diff --git a/apps/client-web/package.json b/apps/client-web/package.json
index 9366445..5f75d06 100644
--- a/apps/client-web/package.json
+++ b/apps/client-web/package.json
@@ -18,6 +18,7 @@
     "@codemirror/state": "^6.5.2",
     "@codemirror/view": "^6.38.8",
     "@inkcre/core": "workspace:*",
+    "@inkcre/extension-runtime-client-web": "https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.1.0/inkcre-extension-runtime-client-web-0.1.0.tgz",
     "@inkcre/ui-web": "1.4.0",
     "@module-federation/runtime": "^0.21.4",
     "@supabase/postgrest-js": "^2.84.0",
diff --git a/apps/client-web/src/components/extension/extensionCard/extensionCard.md b/apps/client-web/src/components/extension/extensionCard/extensionCard.md
index 2911d00..ec13f24 100644
--- a/apps/client-web/src/components/extension/extensionCard/extensionCard.md
+++ b/apps/client-web/src/components/extension/extensionCard/extensionCard.md
@@ -5,11 +5,12 @@ A component that displays extension information and provides controls for toggli
 ## Props
 
 - `extension` (InstalledExtension, required): the canonical installed row
-- `enabled` (boolean, required): whether the current Web Peer UUID is in `enabled[]`
+- `enabled` (boolean, required): whether the selected Client's Peer UUID is in `enabled[]`
+- `controlsCurrentWebRuntime` (boolean, required): whether the switch owns this browser's runtime
+- `setEnabled` (function, required): application-level selected-Client control operation
 
 ## Emits
 
-- `changed`: Emitted after current-Peer enablement changes and the list should be refreshed
 - `updated`: Emitted with the canonical row after configuration or version changes
 - `uninstalled`: Emitted after the canonical row is removed
 
@@ -17,6 +18,8 @@ A component that displays extension information and provides controls for toggli
 
 - Display canonical Extension Name, exact version, and optional nickname
 - Toggle enable/disable status with a switch
+- Mount an Extension-owned setup contribution from this browser's running Web Distribution
+- Keep setup availability independent of which Client is selected for enablement control
 - Edit extension configuration via JSON editor in a dialog
 - Change the exact shared version only while every Peer is disabled
 - Auto-formats configuration as JSON for easier editing
diff --git a/apps/client-web/src/components/extension/extensionCard/extensionCard.ts b/apps/client-web/src/components/extension/extensionCard/extensionCard.ts
index 9643960..5713e30 100644
--- a/apps/client-web/src/components/extension/extensionCard/extensionCard.ts
+++ b/apps/client-web/src/components/extension/extensionCard/extensionCard.ts
@@ -5,11 +5,15 @@ import type { InstalledExtension } from '@inkcre/core'
 export const extensionCardProps = {
   extension: { type: Object as PropType<InstalledExtension>, required: true },
   enabled: { type: Boolean, required: true },
+  controlsCurrentWebRuntime: { type: Boolean, required: true },
+  setEnabled: {
+    type: Function as PropType<(enabled: boolean) => Promise<InstalledExtension>>,
+    required: true,
+  },
 } as const
 
 // --- Emits ---
 export const extensionCardEmits = {
-  changed: () => true,
   updated: (_extension: InstalledExtension) => true,
   uninstalled: () => true,
 } as const
diff --git a/apps/client-web/src/components/extension/extensionCard/extensionCard.vue b/apps/client-web/src/components/extension/extensionCard/extensionCard.vue
index f72f738..ae5aab3 100644
--- a/apps/client-web/src/components/extension/extensionCard/extensionCard.vue
+++ b/apps/client-web/src/components/extension/extensionCard/extensionCard.vue
@@ -1,8 +1,8 @@
 <script setup lang="ts">
-import { ref, computed, watch } from 'vue'
+import { ref, computed, nextTick, shallowRef, watch, type Component } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { InkButton, InkSwitch, InkDialog, InkInput, InkJsonEditor } from '@inkcre/ui-web'
-import { getExtensionHost } from '@/core'
+import { getExtensionHost, getExtensionSetupContribution } from '@/core'
 import { extensionCardProps, extensionCardEmits } from './extensionCard'
 
 const props = defineProps(extensionCardProps)
@@ -12,6 +12,9 @@ const { t } = useI18n()
 // --- data ---
 const configPopupOpen = ref<boolean | Promise<boolean>>(false)
 const versionPopupOpen = ref<boolean | Promise<boolean>>(false)
+const setupPopupOpen = ref(false)
+const setupComponent = shallowRef<Component | null>(null)
+const setupContribution = shallowRef(getExtensionSetupContribution(props.extension.name))
 const togglePromise = ref<Promise<boolean> | null>(null)
 const isUninstalling = ref(false)
 const operationError = ref<string | null>(null)
@@ -28,6 +31,11 @@ watch(
 )
 
 const canUninstall = computed(() => props.extension.enabled.length === 0 && !isUninstalling.value)
+const closeSetup = async () => {
+  setupPopupOpen.value = false
+  setupComponent.value = null
+  await nextTick()
+}
 
 const toggleModel = computed({
   get: () => (togglePromise.value ? togglePromise.value : props.enabled),
@@ -35,17 +43,15 @@ const toggleModel = computed({
     operationError.value = null
     togglePromise.value = (async () => {
       try {
-        if (enabled) {
-          await getExtensionHost().enable(props.extension.name)
-        } else {
-          await getExtensionHost().disable(props.extension.name)
-        }
-        emit('changed')
+        if (!enabled && props.controlsCurrentWebRuntime) await closeSetup()
+        const updated = await props.setEnabled(enabled)
+        emit('updated', updated)
         return enabled
       } catch (error) {
         operationError.value = error instanceof Error ? error.message : String(error)
         return props.enabled
       } finally {
+        setupContribution.value = getExtensionSetupContribution(props.extension.name)
         togglePromise.value = null
       }
     })()
@@ -56,6 +62,13 @@ const onEditConfigClick = () => {
   configPopupOpen.value = true
 }
 
+const onSetupClick = () => {
+  const contribution = setupContribution.value
+  if (!contribution) return
+  setupComponent.value = contribution.component
+  setupPopupOpen.value = true
+}
+
 const onChangeVersionClick = () => {
   versionModel.value = props.extension.version
   versionPopupOpen.value = true
@@ -123,6 +136,13 @@ const onUninstall = async () => {
     </div>
 
     <div class="extension-card__actions">
+      <InkButton
+        v-if="setupContribution"
+        :text="t('extension.setup')"
+        theme="primary"
+        size="sm"
+        @click="onSetupClick"
+      />
       <InkButton @click="onEditConfigClick" :text="t('extension.editConfig')" size="sm" />
       <InkButton
         @click="onChangeVersionClick"
@@ -146,6 +166,17 @@ const onUninstall = async () => {
     </p>
     <p v-if="operationError" class="extension-card__error">{{ operationError }}</p>
 
