelEnabled(false);
 
     const tx = {
       to: txParams.to,
@@ -349,14 +402,17 @@ async function approveDappTx() {
       console.warn('[WalletUI] dApp transaction broadcast but payment history did not record:', result.recordError);
     }
 
-    if (dappTxAutoApproveCheckbox?.checked && permissionKey && selector && txParams.to) {
+    if (autoApprove && permissionKey && selector && txParams.to) {
       await window.dappPermissions.addTransactionAutoApprove(permissionKey, txParams.to, selector, chainId);
       console.log('[WalletUI] Transaction auto-approve added:', txParams.to, selector, 'chain', chainId);
     }
 
     console.log('[WalletUI] dApp transaction sent:', result.hash);
     resolve(result.hash);
-    closeDappTx();
+    // Only tear down the screen if it is still showing *this* request.
+    if (dappTxPending === request) {
+      closeDappTx();
+    }
   } catch (err) {
     console.error('[WalletUI] dApp transaction failed:', err);
     showDappTxError(err.message || 'Transaction failed');
@@ -364,9 +420,22 @@ async function approveDappTx() {
       dappTxApproveBtn.disabled = false;
       dappTxApproveBtn.textContent = 'Confirm';
     }
+    setDappTxCancelEnabled(true);
+  } finally {
+    request.signing = false;
+    endSignatureFlight(request);
   }
 }
 
+/**
+ * Enable/disable the two ways out of the approval screen (Reject, Back).
+ * Both are disabled while a signature is in flight.
+ */
+function setDappTxCancelEnabled(enabled) {
+  if (dappTxRejectBtn) dappTxRejectBtn.disabled = !enabled;
+  if (dappTxBackBtn) dappTxBackBtn.disabled = !enabled;
+}
+
 function rejectDappTx() {
   if (dappTxPending?.reject) {
     dappTxPending.reject({ code: 4001, message: 'User rejected the request' });
@@ -379,10 +448,12 @@ function closeDappTx() {
   dappTxPending = null;
   hideDappTxError();
   if (dappTxPasswordInput) dappTxPasswordInput.value = '';
+  if (dappTxAutoApproveCheckbox) dappTxAutoApproveCheckbox.checked = false;
   if (dappTxApproveBtn) {
     dappTxApproveBtn.disabled = false;
     dappTxApproveBtn.textContent = 'Confirm';
   }
+  setDappTxCancelEnabled(true);
 }
 
 function showDappTxError(message) {
diff --git a/src/renderer/lib/wallet/dapp-tx.test.js b/src/renderer/lib/wallet/dapp-tx.test.js
index fe5fcfcb..b4151a88 100644
--- a/src/renderer/lib/wallet/dapp-tx.test.js
+++ b/src/renderer/lib/wallet/dapp-tx.test.js
@@ -33,3 +33,249 @@ describe('dapp-tx helpers', () => {
     })).toEqual({ origin: 'https://app.example' });
   });
 });
+
+const { createDocument, createElement } = require('../../../../test/helpers/fake-dom.js');
+
+const originalWindow = global.window;
+const originalDocument = global.document;
+
+const DAPP_TX_ELEMENT_IDS = [
+  'sidebar-dapp-tx',
+  'dapp-tx-back',
+  'dapp-tx-site',
+  'dapp-tx-to',
+  'dapp-tx-value',
+  'dapp-tx-data',
+  'dapp-tx-data-row',
+  'dapp-tx-network',
+  'dapp-tx-fee',
+  'dapp-tx-warning',
+  'dapp-tx-unlock',
+  'dapp-tx-touchid-btn',
+  'dapp-tx-password-link',
+  'dapp-tx-password-section',
+  'dapp-tx-password-input',
+  'dapp-tx-password-submit',
+  'dapp-tx-error',
+  'dapp-tx-reject',
+  'dapp-tx-approve',
+  'dapp-tx-auto-approve-row',
+  'dapp-tx-auto-approve',
+];
+
+const LEDGER_INDEX = 1000000;
+
+function flush() {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+function deferred() {
+  let resolve;
+  const promise = new Promise((res) => {
+    resolve = res;
+  });
+  return { promise, resolve };
+}
+
+async function loadDappTx() {
+  jest.resetModules();
+
+  const elementsById = Object.fromEntries(
+    DAPP_TX_ELEMENT_IDS.map((id) => [id, createElement('button')])
+  );
+  elementsById['dapp-tx-auto-approve'].checked = false;
+  global.document = createDocument({ elementsById });
+
+  const send = deferred();
+  const addTransactionAutoApprove = jest.fn().mockResolvedValue({ success: true });
+  global.window = {
+    dappPermissions: {
+      getPermission: jest.fn().mockResolvedValue({ walletIndex: LEDGER_INDEX, chainId: 8453 }),
+      addTransactionAutoApprove,
+    },
+    networks: {
+      getChains: jest.fn().mockResolvedValue({
+        success: true,
+        chains: { 8453: { name: 'Base', nativeSymbol: 'ETH' } },
+      }),
+    },
+    wallet: {
+      getDerivedWallets: jest.fn().mockResolvedValue({
+        success: true,
+        wallets: [{ index: LEDGER_INDEX, address: '0xledger', type: 'ledger' }],
+      }),
+      estimateGas: jest.fn().mockResolvedValue({ success: true, gasLimit: '21000' }),
+      getGasPrice: jest.fn().mockResolvedValue({
+        success: true,
+        type: 'legacy',
+        gasPrice: '1000000000',
+        effectiveGasPrice: '1000000000',
+      }),
+      dappSendTransaction: jest.fn(() => send.promise),
+    },
+  };
+
+  // The Ledger account bypasses the vault-unlock gate, the same as in the app.
+  jest.doMock('./wallet-utils.js', () => ({
+    bypassUnlockGateForHardware: jest.fn((_index, _unlockEl, confirmBtn) => {
+      if (confirmBtn) confirmBtn.disabled = false;
+      return true;
+    }),
+    signingButtonLabel: jest.fn(() => 'Confirm on your Ledger…'),
+  }));
+  jest.doMock('./wallet-state.js', () => ({
+    walletState: { identityView: createElement('div'), selectedChainId: 8453 },
+    registerScreenHider: jest.fn(),
+    hideAllSubscreens: jest.fn(),
+  }));
+  jest.doMock('../sidebar.js', () => ({ open: jest.fn() }));
+
+  const mod = await import('./dapp-tx.js');
+  mod.initDappTx();
+
+  const txParams = {
+    to: '0xToken00000000000000000000000000000000dead',
+    value: '0',
+    data: '0x095ea7b300000000000000000000000000000000000000000000000000000000000000ff',
+  };
+
+  async function openApproval() {
+    const settled = { state: 'pending' };
+    const promise = mod.showDappTxApproval({}, 'https://app.example', txParams).then(
+      (hash) => {
+        settled.state = 'resolved';
+        settled.value = hash;
+      },
+      (err) => {
+        settled.state = 'rejected';
+        settled.value = err;
+      }
+    );
+    await flush();
+    return { settled, promise };
+  }
+
+  return { mod, elements: elementsById, send, addTransactionAutoApprove, openApproval, txParams };
+}
+
+describe('dapp-tx approval lifecycle', () => {
+  afterEach(() => {
+    global.window = originalWindow;
+    global.document = originalDocument;
+    jest.restoreAllMocks();
+  });
+
+  test('reject and back are inert while a Ledger signature is in flight', async () => {
+    const { elements, send, addTransactionAutoApprove, openApproval } = await loadDappTx();
+    const { settled, promise } = await openApproval();
+
+    elements['dapp-tx-auto-approve'].checked = true;
+    elements['dapp-tx-approve'].dispatch('click');
+    await flush();
+
+    // Device prompt is up: the only two ways out of the screen are closed,
+    // because the signature can no longer be recalled.
+    expect(elements['dapp-tx-approve'].textContent).toBe('Confirm on your Ledger…');
+    expect(elements['dapp-tx-reject'].disabled).toBe(true);
+    expect(elements['dapp-tx-back'].disabled).toBe(true);
+
+    elements['dapp-tx-reject'].dispatch('click');
+    elements['dapp-tx-back'].dispatch('click');
+    await flush();
+    expect(settled.state).toBe('pending');
+
+    send.resolve({ success: true, hash: '0xhash' });
+    await promise;
+
+    expect(settled).toMatchObject({ state: 'resolved', value: '0xhash' });
+    expect(addTransactionAutoApprove).toHaveBeenCalledTimes(1);
+  });
+
+  test('a second request cannot take the screen from an in-flight signature', async () => {
+    const { elements, send, openApproval } = await loadDappTx();
+    const first = await openApproval();
+
+    elements['dapp-tx-approve'].dispatch('click');
+    await flush();
+    expect(elements['dapp-tx-reject'].disabled).toBe(true);
+
+    // The device prompt for the first tx is still up: the newcomer is
+    // refused rather than repainting the screen and re-enabling the way
+    // out from under it.
+    const second = await openApproval();
+    expect(second.settled.state).toBe('rejected');
+    expect(second.settled.value).toMatchObject({ code: -32002 });
+    expect(elements['dapp-tx-reject'].disabled).toBe(true);
+    expect(elements['dapp-tx-back'].disabled).toBe(true);
+    expect(elements['dapp-tx-approve'].disabled).toBe(true);
+    expect(elements['dapp-tx-approve'].textContent).toBe('Confirm on your Ledger…');
+
+    // Cancelling now still cannot settle the first request behind the device.
+    elements['dapp-tx-reject'].dispatch('click');
+    await flush();
+    expect(first.settled.state).toBe('pending');
+
+    send.resolve({ success: true, hash: '0xhash' });
+    await first.promise;
+    expect(first.settled).toMatchObject({ state: 'resolved', value: '0xhash' });
+  });
+
+  // The per-module guard above only stops a second *transaction*. Every
+  // other approval surface (dapp-sign, dapp-connect, x402, vault-unlock)
+  // shares the same sidebar and takes it over via hideAllSubscreens(), so
+  // the flight also has to hold the shared lock — that is what refuses
+  // them while the device prompt is up.
+  test('an in-flight signature holds the shared sidebar lock until it settles', async () => {
+    const { elements, send, openApproval } = await loadDappTx();
+    // After loadDappTx's resetModules, so this is the same lock instance
+    // the module under test holds.
+    const flight = await import('./signature-flight.js');
+    const { promise } = await openApproval();
+
+    expect(flight.isSignatureInFlight()).toBe(false);
+
+    elements['dapp-tx-approve'].dispatch('click');
+    await flush();
+    expect(flight.isSignatureInFlight()).toBe(true);
+
+    send.resolve({ success: true, hash: '0xhash' });
+    await promise;
+    expect(flight.isSignatureInFlight()).toBe(false);
+  });
+
+  test('rejecting before confirming settles 4001 and installs no auto-approve rule', async () => {
+    const { elements, addTransactionAutoApprove, openApproval } = await loadDappTx();
+    const { settled, promise } = await openApproval();
+
+    elements['dapp-tx-auto-approve'].checked = true;
+    elements['dapp-tx-reject'].dispatch('click');
+    await promise;
+
+    expect(settled.state).toBe('rejected');
+    expect(settled.value).toMatchObject({ code: 4001 });
+    expect(addTransactionAutoApprove).not.toHaveBeenCalled();
+    // Closing clears the checkbox so the intent cannot leak into the next request.
+    expect(elements['dapp-tx-auto-approve'].checked).toBe(false);
+  });
+
+  test('auto-approve intent does not leak into the next request', async () => {
+    const { elements, send, addTransactionAutoApprove, openApproval } = await loadDappTx();
+    const first = await openApproval();
+
+    elements['dapp-tx-auto-approve'].checked = true;
+    elements['dapp-tx-approve'].dispatch('click');
+    send.resolve({ success: true, hash: '0xhash' });
+    await first.promise;
+    expect(addTransactionAutoApprove).toHaveBeenCalledTimes(1);
+    expect(elements['dapp-tx-auto-approve'].checked).toBe(false);
+
+    const second = await openApproval();
+    expect(elements['dapp-tx-auto-approve'].checked).toBe(false);
+    expect(elements['dapp-tx-reject'].disabled).toBe(false);
+    elements['dapp-tx-approve'].dispatch('click');
+    await second.promise;
+
+    expect(second.settled).toMatchObject({ state: 'resolved', value: '0xhash' });
+    expect(addTransactionAutoApprove).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/src/renderer/lib/wallet/dapp-x402.js b/src/renderer/lib/wallet/dapp-x402.js
index 7566e3d0..f1c26583 100644
--- a/src/renderer/lib/wallet/dapp-x402.js
+++ b/src/renderer/lib/wallet/dapp-x402.js
@@ -20,8 +20,21 @@
  */
 
 import { walletState, registerScreenHider, hideAllSubscreens } from './wallet-state.js';
+import {
+  isSignatureInFlight,
+  beginSignatureFlight,
+  endSignatureFlight,
+} from './signature-flight.js';
 import { open as openSidebarPanel, isVisible as isSidebarVisible } from '../sidebar.js';
-import { escapeHtml, formatRawTokenBalance, truncateAddress, toAtomicUnits, X402_WINDOW_OPTIONS } from './wallet-utils.js';
+import {
+  escapeHtml,
+  formatRawTokenBalance,
+  truncateAddress,
+  toAtomicUnits,
+  X402_WINDOW_OPTIONS,
+  isLedgerAccount,
+  signingButtonLabel,
+} from './wallet-utils.js';
 import { getPermissionKey } from '../origin-utils.js';
 import { refreshBalances } from './balance-display.js';
 import { showX402Permissions } from './permission-manage.js';
@@ -65,6 +78,7 @@ let unlockError;
 let errorEl;
 let grantRow;
 let grantToggle;
+let ledgerNoteEl;
 let grantCapInput;
 let grantCapSymbol;
 let grantWindowSelect;
@@ -111,6 +125,7 @@ export function initDappX402() {
   errorEl = document.getElementById('x402-approval-error');
   grantRow = document.getElementById('x402-approval-grant-row');
   grantToggle = document.getElementById('x402-approval-grant-toggle');
+  ledgerNoteEl = document.getElementById('x402-approval-ledger-note');
   grantCapInput = document.getElementById('x402-approval-grant-cap-input');
   grantCapSymbol = document.getElementById('x402-approval-grant-cap-symbol');
   grantWindowSelect = document.getElementById('x402-approval-grant-window-select');
@@ -124,6 +139,13 @@ export function initDappX402() {
   bannerDisconnectBtn = document.getElementById('x402-connection-disconnect');
 
   registerScreenHider(() => {
+    // An in-flight payment signature owns the card: the device prompt it
+    // produced cannot be recalled, so cancelling here would tear down the
+    // detection in main (x402:cancel navigates the paywall away) while the
+    // user is still confirming the very payment on the device.
+    // hideAllSubscreens() already refuses to run while a signature is in
+    // flight; this is the second line of defence for a direct hider call.
+    if (pending?.signing) return;
     if (pending) {
       reject().catch((err) => console.error('[x402] hide reject failed:', err));
     } else {
@@ -254,6 +276,14 @@ function wireChooser() {
     if (!(target instanceof HTMLInputElement) || target.name !== 'x402-chooser') return;
     const index = Number(target.value);
     if (!Number.isInteger(index) || index < 0) return;
+    if (pending.signing) {
+      // Frozen: the selected accept is already on the device and cannot be
+      // swapped. Repaint the rows so the radio snaps back to the payment
+      // actually being confirmed — accepting the click would also
+      // re-render the card and re-enable Pay under the live prompt.
+      showChooser(pending.accepts || [], pending.selectedAcceptIndex);
+      return;
+    }
     if (pending.selectedAcceptIndex === index) return;
     pending.selectedAcceptIndex = index;
     renderCard();
@@ -305,6 +335,20 @@ function wireButtons() {
 }
 
 async function showApproval({ webContentsId, detectionId, url, resourceType }) {
+  // The sidebar is a single shared surface and an in-flight signature owns
+  // it: the device prompt it produced cannot be recalled, so a second 402
+  // must not overwrite `pending` and re-enable Pay/Reject/Back underneath
+  // it — the user would be cancelling (or paying) the newcomer while the
+  // device still shows the first payment, and the first payment's own
+  // result would land on the wrong card. The lock is global (see
+  // signature-flight.js), so a dapp-tx/dapp-sign confirmation blocks the
+  // card too. Leave the detection with main; it is re-offered the next
+  // time the page asks.
+  if (isSignatureInFlight()) {
+    console.warn('[x402] approval-needed ignored: a signature is already in flight');
+    return;
+  }
+
   // Re-fetch the canonical details via IPC so the sidebar trusts main's
   // view (asset allowlist, autoPay state, per-accept balances).
   // detectionId routes to the specific 402 we got the event for, immune
@@ -316,6 +360,14 @@ async function showApproval({ webContentsId, detectionId, url, resourceType }) {
     return;
   }
 
+  // Re-checked after the await: the user may have hit Pay on the card
+  // that is currently up (or confirmed on another surface) while the
+  // details round-trip was in flight.
+  if (isSignatureInFlight()) {
+    console.warn('[x402] approval-needed ignored: a signature is already in flight');
+    return;
+  }
+
   hideAllSubscreens();
   resetGrantEditor();
 
@@ -354,6 +406,10 @@ function renderCard() {
   const accepts = pending.accepts || [];
   const fundableCount = accepts.filter((e) => e.fundable).length;
 
+  // Auto-pay can skip this dialog but never the physical confirmation —
+  // say so when the paying account is a hardware wallet.
+  ledgerNoteEl?.classList.toggle('hidden', !isLedgerAccount(walletState.activeWalletIndex));
+
   let origin;
   try { origin = new URL(pending.url).origin; } catch { origin = pending.url; }
   siteEl.textContent = origin;
@@ -420,6 +476,11 @@ function renderCard() {
     hideError();
   }
 