+    <InkDialog
+      v-model="setupPopupOpen"
+      :title="t('extension.setupTitle', { name: extension.nickname ?? extension.name })"
+      :show-cancel="false"
+      :show-confirm="false"
+      :close-on-scrim="false"
+      @update:model-value="(open) => !open && closeSetup()"
+    >
+      <component :is="setupComponent" v-if="setupComponent" @close="closeSetup" />
+    </InkDialog>
+
     <InkDialog
       v-model="configPopupOpen"
       :title="t('extension.editConfigTitle')"
diff --git a/apps/client-web/src/core.ts b/apps/client-web/src/core.ts
index 525f2f9..0122685 100644
--- a/apps/client-web/src/core.ts
+++ b/apps/client-web/src/core.ts
@@ -7,11 +7,8 @@
 
 import {
   configStore,
-  getMFImplementation,
+  ExtensionRegistryOriginResolver,
   localStorageAdapter,
-  PostgrestExtensionStatePort,
-  RegistryExtensionReleaseReader,
-  setMFImplementation,
   registerCoreResolvers,
   TextResolver,
   AudioResolver,
@@ -23,11 +20,17 @@ import {
   HtmlResolver,
   ZipResolver,
   PeerManager,
+  WebPeerRuntime,
   JobManager,
-  WebExtensionHost,
-  type ExtensionStatePort,
+  type ExtensionModule,
+  type ExtensionSetupContribution,
 } from '@inkcre/core'
-import { createInstance } from '@module-federation/enhanced/runtime'
+import { createInstance } from '@module-federation/runtime'
+import {
+  ExtensionManager,
+  RegistryReleaseReader,
+  type WebExtensionModule,
+} from '@inkcre/extension-runtime-client-web'
 import * as InKCreCore from '@inkcre/core'
 import * as Zod from 'zod'
 import * as Vue from 'vue'
@@ -78,38 +81,87 @@ export function setupResolvers(): void {
 // Configuration
 // ============================================================================
 
-let extensionHost: WebExtensionHost | null = null
-
-export function initializeExtensionHost(state: ExtensionStatePort): WebExtensionHost {
-  extensionHost = new WebExtensionHost({
-    state,
-    releases: new RegistryExtensionReleaseReader(
-      () => configStore.peerConfig.extension_registry_url
-    ),
-    moduleFederation: getMFImplementation,
-    currentPeerId: () => configStore.metaConfig.INKCRE_PEER_ID,
-    hostSdkVersion: corePackageJson.version,
+type ClientExtensionModule = WebExtensionModule & ExtensionModule
+type ClientExtensionManager = ExtensionManager<ClientExtensionModule>
+
+let extensionHost: ClientExtensionManager | null = null
+let extensionHostStartup: Promise<void> | null = null
+let moduleFederation: ReturnType<typeof createInstance> | null = null
+let webPeerRuntime: WebPeerRuntime | null = null
+
+export function initializeExtensionHost(): ClientExtensionManager {
+  extensionHostStartup = null
+  const registryOrigin = new ExtensionRegistryOriginResolver(
+    () => configStore.peerConfig.extension_registry_url
+  )
+  if (!moduleFederation) throw new Error('Module Federation has not been initialized.')
+  extensionHost = new ExtensionManager<ClientExtensionModule>({
+    releases: new RegistryReleaseReader({
+      registryOrigin: () => registryOrigin.resolve(),
+      hostSdk: { name: '@inkcre/core', version: corePackageJson.version },
+    }),
+    moduleFederation,
   })
   return extensionHost
 }
 
-export function getExtensionHost(): WebExtensionHost {
+/** Share one initial runtime restore across the app shell and management view. */
+export function startExtensionHost(): Promise<void> {
+  if (extensionHostStartup) return extensionHostStartup
+  const startup = getExtensionHost().startup(configStore.metaConfig.INKCRE_PEER_ID)
+  extensionHostStartup = startup.catch((error: unknown) => {
+    extensionHostStartup = null
+    throw error
+  })
+  return extensionHostStartup
+}
+
+export function getExtensionHost(): ClientExtensionManager {
   if (!extensionHost) {
     throw new Error('Web Extension Host state port has not been initialized.')
   }
   return extensionHost
 }
 
+/** Project the running native module into the Client-owned setup popup contract. */
+export function getExtensionSetupContribution(name: string): ExtensionSetupContribution | null {
+  return getExtensionHost().getModule(name)?.setup ?? null
+}
+
+/** Replace the browser-owned lease runtime after a validated Settings cutover. */
+export function adoptWebPeerRuntime(runtime: WebPeerRuntime): void {
+  webPeerRuntime?.stop()
+  webPeerRuntime = runtime
+}
+
+export function stopWebPeerRuntime(): void {
+  webPeerRuntime?.stop()
+  webPeerRuntime = null
+}
+
+/** Start the lease after Settings has mounted and loaded recovery configuration. */
+export async function startConfiguredWebPeerRuntime(): Promise<void> {
+  if (!configStore.metaConfig.INKCRE_PGREST_URL || !configStore.metaConfig.INKCRE_JWT_SECRET) return
+  const candidate = new WebPeerRuntime(configStore.metaConfig.INKCRE_PEER_ID)
+  try {
+    await candidate.start()
+    adoptWebPeerRuntime(candidate)
+  } catch (error) {
+    candidate.stop()
+    throw error
+  }
+}
+
 // ============================================================================
 // Module Federation
 // ============================================================================
 
 /**
  * Initialize Module Federation runtime.
- * Creates the MF instance and injects it into core.
+ * Creates the MF instance consumed by the application-owned Extension manager.
  */
 export function initializeModuleFederation(): void {
-  const mfInstance = createInstance({
+  moduleFederation = createInstance({
     name: 'host',
     remotes: [],
     shared: {
@@ -164,21 +216,6 @@ export function initializeModuleFederation(): void {
     },
   })
 
-  // Inject MF implementation into core
-  const mfImpl = {
-    registerRemotes: (
-      remotes: Array<{ name: string; entry: string; type?: 'module' | 'script' }>,
-      options?: { force?: boolean }
-    ) => {
-      mfInstance.registerRemotes(remotes, options)
-    },
-    loadRemote: async <T>(remoteName: string): Promise<T | null> => {
-      return mfInstance.loadRemote<T>(remoteName)
-    },
-  }
-
-  setMFImplementation(mfImpl)
-
   console.log('[Core] Module Federation initialized')
 }
 