+  // A live device prompt outranks every re-derived button state above:
+  // the signature cannot be recalled, so nothing may hand the user a
+  // second Pay (or a Reject/Back that tears the card down) underneath it.
+  if (pending.signing) lockCardForFlight();
+
   // Over-cap warning for the SELECTED entry's autoPay state.
   if (entry?.autoPay?.kind === 'over-cap') {
     warningTextEl.textContent =
@@ -645,15 +706,17 @@ function buildGrantPayloadFromInputs() {
 
 async function checkUnlockState() {
   try {
-    const status = await window.identity.getStatus();
-
-    if (status.isUnlocked) {
-      // Drop locked-mode collapse + re-derive Pay-button state from
-      // fundability + asset-recognised. The locked branch below
-      // force-disables Pay, so when the user unlocks this is what
-      // restores the correct disabled state — without it the Pay
-      // button stays stuck until a chooser interaction re-triggers
-      // renderCard.
+    // Ledger accounts sign payment authorizations on the device — no
+    // vault key, no unlock gate (short-circuit skips the status IPC).
+    // Either way: drop locked-mode collapse + re-derive Pay-button
+    // state from fundability + asset-recognised. The locked branch
+    // below force-disables Pay, so this is what restores the correct
+    // disabled state — without it the Pay button stays stuck until a
+    // chooser interaction re-triggers renderCard.
+    if (
+      isLedgerAccount(walletState.activeWalletIndex) ||
+      (await window.identity.getStatus()).isUnlocked
+    ) {
       screen?.classList.remove('is-locked');
       unlockBlock?.classList.add('hidden');
       if (pending) renderCard();
@@ -733,24 +796,32 @@ async function handlePasswordUnlock() {
 }
 
 async function approve() {
-  if (!pending) return;
-  pending.signing = true;
-  approveBtn.disabled = true;
-  rejectBtn.disabled = true;
-  approveBtn.textContent = 'Signing…';
+  // Re-entrance guard, same shape as dapp-tx/dapp-sign: a second click
+  // (the chooser's `change` handler re-renders the card, which re-enables
+  // Pay) would start a second, concurrent device signature and let
+  // whichever finishes first settle the other one's flight.
+  if (!pending || pending.signing) return;
+
+  const request = pending;
+  request.signing = true;
+  // Claim the sidebar for the whole flight: no other approval surface may
+  // repaint over the card or tear it down (which would cancel the
+  // detection in main) while the device confirmation is live.
+  beginSignatureFlight(request);
+  lockCardForFlight();
   hideError();
 
   const grant = buildGrantPayloadFromInputs();
   let result;
   try {
     result = await window.electronAPI.x402Approve({
-      webContentsId: pending.webContentsId,
-      detectionId: pending.detectionId,
+      webContentsId: request.webContentsId,
+      detectionId: request.detectionId,
       grant,
-      selectedAcceptIndex: pending.selectedAcceptIndex,
+      selectedAcceptIndex: request.selectedAcceptIndex,
     });
   } catch (err) {
-    restoreCardWithError(err?.message || 'Payment approval failed.');
+    restoreCardWithError(request, err?.message || 'Payment approval failed.');
     return;
   }
 
@@ -759,12 +830,41 @@ async function approve() {
     // and handleApprovalResult finalises it. mainFrame path returns
     // success without pending — close immediately.
     if (result.pending) return;
+    // The card this call belongs to may already be gone (the paying tab
+    // died mid-signature and main sent `cancelled`, tearing it down) and
+    // replaced by a newer request. Settle only our own flight then —
+    // closing here would hide a live card that isn't ours.
+    if (pending !== request) {
+      settleFlight(request);
+      return;
+    }
     closeAndReset();
     updateX402ConnectionBanner().catch(() => {});
     return;
   }
 
-  restoreCardWithError(result?.error);
+  restoreCardWithError(request, result?.error);
+}
+
+// The card's controls while a device confirmation is live: no way in and
+// no way out, because the prompt on the device cannot be recalled. Also
+// re-applied by renderCard, which otherwise re-enables Pay underneath an
+// in-flight signature (chooser flips, unlock re-checks, balance updates).
+function lockCardForFlight() {
+  approveBtn.disabled = true;
+  rejectBtn.disabled = true;
+  if (backBtn) backBtn.disabled = true;
+  approveBtn.textContent = signingButtonLabel(walletState.activeWalletIndex);
+}
+
+// Settle a request's claim on the sidebar. Identity-scoped: a stale
+// continuation (its card already torn down and replaced) clears its own
+// flag and releases only a lock it still holds — endSignatureFlight is a
+// no-op for a token that no longer owns it.
+function settleFlight(request) {
+  if (!request) return;
+  request.signing = false;
+  endSignatureFlight(request);
 }
 
 // Restore the approval card to its clickable state and show an error.
@@ -773,11 +873,19 @@ async function approve() {
 // handleApprovalResult). The locked-vault re-check is the non-obvious
 // behaviour worth centralising — without it the unlock UI won't re-
 // appear when the vault auto-locked between render and click.
-function restoreCardWithError(error) {
-  if (pending) pending.signing = false;
+// `request` is the card the failure belongs to: a continuation whose card
+// was already torn down (cancelled paying tab) must not repaint — or
+// unlock — the card that replaced it, nor release its signature lock.
+function restoreCardWithError(request, error) {
+  settleFlight(request);
+  if (request && pending !== request) {
+    console.warn('[x402] ignoring result for a card that is no longer shown:', error);
+    return;
+  }
   approveBtn.textContent = 'Pay';
   approveBtn.disabled = false;
   rejectBtn.disabled = false;
+  if (backBtn) backBtn.disabled = false;
   showError(error || 'Payment failed.');
   if (/locked/i.test(error || '')) {
     checkUnlockState();
@@ -787,14 +895,23 @@ function restoreCardWithError(error) {
 // Finalises the subresource "Signing..." state when the detector's
 // async sign completes. detectionId-match guards against a stale event
 // for a previously-rendered card.
-function handleApprovalResult({ detectionId, success, error }) {
+function handleApprovalResult({ detectionId, success, error, cancelled }) {
   if (!pending || pending.detectionId !== detectionId) return;
   if (success) {
     closeAndReset();
     updateX402ConnectionBanner().catch(() => {});
     return;
   }
-  restoreCardWithError(error);
+  if (cancelled) {
+    // The request itself is gone (main sends this when the paying tab is
+    // destroyed). There is nothing left to retry, so tear the card down —
+    // which is also what releases the sidebar if the user had already
+    // sent the authorization to the device.
+    console.warn(`[x402] approval cancelled: ${error || 'request is gone'}`);
+    closeAndReset();
+    return;
+  }
+  restoreCardWithError(pending, error);
 }
 
 async function reject() {
@@ -826,11 +943,15 @@ async function reject() {
 function closeAndReset() {
   screen?.classList.add('hidden');
   walletState.identityView?.classList.remove('hidden');
+  // The card is gone, so whatever signature it owned is settled — release
+  // the sidebar (no-op unless this card holds the lock).
+  endSignatureFlight(pending);
   pending = null;
   resetGrantEditor();
   approveBtn.textContent = 'Pay';
   approveBtn.disabled = false;
   rejectBtn.disabled = false;
+  if (backBtn) backBtn.disabled = false;
   hideError();
   hideUnlockError();
   if (passwordInput) passwordInput.value = '';
diff --git a/src/renderer/lib/wallet/dapp-x402.test.js b/src/renderer/lib/wallet/dapp-x402.test.js
index 538c26b5..f521d5b4 100644
--- a/src/renderer/lib/wallet/dapp-x402.test.js
+++ b/src/renderer/lib/wallet/dapp-x402.test.js
@@ -259,6 +259,7 @@ async function loadDappX402(options = {}) {
   const approvalResultHandlers = [];
   const balancesUpdatedHandlers = [];
   const hideAllSubscreens = jest.fn();
+  const screenHiders = [];
   const openSidebarPanel = jest.fn();
   const updatePermissionSubscreen = jest.fn();
   const refreshBalances = jest.fn().mockResolvedValue(undefined);
@@ -320,7 +321,7 @@ async function loadDappX402(options = {}) {
       identityView,
       registeredChains: { 8453: { name: 'Base' } },
     },
-    registerScreenHider: jest.fn(),
+    registerScreenHider: jest.fn((fn) => screenHiders.push(fn)),
     hideAllSubscreens,
   }));
   jest.doMock('../sidebar.js', () => ({
@@ -348,6 +349,7 @@ async function loadDappX402(options = {}) {
     balancesUpdatedHandlers,
     identityView,
     hideAllSubscreens,
+    screenHiders,
     openSidebarPanel,
   };
 }
@@ -441,4 +443,319 @@ describe('dapp-x402 approval card lifecycle', () => {
     expect(ctx.elements['x402-approval-error'].textContent).toBe('Payment settlement failed.');
     expect(ctx.elements['x402-approval-error'].classList.contains('hidden')).toBe(false);
   });
+
+  // The card's own screen hider force-cancels the payment (x402:reject /
+  // x402:cancel + card teardown). Firing it mid-signature would cancel the
+  // detection in main while the device is still showing the payment the
+  // user is confirming — so it must exempt an in-flight signature. The
+  // global lock (signature-flight.js) stops hideAllSubscreens() from
+  // reaching the hider at all; this covers a direct hider call.
+  test('a screen hider fired mid-payment leaves the card and the detection alone', async () => {
+    const ctx = await loadDappX402({ approveResult: { success: true, pending: true } });
+    // After loadDappX402's resetModules, so this is the same lock instance
+    // the module under test holds.
+    const flight = await import('./signature-flight.js');
+
+    await ctx.approvalNeededHandlers[0]({
+      webContentsId: 7,
+      detectionId: 'event-det',
+      url: 'https://pay.example/article',
+      resourceType: 'image',
+    });
+    await ctx.elements['x402-approval-approve'].fire('click');
+    expect(ctx.elements['x402-approval-approve'].textContent).toMatch(/^Signing/);
+    // The payment owns the sidebar for the whole flight.
+    expect(flight.isSignatureInFlight()).toBe(true);
+
+    ctx.screenHiders.forEach((hide) => hide());
+
+    expect(ctx.electronAPI.x402Reject).not.toHaveBeenCalled();
+    expect(ctx.electronAPI.x402Cancel).not.toHaveBeenCalled();
+    expect(ctx.elements['sidebar-x402-approval'].classList.contains('hidden')).toBe(false);
+    expect(ctx.elements['x402-approval-approve'].textContent).toMatch(/^Signing/);
+    expect(ctx.elements['x402-approval-reject'].disabled).toBe(true);
+    expect(ctx.elements['x402-approval-back'].disabled).toBe(true);
+
+    // Settling the payment releases the sidebar for the next surface.
+    ctx.approvalResultHandlers[0]({ detectionId: 'det-1', success: true });
+    expect(flight.isSignatureInFlight()).toBe(false);
+  });
+
+  // The paying tab is chrome the lock deliberately doesn't cover, so it
+  // can be closed while the device prompt is up. Main then reports the
+  // request as cancelled — the card must tear itself down and hand the
+  // sidebar back, otherwise the lock is held for the rest of the session
+  // and every other surface (dApp requests, send, unlock) stays refused.
+  test('a cancelled result tears the card down and releases the sidebar', async () => {
+    const ctx = await loadDappX402({ approveResult: { success: true, pending: true } });
+    const flight = await import('./signature-flight.js');
+    jest.spyOn(console, 'warn').mockImplementation(() => {});
+
+    await ctx.approvalNeededHandlers[0]({
+      webContentsId: 7,
+      detectionId: 'event-det',
+      url: 'https://pay.example/article',
+      resourceType: 'image',
+    });
+    await ctx.elements['x402-approval-approve'].fire('click');
+    expect(flight.isSignatureInFlight()).toBe(true);
+
+    ctx.approvalResultHandlers[0]({
+      detectionId: 'det-1',
+      success: false,
+      cancelled: true,
+      error: 'The tab that requested this payment was closed.',
+    });
+
+    expect(flight.isSignatureInFlight()).toBe(false);
+    expect(ctx.elements['sidebar-x402-approval'].classList.contains('hidden')).toBe(true);
+    expect(ctx.identityView.classList.contains('hidden')).toBe(false);
+    expect(ctx.elements['x402-approval-approve'].textContent).toBe('Pay');
+    expect(ctx.elements['x402-approval-approve'].disabled).toBe(false);
+    // No teardown IPC: the detection died with the tab, and x402:reject
+    // would be aimed at a dead id.
+    expect(ctx.electronAPI.x402Reject).not.toHaveBeenCalled();
+    expect(ctx.electronAPI.x402Cancel).not.toHaveBeenCalled();
+    expect(console.warn).toHaveBeenCalledWith(
+      expect.stringContaining('The tab that requested this payment was closed.')
+    );
+  });
+
+  // A cancelled event for some other tab's card must not touch this one.
+  test('a cancelled result for a different detection is ignored', async () => {
+    const ctx = await loadDappX402({ approveResult: { success: true, pending: true } });
+    const flight = await import('./signature-flight.js');
+
+    await ctx.approvalNeededHandlers[0]({
+      webContentsId: 7,
+      detectionId: 'event-det',
+      url: 'https://pay.example/article',
+      resourceType: 'image',
+    });
+    await ctx.elements['x402-approval-approve'].fire('click');
+
+    ctx.approvalResultHandlers[0]({ detectionId: 'other-det', success: false, cancelled: true });
+
+    expect(flight.isSignatureInFlight()).toBe(true);
+    expect(ctx.elements['sidebar-x402-approval'].classList.contains('hidden')).toBe(false);
+    expect(ctx.elements['x402-approval-approve'].textContent).toMatch(/^Signing/);
+
+    // Clean up the lock so it can't bleed into another test.
+    ctx.approvalResultHandlers[0]({ detectionId: 'det-1', success: true });
+  });
+
+  // The chooser radios stay live DOM while the authorization sits on the
+  // device. Flipping one re-rendered the card, which re-derived Pay as
+  // enabled — a second click then started a second, concurrent device
+  // signature for a different accept, and whichever settled first
+  // released the lock the other one was still holding.
+  test('a chooser flip mid-signature cannot re-arm Pay or start a second signature', async () => {
+    let releaseApprove;
+    const approveGate = new Promise((resolve) => {
+      releaseApprove = resolve;
+    });
+    const ctx = await loadDappX402({
+      details: {
+        success: true,
+        detectionId: 'det-1',
+        url: 'https://pay.example/article',
+        accepts: [
+          createAccept(),
+          createAccept({
+            balanceKey: '8453:0xDAI',
+            asset: { symbol: 'DAI', decimals: 18 },
+          }),
+        ],
+        initialSelectionIndex: 0,
+      },
+    });
+    const flight = await import('./signature-flight.js');
+    ctx.electronAPI.x402Approve.mockReturnValue(approveGate);
+
+    await ctx.approvalNeededHandlers[0]({
+      webContentsId: 7,
+      detectionId: 'event-det',
+      url: 'https://pay.example/article',
+      resourceType: 'mainFrame',
+    });
+    await flushMicrotasks();
+    expect(ctx.elements['x402-approval-chooser'].classList.contains('hidden')).toBe(false);
+
+    const paying = ctx.elements['x402-approval-approve'].fire('click');
+    await flushMicrotasks();
+    expect(flight.isSignatureInFlight()).toBe(true);
+    expect(ctx.elements['x402-approval-approve'].textContent).toMatch(/^Signing/);
+
+    const radio = new FakeInputElement();
+    radio.name = 'x402-chooser';
+    radio.value = '1';
+    await ctx.elements['x402-approval-chooser-options'].fire('change', { target: radio });
+
+    expect(ctx.elements['x402-approval-approve'].disabled).toBe(true);
+    expect(ctx.elements['x402-approval-approve'].textContent).toMatch(/^Signing/);
+    expect(ctx.elements['x402-approval-reject'].disabled).toBe(true);
+    expect(ctx.elements['x402-approval-back'].disabled).toBe(true);
+    // The rows are repainted from the pinned selection, so the radio can't
+    // show an accept the device isn't holding.
+    const rows = ctx.elements['x402-approval-chooser-options'].children;
+    expect(rows).toHaveLength(2);
+    expect(rows[0].innerHTML).toMatch(/value="0" checked/);
+    expect(rows[1].innerHTML).not.toMatch(/checked/);
+
+    // Even a click that gets through anyway (the button is shared DOM)
+    // must not reach the device a second time.
+    await ctx.elements['x402-approval-approve'].fire('click');
+    expect(ctx.electronAPI.x402Approve).toHaveBeenCalledTimes(1);
+    expect(ctx.electronAPI.x402Approve).toHaveBeenCalledWith(
+      expect.objectContaining({ selectedAcceptIndex: 0 })
+    );
+
+    releaseApprove({ success: true });
+    await paying;
+    expect(flight.isSignatureInFlight()).toBe(false);
+  });
+
+  // The paying tab can die mid-signature, which tears the card down and
+  // frees the sidebar for the next 402 — but the first card's approve()
+  // is still parked on the device. Its continuation must settle only
+  // itself, never the card that took the sidebar over.
+  test('a stale approve failure cannot release or repaint the card that replaced it', async () => {
+    const ctx = await loadDappX402();
+    const flight = await import('./signature-flight.js');
+    jest.spyOn(console, 'warn').mockImplementation(() => {});
+
+    let failFirstApprove;
+    ctx.electronAPI.x402Approve.mockImplementationOnce(
+      () => new Promise((_, reject) => { failFirstApprove = reject; })
+    );
+
+    // Card A pays; the device prompt is live.
+    await ctx.approvalNeededHandlers[0]({
+      webContentsId: 7,
+      detectionId: 'event-det',
+      url: 'https://pay.example/a',
+      resourceType: 'mainFrame',
+    });
+    await flushMicrotasks();
+    const payingA = ctx.elements['x402-approval-approve'].fire('click');
+    await flushMicrotasks();
+    expect(flight.isSignatureInFlight()).toBe(true);
+
+    // Its tab dies: main reports the request as cancelled, the card goes.
+    ctx.approvalResultHandlers[0]({
+      detectionId: 'det-1',
+      success: false,
+      cancelled: true,
+      error: 'The tab that requested this payment was closed.',
+    });
+    expect(flight.isSignatureInFlight()).toBe(false);
+
+    // Card B takes the sidebar and starts its own device confirmation.
+    ctx.electronAPI.x402GetDetails.mockResolvedValue({
+      success: true,
+      detectionId: 'det-2',
+      url: 'https://pay.example/b',
+      accepts: [createAccept()],
+      initialSelectionIndex: 0,
+    });
+    ctx.electronAPI.x402Approve.mockResolvedValue({ success: true, pending: true });
+    await ctx.approvalNeededHandlers[0]({
+      webContentsId: 9,
+      detectionId: 'det-2',
+      url: 'https://pay.example/b',
+      resourceType: 'image',
+    });
+    await flushMicrotasks();
+    await ctx.elements['x402-approval-approve'].fire('click');
+    expect(flight.isSignatureInFlight()).toBe(true);
+
+    // The user finally clears card A's prompt on the device.
+    failFirstApprove(new Error('Request rejected on the Ledger device.'));
+    await payingA;
+    await flushMicrotasks();
+
+    expect(flight.isSignatureInFlight()).toBe(true);
+    expect(ctx.elements['sidebar-x402-approval'].classList.contains('hidden')).toBe(false);
+    expect(ctx.elements['x402-approval-approve'].textContent).toMatch(/^Signing/);
+    expect(ctx.elements['x402-approval-approve'].disabled).toBe(true);
+    expect(ctx.elements['x402-approval-error'].classList.contains('hidden')).toBe(true);
+
+    // Card B settles normally afterwards.
+    ctx.approvalResultHandlers[0]({ detectionId: 'det-2', success: true });
+    expect(flight.isSignatureInFlight()).toBe(false);
+  });
+
+  // Same staleness, opposite outcome: card A's payment succeeds after its
+  // card is gone. Closing the screen here would hide card B while its own
+  // signature is still live in main.
+  test('a stale approve success cannot tear down the card that replaced it', async () => {
+    const ctx = await loadDappX402();
+    const flight = await import('./signature-flight.js');
+    jest.spyOn(console, 'warn').mockImplementation(() => {});
+
+    let settleFirstApprove;
+    ctx.electronAPI.x402Approve.mockImplementationOnce(
+      () => new Promise((resolve) => { settleFirstApprove = resolve; })
+    );
+
+    await ctx.approvalNeededHandlers[0]({
+      webContentsId: 7,
+      detectionId: 'event-det',
+      url: 'https://pay.example/a',
+      resourceType: 'mainFrame',
+    });
+    await flushMicrotasks();
+    const payingA = ctx.elements['x402-approval-approve'].fire('click');
+    await flushMicrotasks();
+
+    ctx.approvalResultHandlers[0]({ detectionId: 'det-1', success: false, cancelled: true });
+
+    ctx.electronAPI.x402GetDetails.mockResolvedValue({
+      success: true,
+      detectionId: 'det-2',
+      url: 'https://pay.example/b',
+      accepts: [createAccept()],
+      initialSelectionIndex: 0,
+    });
+    ctx.electronAPI.x402Approve.mockResolvedValue({ success: true, pending: true });
+    await ctx.approvalNeededHandlers[0]({
+      webContentsId: 9,
+      detectionId: 'det-2',
+      url: 'https://pay.example/b',
+      resourceType: 'image',
+    });
+    await flushMicrotasks();
+    await ctx.elements['x402-approval-approve'].fire('click');
+
+    settleFirstApprove({ success: true });
+    await payingA;
+    await flushMicrotasks();
+
+    expect(flight.isSignatureInFlight()).toBe(true);
+    expect(ctx.elements['sidebar-x402-approval'].classList.contains('hidden')).toBe(false);
+    expect(ctx.elements['x402-approval-approve'].textContent).toMatch(/^Signing/);
+
+    ctx.approvalResultHandlers[0]({ detectionId: 'det-2', success: true });
+    expect(flight.isSignatureInFlight()).toBe(false);
+  });
+
+  // Once idle again the hider keeps its original meaning: an unanswered
+  // card being replaced by another screen is a cancel.
+  test('a screen hider fired on an unsigned card still cancels the payment', async () => {
+    const ctx = await loadDappX402();
+
+    await ctx.approvalNeededHandlers[0]({
+      webContentsId: 7,
+      detectionId: 'event-det',
+      url: 'https://pay.example/article',
+      resourceType: 'mainFrame',
+    });
+    await flushMicrotasks();
+
+    ctx.screenHiders.forEach((hide) => hide());
+    await flushMicrotasks();
+
+    expect(ctx.electronAPI.x402Cancel).toHaveBeenCalledWith({ webContentsId: 7 });
+    expect(ctx.elements['sidebar-x402-approval'].classList.contains('hidden')).toBe(true);
+  });
 });
diff --git a/src/renderer/lib/wallet/export-mnemonic.js b/src/renderer/lib/wallet/export-mnemonic.js
index cf8cded5..3237854e 100644
--- a/src/renderer/lib/wallet/export-mnemonic.js
+++ b/src/renderer/lib/wallet/export-mnemonic.js
@@ -5,6 +5,7 @@
  */
 