@@ -196,17 +233,34 @@ export function shouldLoadPeerConfigAtBootstrap(pathname: string): boolean {
 
 export async function initializeCore(options: { loadPeerConfig?: boolean } = {}): Promise<void> {
   await configStore.initializeMeta(localStorageAdapter)
-  if (options.loadPeerConfig ?? true) {
-    await configStore.loadPeerConfig()
+  await configStore.saveMeta()
+  const requirePeerConnection = options.loadPeerConfig ?? true
+  if (
+    requirePeerConnection &&
+    configStore.metaConfig.INKCRE_PGREST_URL &&
+    configStore.metaConfig.INKCRE_JWT_SECRET
+  ) {
+    const candidate = new WebPeerRuntime(configStore.metaConfig.INKCRE_PEER_ID)
+    try {
+      await candidate.register()
+      await configStore.loadPeerConfig()
+      await candidate.start()
+      adoptWebPeerRuntime(candidate)
+    } catch (error) {
+      candidate.stop()
+      throw error
+    }
   }
   PeerManager.setupBuiltinOutbounds()
   JobManager.startWorker()
   setupResolvers()
   initializeModuleFederation()
-  initializeExtensionHost(new PostgrestExtensionStatePort())
+  initializeExtensionHost()
+  if (webPeerRuntime) await webPeerRuntime.start()
   console.log('[Core] Initialization complete')
 }
 
 export function shutdownCore(): void {
+  stopWebPeerRuntime()
   JobManager.stopWorker()
 }
diff --git a/apps/client-web/src/extension-peer-control.ts b/apps/client-web/src/extension-peer-control.ts
new file mode 100644
index 0000000..9fe5080
--- /dev/null
+++ b/apps/client-web/src/extension-peer-control.ts
@@ -0,0 +1,69 @@
+import {
+  InstalledExtensionSchema,
+  ExtensionModel,
+  Peer,
+  PeerManager,
+  PeerProtocolResponseSchema,
+  type InstalledExtension,
+} from '@inkcre/core'
+import type { ExtensionManager } from '@inkcre/extension-runtime-client-web'
+
+export const EXTENSION_MANAGEMENT_CAPABILITY = 'core.extension.management.v1'
+export type ExtensionPeerControlMode = 'current-runtime' | 'remote-host' | 'desired-state'
+
+export function peerAdvertises(peer: Peer, capability: string): boolean {
+  try {
+    return peer.capabilitySnapshot().some((candidate) => candidate.id === capability)
+  } catch {
+    return false
+  }
+}
+
+export function extensionPeerControlMode(
+  peer: Peer,
+  currentPeerId: string
+): ExtensionPeerControlMode {
+  if (peer.id === currentPeerId) return 'current-runtime'
+  const live = peer.lease_expires_at !== null && peer.lease_expires_at.getTime() > Date.now()
+  return live && peerAdvertises(peer, EXTENSION_MANAGEMENT_CAPABILITY)
+    ? 'remote-host'
+    : 'desired-state'
+}
+
+export async function setExtensionPeerEnabled(input: {
+  name: string
+  peer: Peer
+  currentPeerId: string
+  enabled: boolean
+  manager: ExtensionManager
+}): Promise<InstalledExtension> {
+  const mode = extensionPeerControlMode(input.peer, input.currentPeerId)
+  if (mode === 'current-runtime') {
+    return input.enabled
+      ? input.manager.enable(input.name, input.currentPeerId)
+      : input.manager.disable(input.name, input.currentPeerId)
+  }
+  if (mode === 'desired-state') {
+    const extension = await ExtensionModel.get(input.name)
+    if (!extension) throw new Error(`Extension ${input.name} is not installed.`)
+    return input.enabled
+      ? extension.enablePeer(input.peer.id)
+      : extension.disablePeer(input.peer.id)
+  }
+
+  const delegated = await PeerManager.delegate(
+    EXTENSION_MANAGEMENT_CAPABILITY,
+    {
+      body: {
+        action: input.enabled ? 'enable' : 'disable',
+        extension: input.name,
+      },
+    },
+    input.peer.id
+  )
+  const response = PeerProtocolResponseSchema.parse(delegated)
+  if (response.status !== 200 || response.body === undefined) {
+    throw new Error(`Extension management Peer returned HTTP ${response.status} for ${input.name}.`)
+  }
+  return InstalledExtensionSchema.parse(response.body)
+}
diff --git a/apps/client-web/src/locales/messages/en.json b/apps/client-web/src/locales/messages/en.json
index ed37a27..f1e7939 100644
--- a/apps/client-web/src/locales/messages/en.json
+++ b/apps/client-web/src/locales/messages/en.json
@@ -29,6 +29,10 @@
     "extensionRegistryUrl": "Extension Registry URL",
     "jwtSecret": "JWT Secret",
     "clientId": "Client ID",
+    "peerId": "Client ID",
+    "peerIdGenerated": "Generated and persisted for this browser origin.",
+    "peerConfig": "Client Settings",
+    "peerConfigNotice": "Saved for this client and shared with every browser session using this Client ID.",
     "languageLabel": "Language",
     "languageDescription": "Select your preferred language",
     "saveConfig": "Save",
@@ -83,6 +87,14 @@
     "changeVersion": "Change Version",
     "changeVersionTitle": "Change Exact Extension Version",
     "uninstall": "Uninstall",
+    "setup": "Setup",
+    "setupTitle": "Set up {name}",
+    "peerSelector": "Control Extension on Client",
+    "peerSelectorPlaceholder": "Select a Client",
+    "peerNotFound": "The selected Client no longer exists.",
+    "currentBrowser": "This browser",
+    "desiredStateOnly": "This Client has no live management endpoint. Changes update its durable enabled state and take effect when that Client next reconciles it.",
+    "peerListUnavailable": "The Client list could not be loaded: {error}",
     "enabledPeerCount": "Enabled on {count} Peer(s).",
     "uninstallDisabled": "Disable every Peer before uninstalling or changing the shared version."
   },
diff --git a/apps/client-web/src/locales/messages/zh-CN.json b/apps/client-web/src/locales/messages/zh-CN.json
index 8fd0894..7bda22b 100644
--- a/apps/client-web/src/locales/messages/zh-CN.json
+++ b/apps/client-web/src/locales/messages/zh-CN.json
@@ -29,6 +29,10 @@
     "extensionRegistryUrl": "扩展注册表地址",
     "jwtSecret": "JWT 密钥",
     "clientId": "客户端 ID",
+    "peerId": "客户端 ID",
+    "peerIdGenerated": "由当前浏览器来源自动生成并持久保存。",
+    "peerConfig": "客户端设置",
+    "peerConfigNotice": "配置存储在当前客户端上，并由使用同一客户端 ID 的浏览器会话共享。",
     "languageLabel": "语言",
     "languageDescription": "选择您的首选语言",
     "saveConfig": "保存",
@@ -83,6 +87,14 @@
     "changeVersion": "变更版本",
     "changeVersionTitle": "变更扩展的精确版本",
     "uninstall": "卸载",
+    "setup": "设置",
+    "setupTitle": "设置 {name}",
+    "peerSelector": "控制扩展的客户端",
+    "peerSelectorPlaceholder": "选择客户端",
+    "peerNotFound": "所选客户端已不存在。",
+    "currentBrowser": "当前浏览器",
+    "desiredStateOnly": "此客户端没有在线管理端点；操作只更新其持久启用状态，并在该客户端下次协调状态时生效。",
+    "peerListUnavailable": "无法加载客户端列表：{error}",
     "enabledPeerCount": "已在 {count} 个 Peer 上启用。",
     "uninstallDisabled": "卸载或变更共享版本前，必须先禁用所有 Peer。"
   },
diff --git a/apps/client-web/src/main.ts b/apps/client-web/src/main.ts
index 58a026d..a905d48 100644
--- a/apps/client-web/src/main.ts
+++ b/apps/client-web/src/main.ts
@@ -20,18 +20,21 @@ setInfoBaseRouter(createInfoBaseRouterAdapter(router))
 // Initialize core package
 import { initializeCore, shutdownCore } from './core'
 import { shouldLoadPeerConfigAtBootstrap } from './core'
+const loadPeerConfigAtBootstrap = shouldLoadPeerConfigAtBootstrap(window.location.pathname)
 await initializeCore({
   // Settings is the recovery surface for invalid or incomplete bootstrap
-  // credentials. It must mount without first contacting the configured Peer.
-  loadPeerConfig: shouldLoadPeerConfigAtBootstrap(window.location.pathname),
+  // credentials. It mounts before contacting the configured Peer.
+  loadPeerConfig: loadPeerConfigAtBootstrap,
 })
 app.mount('#app')
 
-import { getExtensionHost } from './core'
+import { getExtensionHost, startExtensionHost } from './core'
 const extensionHost = getExtensionHost()
-extensionHost.startup().catch((error) => {
-  console.error('[Web Extension Host] Startup failed:', error)
-})
+if (loadPeerConfigAtBootstrap) {
+  startExtensionHost().catch((error) => {
+    console.error('[Web Extension Host] Startup failed:', error)
+  })
+}
 
 window.addEventListener('beforeunload', () => {
   shutdownCore()
diff --git a/apps/client-web/src/views/extensions/extensions.scss b/apps/client-web/src/views/extensions/extensions.scss
index fcc75c7..4782420 100644
--- a/apps/client-web/src/views/extensions/extensions.scss
+++ b/apps/client-web/src/views/extensions/extensions.scss
@@ -18,6 +18,17 @@
     overflow-y: auto;
   }
 
+  &__header {
+    display: grid;
+    gap: sys-var(space, sm);
+  }
+
+  &__notice {
+    @include apply-font(body-sm);
+    margin: 0;
+    color: sys-var(color, text, muted);
+  }
+
   &__error {
     @include apply-font(body-sm);
     color: sys-var(color, danger, base);
diff --git a/apps/client-web/src/views/extensions/extensions.vue b/apps/client-web/src/views/extensions/extensions.vue
index 7bdce78..efcad47 100644
--- a/apps/client-web/src/views/extensions/extensions.vue
+++ b/apps/client-web/src/views/extensions/extensions.vue
@@ -1,21 +1,76 @@
 <script setup lang="ts">
-import { onMounted, ref } from 'vue'
+import { computed, onMounted, ref } from 'vue'
 import extensionCard from '@/components/extension/extensionCard/extensionCard.vue'
 import installExtension from '@/components/extension/installExtension/installExtension.vue'
-import { InkLoading } from '@inkcre/ui-web'
-import { configStore, type InstalledExtension } from '@inkcre/core'
-import { getExtensionHost } from '@/core'
+import { InkDropdown, InkLoading } from '@inkcre/ui-web'
+import { configStore, Peer, type InstalledExtension } from '@inkcre/core'
+import { getExtensionHost, startExtensionHost } from '@/core'
+import { extensionPeerControlMode, setExtensionPeerEnabled } from '@/extension-peer-control'
 import { useI18n } from 'vue-i18n'
 
 // --- data ---
 const { t } = useI18n()
 const currentPeerId = configStore.metaConfig.INKCRE_PEER_ID
+const selectedPeerId = ref(currentPeerId)
+const peers = ref<Peer[]>([])
 const extensions = ref<InstalledExtension[]>([])
+const peersLoading = ref(false)
 const extensionsLoading = ref(false)
 const error = ref<string | null>(null)
+const peerError = ref<string | null>(null)
 
-const isEnabledForCurrentPeer = (extension: InstalledExtension) =>
-  currentPeerId ? extension.enabled.includes(currentPeerId) : false
+const currentPeerFallback = Peer.parse({
+  id: currentPeerId,
+  name: t('extension.currentBrowser'),
+  labels: [],
+  config: {},
+  config_schema: {},
+  capabilities: [],
+  lease_expires_at: new Date(Date.now() + 60_000),
+  created_at: new Date(),
+  updated_at: new Date(),
+})
+const selectedPeer = computed(
+  () =>
+    peers.value.find((peer) => peer.id === selectedPeerId.value) ??
+    (selectedPeerId.value === currentPeerId ? currentPeerFallback : null)
+)
+const peerOptions = computed(() => {
+  const options = peers.value.map((peer) => ({
+    label:
+      peer.id === currentPeerId ? `${peer.name} (${t('extension.currentBrowser')})` : peer.name,
+    value: peer.id,
+    description: peer.id,
+  }))
+  return peers.value.some((peer) => peer.id === currentPeerId)
+    ? options
+    : [
+        {
+          label: t('extension.currentBrowser'),
+          value: currentPeerId,
+          description: currentPeerId,
+        },
+        ...options,
+      ]
+})
+const selectedControlMode = computed(() =>
+  selectedPeer.value ? extensionPeerControlMode(selectedPeer.value, currentPeerId) : null
+)
+const isEnabledForSelectedPeer = (extension: InstalledExtension) =>
+  extension.enabled.includes(selectedPeerId.value)
+
+const refreshPeers = async () => {
+  peersLoading.value = true
+  peerError.value = null
+  try {
+    peers.value = await Peer.list()
+  } catch (cause) {
+    peers.value = []
+    peerError.value = cause instanceof Error ? cause.message : String(cause)
+  } finally {
+    peersLoading.value = false
+  }
+}
 
 const refreshExtensions = async () => {
   extensionsLoading.value = true
@@ -29,7 +84,14 @@ const refreshExtensions = async () => {
   }
 }
 