 import { walletState, registerScreenHider } from './wallet-state.js';
+import { refuseSubscreenWhileInFlight } from './signature-flight.js';
 
 // DOM references
 let exportMnemonicScreen;
@@ -70,6 +71,8 @@ function setupExportMnemonicListeners() {
 }
 
 async function openExportMnemonic() {
+  if (refuseSubscreenWhileInFlight('Recovery phrase screen')) return;
+
   walletState.identityView?.classList.add('hidden');
   exportMnemonicScreen?.classList.remove('hidden');
 
diff --git a/src/renderer/lib/wallet/permission-manage.js b/src/renderer/lib/wallet/permission-manage.js
index b6ce7bf8..665c4ac4 100644
--- a/src/renderer/lib/wallet/permission-manage.js
+++ b/src/renderer/lib/wallet/permission-manage.js
@@ -6,6 +6,7 @@
  */
 
 import { walletState, hideAllSubscreens, registerScreenHider } from './wallet-state.js';
+import { isSignatureInFlight } from './signature-flight.js';
 import { open as openSidebarPanel } from '../sidebar.js';
 import { updateConnectionBanner, disconnectDapp } from './dapp-connect.js';
 import { updateSwarmConnectionBanner, disconnectSwarmApp } from './swarm-connect.js';
@@ -120,10 +121,26 @@ export function initPermissionManage() {
   registerScreenHider(() => closeX402Perms());
 }
 
+/**
+ * These management subscreens are opened from the connection banners, but
+ * the banners live in the identity view that an approval screen hides — so
+ * this is belt-and-braces against any future entry point: while a device
+ * confirmation is live it owns the sidebar (see signature-flight.js) and
+ * nothing may repaint over it.
+ */
+function signatureInFlightBlocks(what) {
+  if (!isSignatureInFlight()) return false;
+  console.warn(`[PermissionManage] ${what} not opened: a signature is already in flight`);
+  return true;
+}
+
 export async function showDappPermissions(permissionKey) {
+  if (signatureInFlightBlocks('dapp permissions')) return;
+
   const permission = await window.dappPermissions.getPermission(permissionKey);
   if (!permission) return;
 
+  if (signatureInFlightBlocks('dapp permissions')) return;
   hideAllSubscreens();
   dappPermsKey = permissionKey;
   if (dappPermsSite) dappPermsSite.textContent = permissionKey;
@@ -203,6 +220,8 @@ async function handleDappDisconnect() {
 }
 
 export async function showSwarmPermissions(permissionKey, options = {}) {
+  if (signatureInFlightBlocks('swarm permissions')) return;
+
   const permission = await window.swarmPermissions.getPermission(permissionKey);
   if (!permission) return;
 
@@ -211,6 +230,7 @@ export async function showSwarmPermissions(permissionKey, options = {}) {
     return;
   }
 
+  if (signatureInFlightBlocks('swarm permissions')) return;
   hideAllSubscreens();
   swarmPermsKey = permissionKey;
   if (swarmPermsSite) swarmPermsSite.textContent = permissionKey;
@@ -341,6 +361,8 @@ async function createSwarmAppScopedIdentity() {
 }
 
 export async function showX402Permissions(originKey) {
+  if (signatureInFlightBlocks('x402 permissions')) return;
+
   hideAllSubscreens();
 
   x402PermsKey = originKey;
diff --git a/src/renderer/lib/wallet/publish-setup.js b/src/renderer/lib/wallet/publish-setup.js
index a3509224..c6afacfe 100644
--- a/src/renderer/lib/wallet/publish-setup.js
+++ b/src/renderer/lib/wallet/publish-setup.js
@@ -7,6 +7,7 @@
 
 import { state } from '../state.js';
 import { walletState, registerScreenHider } from './wallet-state.js';
+import { refuseSubscreenWhileInFlight } from './signature-flight.js';
 import { isChequebookDeployed } from './wallet-utils.js';
 import { normalizeSwarmMode } from './swarm-readiness.js';
 import { fetchAntJson } from './ant-api.js';
@@ -77,6 +78,8 @@ export function initPublishSetup() {
 }
 
 export function openPublishSetup() {
+  if (refuseSubscreenWhileInFlight('Publish setup screen')) return;
+
   walletState.identityView?.classList.add('hidden');
   publishSetupScreen?.classList.remove('hidden');
 
diff --git a/src/renderer/lib/wallet/publisher-identities.js b/src/renderer/lib/wallet/publisher-identities.js
index 7c99be05..4a6b305c 100644
--- a/src/renderer/lib/wallet/publisher-identities.js
+++ b/src/renderer/lib/wallet/publisher-identities.js
@@ -6,6 +6,7 @@
  */
 
 import { walletState, registerScreenHider } from './wallet-state.js';
+import { refuseSubscreenWhileInFlight } from './signature-flight.js';
 import { escapeHtml } from './wallet-utils.js';
 import { showVaultUnlock } from './vault-unlock.js';
 import { showPublisherIdentityCreate } from './publisher-identity-create.js';
@@ -60,6 +61,8 @@ export function initPublisherIdentities() {
 }
 
 export async function openPublisherIdentities() {
+  if (refuseSubscreenWhileInFlight('Publisher identities screen')) return;
+
   await reloadEntries();
   if (filterInput) filterInput.value = '';
   showPublisherIdentityList();
diff --git a/src/renderer/lib/wallet/publisher-identity-selector.js b/src/renderer/lib/wallet/publisher-identity-selector.js
index 962e72a7..40027dba 100644
--- a/src/renderer/lib/wallet/publisher-identity-selector.js
+++ b/src/renderer/lib/wallet/publisher-identity-selector.js
@@ -142,6 +142,13 @@ function buildIdentityItem(identity, isActive, handlers) {
   item.type = 'button';
   item.className = 'wallet-selector-item publisher-identity-selector-item';
   if (isActive) item.classList.add('active');
+  // Main flags identities whose backing account can't sign feeds (deleted
+  // wallet, hardware account). Selecting one would only fail later, so the
+  // row is shown greyed out and inert instead of silently breaking feeds.
+  if (identity.unavailable) {
+    item.classList.add('unavailable');
+    item.disabled = true;
+  }
 
   item.innerHTML = `
     <div class="wallet-selector-item-info">
@@ -149,6 +156,7 @@ function buildIdentityItem(identity, isActive, handlers) {
       <div class="wallet-selector-item-address-row">
         <span class="publisher-identity-mode">${escapeHtml(identityModeLabel(identity))}</span>
         <code class="wallet-selector-item-address" title="${escapeHtml(identity.owner || '')}">${escapeHtml(truncateAddress(identity.owner))}</code>
+        ${identity.unavailable ? '<span class="publisher-identity-unavailable">Can’t sign feeds</span>' : ''}
       </div>
     </div>
     <div class="wallet-selector-item-actions">
@@ -161,6 +169,7 @@ function buildIdentityItem(identity, isActive, handlers) {
   `;
 
   item.addEventListener('click', () => {
+    if (identity.unavailable) return;
     closePublisherIdentityDropdowns();
     handlers.onSelect?.(identity);
   });
diff --git a/src/renderer/lib/wallet/receive.js b/src/renderer/lib/wallet/receive.js
index 3505bab1..689a8a2f 100644
--- a/src/renderer/lib/wallet/receive.js
+++ b/src/renderer/lib/wallet/receive.js
@@ -5,6 +5,7 @@
  */
 
 import { walletState, registerScreenHider } from './wallet-state.js';
+import { refuseSubscreenWhileInFlight } from './signature-flight.js';
 
 // DOM references
 let receiveScreen;
@@ -42,6 +43,8 @@ function setupReceiveScreen() {
 }
 
 export async function openReceive() {
+  if (refuseSubscreenWhileInFlight('Receive screen')) return;
+
   if (!walletState.fullAddresses.wallet) {
     console.error('[WalletUI] No wallet address available');
     return;
diff --git a/src/renderer/lib/wallet/send.js b/src/renderer/lib/wallet/send.js
index bbd53614..4f74ba24 100644
--- a/src/renderer/lib/wallet/send.js
+++ b/src/renderer/lib/wallet/send.js
@@ -5,7 +5,12 @@
  */
 
 import { walletState, registerScreenHider } from './wallet-state.js';
-import { escapeHtml } from './wallet-utils.js';
+import {
+  isSignatureInFlight,
+  beginSignatureFlight,
+  endSignatureFlight,
+} from './signature-flight.js';
+import { escapeHtml, isLedgerAccount, bypassUnlockGateForHardware } from './wallet-utils.js';
 import { refreshBalances, getTokensWithBalance, getChainsWithBalance, sortTokens } from './balance-display.js';
 import {
   getTrustStatusSentence,
@@ -82,6 +87,12 @@ let sendTxState = {
   chainId: null,
 };
 
+// Token identifying *this* screen's in-flight signature while
+// wallet:send-transaction is awaiting the device. Identity (not a boolean)
+// so a late release from a superseded send cannot free a lock it no longer
+// holds — see signature-flight.js.
+let sendFlight = null;
+
 export function initSend() {
   sendScreen = document.getElementById('sidebar-send');
   sendBackBtn = document.getElementById('send-back');
@@ -131,7 +142,17 @@ export function initSend() {
   sendRetryBtn = document.getElementById('send-retry-btn');
 
   // Register screen hider
-  registerScreenHider(() => sendScreen?.classList.add('hidden'));
+  registerScreenHider(() => {
+    // An in-flight send signature owns the sidebar: the device prompt it
+    // produced cannot be recalled, so hiding "Confirm on your Ledger" here
+    // would leave the user answering another surface's screen while the
+    // device still shows this transaction — and the broadcast would land
+    // with no visible feedback. hideAllSubscreens() already refuses while
+    // a signature is in flight; this is the second line of defence for a
+    // direct hider call.
+    if (sendFlight) return;
+    sendScreen?.classList.add('hidden');
+  });
 
   setupSendScreen();
 }
@@ -237,6 +258,17 @@ export function openSend(options = {}) {
     return;
   }
 
+  // The send screen takes over the sidebar directly (it predates
+  // hideAllSubscreens), so it needs its own check: while a device
+  // confirmation is live the screen that started it owns the sidebar and
+  // nothing may paint over it — see signature-flight.js. Entry points are
+  // page-reachable (an `ethereum:` tip link routes here via openSendFlow),
+  // so this is not merely belt-and-braces.
+  if (isSignatureInFlight()) {
+    console.warn('[WalletUI] Send screen not opened: a signature is already in flight');
+    return;
+  }
+
   resetSendState();
   applySendOpenOptions(options);
 
@@ -254,6 +286,14 @@ export function openSend(options = {}) {
 }
 
 export function closeSend() {
+  // Same ownership rule as the screen hider, on the other teardown path:
+  // Back, a sidebar close and the coordinator's closeAllSubscreens() all
+  // land here. Resetting state under a live device prompt would strand the
+  // broadcast with no UI to report into.
+  if (sendFlight) {
+    console.warn('[WalletUI] Send screen not closed: a signature is in flight on this transaction');
+    return;
+  }
   sendScreen?.classList.add('hidden');
   walletState.identityView?.classList.remove('hidden');
   resetSendState();
@@ -319,6 +359,17 @@ function showSendPendingView() {
   sendPendingView?.classList.remove('hidden');
   sendSuccessView?.classList.add('hidden');
   sendErrorView?.classList.add('hidden');
+
+  // Hardware accounts wait on a physical confirmation, not the network.
+  const onLedger = isLedgerAccount(walletState.activeWalletIndex);
+  const title = sendPendingView?.querySelector('.send-pending-title');
+  const text = sendPendingView?.querySelector('.send-pending-text');
+  if (title) title.textContent = onLedger ? 'Confirm on your Ledger' : 'Sending Transaction';
+  if (text) {
+    text.textContent = onLedger
+      ? 'Review the transaction on your Ledger and approve it there.'
+      : 'Please wait while your transaction is being processed...';
+  }
 }
 
 function showSendSuccessView(explorerUrl) {
@@ -1053,6 +1104,10 @@ function buildRecipientVerifiedBadge(trust) {
 
 async function configureSendUnlockUI() {
   try {
+    if (bypassUnlockGateForHardware(walletState.activeWalletIndex, sendUnlockSection, sendConfirmBtn)) {
+      return;
+    }
+
     const status = await window.identity.getStatus();
 
     if (status.isUnlocked) {
@@ -1147,6 +1202,16 @@ async function handleSendConfirm() {
 
   showSendPendingView();
 
+  // Claim the sidebar for the whole flight: wallet:send-transaction puts a
+  // prompt on the device that the renderer cannot recall, so no other
+  // approval surface may repaint over "Confirm on your Ledger" or tear it
+  // down. Back is the other way out of this screen and must go too — see
+  // signature-flight.js.
+  const flight = {};
+  sendFlight = flight;
+  beginSignatureFlight(flight);
+  if (sendBackBtn) sendBackBtn.disabled = true;
+
   try {
     const token = sendTxState.selectedToken;
 
@@ -1204,6 +1269,13 @@ async function handleSendConfirm() {
   } catch (err) {
     console.error('[WalletUI] Transaction failed:', err);
     showSendErrorView(err.message || 'Transaction failed');
+  } finally {
+    // The device prompt is answered (or the send never reached it), so the
+    // sidebar is free again. Guarded on identity so a superseded flight
+    // cannot release a lock a later send holds.
+    if (sendFlight === flight) sendFlight = null;
+    endSignatureFlight(flight);
+    if (sendBackBtn) sendBackBtn.disabled = false;
   }
 }
 
diff --git a/src/renderer/lib/wallet/send.test.js b/src/renderer/lib/wallet/send.test.js
index 9df56b7a..4407e20a 100644
--- a/src/renderer/lib/wallet/send.test.js
+++ b/src/renderer/lib/wallet/send.test.js
@@ -115,3 +115,166 @@ describe('send wallet review', () => {
     expect(warning.getAttribute('aria-label')).toContain('spoof.gwei');
   });
 });
+
+const { createDocument, createElement } = require('../../../../test/helpers/fake-dom.js');
+
+const SEND_ELEMENT_IDS = [
+  'sidebar-send', 'send-back', 'send-input-view', 'send-review-view',
+  'send-pending-view', 'send-success-view', 'send-error-view', 'send-recipient',
+  'send-recipient-error', 'send-chain-selector', 'send-chain-btn', 'send-chain-logo',
+  'send-chain-name', 'send-chain-dropdown', 'send-chain-list', 'send-asset-selector',
+  'send-asset-btn', 'send-asset-logo', 'send-asset-name', 'send-asset-dropdown',
+  'send-asset-list', 'send-amount', 'send-max-btn', 'send-balance-hint',
+  'send-amount-error', 'send-continue-btn', 'send-general-error', 'send-review-to',
+  'send-review-amount', 'send-review-network', 'send-review-fee-value',
+  'send-review-total', 'send-edit-btn', 'send-confirm-btn', 'send-unlock-section',
+  'send-touchid-btn', 'send-password-link', 'send-password-section',
+  'send-password-input', 'send-password-submit', 'send-unlock-error',
+  'send-review-error', 'send-explorer-link', 'send-done-btn', 'send-error-text',
+  'send-retry-btn', 'wallet-send-btn',
+];
+
+const flush = () => new Promise((resolve) => setImmediate(resolve));
+
+const deferred = () => {
+  let resolve;
+  const promise = new Promise((res) => { resolve = res; });
+  return { promise, resolve };
+};
+
+// Drives the real send screen against the real wallet-state/signature-flight
+// modules, so the shared sidebar lock under test is the same instance every
+// other approval surface would see.
+async function loadSendScreen() {
+  jest.resetModules();
+  // The screen arms focus/balance-refresh timers we don't care about here;
+  // faking them keeps no handles alive past the test.
+  jest.useFakeTimers({ doNotFake: ['setImmediate', 'nextTick', 'queueMicrotask'] });
+
+  // The screen and its views start hidden, as they do in index.html, so
+  // that showing/hiding them is observable.
+  const startsHidden = new Set([
+    'sidebar-send', 'send-input-view', 'send-review-view', 'send-pending-view',
+    'send-success-view', 'send-error-view',
+  ]);
+  const elements = Object.fromEntries(
+    SEND_ELEMENT_IDS.map((id) => [
+      id,
+      createElement('div', startsHidden.has(id) ? { classes: ['hidden'] } : {}),
+    ])
+  );
+  global.document = createDocument({ elementsById: elements });
+
+  const send = deferred();
+  global.window = {
+    location: { href: 'file:///app/index.html' },
+    internalPages: { routable: {} },
+    electronAPI: {},
+    wallet: {
+      parseAmount: jest.fn().mockResolvedValue({ success: true, value: '1000' }),
+      sendTransaction: jest.fn(() => send.promise),
+    },
+    dispatchEvent: jest.fn(),
+    CustomEvent: class {},
+  };
+  global.CustomEvent = class { constructor(type, init) { this.type = type; Object.assign(this, init); } };
+
+  const token = { key: 'gnosis-native', symbol: 'xDAI', decimals: 18, address: null };
+  jest.doMock('./balance-display.js', () => ({
+    refreshBalances: jest.fn(),
+    getTokensWithBalance: jest.fn(() => [token]),
+    getChainsWithBalance: jest.fn(() => [{ chainId: 100 }]),
+    sortTokens: jest.fn((tokens) => tokens),
+  }));
+  jest.doMock('../tabs.js', () => ({ createTab: jest.fn() }));
+
+  const state = await import('./wallet-state.js');
+  const flight = await import('./signature-flight.js');
+  state.walletState.fullAddresses.wallet = ADDRESS;
+  state.walletState.identityView = createElement('div');
+  state.walletState.selectedChainId = 100;
+  state.walletState.registeredChains = { 100: { name: 'Gnosis' } };
+  // A hardware account: the send waits on a device prompt that cannot be
+  // recalled, which is what makes the sidebar lock necessary.
+  state.walletState.activeWalletIndex = 0;
+  state.walletState.derivedWallets = [{ index: 0, type: 'ledger' }];
+
+  const mod = await import('./send.js');
+  mod.initSend();
+
+  return { mod, state, flight, elements, send };
+}
+
+describe('send screen sidebar ownership', () => {
+  afterEach(() => {
+    jest.dontMock('./balance-display.js');
+    jest.dontMock('../tabs.js');
+    delete global.document;
+    delete global.window;
+    delete global.CustomEvent;
+    jest.useRealTimers();
+  });
+
+  test('a confirming send holds the shared sidebar lock until the device answers', async () => {
+    const { mod, flight, elements, send } = await loadSendScreen();
+
+    mod.openSend();
+    expect(flight.isSignatureInFlight()).toBe(false);
+
+    elements['send-confirm-btn'].dispatch('click');
+    await flush();
+    expect(window.wallet.sendTransaction).toHaveBeenCalled();
+    expect(flight.isSignatureInFlight()).toBe(true);
+
+    send.resolve({ success: true, hash: '0xfeedface', explorerUrl: 'https://ex/0xfeedface' });
+    await flush();
+    expect(flight.isSignatureInFlight()).toBe(false);
+  });
+
+  test('nothing may hide the send screen while its signature is in flight', async () => {
+    const { mod, state, elements, send } = await loadSendScreen();
+
+    mod.openSend();
+    elements['send-confirm-btn'].dispatch('click');
+    await flush();
+
+    // The shared teardown a dApp request would use (personal_sign,
+    // eth_requestAccounts) must refuse rather than paint over the live
+    // "Confirm on your Ledger" screen.
+    expect(() => state.hideAllSubscreens()).toThrow(/already in progress/);
+    expect(elements['sidebar-send'].classList.contains('hidden')).toBe(false);
+    expect(elements['send-pending-view'].classList.contains('hidden')).toBe(false);
+
+    // Back / sidebar-close / closeAllSubscreens land on closeSend().
+    mod.closeSend();
+    expect(elements['sidebar-send'].classList.contains('hidden')).toBe(false);
+    expect(elements['send-back'].disabled).toBe(true);
+
+    send.resolve({ success: true, hash: '0xfeedface', explorerUrl: 'https://ex/0xfeedface' });
+    await flush();
+
+    // Once the device has answered the screen is ordinary again.
+    expect(elements['send-success-view'].classList.contains('hidden')).toBe(false);
+    expect(elements['send-back'].disabled).toBe(false);
+    state.hideAllSubscreens();
+    expect(elements['sidebar-send'].classList.contains('hidden')).toBe(true);
+  });
+
+  test('the send screen refuses to open over another surface\'s device confirmation', async () => {
+    const { mod, flight, elements } = await loadSendScreen();
+
+    // An x402 payment / dApp transaction is waiting on the device.
+    const other = {};
+    flight.beginSignatureFlight(other);
+
+    mod.openSend();
+    expect(elements['sidebar-send'].classList.contains('hidden')).toBe(true);
+    expect(elements['send-input-view'].classList.contains('hidden')).toBe(true);
+
+    // …and opens normally once the device has answered.
+    flight.endSignatureFlight(other);
+    mod.openSend();
+    expect(elements['sidebar-send'].classList.contains('hidden')).toBe(false);
+    expect(elements['send-input-view'].classList.contains('hidden')).toBe(false);
+  });
+});
diff --git a/src/renderer/lib/wallet/signature-flight.js b/src/renderer/lib/wallet/signature-flight.js
new file mode 100644
index 00000000..75e5ddc7
--- /dev/null
+++ b/src/renderer/lib/wallet/signature-flight.js
@@ -0,0 +1,97 @@
+/**
+ * Approval-surface ownership lock.
+ *
+ * A hardware signature is a device prompt we cannot recall: once the user
+ * has been asked to confirm on the device, nothing in the renderer can take
+ * the request back. The sidebar is a single shared surface, so while such a
+ * signature is in flight the approval screen that started it owns the
+ * sidebar — no other surface (dapp-tx, dapp-sign, dapp-connect, x402,
+ * vault-unlock, swarm, permission management) may repaint over it or tear it
+ * down via hideAllSubscreens().
+ *
+ * The lock lives here, not in the individual modules, because a per-module
+ * `pending.signing` flag only stops a module from stealing its *own* screen;
+ * the screen itself is shared by every module. It is also deliberately not
+ * part of `walletState` — that object is view state that tests replace
+ * wholesale, whereas this lock must be the same instance for every surface.
+ */
+
+// The request object that owns the sidebar, or null when idle. Identity of
+// the token matters (not just a boolean) so a late `end` from a superseded
+// request cannot release a lock it no longer holds.
+let owner = null;
+
+// Chrome that is not itself an approval surface — the sidebar's close
+// button, the toolbar toggle, the tab bar — has to *look* locked while the
+// device prompt is up, the same way Back/Reject do. Those controls live
+// outside any approval module, so they subscribe here instead of polling.
+const listeners = new Set();
+
+/**
+ * Subscribe to lock ownership changes. The listener is called with the new
+ * in-flight boolean whenever it flips. Returns an unsubscribe function.
+ */
+export function onSignatureFlightChange(listener) {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+
+function notify(wasInFlight) {
+  const inFlight = owner !== null;
+  if (inFlight === wasInFlight) return;
+  listeners.forEach((listener) => {
+    try {
+      listener(inFlight);
+    } catch (err) {
+      console.error('[SignatureFlight] listener failed:', err);
+    }
+  });
+}
+
+/** Take the lock for `token` (typically the module's `pending` object). */
+export function beginSignatureFlight(token) {
+  const wasInFlight = owner !== null;
+  owner = token ?? null;
+  notify(wasInFlight);
+}
+
+/** Release the lock, but only if `token` still holds it. */
+export function endSignatureFlight(token) {
+  if (token && owner === token) {
+    owner = null;
+    notify(true);
+  }
+}
+
+export function isSignatureInFlight() {
+  return owner !== null;
+}
+
+/**
+ * The standard "already pending" JSON-RPC error handed to whichever dApp
+ * request tried to take the screen while a device confirmation was live.
+ * The dApp can retry once the device is done.
+ */
+export function signatureInFlightError() {
+  return Object.assign(
+    new Error('A signature is already in progress — finish it on your device first'),
+    { code: -32002 }
+  );
+}
+
+export function assertNoSignatureInFlight() {
+  if (owner !== null) {
+    throw signatureInFlightError();
+  }
+}
+
+/**
+ * Guard for a sub-screen that takes the sidebar over directly instead of
+ * going through hideAllSubscreens() (so the backstop there does not cover
+ * it). Returns true — "refuse to open" — while any surface owns the device.
+ */
+export function refuseSubscreenWhileInFlight(label) {
+  if (owner === null) return false;
+  console.warn(`[WalletUI] ${label} not opened: a signature is in flight`);
+  return true;
+}
diff --git a/src/renderer/lib/wallet/signature-flight.test.js b/src/renderer/lib/wallet/signature-flight.test.js
new file mode 100644
index 00000000..e0c2fed3
--- /dev/null
+++ b/src/renderer/lib/wallet/signature-flight.test.js
@@ -0,0 +1,109 @@
+/**
+ * The approval-surface ownership lock, and the hideAllSubscreens()
+ * backstop that enforces it.
+ *
+ * Every approval surface (dapp-tx, dapp-sign, dapp-connect, x402, swarm,
+ * vault-unlock) shares one sidebar and takes it over by calling
+ * hideAllSubscreens(). A per-module "signature in flight" flag therefore
+ * only protects a module from itself — the cross-surface case is what
+ * these tests pin down.
+ */
+
+async function load() {
+  jest.resetModules();
+  const flight = await import('./signature-flight.js');
+  const state = await import('./wallet-state.js');
+  return { flight, state };
+}
+
+describe('signature-flight lock', () => {
+  test('hideAllSubscreens runs every hider when no signature is in flight', async () => {
+    const { state } = await load();
+    const hider = jest.fn();
+    state.registerScreenHider(hider);
+
+    state.hideAllSubscreens();
+
+    expect(hider).toHaveBeenCalledTimes(1);
+  });
+
+  test('hideAllSubscreens refuses — and hides nothing — while a signature is in flight', async () => {
+    const { flight, state } = await load();
+    const hider = jest.fn();
+    state.registerScreenHider(hider);
+    const request = { id: 'ledger-tx' };
+
+    flight.beginSignatureFlight(request);
+
+    expect(() => state.hideAllSubscreens()).toThrow(/already in progress/);
+    // The screen the device prompt belongs to is still standing: no hider
+    // ran, so nothing was torn down or re-enabled underneath it.
+    expect(hider).not.toHaveBeenCalled();
+  });
+
+  test('the refusal carries the standard "already pending" JSON-RPC code', async () => {
+    const { flight, state } = await load();
+    flight.beginSignatureFlight({});
+
+    expect(() => state.hideAllSubscreens()).toThrow(
+      expect.objectContaining({ code: -32002 })
+    );
+    expect(flight.signatureInFlightError().code).toBe(-32002);
+    expect(() => flight.assertNoSignatureInFlight()).toThrow(
+      expect.objectContaining({ code: -32002 })
+    );
+  });
+
+  test('the lock is released only by the request that took it', async () => {
+    const { flight, state } = await load();
+    const hider = jest.fn();
+    state.registerScreenHider(hider);
+    const request = { id: 'a' };
+
+    flight.beginSignatureFlight(request);
+    // A superseded request settling late must not hand the sidebar away
+    // from the confirmation that currently owns it.
+    flight.endSignatureFlight({ id: 'b' });
+    expect(flight.isSignatureInFlight()).toBe(true);
+    expect(() => state.hideAllSubscreens()).toThrow();
+
+    flight.endSignatureFlight(request);
+    expect(flight.isSignatureInFlight()).toBe(false);
+    state.hideAllSubscreens();
+    expect(hider).toHaveBeenCalledTimes(1);
+  });
+
+  // The sidebar's close button, the toolbar toggle and the tab bar are not
+  // approval surfaces — they sit in the chrome above whichever screen is up
+  // — so they subscribe here to go visibly dead for the flight.
+  test('ownership changes are broadcast to chrome subscribers', async () => {
+    const { flight } = await load();
+    const seen = [];
+    const unsubscribe = flight.onSignatureFlightChange((inFlight) => seen.push(inFlight));
+    const request = { id: 'a' };
+
+    flight.beginSignatureFlight(request);
+    // A superseded release does not flip the state, so it does not notify.
+    flight.endSignatureFlight({ id: 'b' });
+    flight.endSignatureFlight(request);
+
+    expect(seen).toEqual([true, false]);
+
+    unsubscribe();
+    flight.beginSignatureFlight(request);
+    expect(seen).toEqual([true, false]);
+  });
+
+  test('a screen that takes the sidebar over directly refuses while in flight', async () => {
+    const { flight } = await load();
+    const warn = jest.spyOn(console, 'warn').mockImplementation(() => {});
+
+    expect(flight.refuseSubscreenWhileInFlight('Receive screen')).toBe(false);
+
+    flight.beginSignatureFlight({});
+    expect(flight.refuseSubscreenWhileInFlight('Receive screen')).toBe(true);
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('Receive screen'));
+
+    warn.mockRestore();
+  });
+});
diff --git a/src/renderer/lib/wallet/stamp-manager.js b/src/renderer/lib/wallet/stamp-manager.js
index c7f1093c..0477a868 100644
--- a/src/renderer/lib/wallet/stamp-manager.js
+++ b/src/renderer/lib/wallet/stamp-manager.js
@@ -8,6 +8,7 @@
  */
 
 import { walletState, registerScreenHider } from './wallet-state.js';
+import { refuseSubscreenWhileInFlight } from './signature-flight.js';
 import { formatRawTokenBalance, formatBytes } from './wallet-utils.js';
 import { fetchAntJson } from './ant-api.js';
 
@@ -83,6 +84,8 @@ export function initStampManager() {
 }
 
 export function openStampManager() {
+  if (refuseSubscreenWhileInFlight('Stamp manager screen')) return;
+
   walletState.identityView?.classList.add('hidden');
   stampManagerScreen?.classList.remove('hidden');
   isOpen = true;
diff --git a/src/renderer/lib/wallet/swarm-connect.js b/src/renderer/lib/wallet/swarm-connect.js
index 51cb52d3..bcc5fa98 100644
--- a/src/renderer/lib/wallet/swarm-connect.js
+++ b/src/renderer/lib/wallet/swarm-connect.js
@@ -6,6 +6,7 @@
  */
 
 import { walletState, registerScreenHider, hideAllSubscreens } from './wallet-state.js';
+import { isSignatureInFlight, signatureInFlightError } from './signature-flight.js';
 import { formatBytes } from './wallet-utils.js';
 import { open as openSidebarPanel, isVisible as isSidebarVisible } from '../sidebar.js';
 import { getPermissionKey, getActiveWebview } from '../dapp-provider.js';
@@ -412,6 +413,12 @@ function setupSwarmConnectScreen() {
  * on screen).
  */
 export function showSwarmConnect(displayUrl, permissionKey, resolve, reject, webview) {
+  // A live device confirmation owns the sidebar (see signature-flight.js).
+  if (isSignatureInFlight()) {
+    reject(signatureInFlightError());
+    return;
+  }
+
   swarmConnectQueue.show({ displayUrl, permissionKey, resolve, reject, webview });
 }
 