-onMounted(() => void refreshExtensions())
+onMounted(async () => {
+  try {
+    await startExtensionHost()
+  } catch {
+    // The app shell owns runtime-startup reporting; this list remains a recovery surface.
+  }
+  await Promise.all([refreshPeers(), refreshExtensions()])
+})
 
 // --- methods ---
 const onInstallExtension = () => {
@@ -41,6 +103,21 @@ const updExtension = (updatedExtension: InstalledExtension) => {
     extension.name === updatedExtension.name ? updatedExtension : extension
   )
 }
+
+const setEnabledForSelectedPeer = (
+  extension: InstalledExtension,
+  enabled: boolean
+): Promise<InstalledExtension> => {
+  const peer = selectedPeer.value
+  if (!peer) throw new Error(t('extension.peerNotFound'))
+  return setExtensionPeerEnabled({
+    name: extension.name,
+    peer,
+    currentPeerId,
+    enabled,
+    manager: getExtensionHost(),
+  })
+}
 </script>
 
 <template>
@@ -48,7 +125,22 @@ const updExtension = (updatedExtension: InstalledExtension) => {
     <installExtension @install="onInstallExtension" />
 
     <div class="extensions-view__list">
-      <div v-if="extensionsLoading" class="flex items-center justify-center">
+      <div class="extensions-view__header">
+        <InkDropdown
+          v-model="selectedPeerId"
+          :label="t('extension.peerSelector')"
+          :placeholder="t('extension.peerSelectorPlaceholder')"
+          :options="peerOptions"
+        />
+        <p v-if="selectedControlMode === 'desired-state'" class="extensions-view__notice">
+          {{ t('extension.desiredStateOnly') }}
+        </p>
+        <p v-if="peerError" class="extensions-view__error">
+          {{ t('extension.peerListUnavailable', { error: peerError }) }}
+        </p>
+      </div>
+
+      <div v-if="extensionsLoading || peersLoading" class="flex items-center justify-center">
         <InkLoading />
       </div>
       <p v-else-if="error" class="extensions-view__error">{{ error }}</p>
@@ -57,8 +149,9 @@ const updExtension = (updatedExtension: InstalledExtension) => {
         v-else
         :key="extension.name"
         :extension="extension"
-        :enabled="isEnabledForCurrentPeer(extension)"
-        @changed="refreshExtensions"
+        :enabled="isEnabledForSelectedPeer(extension)"
+        :controls-current-web-runtime="selectedControlMode === 'current-runtime'"
+        :set-enabled="(enabled) => setEnabledForSelectedPeer(extension, enabled)"
         @updated="updExtension"
         @uninstalled="refreshExtensions"
       />
diff --git a/apps/client-web/src/views/settings/settings.scss b/apps/client-web/src/views/settings/settings.scss
index d8f83b9..bbc1b08 100644
--- a/apps/client-web/src/views/settings/settings.scss
+++ b/apps/client-web/src/views/settings/settings.scss
@@ -25,7 +25,8 @@
   }
 
   &__secret,
-  &__locale {
+  &__locale,
+  &__identity {
     display: flex;
     flex-direction: column;
     gap: sys-var('space', 'xs');
@@ -43,6 +44,10 @@
     }
   }
 
+  &__identity code {
+    overflow-wrap: anywhere;
+  }
+
   &__actions {
     display: flex;
     gap: sys-var('space', 'md');
diff --git a/apps/client-web/src/views/settings/settings.vue b/apps/client-web/src/views/settings/settings.vue
index 6ceb766..c4b6157 100644
--- a/apps/client-web/src/views/settings/settings.vue
+++ b/apps/client-web/src/views/settings/settings.vue
@@ -1,16 +1,33 @@
 <script setup lang="ts">
-import { computed, reactive, ref, watch } from 'vue'
+import { computed, onMounted, reactive, ref, watch } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { InkForm, InkInput, InkButton, InkDoubleCheck } from '@inkcre/ui-web'
-import { configStore, MetaConfigSchema, type MetaConfig } from '@inkcre/core'
+import {
+  configStore,
+  MetaConfigSchema,
+  PeerConfigSchema,
+  type MetaConfig,
+  type PeerConfig,
+} from '@inkcre/core'
 import { setLocale, SUPPORT_LOCALES, LOCALE_NAMES, type SupportLocale } from '@/locales'
 import i18n from '@/locales'
 import PeerList from '@/components/peer/peerList/peerList.vue'
+import { adoptWebPeerRuntime, startConfiguredWebPeerRuntime, stopWebPeerRuntime } from '@/core'
 
 const { t } = useI18n()
 
 // Local reactive copy of metaConfig for form editing
 const metaFormConfig = reactive<MetaConfig>({ ...configStore.metaConfig })
+const peerFormConfig = reactive<PeerConfig>(PeerConfigSchema.parse(configStore.peerConfig))
+const allPeersRevision = ref(0)
+const peerConfigLoading = ref(false)
+const saving = ref(false)
+const hasConnectedConfig = computed(
+  () =>
+    Boolean(configStore.metaConfig.INKCRE_PGREST_URL) &&
+    Boolean(configStore.metaConfig.INKCRE_JWT_SECRET)
+)
+const formBusy = computed(() => peerConfigLoading.value || saving.value)
 
 // Synchronize metaFormConfig with configStore.metaConfig
 watch(
@@ -20,6 +37,25 @@ watch(
   },
   { deep: true }
 )
+watch(
+  () => configStore.peerConfig,
+  (newPeerConfig) => Object.assign(peerFormConfig, PeerConfigSchema.parse(newPeerConfig)),
+  { deep: true }
+)
+
+onMounted(async () => {
+  if (!hasConnectedConfig.value) return
+  peerConfigLoading.value = true
+  try {
+    await configStore.loadPeerConfig()
+    Object.assign(peerFormConfig, PeerConfigSchema.parse(configStore.peerConfig))
+    await startConfiguredWebPeerRuntime()
+  } catch (error) {
+    console.warn('Configured Web Peer could not start from Settings.', error)
+  } finally {
+    peerConfigLoading.value = false
+  }
+})
 
 // Current locale (computed for v-model)
 const currentLocale = computed({
@@ -31,22 +67,31 @@ const currentLocale = computed({
 
 // Save config
 const onSave = async () => {
+  if (formBusy.value) return
+  saving.value = true
   try {
-    const validated = MetaConfigSchema.parse(metaFormConfig)
-    Object.assign(configStore.metaConfig, validated)
-    await configStore.saveMeta()
-    await configStore.loadPeerConfig()
+    const validatedMeta = MetaConfigSchema.parse(metaFormConfig)
+    const validatedPeer = PeerConfigSchema.parse(peerFormConfig)
+    const runtime = await configStore.connectAndSave(validatedMeta, validatedPeer)
+    adoptWebPeerRuntime(runtime)
+    Object.assign(metaFormConfig, configStore.metaConfig)
+    Object.assign(peerFormConfig, PeerConfigSchema.parse(configStore.peerConfig))
+    allPeersRevision.value += 1
     alert(t('settings.saveSuccess'))
   } catch (error) {
     console.error('Failed to save config:', error)
     alert('Failed to save configuration')
+  } finally {
+    saving.value = false
   }
 }
 