@@ -582,6 +589,12 @@ function setupSwarmPublishScreen() {
  * screen). Resolves on "Publish", rejects (code 4001) on "Cancel".
  */
 export function showSwarmPublishApproval(permissionKey, params, resolve, reject, method) {
+  // A live device confirmation owns the sidebar (see signature-flight.js).
+  if (isSignatureInFlight()) {
+    reject(signatureInFlightError());
+    return;
+  }
+
   swarmPublishQueue.show({ permissionKey, params, resolve, reject, method });
 }
 
@@ -865,6 +878,12 @@ function setupSwarmFeedScreen() {
  * screen). On approval, establishes or re-grants feed access for the origin.
  */
 export function showSwarmFeedApproval(permissionKey, params, resolve, reject, options = {}) {
+  // A live device confirmation owns the sidebar (see signature-flight.js).
+  if (isSignatureInFlight()) {
+    reject(signatureInFlightError());
+    return;
+  }
+
   const autoApproveType = options.autoApproveType === 'signing' ? 'signing' : 'feeds';
   swarmFeedQueue.show({ permissionKey, params, resolve, reject, autoApproveType, method: options.method });
 }
diff --git a/src/renderer/lib/wallet/vault-unlock.js b/src/renderer/lib/wallet/vault-unlock.js
index ac364d0a..c9810b67 100644
--- a/src/renderer/lib/wallet/vault-unlock.js
+++ b/src/renderer/lib/wallet/vault-unlock.js
@@ -10,6 +10,7 @@
  */
 
 import { walletState, registerScreenHider, hideAllSubscreens } from './wallet-state.js';
+import { isSignatureInFlight, signatureInFlightError } from './signature-flight.js';
 import { open as openSidebarPanel } from '../sidebar.js';
 
 let screen;
@@ -75,6 +76,14 @@ export function initVaultUnlock() {
  */
 export function showVaultUnlock(permissionKey) {
   return new Promise((resolve, reject) => {
+    // A live device confirmation owns the sidebar — an auto-approved
+    // action's unlock prompt must not paint over it (see
+    // signature-flight.js). The caller retries once the device is done.
+    if (isSignatureInFlight()) {
+      reject(signatureInFlightError());
+      return;
+    }
+
     if (pending) {
       pending.reject({ code: 4001, message: 'Superseded by new unlock request' });
     }
diff --git a/src/renderer/lib/wallet/wallet-selector.js b/src/renderer/lib/wallet/wallet-selector.js
index 0f8d7149..07e6acd5 100644
--- a/src/renderer/lib/wallet/wallet-selector.js
+++ b/src/renderer/lib/wallet/wallet-selector.js
@@ -15,21 +15,25 @@ let walletSelectorAddress;
 let walletSelectorDropdown;
 let walletSelectorList;
 let walletCreateBtn;
+let walletConnectLedgerBtn;
 let walletHeadlineName;
 
-// Callback for opening create wallet screen (set by coordinator)
+// Callbacks for opening subscreens (set by coordinator)
 let openCreateWalletFn = null;
+let openConnectLedgerFn = null;
 
-export function initWalletSelector(openCreateWallet) {
+export function initWalletSelector(openCreateWallet, openConnectLedger) {
   walletSelectorBtn = document.getElementById('wallet-selector-btn');
   walletSelectorName = document.getElementById('wallet-selector-name');
   walletSelectorAddress = document.getElementById('wallet-selector-address');
   walletSelectorDropdown = document.getElementById('wallet-selector-dropdown');
   walletSelectorList = document.getElementById('wallet-selector-list');
   walletCreateBtn = document.getElementById('wallet-create-btn');
+  walletConnectLedgerBtn = document.getElementById('wallet-connect-ledger-btn');
   walletHeadlineName = document.getElementById('wallet-headline-name');
 
   openCreateWalletFn = openCreateWallet;
+  openConnectLedgerFn = openConnectLedger;
 
   setupWalletSelector();
 }
@@ -52,6 +56,13 @@ function setupWalletSelector() {
       if (openCreateWalletFn) openCreateWalletFn();
     });
   }
+
+  if (walletConnectLedgerBtn) {
+    walletConnectLedgerBtn.addEventListener('click', () => {
+      closeWalletDropdown();
+      if (openConnectLedgerFn) openConnectLedgerFn();
+    });
+  }
 }
 
 function toggleWalletDropdown() {
@@ -98,7 +109,7 @@ function renderWalletList() {
 
     item.innerHTML = `
       <div class="wallet-selector-item-info">
-        <span class="wallet-selector-item-name">${escapeHtml(wallet.name)}</span>
+        <span class="wallet-selector-item-name">${escapeHtml(wallet.name)}${wallet.type === 'ledger' ? '<span class="wallet-selector-item-badge">Ledger</span>' : ''}</span>
         <div class="wallet-selector-item-address-row">
           <code class="wallet-selector-item-address">${truncatedAddress}</code>
           ${wallet.address ? `
diff --git a/src/renderer/lib/wallet/wallet-settings.js b/src/renderer/lib/wallet/wallet-settings.js
index 28f24ddb..e5db398f 100644
--- a/src/renderer/lib/wallet/wallet-settings.js
+++ b/src/renderer/lib/wallet/wallet-settings.js
@@ -5,6 +5,7 @@
  */
 
 import { walletState, registerScreenHider } from './wallet-state.js';
+import { refuseSubscreenWhileInFlight } from './signature-flight.js';
 import { selectWallet } from './wallet-selector.js';
 
 // DOM references
@@ -97,6 +98,8 @@ function setupWalletSettingsScreen() {
 }
 
 function openWalletSettings() {
+  if (refuseSubscreenWhileInFlight('Wallet settings screen')) return;
+
   const activeWallet = walletState.derivedWallets.find(w => w.index === walletState.activeWalletIndex);
   if (!activeWallet) {
     console.error('[WalletUI] No active wallet found');
diff --git a/src/renderer/lib/wallet/wallet-state.js b/src/renderer/lib/wallet/wallet-state.js
index 3c8f4fe0..47bad0de 100644
--- a/src/renderer/lib/wallet/wallet-state.js
+++ b/src/renderer/lib/wallet/wallet-state.js
@@ -2,6 +2,9 @@
  * Shared mutable state for wallet UI modules.
  * All submodules import and mutate the same object reference — no stale reads.
  */
+
+import { assertNoSignatureInFlight } from './signature-flight.js';
+
 export const walletState = {
   // Identity
   identityData: null,
@@ -44,6 +47,17 @@ export function registerScreenHider(fn) {
   screenHiders.push(fn);
 }
 
+/**
+ * Hide every registered sub-screen so a caller can take over the sidebar.
+ *
+ * Refuses while a signature is in flight: that screen owns the sidebar
+ * until the device prompt it produced is answered (see signature-flight.js).
+ * Callers check the lock first and refuse the newcomer on their own error
+ * channel; this throw is the backstop that turns a missed check into a
+ * loud failure *before* anything is torn down, rather than a silent steal
+ * of a live device confirmation.
+ */
 export function hideAllSubscreens() {
+  assertNoSignatureInFlight();
   screenHiders.forEach(fn => fn());
 }
diff --git a/src/renderer/lib/wallet/wallet-utils.js b/src/renderer/lib/wallet/wallet-utils.js
index 8430688e..e33de7be 100644
--- a/src/renderer/lib/wallet/wallet-utils.js
+++ b/src/renderer/lib/wallet/wallet-utils.js
@@ -2,6 +2,8 @@
  * Shared utility functions for wallet UI modules.
  */
 
+import { walletState } from './wallet-state.js';
+
 export function truncateAddress(address, startChars = 6, endChars = 4) {
   if (!address || address.length <= startChars + endChars + 3) {
     return address;
@@ -9,6 +11,40 @@ export function truncateAddress(address, startChars = 6, endChars = 4) {
   return `${address.slice(0, startChars)}...${address.slice(-endChars)}`;
 }
 
+/**
+ * Whether a wallet index belongs to a Ledger hardware account. Hardware
+ * accounts sign on the device: no vault unlock, and approval UIs show a
+ * "confirm on your Ledger" state instead of instant signing.
+ *
+ * @param {number} walletIndex
+ * @returns {boolean}
+ */
+export function isLedgerAccount(walletIndex) {
+  return walletState.derivedWallets?.find((wallet) => wallet.index === walletIndex)?.type === 'ledger';
+}
+
+/** Pending label for approve buttons while a signature is in flight. */
+export function signingButtonLabel(walletIndex) {
+  return isLedgerAccount(walletIndex) ? 'Confirm on your Ledger…' : 'Signing…';
+}
+
+/**
+ * Hardware accounts sign on the device — no vault key, no unlock gate.
+ * Hides the unlock section and enables the confirm button; returns true
+ * when the gate was bypassed so callers can skip the vault-status flow.
+ *
+ * @param {number} walletIndex
+ * @param {HTMLElement|null} unlockEl - the unlock section to hide
+ * @param {HTMLButtonElement|null} confirmBtn - the approve/confirm button
+ * @returns {boolean}
+ */
+export function bypassUnlockGateForHardware(walletIndex, unlockEl, confirmBtn) {
+  if (!isLedgerAccount(walletIndex)) return false;
+  unlockEl?.classList.add('hidden');
+  if (confirmBtn) confirmBtn.disabled = false;
+  return true;
+}
+
 export function escapeHtml(text) {
   const div = document.createElement('div');
   div.textContent = text;
diff --git a/src/renderer/styles/sidebar.css b/src/renderer/styles/sidebar.css
index 0659017d..36fe1149 100644
--- a/src/renderer/styles/sidebar.css
+++ b/src/renderer/styles/sidebar.css
@@ -93,10 +93,17 @@
   transition: color 0.15s ease, border-color 0.15s ease;
 }
 
-.sidebar-tab:hover {
+.sidebar-tab:hover:not(:disabled) {
   color: var(--text);
 }
 
+/* A device confirmation owns the sidebar until it is answered, so the
+   header chrome that would tear it down goes dead with it. */
+.sidebar-tab:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
 .sidebar-tab.active {
   color: var(--accent);
   border-bottom-color: var(--accent);
@@ -212,11 +219,16 @@
   transition: background-color 0.15s ease, color 0.15s ease;
 }
 
-.sidebar-close:hover {
+.sidebar-close:hover:not(:disabled) {
   background-color: rgba(255, 255, 255, 0.1);
   color: var(--text);
 }
 
+.sidebar-close:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
 .sidebar-close svg {
   width: 16px;
   height: 16px;
@@ -281,11 +293,16 @@
   transition: background-color 0.2s ease, color 0.2s ease;
 }
 
-.wallet-toggle-btn:hover,
+.wallet-toggle-btn:hover:not(:disabled),
 .wallet-toggle-btn[aria-expanded='true'] {
   background-color: rgba(255, 255, 255, 0.1);
 }
 
+.wallet-toggle-btn:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
 .wallet-toggle-btn svg {
   width: 15px;
   height: 15px;
@@ -628,11 +645,11 @@
   background-color: var(--toolbar);
 }
 
-[data-theme="light"] .sidebar-close:hover {
+[data-theme="light"] .sidebar-close:hover:not(:disabled) {
   background-color: rgba(0, 0, 0, 0.05);
 }
 
-[data-theme="light"] .wallet-toggle-btn:hover,
+[data-theme="light"] .wallet-toggle-btn:hover:not(:disabled),
 [data-theme="light"] .wallet-toggle-btn[aria-expanded='true'] {
   background-color: rgba(0, 0, 0, 0.1);
 }
@@ -709,10 +726,15 @@
   transition: background-color 0.15s ease;
 }
 
-.subscreen-back-btn:hover {
+.subscreen-back-btn:hover:not(:disabled) {
   background: rgba(255, 255, 255, 0.05);
 }
 
+.subscreen-back-btn:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
 .subscreen-back-btn svg {
   width: 16px;
   height: 16px;
@@ -2797,6 +2819,12 @@
   font-weight: 500;
 }
 
+.x402-grant-ledger-note {
+  margin: 6px 0 0;
+  font-size: 11px;
+  color: var(--muted);
+}
+
 .x402-grant-fields {
   display: flex;
   flex-direction: column;
@@ -3520,6 +3548,16 @@
   color: var(--muted);
 }
 
+.publisher-identity-unavailable {
+  font-size: 11px;
+  color: var(--danger);
+}
+
+.publisher-identity-selector-item.unavailable {
+  opacity: 0.55;
+  cursor: not-allowed;
+}
+
 .publisher-identity-create-actions {
   display: flex;
   gap: 8px;
@@ -3881,6 +3919,188 @@
   opacity: 0.9;
 }
 
+/* Connect Ledger sub-screen */
+/* Same pill recipe as .auto-approve-badge, sized for the selector rows */
+.wallet-selector-item-badge {
+  display: inline-block;
+  margin-left: 6px;
+  padding: 1px 6px;
+  font-size: 9px;
+  font-weight: 600;
+  letter-spacing: 0.5px;
+  text-transform: uppercase;
+  color: var(--accent, #6366f1);
+  background: var(--accent-muted, rgba(99, 102, 241, 0.15));
+  border-radius: 4px;
+  vertical-align: 1px;
+}
+
+.connect-ledger-illustration {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  margin: 8px auto 16px;
+  width: 72px;
+  height: 72px;
+  color: var(--muted);
+  background: rgba(255, 255, 255, 0.03);
+  border: 1px solid var(--border);
+  border-radius: 50%;
+}
+
+.connect-ledger-illustration svg {
+  width: 40px;
+  height: 40px;
+}
+
+.connect-ledger-status {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  margin-top: 8px;
+  font-size: 12px;
+  color: var(--muted);
+  text-align: center;
+}
+
+.connect-ledger-status-spinner {
+  width: 12px;
+  height: 12px;
+  flex-shrink: 0;
+  border: 2px solid var(--border);
+  border-top-color: var(--accent);
+  border-radius: 50%;
+  animation: spin 0.9s linear infinite;
+}
+
+.connect-ledger-scheme-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  margin-bottom: 10px;
+  font-size: 12px;
+  color: var(--muted);
+}
+
+.connect-ledger-scheme-select {
+  padding: 6px 8px;
+  font-size: 12px;
+  color: var(--text);
+  background: rgba(0, 0, 0, 0.2);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  outline: none;
+}
+
+.connect-ledger-account-list {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+
+.connect-ledger-loading {
+  padding: 12px;
+  font-size: 12px;
+  color: var(--muted);
+  text-align: center;
+}
+
+.connect-ledger-account {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  width: 100%;
+  padding: 10px 12px;
+  background: rgba(255, 255, 255, 0.03);
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  cursor: pointer;
+  text-align: left;
+  transition: border-color 0.15s ease, background-color 0.15s ease;
+}
+
+.connect-ledger-account:hover:not(:disabled) {
+  background: rgba(255, 255, 255, 0.06);
+}
+
+.connect-ledger-account.selected {
+  border-color: var(--accent);
+  background: rgba(138, 180, 248, 0.1);
+}
+
+.connect-ledger-account.added {
+  opacity: 0.55;
+  cursor: default;
+}
+
+.connect-ledger-account-info {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  overflow: hidden;
+}
+
+.connect-ledger-account-address {
+  font-size: 12px;
+  font-family: 'SF Mono', 'Menlo', 'Monaco', monospace;
+  color: var(--text);
+}
+
+.connect-ledger-account-path {
+  font-size: 10px;
+  color: var(--muted);
+}
+
+.connect-ledger-account-added {
+  font-size: 10px;
+  font-weight: 600;
+  color: var(--muted);
+  text-transform: uppercase;
+}
+
+.connect-ledger-load-more {
+  display: block;
+  width: 100%;
+  margin: 8px 0 12px;
+  padding: 8px;
+  font-size: 12px;
+  color: var(--accent);
+  background: transparent;
+  border: 1px dashed var(--border);
+  border-radius: 8px;
+  cursor: pointer;
+  transition: background-color 0.15s ease;
+}
+
+.connect-ledger-load-more:hover:not(:disabled) {
+  background: rgba(255, 255, 255, 0.04);
+}
+
+.connect-ledger-load-more:disabled {
+  opacity: 0.5;
+  cursor: wait;
+}
+
+[data-theme="light"] .connect-ledger-illustration,
+[data-theme="light"] .connect-ledger-account {
+  background: rgba(0, 0, 0, 0.02);
+}
+
+[data-theme="light"] .connect-ledger-account:hover:not(:disabled) {
+  background: rgba(0, 0, 0, 0.05);
+}
+
+[data-theme="light"] .connect-ledger-account.selected {
+  background: rgba(26, 115, 232, 0.08);
+}
+
+[data-theme="light"] .connect-ledger-scheme-select {
+  background: rgba(0, 0, 0, 0.05);
+}
+
 /* Light theme wallet selector */
 [data-theme="light"] .wallet-selector-btn {
   background: rgba(0, 0, 0, 0.03);
@@ -5933,10 +6153,17 @@
   transition: background-color 0.15s;
 }
 
-.dapp-tx-reject-btn:hover {
+.dapp-tx-reject-btn:hover:not(:disabled) {
   background: var(--toolbar-hover);
 }
 
+/* Disabled while a signature is in flight (see dapp-tx.js): the request
+   can no longer be recalled, so the way out has to read as unavailable. */
+.dapp-tx-reject-btn:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
 .dapp-tx-approve-btn {
   flex: 1;
   padding: 14px;
@@ -5972,7 +6199,7 @@
   background: rgba(0, 0, 0, 0.03);
 }
 
-[data-theme="light"] .dapp-tx-reject-btn:hover {
+[data-theme="light"] .dapp-tx-reject-btn:hover:not(:disabled) {
   background: rgba(0, 0, 0, 0.06);
 }
 
@@ -6168,10 +6395,15 @@
   transition: background-color 0.15s;
 }
 
-.dapp-sign-reject-btn:hover {
+.dapp-sign-reject-btn:hover:not(:disabled) {
   background: var(--toolbar-hover);
 }
 
+.dapp-sign-reject-btn:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
 .dapp-sign-approve-btn {
   flex: 1;
   padding: 14px;
@@ -6211,6 +6443,6 @@
   background: rgba(0, 0, 0, 0.03);
 }
 
-[data-theme="light"] .dapp-sign-reject-btn:hover {
+[data-theme="light"] .dapp-sign-reject-btn:hover:not(:disabled) {
   background: rgba(0, 0, 0, 0.06);
 }
diff --git a/test-e2e/dapp-tx-ledger-confirm.spec.js b/test-e2e/dapp-tx-ledger-confirm.spec.js
new file mode 100644
index 00000000..da154adc
--- /dev/null
+++ b/test-e2e/dapp-tx-ledger-confirm.spec.js
@@ -0,0 +1,240 @@
+// dApp transaction approval with a hardware account — once Confirm is
+// pressed the signature lives on the device and cannot be recalled, so
+// Reject and Back must stop being a way out: settling the dApp promise
+// with 4001 behind an in-flight signature would tell the site the user
+// declined while the transaction still broadcasts (and would still install
+// the "always allow" rule when the continuation resumed).
+//
+// Driven through the real renderer screen: the main-process IPC the screen
+// talks to is replaced for this app instance, and the send handler is left
+// hanging to hold the UI in the device-prompt state.
+
+const { test, expect } = require('./fixtures');
+
+const LEDGER = {
+  index: 1000000,
+  name: 'Ledger 1',
+  address: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+  type: 'ledger',
+  path: "44'/60'/0'/0/0",
+};
+
+const TX_PARAMS = {
+  to: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
+  value: '0',
+  // approve(address,uint256) — a contract call, so the auto-approve row shows.
+  data: '0x095ea7b3' + '0'.repeat(56) + 'deadbeef' + 'f'.repeat(64),
+};
+
+function stubMainIpc(electronApp, ledger) {
+  return electronApp.evaluate(({ ipcMain }, ledger) => {
+    const replace = (channel, handler) => {
+      ipcMain.removeHandler(channel);
+      ipcMain.handle(channel, handler);
+    };
+    replace('dapp:get-permission', () => ({
+      origin: 'https://swap.example',
+      walletIndex: ledger.index,
+      chainId: 8453,
+    }));
+    replace('wallet:get-derived-wallets', () => ({ success: true, wallets: [ledger] }));
+    replace('wallet:estimate-gas', () => ({ success: true, gasLimit: '21000' }));
+    replace('wallet:get-gas-price', () => ({
+      success: true,
+      type: 'legacy',
+      gasPrice: '1000000000',
+      effectiveGasPrice: '1000000000',
+    }));
+    replace('networks:get-chains', () => ({
+      success: true,
+      chains: { 8453: { chainId: 8453, name: 'Base', nativeSymbol: 'ETH' } },
+    }));
+    replace('dapp:add-transaction-auto-approve', () => ({ success: true }));
+    replace('identity:get-status', () => ({ isUnlocked: true }));
+    // Never settles on its own: this is the window where the device prompt
+    // is up and the user is deciding.
+    globalThis.__resolveLedgerSend = null;
+    replace('wallet:dapp-send-transaction', () => new Promise((resolve) => {
+      globalThis.__resolveLedgerSend = resolve;
+    }));
+  }, ledger);
+}
+
+// Opens an approval screen and stashes its settled state on
+// `window.__dappTxSettled[key]`, so a test can watch two requests at once.
+function requestApproval(window, key, txParams) {
+  return window.evaluate(async ({ ledger, key, txParams }) => {
+    const dappTx = await import('./lib/wallet/dapp-tx.js');
+    const { walletState } = await import('./lib/wallet/wallet-state.js');
+    // The account type is what makes the screen skip the vault-unlock gate.
+    walletState.derivedWallets = [ledger];
+
+    window.__dappTxSettled = window.__dappTxSettled || {};
+    window.__dappTxSettled[key] = 'pending';
+    dappTx.showDappTxApproval({}, 'https://swap.example', txParams).then(
+      (hash) => { window.__dappTxSettled[key] = `resolved:${hash}`; },
+      (err) => { window.__dappTxSettled[key] = `rejected:${err.code || err.message}`; }
+    );
+  }, { ledger: LEDGER, key, txParams });
+}
+
+function settledState(window, key) {
+  return window.evaluate((key) => window.__dappTxSettled[key], key);
+}
+
+test('reject and back are inert while a Ledger confirmation is in flight', async ({
+  electronApp,
+  window,
+}) => {
+  await stubMainIpc(electronApp, LEDGER);
+  await requestApproval(window, 'a', TX_PARAMS);
+
+  await expect(window.locator('#sidebar-dapp-tx')).toBeVisible();
+  await expect(window.locator('#dapp-tx-approve')).toBeEnabled();
+  await expect(window.locator('#dapp-tx-reject')).toBeEnabled();
+  await window.screenshot({ path: 'test-results/dapp-tx-ledger-before-confirm.png' });
+
+  await window.check('#dapp-tx-auto-approve');
+  await window.click('#dapp-tx-approve');
+
+  await expect(window.locator('#dapp-tx-approve')).toHaveText('Confirm on your Ledger…');
+  await expect(window.locator('#dapp-tx-reject')).toBeDisabled();
+  await expect(window.locator('#dapp-tx-back')).toBeDisabled();
+  await window.screenshot({ path: 'test-results/dapp-tx-ledger-in-flight.png' });
+
+  // Clicking them anyway (a stray programmatic click, or a click that raced
+  // the disable) must not settle the dApp promise or close the screen.
+  await window.evaluate(() => {
+    document.getElementById('dapp-tx-reject').click();
+    document.getElementById('dapp-tx-back').click();
+  });
+  await expect(window.locator('#sidebar-dapp-tx')).toBeVisible();
+  expect(await settledState(window, 'a')).toBe('pending');
+
+  // The device approves: the tx resolves for the dApp and the screen closes
+  // with the auto-approve checkbox cleared for the next request.
+  await electronApp.evaluate(() => {
+    globalThis.__resolveLedgerSend({ success: true, hash: '0xabc123', recorded: true });
+  });
+  await expect(window.locator('#sidebar-dapp-tx')).toBeHidden();
+  expect(await settledState(window, 'a')).toBe('resolved:0xabc123');
+  expect(await window.isChecked('#dapp-tx-auto-approve')).toBe(false);
+  await expect(window.locator('#dapp-tx-reject')).toBeEnabled();
+});
+
+// The screen is a single shared surface. A second dApp request arriving
+// while the device is still showing the first one must not repaint it and
+// re-enable the way out: the user would click a Reject that appears to
+// cancel what the device is displaying, get 4001 for the *newcomer*, then
+// approve the still-live first prompt and see it broadcast after the
+// visible cancel.
+test('a second request cannot take the screen from an in-flight Ledger confirmation', async ({
+  electronApp,
+  window,
+}) => {
+  await stubMainIpc(electronApp, LEDGER);
+  await requestApproval(window, 'a', TX_PARAMS);
+
+  await expect(window.locator('#sidebar-dapp-tx')).toBeVisible();
+  await window.click('#dapp-tx-approve');
+  await expect(window.locator('#dapp-tx-approve')).toHaveText('Confirm on your Ledger…');
+  await expect(window.locator('#dapp-tx-reject')).toBeDisabled();
+
+  // Second request lands while the device prompt for the first is up.
+  await requestApproval(window, 'b', {
+    ...TX_PARAMS,
+    to: '0x4200000000000000000000000000000000000006',
+  });
+
+  // It is refused with "already pending" instead of taking the screen, and
+  // the screen still belongs to the first request: same recipient, same
+  // "Confirm on your Ledger…" state, no way out re-enabled.
+  await expect
+    .poll(() => settledState(window, 'b'))
+    .toBe('rejected:-32002');
+  await expect(window.locator('#dapp-tx-to')).toHaveAttribute('title', TX_PARAMS.to);
+  await expect(window.locator('#dapp-tx-approve')).toHaveText('Confirm on your Ledger…');
+  await expect(window.locator('#dapp-tx-approve')).toBeDisabled();
+  await expect(window.locator('#dapp-tx-reject')).toBeDisabled();
+  await expect(window.locator('#dapp-tx-back')).toBeDisabled();
+  await window.screenshot({ path: 'test-results/dapp-tx-ledger-second-request-refused.png' });
+
+  await window.evaluate(() => {
+    document.getElementById('dapp-tx-reject').click();
+    document.getElementById('dapp-tx-back').click();
+  });
+  expect(await settledState(window, 'a')).toBe('pending');
+
+  // The device approves the first request: it — and only it — settles.
+  await electronApp.evaluate(() => {
+    globalThis.__resolveLedgerSend({ success: true, hash: '0xabc123', recorded: true });
+  });
+  await expect(window.locator('#sidebar-dapp-tx')).toBeHidden();
+  expect(await settledState(window, 'a')).toBe('resolved:0xabc123');
+  expect(await settledState(window, 'b')).toBe('rejected:-32002');
+});
+
+// Same steal, different thief. The sidebar is shared by *every* approval
+// surface, and each of them takes it over by calling hideAllSubscreens() —
+// so a per-module "already pending" guard only stops a sibling request of
+// the same kind. A personal_sign, or a permissionless eth_requestAccounts,
+// would otherwise paint its own screen over the live confirmation with
+// Reject/Sign/Connect fully enabled: the user cancels what they believe the
+// device is showing, and the first transaction broadcasts anyway.
+test('other approval surfaces cannot take the screen from an in-flight Ledger confirmation', async ({
+  electronApp,
+  window,
+}) => {
+  await stubMainIpc(electronApp, LEDGER);
+  await requestApproval(window, 'a', TX_PARAMS);
+
+  await expect(window.locator('#sidebar-dapp-tx')).toBeVisible();
+  await window.click('#dapp-tx-approve');
+  await expect(window.locator('#dapp-tx-approve')).toHaveText('Confirm on your Ledger…');
+  await expect(window.locator('#dapp-tx-reject')).toBeDisabled();
+
+  // The page now asks for a signature and for accounts while the device
+  // prompt for the transaction is still up.
+  await window.evaluate(async () => {
+    const dappSign = await import('./lib/wallet/dapp-sign.js');
+    const dappConnect = await import('./lib/wallet/dapp-connect.js');
+    window.__otherSurfaces = {};
+    dappSign
+      .showDappSignApproval({}, 'https://swap.example', 'personal_sign', ['0xdeadbeef', '0xledger'])
+      .then(
+        (sig) => { window.__otherSurfaces.sign = `resolved:${sig}`; },
+        (err) => { window.__otherSurfaces.sign = `rejected:${err.code || err.message}`; }
+      );
+    await new Promise((resolve, reject) => {
+      dappConnect.showDappConnect('https://swap.example', 'https://swap.example', resolve, reject, {});
+    }).then(
+      () => { window.__otherSurfaces.connect = 'resolved'; },
+      (err) => { window.__otherSurfaces.connect = `rejected:${err.code || err.message}`; }
+    );
+  });
+
+  await expect
+    .poll(() => window.evaluate(() => window.__otherSurfaces?.sign))
+    .toBe('rejected:-32002');
+  await expect
+    .poll(() => window.evaluate(() => window.__otherSurfaces?.connect))
+    .toBe('rejected:-32002');
+
+  // Neither screen took the sidebar; the transaction confirmation is
+  // untouched, with both ways out still closed.
+  await expect(window.locator('#sidebar-dapp-sign')).toBeHidden();
+  await expect(window.locator('#sidebar-dapp-connect')).toBeHidden();
+  await expect(window.locator('#sidebar-dapp-tx')).toBeVisible();
+  await expect(window.locator('#dapp-tx-to')).toHaveAttribute('title', TX_PARAMS.to);
+  await expect(window.locator('#dapp-tx-approve')).toHaveText('Confirm on your Ledger…');
+  await expect(window.locator('#dapp-tx-reject')).toBeDisabled();
+  await expect(window.locator('#dapp-tx-back')).toBeDisabled();
+  await window.screenshot({ path: 'test-results/dapp-tx-ledger-other-surfaces-refused.png' });
+
+  // The device approves: the transaction — and only it — settles.
+  await electronApp.evaluate(() => {
+    globalThis.__resolveLedgerSend({ success: true, hash: '0xabc123', recorded: true });
+  });
+  await expect(window.locator('#sidebar-dapp-tx')).toBeHidden();
+  expect(await settledState(window, 'a')).toBe('resolved:0xabc123');
+});
diff --git a/test-e2e/publisher-identity-selector.spec.js b/test-e2e/publisher-identity-selector.spec.js
new file mode 100644
index 00000000..dbb0f4f5
--- /dev/null
+++ b/test-e2e/publisher-identity-selector.spec.js
@@ -0,0 +1,98 @@
+// Publisher identity selector — identities the main process flags as
+// `unavailable` (deleted wallet, hardware account that can't export a key
+// for Swarm feed signing) must render as inert, not as an ordinary pick
+// that only fails later with an opaque INTERNAL_ERROR.
+//
+// The selector is shared by the feed prompt, the Swarm permission screen
+// and publisher identity management, so asserting it here covers all
+// three call sites at once.
+
+const { test, expect } = require('./fixtures');
+
+const STATE = {
+  origin: 'myapp.eth',
+  activeIdentityId: 'app-scoped:0',
+  identities: [
+    {
+      id: 'app-scoped:0',
+      mode: 'app-scoped',
+      label: 'myapp.eth identity',
+      publisherKeyIndex: 0,
+      owner: '0x1111111111111111111111111111111111111111',
+      stored: true,
+    },
+    {
+      id: 'ethereum-wallet:0',
+      mode: 'ethereum-wallet',
+      label: 'Main Wallet',
+      walletIndex: 0,
+      owner: '0x2222222222222222222222222222222222222222',
+      stored: false,
+    },
+    {
+      id: 'ethereum-wallet:1',
+      mode: 'ethereum-wallet',
+      label: 'Ledger 1',
+      walletIndex: 1,
+      owner: '0x3333333333333333333333333333333333333333',
+      stored: true,
+      unavailable: true,
+    },
+  ],
+};
+
+test('an unavailable publisher identity renders inert and cannot be selected', async ({
+  window,
+}) => {
+  const result = await window.evaluate(async (state) => {
+    const mod = await import('./lib/wallet/publisher-identity-selector.js');
+
+    // Park the selector over the chrome so it is visible for the shot.
+    const host = document.createElement('div');
+    host.id = 'e2e-identity-selector';
+    host.style.cssText =
+      'position:fixed;top:140px;left:50%;transform:translateX(-50%);width:340px;z-index:99999;'
+      + 'background:var(--bg);padding:12px;border-radius:10px;';
+    document.body.appendChild(host);
+
+    const selected = [];
+    mod.renderPublisherIdentitySelector(host, state, {
+      onSelect: (identity) => selected.push(identity.id),
+    });
+
+    host.querySelector('.publisher-identity-selector-btn').click();
+
+    const items = Array.from(host.querySelectorAll('.publisher-identity-selector-item'));
+    const unavailable = items.find((item) => item.textContent.includes('Ledger 1'));
+    const usable = items.find((item) => item.textContent.includes('Main Wallet'));
+
+    unavailable.click();
+    usable.click();
+
+    return {
+      unavailableDisabled: unavailable.disabled,
+      unavailableNote: unavailable.textContent.includes('sign feeds'),
+      usableDisabled: usable.disabled,
+      selected,
+    };
+  }, STATE);
+
+  expect(result.unavailableDisabled).toBe(true);
+  expect(result.unavailableNote).toBe(true);
+  expect(result.usableDisabled).toBe(false);
+  // Clicking the unavailable row is a no-op; the usable one still selects.
+  expect(result.selected).toEqual(['ethereum-wallet:0']);
+
+  // Selecting closes the dropdown; reopen it so the shot shows the list.
+  // Wait for the close to settle before toggling — under load a reopen click
+  // that lands mid-close races the toggle and leaves the list hidden.
+  const list = window.locator('#e2e-identity-selector .wallet-selector-list');
+  await expect(list).toBeHidden();
+  await window.click('#e2e-identity-selector .publisher-identity-selector-btn');
+  await expect(list).toBeVisible();
+  const box = await window.locator('#e2e-identity-selector').boundingBox();
+  await window.screenshot({
+    path: '/tmp/publisher-identity-unavailable.png',
+    clip: { x: box.x - 20, y: box.y - 20, width: box.width + 40, height: box.height + 300 },
+  });
+});
diff --git a/test-e2e/send-ledger-confirm.spec.js b/test-e2e/send-ledger-confirm.spec.js
new file mode 100644
index 00000000..9a0c7dba
--- /dev/null
+++ b/test-e2e/send-ledger-confirm.spec.js
@@ -0,0 +1,220 @@
+// Manual send with a hardware account — once Confirm is pressed the
+// signature lives on the device and cannot be recalled, so the send screen
+// owns the sidebar until the device answers. Every other approval surface
+// takes the sidebar over via hideAllSubscreens(), so without the shared
+// lock a dApp request (personal_sign, a permissionless eth_requestAccounts)
+// paints over "Confirm on your Ledger" with Reject/Sign fully enabled: the
+// user rejects what they believe the device is showing, then clears the
+// still-live device prompt and the send broadcasts with no visible feedback.
+//
+// Driven through the real renderer screen: the main-process IPC the screen
+// talks to is replaced for this app instance, and the send handler is left
+// hanging to hold the UI in the device-prompt state.
+
+const { test, expect } = require('./fixtures');
+
+const LEDGER = {
+  index: 1000000,
+  name: 'Ledger 1',
+  address: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+  type: 'ledger',
+  path: "44'/60'/0'/0/0",
+};
+
+const RECIPIENT = '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913';
+
+function stubMainIpc(electronApp) {
+  return electronApp.evaluate(({ ipcMain }) => {
+    const replace = (channel, handler) => {
+      ipcMain.removeHandler(channel);
+      ipcMain.handle(channel, handler);
+    };