 // Reset config
 const onReset = async () => {
   await configStore.resetMeta()
+  stopWebPeerRuntime()
   Object.assign(metaFormConfig, configStore.metaConfig)
+  Object.assign(peerFormConfig, PeerConfigSchema.parse(configStore.peerConfig))
 }
 
 // Export config
@@ -73,16 +118,20 @@ const onExport = () => {
 const fileInput = ref<HTMLInputElement | null>(null)
 
 const onImport = () => {
+  if (formBusy.value) return
   fileInput.value?.click()
 }
 
 const onFileSelected = async (event: Event) => {
+  if (formBusy.value) return
   const input = event.target as HTMLInputElement
   const file = input.files?.[0]
   if (!file) return
 
   const reader = new FileReader()
   reader.onload = async (e) => {
+    if (formBusy.value) return
+    saving.value = true
     try {
       const content = e.target?.result as string
       const imported = JSON.parse(content)
@@ -90,14 +139,20 @@ const onFileSelected = async (event: Event) => {
         ...configStore.metaConfig,
         ...imported.metaConfig,
       })
-      Object.assign(configStore.metaConfig, validated)
-      await configStore.saveMeta()
-      await configStore.loadPeerConfig()
+      const runtime = await configStore.connectAndSave(
+        validated,
+        PeerConfigSchema.parse(peerFormConfig)
+      )
+      adoptWebPeerRuntime(runtime)
       Object.assign(metaFormConfig, configStore.metaConfig)
+      Object.assign(peerFormConfig, PeerConfigSchema.parse(configStore.peerConfig))
+      allPeersRevision.value += 1
       alert(t('settings.saveSuccess'))
     } catch (error) {
       console.error('Failed to import config:', error)
       alert(t('settings.importError'))
+    } finally {
+      saving.value = false
     }
   }
   reader.readAsText(file)
@@ -134,10 +189,18 @@ const onFileSelected = async (event: Event) => {
         <small>{{ t('settings.jwtStoredLocally') }}</small>
       </label>
 
+      <div class="settings-view__identity">
+        <span>{{ t('settings.peerId') }}</span>
+        <code>{{ metaFormConfig.INKCRE_PEER_ID }}</code>
+        <small>{{ t('settings.peerIdGenerated') }}</small>
+      </div>
+
+      <h2 class="settings-view__section-title">{{ t('settings.peerConfig') }}</h2>
+      <p class="settings-view__notice">{{ t('settings.peerConfigNotice') }}</p>
       <InkInput
-        v-model="metaFormConfig.INKCRE_PEER_ID"
-        :label="t('settings.clientId')"
-        placeholder="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+        v-model="peerFormConfig.extension_registry_url"
+        :label="t('settings.extensionRegistryUrl')"
+        placeholder="https://registry.inkcre.dev"
       />
 
       <!-- Language Selection -->
@@ -154,7 +217,13 @@ const onFileSelected = async (event: Event) => {
 
     <!-- Action Buttons -->
     <div class="settings-view__actions">
-      <InkButton :text="t('settings.saveConfig')" theme="primary" @click="onSave" />
+      <InkButton
+        :text="t('settings.saveConfig')"
+        theme="primary"
+        :disabled="formBusy"
+        :loading="saving"
+        @click="onSave"
+      />
 
       <InkDoubleCheck
         :title="t('settings.resetConfirmTitle')"
@@ -165,11 +234,11 @@ const onFileSelected = async (event: Event) => {
       </InkDoubleCheck>
 
       <InkButton :text="t('settings.exportConfig')" @click="onExport" />
-      <InkButton :text="t('settings.importConfig')" @click="onImport" />
+      <InkButton :text="t('settings.importConfig')" :disabled="formBusy" @click="onImport" />
     </div>
     <p class="settings-view__export-note">{{ t('settings.exportExcludesSecret') }}</p>
 
-    <PeerList />
+    <PeerList v-if="hasConnectedConfig" :key="allPeersRevision" />
 
     <!-- Hidden file input for import -->
     <input
diff --git a/extensions/twitter/CHANGELOG.md b/extensions/twitter/CHANGELOG.md
index b5bb938..98f2127 100644
--- a/extensions/twitter/CHANGELOG.md
+++ b/extensions/twitter/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @inkcre/ext-twitter
 
+## 0.2.0
+
+### Minor Changes
+
+- Add the Extension-owned multi-step setup wizard for OAuth, Bookmark Sources, and scheduling.
+
 ## 0.1.2
 