+    replace('wallet:parse-amount', () => ({ success: true, value: '1000000000000000' }));
+    replace('wallet:estimate-gas', () => ({ success: true, gasLimit: '21000' }));
+    replace('wallet:get-gas-price', () => ({
+      success: true,
+      type: 'legacy',
+      gasPrice: '1000000000',
+      effectiveGasPrice: '1000000000',
+    }));
+    replace('ens:resolve-reverse', () => ({ success: false }));
+    replace('identity:get-status', () => ({ isUnlocked: true }));
+    replace('dapp:get-permission', () => ({
+      origin: 'https://swap.example',
+      walletIndex: 1000000,
+      chainId: 8453,
+    }));
+    replace('wallet:get-derived-wallets', () => ({
+      success: true,
+      wallets: [{
+        index: 1000000,
+        name: 'Ledger 1',
+        address: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+        type: 'ledger',
+      }],
+    }));
+    // Never settles on its own: this is the window where the device prompt
+    // is up and the user is deciding.
+    globalThis.__resolveLedgerSend = null;
+    replace('wallet:send-transaction', () => new Promise((resolve) => {
+      globalThis.__resolveLedgerSend = resolve;
+    }));
+  });
+}
+
+// Opens the send screen on a Ledger account with a recipient and amount
+// pre-filled, exactly as the `ethereum:` tip-link entry point does.
+async function openSendOnLedger(window, recipient) {
+  await window.evaluate(async ({ ledger, recipient }) => {
+    const { walletState } = await import('./lib/wallet/wallet-state.js');
+    const sidebar = await import('./lib/sidebar.js');
+    const send = await import('./lib/wallet/send.js');
+    sidebar.open();
+    // The harness profile has no identity, so the setup CTA is up; the real
+    // app shows the identity view here. Hide it so the screenshots show
+    // what a user with a wallet would actually see.
+    document.getElementById('sidebar-setup-cta')?.classList.add('hidden');
+
+    walletState.viewMode = 'identity';
+    walletState.fullAddresses.wallet = ledger.address;
+    // The account type is what makes the screen skip the vault-unlock gate
+    // and wait on the device instead of the network.
+    walletState.derivedWallets = [ledger];
+    walletState.activeWalletIndex = ledger.index;
+    walletState.selectedChainId = 8453;
+    walletState.registeredChains = {
+      8453: { chainId: 8453, name: 'Base', nativeSymbol: 'ETH' },
+    };
+    walletState.registeredTokens = {
+      'base-native': {
+        chainId: 8453, symbol: 'ETH', name: 'Ether', decimals: 18, address: null, builtin: true,
+      },
+    };
+    walletState.currentBalances = {
+      'base-native': { formatted: '1.0', symbol: 'ETH' },
+    };
+
+    send.openSend({ recipient, chainId: 8453 });
+  }, { ledger: LEDGER, recipient });
+
+  await expect(window.locator('#sidebar-send')).toBeVisible();
+  await window.fill('#send-amount', '0.001');
+  await window.click('#send-continue-btn');
+  await expect(window.locator('#send-review-view')).toBeVisible();
+}
+
+test('a dApp request cannot take the sidebar from an in-flight send confirmation', async ({
+  electronApp,
+  window,
+}) => {
+  await stubMainIpc(electronApp);
+  await openSendOnLedger(window, RECIPIENT);
+
+  await window.click('#send-confirm-btn');
+
+  // The device prompt is up: the screen says so and Back is closed off.
+  await expect(window.locator('#send-pending-view')).toBeVisible();
+  await expect(window.locator('#send-pending-view .send-pending-title'))
+    .toHaveText('Confirm on your Ledger');
+  await expect(window.locator('#send-back')).toBeDisabled();
+  await window.screenshot({ path: 'test-results/send-ledger-in-flight.png' });
+
+  // The page now asks for a signature and for accounts while the device
+  // prompt for the send is still up.
+  await window.evaluate(async () => {
+    const dappSign = await import('./lib/wallet/dapp-sign.js');
+    const dappConnect = await import('./lib/wallet/dapp-connect.js');
+    window.__otherSurfaces = {};
+    dappSign
+      .showDappSignApproval({}, 'https://swap.example', 'personal_sign', ['0xdeadbeef', '0xledger'])
+      .then(
+        (sig) => { window.__otherSurfaces.sign = `resolved:${sig}`; },
+        (err) => { window.__otherSurfaces.sign = `rejected:${err.code || err.message}`; }
+      );
+    await new Promise((resolve, reject) => {
+      dappConnect.showDappConnect('https://swap.example', 'https://swap.example', resolve, reject, {});
+    }).then(
+      () => { window.__otherSurfaces.connect = 'resolved'; },
+      (err) => { window.__otherSurfaces.connect = `rejected:${err.code || err.message}`; }
+    );
+  });
+
+  await expect.poll(() => window.evaluate(() => window.__otherSurfaces?.sign)).toBe('rejected:-32002');
+  await expect.poll(() => window.evaluate(() => window.__otherSurfaces?.connect)).toBe('rejected:-32002');
+
+  // Neither screen took the sidebar; the send confirmation is untouched.
+  await expect(window.locator('#sidebar-dapp-sign')).toBeHidden();
+  await expect(window.locator('#sidebar-dapp-connect')).toBeHidden();
+  await expect(window.locator('#sidebar-send')).toBeVisible();
+  await expect(window.locator('#send-pending-view')).toBeVisible();
+  await expect(window.locator('#send-back')).toBeDisabled();
+  await window.screenshot({ path: 'test-results/send-ledger-dapp-request-refused.png' });
+
+  // A stray Back click (or a tab switch / sidebar close, which both land on
+  // closeSend) must not tear the screen down either.
+  await window.evaluate(async () => {
+    document.getElementById('send-back').click();
+    const send = await import('./lib/wallet/send.js');
+    send.closeSend();
+  });
+  await expect(window.locator('#sidebar-send')).toBeVisible();
+  await expect(window.locator('#send-pending-view')).toBeVisible();
+
+  // The device approves: the send reports success on its own screen, where
+  // the user can actually see it.
+  await electronApp.evaluate(() => {
+    globalThis.__resolveLedgerSend({
+      success: true,
+      hash: '0xfeedface',
+      explorerUrl: 'https://basescan.org/tx/0xfeedface',
+      recorded: true,
+    });
+  });
+  await expect(window.locator('#send-success-view')).toBeVisible();
+  await expect(window.locator('#sidebar-send')).toBeVisible();
+  await expect(window.locator('#send-back')).toBeEnabled();
+  await window.screenshot({ path: 'test-results/send-ledger-success-visible.png' });
+});
+
+// The other direction: an `ethereum:` tip link is page-reachable and routes
+// straight into the send screen, so it must not paint over a live device
+// confirmation owned by another surface either.
+test('the send screen refuses to open over another surface\'s device confirmation', async ({
+  electronApp,
+  window,
+}) => {
+  await stubMainIpc(electronApp);
+  await electronApp.evaluate(({ ipcMain }) => {
+    ipcMain.removeHandler('wallet:dapp-send-transaction');
+    ipcMain.handle('wallet:dapp-send-transaction', () => new Promise(() => {}));
+  });
+
+  // A dApp transaction is waiting on the device.
+  await window.evaluate(async ({ ledger }) => {
+    const { walletState } = await import('./lib/wallet/wallet-state.js');
+    const dappTx = await import('./lib/wallet/dapp-tx.js');
+    walletState.viewMode = 'identity';
+    walletState.fullAddresses.wallet = ledger.address;
+    walletState.derivedWallets = [ledger];
+    walletState.activeWalletIndex = ledger.index;
+    dappTx.showDappTxApproval({}, 'https://swap.example', {
+      to: '0x4200000000000000000000000000000000000006',
+      value: '0x0',
+    }).catch(() => {});
+  }, { ledger: LEDGER });
+
+  await expect(window.locator('#sidebar-dapp-tx')).toBeVisible();
+  await window.click('#dapp-tx-approve');
+  await expect(window.locator('#dapp-tx-approve')).toHaveText('Confirm on your Ledger…');
+
+  // The page follows a tip link into the send flow.
+  await window.evaluate(async (recipient) => {
+    const send = await import('./lib/wallet/send.js');
+    send.openSend({ recipient, chainId: 8453 });
+  }, RECIPIENT);
+
+  await expect(window.locator('#sidebar-send')).toBeHidden();
+  await expect(window.locator('#sidebar-dapp-tx')).toBeVisible();
+  await expect(window.locator('#dapp-tx-approve')).toHaveText('Confirm on your Ledger…');
+  await window.screenshot({ path: 'test-results/send-open-refused-during-dapp-confirm.png' });
+});
diff --git a/test-e2e/sidebar-in-flight-chrome.spec.js b/test-e2e/sidebar-in-flight-chrome.spec.js
new file mode 100644
index 00000000..23880ecf
--- /dev/null
+++ b/test-e2e/sidebar-in-flight-chrome.spec.js
@@ -0,0 +1,178 @@
+// The sidebar chrome — the header X, the tab bar, the toolbar toggle — sits
+// above whatever approval screen is up and is *not* an approval surface, so
+// it used to sit outside the signature lock entirely. With a device prompt
+// live ("Confirm on your Ledger", Back/Reject disabled) a click on the X
+// directly above it collapsed the panel over an un-recallable confirmation:
+// the user approves on the device to make it go away and the transaction
+// broadcasts into a hidden screen. The same click fires 'sidebar-closed',
+// whose closeAllSubscreens() cascade un-hides the identity view — reopening
+// the panel then showed an interactive identity view stacked on the pending
+// send, with its own unguarded Receive / Settings / Ledger openers.
+//
+// Driven through the real renderer, with the main-process IPC replaced for
+// this app instance and the send handler left hanging to hold the UI in the
+// device-prompt state.
+
+const { test, expect } = require('./fixtures');
+
+const LEDGER = {
+  index: 1000000,
+  name: 'Ledger 1',
+  address: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+  type: 'ledger',
+  path: "44'/60'/0'/0/0",
+};
+
+const RECIPIENT = '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913';
+
+function stubMainIpc(electronApp) {
+  return electronApp.evaluate(({ ipcMain }) => {
+    const replace = (channel, handler) => {
+      ipcMain.removeHandler(channel);
+      ipcMain.handle(channel, handler);
+    };
+    replace('wallet:parse-amount', () => ({ success: true, value: '1000000000000000' }));
+    replace('wallet:estimate-gas', () => ({ success: true, gasLimit: '21000' }));
+    replace('wallet:get-gas-price', () => ({
+      success: true,
+      type: 'legacy',
+      gasPrice: '1000000000',
+      effectiveGasPrice: '1000000000',
+    }));
+    replace('ens:resolve-reverse', () => ({ success: false }));
+    replace('identity:get-status', () => ({ isUnlocked: true }));
+    replace('wallet:get-derived-wallets', () => ({
+      success: true,
+      wallets: [{
+        index: 1000000,
+        name: 'Ledger 1',
+        address: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+        type: 'ledger',
+      }],
+    }));
+    // Never settles on its own: this is the window where the device prompt
+    // is up and the user is deciding.
+    globalThis.__resolveLedgerSend = null;
+    replace('wallet:send-transaction', () => new Promise((resolve) => {
+      globalThis.__resolveLedgerSend = resolve;
+    }));
+  });
+}
+
+// Opens the sidebar on a Ledger account and drives the send screen to the
+// review step, exactly as a user tipping from a page would arrive there.
+async function openSendOnLedger(window) {
+  await window.evaluate(async ({ ledger, recipient }) => {
+    const { walletState } = await import('./lib/wallet/wallet-state.js');
+    const sidebar = await import('./lib/sidebar.js');
+    const send = await import('./lib/wallet/send.js');
+    sidebar.open();
+    // The harness profile has no identity, so the setup CTA is up; the real
+    // app shows the identity view here. Hide it so the screenshots show what
+    // a user with a wallet would actually see.
+    document.getElementById('sidebar-setup-cta')?.classList.add('hidden');
+    document.getElementById('sidebar-identity')?.classList.remove('hidden');
+
+    walletState.viewMode = 'identity';
+    walletState.identityView = document.getElementById('sidebar-identity');
+    walletState.fullAddresses.wallet = ledger.address;
+    walletState.derivedWallets = [ledger];
+    walletState.activeWalletIndex = ledger.index;
+    walletState.selectedChainId = 8453;
+    walletState.registeredChains = {
+      8453: { chainId: 8453, name: 'Base', nativeSymbol: 'ETH' },
+    };
+    walletState.registeredTokens = {
+      'base-native': {
+        chainId: 8453, symbol: 'ETH', name: 'Ether', decimals: 18, address: null, builtin: true,
+      },
+    };
+    walletState.currentBalances = {
+      'base-native': { formatted: '1.0', symbol: 'ETH' },
+    };
+
+    send.openSend({ recipient, chainId: 8453 });
+  }, { ledger: LEDGER, recipient: RECIPIENT });
+
+  await expect(window.locator('#sidebar-send')).toBeVisible();
+  await window.fill('#send-amount', '0.001');
+  await window.click('#send-continue-btn');
+  await expect(window.locator('#send-review-view')).toBeVisible();
+}
+
+test('sidebar chrome cannot collapse or repaint over a live device confirmation', async ({
+  electronApp,
+  window,
+}) => {
+  await stubMainIpc(electronApp);
+  await openSendOnLedger(window);
+
+  await window.click('#send-confirm-btn');
+
+  // The device prompt is up. The chrome above it is dead too, not just Back.
+  await expect(window.locator('#send-pending-view')).toBeVisible();
+  await expect(window.locator('#send-pending-view .send-pending-title'))
+    .toHaveText('Confirm on your Ledger');
+  await expect(window.locator('#send-back')).toBeDisabled();
+  await expect(window.locator('#sidebar-close')).toBeDisabled();
+  await expect(window.locator('#wallet-toggle-btn')).toBeDisabled();
+  await expect(window.locator('.sidebar-tab[data-tab="wallet"]')).toBeDisabled();
+  await window.screenshot({ path: 'test-results/sidebar-chrome-locked-in-flight.png' });
+
+  // The user clicks the X anyway (a real click; the browser drops it on a
+  // disabled button, and the handler refuses regardless).
+  await window.evaluate(() => {
+    document.getElementById('sidebar-close').click();
+    document.getElementById('wallet-toggle-btn').click();
+    document.querySelector('.sidebar-tab[data-tab="settings"]').click();
+  });
+
+  // The panel is still open on the confirmation, and the identity view was
+  // not un-hidden underneath it by the closeAllSubscreens() cascade.
+  await expect(window.locator('#sidebar')).not.toHaveClass(/collapsed/);
+  await expect(window.locator('#sidebar-send')).toBeVisible();
+  await expect(window.locator('#send-pending-view')).toBeVisible();
+  await expect(window.locator('#sidebar-identity')).toBeHidden();
+  await window.screenshot({ path: 'test-results/sidebar-chrome-x-refused.png' });
+
+  // The keyboard route to the same collapse.
+  await window.keyboard.press('Control+Shift+W');
+  await expect(window.locator('#sidebar')).not.toHaveClass(/collapsed/);
+  await expect(window.locator('#send-pending-view')).toBeVisible();
+
+  // Direct openers reachable from the identity view take the sidebar over
+  // without going through hideAllSubscreens(), so they check the lock too.
+  const refused = await window.evaluate(async () => {
+    const receive = await import('./lib/wallet/receive.js');
+    const connectLedger = await import('./lib/wallet/connect-ledger.js');
+    await receive.openReceive();
+    await connectLedger.openConnectLedger();
+    return {
+      receiveHidden: document.getElementById('sidebar-receive').classList.contains('hidden'),
+      ledgerHidden: document.getElementById('sidebar-connect-ledger').classList.contains('hidden'),
+    };
+  });
+  expect(refused).toEqual({ receiveHidden: true, ledgerHidden: true });
+  await expect(window.locator('#send-pending-view')).toBeVisible();
+
+  // The device approves: the send reports success on a screen the user can
+  // actually see, and the chrome comes back to life.
+  await electronApp.evaluate(() => {
+    globalThis.__resolveLedgerSend({
+      success: true,
+      hash: '0xfeedface',
+      explorerUrl: 'https://basescan.org/tx/0xfeedface',
+      recorded: true,
+    });
+  });
+  await expect(window.locator('#send-success-view')).toBeVisible();
+  await expect(window.locator('#sidebar')).not.toHaveClass(/collapsed/);
+  await expect(window.locator('#sidebar-close')).toBeEnabled();
+  await expect(window.locator('#wallet-toggle-btn')).toBeEnabled();
+  await expect(window.locator('.sidebar-tab[data-tab="wallet"]')).toBeEnabled();
+  await window.screenshot({ path: 'test-results/sidebar-chrome-unlocked-after-send.png' });
+
+  // And the X works again now that there is nothing to protect.
+  await window.click('#sidebar-close');
+  await expect(window.locator('#sidebar')).toHaveClass(/collapsed/);
+});
diff --git a/test-e2e/x402-payment-in-flight.spec.js b/test-e2e/x402-payment-in-flight.spec.js
new file mode 100644
index 00000000..a63420e9
--- /dev/null
+++ b/test-e2e/x402-payment-in-flight.spec.js
@@ -0,0 +1,396 @@
+// x402 payment approval with a hardware account — once Pay is pressed the
+// EIP-3009 authorization lives on the device and cannot be recalled.
+//
+// The payment card's screen hider *cancels* the payment (x402:reject for a
+// subresource, x402:cancel for a paywall page, which also navigates the
+// webview away). hideAllSubscreens() fires every hider, so any other
+// approval surface opening mid-payment would force-cancel the detection in