 ### Patch Changes
diff --git a/extensions/twitter/package.json b/extensions/twitter/package.json
index f70ef7f..24e8e4a 100644
--- a/extensions/twitter/package.json
+++ b/extensions/twitter/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@inkcre/ext-twitter",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "private": true,
   "type": "module",
   "scripts": {
@@ -36,7 +36,7 @@
     "nickname": "Twitter",
     "module_federation": {
       "host_sdk": "@inkcre/core",
-      "host_sdk_version": ">=0.1.0 <0.2.0"
+      "host_sdk_version": ">=0.1.2 <0.2.0"
     }
   }
 }
diff --git a/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.md b/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.md
new file mode 100644
index 0000000..562325e
--- /dev/null
+++ b/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.md
@@ -0,0 +1,10 @@
+# TwitterSetupWizard
+
+Twitter-owned four-step setup contribution mounted by the client-web Extension dialog.
+
+- Discovers live Core Peers through Peer capability advertisements.
+- Requires explicit Core enablement before setup commands are available.
+- Configures the user's X OAuth App, opens the standalone provider flow, and polls only the opaque transaction reference.
+- Selects or creates a Bookmark Source and explicitly starts initial collection.
+- Derives progress from Core setup facts; it does not persist a wizard step.
+- Owns its Close action; client-web only owns the popup surface.
diff --git a/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.scss b/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.scss
new file mode 100644
index 0000000..0c6a1ad
--- /dev/null
+++ b/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.scss
@@ -0,0 +1,140 @@
+.twitter-setup {
+  display: grid;
+  gap: 1.25rem;
+  width: min(680px, 80vw);
+
+  &__toolbar {
+    display: flex;
+    justify-content: flex-end;
+  }
+
+  &__steps {
+    display: grid;
+    grid-template-columns: repeat(4, 1fr);
+    gap: 0.5rem;
+    margin: 0;
+    padding: 0;
+    list-style: none;
+
+    li {
+      display: flex;
+      align-items: center;
+      gap: 0.4rem;
+      color: sys-var(color, text, muted);
+      font-size: 0.8rem;
+    }
+
+    span {
+      display: inline-grid;
+      place-items: center;
+      width: 1.5rem;
+      height: 1.5rem;
+      border: 1px solid currentcolor;
+      border-radius: 50%;
+    }
+
+    .is-current,
+    .is-complete {
+      color: sys-var(color, info, base);
+      font-weight: 600;
+    }
+  }
+
+  &__panel {
+    display: grid;
+    gap: 1rem;
+
+    h3,
+    p {
+      margin: 0;
+    }
+
+    code {
+      display: block;
+      margin-top: 0.5rem;
+      padding: 0.6rem;
+      overflow-wrap: anywhere;
+      background: rgb(0 0 0 / 5%);
+    }
+  }
+
+  &__section,
+  &__empty {
+    display: grid;
+    gap: sys-var(space, sm);
+    padding: sys-var(space, md);
+    border: 1px solid sys-var(color, border, base);
+    background: sys-var(color, surface, subtle);
+
+    h4,
+    p {
+      margin: 0;
+    }
+  }
+
+  &__hint {
+    color: sys-var(color, text, subtle);
+  }
+
+  &__field,
+  &__schedule label {
+    display: grid;
+    gap: 0.35rem;
+  }
+
+  &__field input {
+    min-height: 2.5rem;
+    padding: sys-var(space, sm);
+    border: 1px solid sys-var(color, border, base);
+    background: sys-var(color, surface, base);
+    color: sys-var(color, text, base);
+  }
+
+  &__schedule,
+  &__actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.75rem;
+  }
+
+  &__oauth-link {
+    width: fit-content;
+    font-weight: 600;
+  }
+
+  &__loading {
+    display: flex;
+    justify-content: center;
+    min-height: 10rem;
+  }
+
+  &__error {
+    margin: 0;
+    color: sys-var(color, danger, base);
+  }
+
+  dl {
+    display: grid;
+    grid-template-columns: max-content 1fr;
+    gap: 0.5rem 1rem;
+    margin: 0;
+  }
+
+  dt {
+    font-weight: 600;
+  }
+
+  dd {
+    margin: 0;
+  }
+}
+
+@media (max-width: 640px) {
+  .twitter-setup {
+    width: min(88vw, 680px);
+
+    &__steps {
+      grid-template-columns: 1fr 1fr;
+    }
+  }
+}
diff --git a/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.ts b/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.ts
new file mode 100644
index 0000000..aa6288d
--- /dev/null
+++ b/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.ts
@@ -0,0 +1,10 @@
+export const twitterSetupWizardEmits = {
+  close: () => true,
+} as const
+
+export const TWITTER_SETUP_STEPS = [
+  'Prepare',
+  'Connect account',
+  'Bookmark Source',
+  'Review and start',
+] as const
diff --git a/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.vue b/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.vue
new file mode 100644
index 0000000..4ab4bb5
--- /dev/null
+++ b/extensions/twitter/src/components/twitterSetupWizard/twitterSetupWizard.vue
@@ -0,0 +1,444 @@
+<script setup lang="ts">
+import { computed, onBeforeUnmount, onMounted, ref, watch } from 'vue'
+import {
+  InkButton,
+  InkDatetimePickerView,
+  InkDropdown,
+  InkInput,
+  InkLoading,
+  InkPicker,
+  type DropdownOption,
+} from '@inkcre/ui-web'
+import type { Cron, Source } from '@inkcre/core'
+import {
+  discoverCoreCandidates,
+  TwitterBookmarkSetup,
+  TwitterSetupAPI,
+  type CorePeerCandidate,
+  type OAuthTransaction,
+  type TwitterSetupStatus,
+} from '../../setup-api'
+import { TWITTER_SETUP_STEPS, twitterSetupWizardEmits } from './twitterSetupWizard'
+
+const emit = defineEmits(twitterSetupWizardEmits)
+const candidates = ref<CorePeerCandidate[]>([])
+const selectedPeerId = ref<string | number | null>(null)
+const status = ref<TwitterSetupStatus | null>(null)
+const currentStep = ref(0)
+const loading = ref(true)
+const pending = ref<string | null>(null)
+const error = ref<string | null>(null)
+const clientId = ref('')
+const clientSecret = ref('')
+const transaction = ref<OAuthTransaction | null>(null)
+const sources = ref<Source[]>([])
+const selectedSourceId = ref<string | number | null>(null)
+const selectedSource = ref<Source | null>(null)
+const selectedCron = ref<Cron | null>(null)
+const creatingSource = ref(false)
+const sourceNickname = ref('Twitter Bookmarks')
+const scheduleTime = ref(new Date(2000, 0, 1, 0, 0))
+let polling: AbortController | null = null
+const lifecycle = new AbortController()
+
+const selectedCandidate = computed(
+  () => candidates.value.find((item) => item.peer.id === selectedPeerId.value) ?? null
+)
+const api = computed(() =>
+  selectedCandidate.value ? new TwitterSetupAPI(selectedCandidate.value.peer) : null
+)
+const selectedCoreEnabled = computed(() => selectedCandidate.value?.enabled ?? false)
+const busy = computed(() => pending.value !== null)
+const setupReady = computed(() =>
+  Boolean(status.value?.connected && selectedSource.value && selectedCron.value?.enabled)
+)
+const peerOptions = computed<DropdownOption[]>(() =>
+  candidates.value.map((item) => ({
+    value: item.peer.id,
+    label: `${item.peer.name}${item.enabled ? ' — enabled' : ''}`,
+  }))
+)
+const sourceOptions = computed<DropdownOption[]>(() => [
+  ...sources.value.map((source) => ({
+    value: source.id,
+    label: source.nickname || `Bookmark Source #${source.id}`,
+  })),
+  { value: 'create', label: 'Create a new Source' },