+// main while the user is still confirming that very payment on the device.
+//
+// Driven through the real renderer card: the main-process IPC it talks to is
+// replaced for this app instance, and the approve handler is left hanging to
+// hold the UI in the device-prompt state.
+
+const { test, expect } = require('./fixtures');
+
+const LEDGER = {
+  index: 1000000,
+  name: 'Ledger 1',
+  address: '0x209693Bc6afc0C5328bA36FaF03C514EF312287C',
+  type: 'ledger',
+  path: "44'/60'/0'/0/0",
+};
+
+const TX_PARAMS = {
+  to: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
+  value: '0',
+  data: '0x095ea7b3' + '0'.repeat(56) + 'deadbeef' + 'f'.repeat(64),
+};
+
+const USDC_ACCEPT = {
+  accept: {
+    amount: '2500000',
+    asset: '0xUSDC',
+    network: 'base',
+    payTo: '0x1111111111111111111111111111111111111111',
+  },
+  tuple: { amount: '2500000', chainId: 8453 },
+  balanceKey: '8453:0xUSDC',
+  asset: { symbol: 'USDC', decimals: 6 },
+  balance: '5000000',
+  fundable: true,
+};
+
+// A second fundable accept, which is what makes the card render the
+// chooser radios.
+const DAI_ACCEPT = {
+  accept: {
+    amount: '3000000000000000000',
+    asset: '0xDAI',
+    network: 'base',
+    payTo: '0x1111111111111111111111111111111111111111',
+  },
+  tuple: { amount: '3000000000000000000', chainId: 8453 },
+  balanceKey: '8453:0xDAI',
+  asset: { symbol: 'DAI', decimals: 18 },
+  balance: '9000000000000000000',
+  fundable: true,
+};
+
+function stubMainIpc(electronApp, ledger, accepts = [USDC_ACCEPT]) {
+  return electronApp.evaluate(({ ipcMain }, { ledger, accepts }) => {
+    const replace = (channel, handler) => {
+      ipcMain.removeHandler(channel);
+      ipcMain.handle(channel, handler);
+    };
+    replace('identity:get-status', () => ({ isUnlocked: true }));
+    replace('wallet:get-derived-wallets', () => ({ success: true, wallets: [ledger] }));
+    replace('dapp:get-permission', () => ({
+      origin: 'https://pay.example',
+      walletIndex: ledger.index,
+      chainId: 8453,
+    }));
+    replace('x402:get-details', () => ({
+      success: true,
+      detectionId: 'det-1',
+      url: 'https://pay.example/article',
+      accepts,
+      initialSelectionIndex: 0,
+    }));
+    replace('x402:get-all-permissions', () => ({ success: true, permissions: [] }));
+
+    // Cancel paths must stay untouched while the device prompt is up.
+    globalThis.__x402Cancels = { cancel: 0, reject: 0 };
+    replace('x402:cancel', () => {
+      globalThis.__x402Cancels.cancel += 1;
+      return { success: true };
+    });
+    replace('x402:reject', () => {
+      globalThis.__x402Cancels.reject += 1;
+      return { success: true };
+    });
+
+    // Never settles on its own: this is the window where the device prompt
+    // is up and the user is deciding.
+    globalThis.__resolveX402Approve = null;
+    globalThis.__x402ApproveCalls = [];
+    replace('x402:approve', (_event, payload) => new Promise((resolve) => {
+      globalThis.__x402ApproveCalls.push(payload);
+      globalThis.__resolveX402Approve = resolve;
+    }));
+  }, { ledger, accepts });
+}
+
+// Put the app on the Ledger account and raise a 402 the way main does.
+async function openPaymentCard(electronApp, window, ledger) {
+  await window.evaluate(async (ledger) => {
+    const { walletState } = await import('./lib/wallet/wallet-state.js');
+    walletState.derivedWallets = [ledger];
+    walletState.activeWalletIndex = ledger.index;
+  }, ledger);
+
+  await electronApp.evaluate(({ BrowserWindow }) => {
+    BrowserWindow.getAllWindows()[0].webContents.send('x402:approval-needed', {
+      webContentsId: 7,
+      detectionId: 'det-1',
+      url: 'https://pay.example/article',
+      resourceType: 'mainFrame',
+    });
+  });
+}
+
+function cancelCounts(electronApp) {
+  return electronApp.evaluate(() => globalThis.__x402Cancels);
+}
+
+test('a dApp request mid-payment cannot cancel an in-flight Ledger payment', async ({
+  electronApp,
+  window,
+}) => {
+  await stubMainIpc(electronApp, LEDGER);
+  await openPaymentCard(electronApp, window, LEDGER);
+
+  await expect(window.locator('#sidebar-x402-approval')).toBeVisible();
+  await expect(window.locator('#x402-approval-amount')).toHaveText('2.5 USDC');
+  await expect(window.locator('#x402-approval-approve')).toBeEnabled();
+  await window.screenshot({ path: 'test-results/x402-ledger-before-pay.png' });
+
+  await window.click('#x402-approval-approve');
+
+  // Device prompt is up: both ways out of the card are closed.
+  await expect(window.locator('#x402-approval-approve')).toHaveText('Confirm on your Ledger…');
+  await expect(window.locator('#x402-approval-reject')).toBeDisabled();
+  await expect(window.locator('#x402-approval-back')).toBeDisabled();
+
+  // A dApp request lands while the device is showing the payment. It must
+  // be refused rather than firing hideAllSubscreens() — which would run the
+  // card's hider and cancel the detection out from under the device.
+  const settled = await window.evaluate(async (txParams) => {
+    const dappTx = await import('./lib/wallet/dapp-tx.js');
+    return dappTx.showDappTxApproval({}, 'https://swap.example', txParams).then(
+      (hash) => `resolved:${hash}`,
+      (err) => `rejected:${err.code || err.message}`
+    );
+  }, TX_PARAMS);
+  expect(settled).toBe('rejected:-32002');
+
+  expect(await cancelCounts(electronApp)).toEqual({ cancel: 0, reject: 0 });
+  await expect(window.locator('#sidebar-dapp-tx')).toBeHidden();
+  await expect(window.locator('#sidebar-x402-approval')).toBeVisible();
+  await expect(window.locator('#x402-approval-url')).toHaveText('https://pay.example/article');
+  await expect(window.locator('#x402-approval-approve')).toHaveText('Confirm on your Ledger…');
+  await expect(window.locator('#x402-approval-reject')).toBeDisabled();
+  await expect(window.locator('#x402-approval-back')).toBeDisabled();
+  await window.screenshot({ path: 'test-results/x402-ledger-in-flight-protected.png' });
+
+  // The device confirms: the payment — and only it — settles, and the card
+  // releases the sidebar for the next request.
+  await electronApp.evaluate(() => {
+    globalThis.__resolveX402Approve({ success: true });
+  });
+  await expect(window.locator('#sidebar-x402-approval')).toBeHidden();
+  expect(await cancelCounts(electronApp)).toEqual({ cancel: 0, reject: 0 });
+
+  const afterSettle = await window.evaluate(async (txParams) => {
+    const dappTx = await import('./lib/wallet/dapp-tx.js');
+    dappTx.showDappTxApproval({}, 'https://swap.example', txParams).catch(() => {});
+    return 'requested';
+  }, TX_PARAMS);
+  expect(afterSettle).toBe('requested');
+  await expect(window.locator('#sidebar-dapp-tx')).toBeVisible();
+});
+
+// A multi-accept paywall keeps the chooser radios on screen while the
+// authorization is on the device. Flipping one re-renders the card, and the
+// re-render used to re-derive Pay as enabled — offering a second, concurrent
+// device signature for a different accept, whose failure would then release
+// the lock the first one still holds. The card must stay frozen instead.
+test('flipping the accept chooser mid-payment cannot re-arm Pay', async ({
+  electronApp,
+  window,
+}) => {
+  await stubMainIpc(electronApp, LEDGER, [USDC_ACCEPT, DAI_ACCEPT]);
+  await openPaymentCard(electronApp, window, LEDGER);
+
+  await expect(window.locator('#sidebar-x402-approval')).toBeVisible();
+  await expect(window.locator('#x402-approval-chooser')).toBeVisible();
+  await expect(window.locator('#x402-approval-chooser-options .x402-chooser-row')).toHaveCount(2);
+  await expect(window.locator('#x402-approval-approve')).toBeEnabled();
+
+  await window.click('#x402-approval-approve');
+  await expect(window.locator('#x402-approval-approve')).toHaveText('Confirm on your Ledger…');
+
+  // The user pokes the other option while the device prompt is up.
+  await window.click('#x402-approval-chooser-options input[value="1"]');
+
+  await expect(window.locator('#x402-approval-approve')).toHaveText('Confirm on your Ledger…');
+  await expect(window.locator('#x402-approval-approve')).toBeDisabled();
+  await expect(window.locator('#x402-approval-reject')).toBeDisabled();
+  await expect(window.locator('#x402-approval-back')).toBeDisabled();
+  // …and the radio snaps back to the accept that is on the device, so the
+  // card never shows a selection the payment doesn't match.
+  await expect(window.locator('#x402-approval-chooser-options input[value="0"]')).toBeChecked();
+  await expect(window.locator('#x402-approval-chooser-options input[value="1"]')).not.toBeChecked();
+  await expect(window.locator('#x402-approval-amount')).toHaveText('2.5 USDC');
+  await window.screenshot({ path: 'test-results/x402-chooser-flip-in-flight.png' });
+
+  // Even a click that bypasses the disabled button reaches no second sign.
+  await window.evaluate(() => {
+    document.getElementById('x402-approval-approve').dispatchEvent(new Event('click'));
+  });
+  const approveCalls = await electronApp.evaluate(() => globalThis.__x402ApproveCalls);
+  expect(approveCalls).toHaveLength(1);
+  expect(approveCalls[0].selectedAcceptIndex).toBe(0);
+
+  // The device confirms the one payment that was ever sent to it.
+  await electronApp.evaluate(() => {
+    globalThis.__resolveX402Approve({ success: true });
+  });
+  await expect(window.locator('#sidebar-x402-approval')).toBeHidden();
+  expect(await cancelCounts(electronApp)).toEqual({ cancel: 0, reject: 0 });
+});
+
+// Signing without hosted clear-signing resolution means a factory-default
+// Ledger (blind signing off) refuses every contract call — including the
+// EIP-3009 authorization behind an x402 payment. The instruction the user
+// gets has to name the setting to change; "reconnect the device" is a dead
+// end. The message comes from the real main-process mapper.
+test('a blind-signing refusal tells the user which device setting to enable', async ({
+  electronApp,
+  window,
+}) => {
+  await stubMainIpc(electronApp, LEDGER);
+  await electronApp.evaluate(({ ipcMain, app }) => {
+    const nodeRequire = process.mainModule.require.bind(process.mainModule);
+    const { mapLedgerError } = nodeRequire(
+      nodeRequire('path').join(app.getAppPath(), 'src/main/wallet/ledger/errors.js')
+    );
+    // Exactly what the Ethereum app answers when it will not sign data it
+    // cannot decode.
+    const mapped = mapLedgerError(Object.assign(new Error('status 6a80'), { statusCode: 0x6a80 }));
+    ipcMain.removeHandler('x402:approve');
+    ipcMain.handle('x402:approve', () => ({ success: false, error: mapped.message, code: mapped.code }));
+  });
+  await openPaymentCard(electronApp, window, LEDGER);
+
+  await expect(window.locator('#sidebar-x402-approval')).toBeVisible();
+  await window.click('#x402-approval-approve');
+
+  await expect(window.locator('#x402-approval-error')).toBeVisible();
+  await expect(window.locator('#x402-approval-error')).toContainText('Blind signing');
+  await expect(window.locator('#x402-approval-error')).not.toContainText('Reconnect');
+  // The card is usable again: fix the setting on the device and retry.
+  await expect(window.locator('#x402-approval-approve')).toHaveText('Pay');
+  await expect(window.locator('#x402-approval-approve')).toBeEnabled();
+  await expect(window.locator('#x402-approval-reject')).toBeEnabled();
+  await window.screenshot({ path: 'test-results/x402-blind-signing-error.png' });
+});
+
+// The browser tab strip is chrome the signature lock deliberately does not
+// cover, so the paying tab can be closed while the device prompt is up. The
+// subresource card's only release is the x402:approval-result event, so if
+// that event is addressed through the (now dead) paying tab the sidebar
+// keeps the lock for the rest of the session: the card freezes, the X and
+// the toolbar toggle stay disabled, and every dApp request is refused
+// -32002. Driven through the REAL detector + the REAL webContents
+// 'destroyed' handler against a real tab; only get-details/approve are
+// stubbed (the sign itself needs a device).
+test('closing the paying tab mid-payment releases the sidebar instead of bricking it', async ({
+  electronApp,
+  window,
+}) => {
+  await stubMainIpc(electronApp, LEDGER);
+  // The card carries the detectionId get-details hands it, so the stub has
+  // to report the id the real detector below mints (`req-<request id>`).
+  await electronApp.evaluate(({ ipcMain }) => {
+    ipcMain.removeHandler('x402:get-details');
+    ipcMain.handle('x402:get-details', () => ({
+      success: true,
+      detectionId: 'req-4242',
+      url: 'https://pay.example/segment/0',
+      accepts: [{
+        accept: {
+          amount: '2500000',
+          asset: '0xUSDC',
+          network: 'base',
+          payTo: '0x1111111111111111111111111111111111111111',
+        },
+        tuple: { amount: '2500000', chainId: 8453 },
+        balanceKey: '8453:0xUSDC',
+        asset: { symbol: 'USDC', decimals: 6 },
+        balance: '5000000',
+        fundable: true,
+      }],
+      initialSelectionIndex: 0,
+    }));
+  });
+  await window.evaluate(async (ledger) => {
+    const { walletState } = await import('./lib/wallet/wallet-state.js');
+    walletState.derivedWallets = [ledger];
+    walletState.activeWalletIndex = ledger.index;
+  }, LEDGER);
+
+  // A second tab is the paying tab, so closing it doesn't close the window.
+  await window.locator('[data-test="new-tab-btn"]').click();
+  await expect(window.locator('[data-test="tab"]')).toHaveCount(2);
+  const guestId = await window.evaluate(async () => {
+    const tabs = await import('./lib/tabs.js');
+    return tabs.getActiveWebview()?.getWebContentsId() ?? null;
+  });
+  expect(typeof guestId).toBe('number');
+
+  // Real 402 detection on that tab: mints the detectionId, stores the
+  // detection and fires x402:approval-needed through the real sendToHost.
+  await electronApp.evaluate(({ app }, guestId) => {
+    // `require` isn't in scope inside evaluate; go through the main
+    // module so we get the SAME intercept instance the app is running.
+    const nodeRequire = process.mainModule.require.bind(process.mainModule);
+    const intercept = nodeRequire(
+      nodeRequire('path').join(app.getAppPath(), 'src/main/x402/intercept.js')
+    );
+    const requirements = {
+      x402Version: 2,
+      resource: { url: 'https://pay.example/segment/0' },
+      accepts: [{
+        scheme: 'exact',
+        network: 'eip155:8453',
+        amount: '2500000',
+        asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
+        payTo: '0x1111111111111111111111111111111111111111',
+        maxTimeoutSeconds: 60,
+        extra: { name: 'USD Coin', version: '2' },
+      }],
+    };
+    // Not awaited: the detector holds the response open until the user
+    // decides, exactly as it does in production.
+    intercept.detectPaymentRequiredHandler({
+      id: 4242,
+      webContentsId: guestId,
+      url: 'https://pay.example/segment/0',
+      statusLine: 'HTTP/1.1 402 Payment Required',
+      responseHeaders: {
+        'PAYMENT-REQUIRED': [Buffer.from(JSON.stringify(requirements)).toString('base64')],
+      },
+      resourceType: 'xhr',
+    });
+  }, guestId);
+
+  await expect(window.locator('#sidebar-x402-approval')).toBeVisible();
+  await window.click('#x402-approval-approve');
+
+  // Device prompt is up and the sidebar is locked to it.
+  await expect(window.locator('#x402-approval-approve')).toHaveText('Confirm on your Ledger…');
+  await expect(window.locator('#x402-approval-reject')).toBeDisabled();
+  await expect(window.locator('#sidebar-close')).toBeDisabled();
+  await window.screenshot({ path: 'test-results/x402-tab-close-before.png' });
+
+  // Main-side shape of "the authorization has left for the device": the
+  // approval entry is settled and gone, the sign is outstanding.
+  await electronApp.evaluate(({ app }) => {
+    const nodeRequire = process.mainModule.require.bind(process.mainModule);
+    nodeRequire(
+      nodeRequire('path').join(app.getAppPath(), 'src/main/x402/intercept.js')
+    ).clearAllPendingApprovals();
+  });
+
+  // User closes the paying tab. Real destroy → real cleanup → the card is
+  // told its request is gone, over a channel that doesn't need the tab.
+  await window.locator('[data-test="tab"][data-tab-id="2"] [data-test="tab-close"]').click();
+  await expect(window.locator('[data-test="tab"]')).toHaveCount(1);
+
+  await expect(window.locator('#sidebar-x402-approval')).toBeHidden();
+  await expect(window.locator('#sidebar-close')).toBeEnabled();
+  await expect(window.locator('#wallet-toggle-btn')).toBeEnabled();
+  expect(await cancelCounts(electronApp)).toEqual({ cancel: 0, reject: 0 });
+
+  // Acceptance: the wallet works again — a dApp request is served rather
+  // than refused -32002, and the sidebar can be closed normally.
+  const settled = await window.evaluate(async (txParams) => {
+    const dappTx = await import('./lib/wallet/dapp-tx.js');
+    dappTx.showDappTxApproval({}, 'https://swap.example', txParams).catch(() => {});
+    return 'requested';
+  }, TX_PARAMS);
+  expect(settled).toBe('requested');
+  await expect(window.locator('#sidebar-dapp-tx')).toBeVisible();
+  await window.screenshot({ path: 'test-results/x402-tab-close-after.png' });
+});