+])
+
+function message(cause: unknown): string {
+  return cause instanceof Error ? cause.message : String(cause)
+}
+function scheduleFromCron(cron: Cron | null): Date {
+  const [minute = '0', hour = '0'] = cron?.schedule.split(' ') ?? []
+  return new Date(2000, 0, 1, Number(hour), Number(minute))
+}
+async function run(operation: string, task: () => Promise<void>): Promise<void> {
+  if (busy.value) return
+  pending.value = operation
+  error.value = null
+  try {
+    await task()
+  } catch (cause) {
+    error.value = message(cause)
+  } finally {
+    pending.value = null
+  }
+}
+async function loadCollection(preferredSourceId?: number | null): Promise<void> {
+  const collection = await TwitterBookmarkSetup.read(preferredSourceId)
+  sources.value = collection.sources
+  selectedSource.value = collection.source
+  selectedSourceId.value = collection.source?.id ?? null
+  selectedCron.value = collection.cron
+  scheduleTime.value = scheduleFromCron(collection.cron)
+  creatingSource.value = collection.sources.length === 0
+}
+async function applyStatus(next: TwitterSetupStatus): Promise<void> {
+  status.value = next
+  clientId.value = next.client_id ?? ''
+  clientSecret.value = ''
+  if (next.connected) await loadCollection(selectedSource.value?.id)
+  currentStep.value = !next.oauth_app_configured || !next.connected ? 1 : setupReady.value ? 3 : 2
+}
+async function reloadStatus(): Promise<void> {
+  if (api.value && selectedCoreEnabled.value)
+    await applyStatus(await api.value.status(lifecycle.signal))
+}
+async function initialize(): Promise<void> {
+  loading.value = true
+  error.value = null
+  try {
+    candidates.value = await discoverCoreCandidates(lifecycle.signal)
+    const selected =
+      candidates.value.find((item) => item.enabled && item.setupAvailable) ??
+      candidates.value.find((item) => item.enabled) ??
+      candidates.value[0]
+    selectedPeerId.value = selected?.peer.id ?? null
+    if (selected?.enabled) await reloadStatus()
+  } catch (cause) {
+    error.value = message(cause)
+  } finally {
+    loading.value = false
+  }
+}
+watch(selectedPeerId, async (next, previous) => {
+  if (next === previous || loading.value) return
+  stopPolling()
+  status.value = null
+  transaction.value = null
+  currentStep.value = 0
+  error.value = null
+  if (selectedCoreEnabled.value) await run('status', reloadStatus)
+})
+watch(selectedSourceId, async (value) => {
+  if (value === 'create') {
+    creatingSource.value = true
+    selectedSource.value = null
+    selectedCron.value = null
+    return
+  }
+  if (typeof value !== 'number') return
+  creatingSource.value = false
+  const collection = await TwitterBookmarkSetup.read(value)
+  selectedSource.value = collection.source
+  selectedCron.value = collection.cron
+  scheduleTime.value = scheduleFromCron(collection.cron)
+})
+async function enableSelectedCore(): Promise<void> {
+  if (!api.value || !selectedCandidate.value) return
+  await run('enable-core', async () => {
+    const extension = await api.value!.enableCore(lifecycle.signal)
+    selectedCandidate.value!.extension = extension
+    selectedCandidate.value!.enabled = extension.enabled.includes(selectedCandidate.value!.peer.id)
+    await reloadStatus()
+  })
+}
+async function saveOAuthApp(): Promise<void> {
+  if (!api.value) return
+  await run('save-oauth-app', async () => {
+    try {
+      await applyStatus(
+        await api.value!.saveOAuthApp(clientId.value, clientSecret.value, false, lifecycle.signal)
+      )
+    } catch (cause) {
+      const text = message(cause)
+      if (!text.includes('requires confirmation')) throw cause
+      if (!window.confirm(`${text}\n\nDisconnect the current account and continue?`)) return
+      await applyStatus(
+        await api.value!.saveOAuthApp(clientId.value, clientSecret.value, true, lifecycle.signal)
+      )
+    }
+  })
+}
+function stopPolling(): void {
+  polling?.abort()
+  polling = null
+}
+function close(): void {
+  stopPolling()
+  emit('close')
+}
+async function wait(milliseconds: number, signal: AbortSignal): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    if (signal.aborted) return reject(new DOMException('Polling cancelled', 'AbortError'))
+    const onAbort = () => {
+      window.clearTimeout(timer)
+      reject(new DOMException('Polling cancelled', 'AbortError'))
+    }
+    const timer = window.setTimeout(() => {
+      signal.removeEventListener('abort', onAbort)
+      resolve()
+    }, milliseconds)
+    signal.addEventListener('abort', onAbort, { once: true })
+  })
+}
+async function pollTransaction(id: string): Promise<void> {
+  if (!api.value) return
+  stopPolling()
+  const controller = new AbortController()
+  polling = controller
+  try {
+    while (!controller.signal.aborted) {
+      await wait(2000, controller.signal)
+      const next = await api.value.oauthTransaction(id, controller.signal)
+      transaction.value = next
+      if (!['pending', 'exchanging'].includes(next.status)) {
+        if (next.status === 'succeeded') await reloadStatus()
+        else error.value = next.error ?? 'Twitter authorization did not complete.'
+        return
+      }
+    }
+  } catch (cause) {
+    if (!controller.signal.aborted) error.value = message(cause)
+  } finally {
+    if (polling === controller) polling = null
+  }
+}
+async function beginOAuth(): Promise<void> {
+  if (!api.value) return
+  await run('begin-oauth', async () => {
+    transaction.value = await api.value!.beginOAuth(lifecycle.signal)
+    void pollTransaction(transaction.value.id)
+  })
+}
+async function disconnect(): Promise<void> {
+  if (!api.value) return
+  await run('disconnect', async () => {
+    stopPolling()
+    transaction.value = null
+    await applyStatus(await api.value!.disconnect(lifecycle.signal))
+  })
+}
+async function createSource(): Promise<void> {
+  await run('create-source', async () => {
+    const source = await TwitterBookmarkSetup.createSource(sourceNickname.value)
+    creatingSource.value = false
+    await loadCollection(source.id)
+  })
+}
+async function saveSchedule(): Promise<void> {
+  if (!selectedSource.value) return
+  await run('save-schedule', async () => {
+    selectedCron.value = await TwitterBookmarkSetup.saveSchedule(
+      selectedSource.value!,
+      scheduleTime.value.getHours(),
+      scheduleTime.value.getMinutes()
+    )
+    currentStep.value = 3
+  })
+}
+async function finish(): Promise<void> {
+  if (!selectedSource.value || !selectedCron.value) return
+  await run('finish', async () => {
+    selectedCron.value = await TwitterBookmarkSetup.finish(
+      selectedSource.value!,
+      selectedCron.value!
+    )
+  })
+}
+onMounted(() => void initialize())
+onBeforeUnmount(() => {
+  lifecycle.abort()
+  stopPolling()
+})
+</script>
+
+<template>
+  <section class="twitter-setup">
+    <ol class="twitter-setup__steps" aria-label="Twitter setup progress">
+      <li
+        v-for="(step, index) in TWITTER_SETUP_STEPS"
+        :key="step"
+        :class="{ 'is-current': currentStep === index, 'is-complete': currentStep > index }"
+      >
+        <span>{{ index + 1 }}</span
+        >{{ step }}
+      </li>
+    </ol>
+    <div v-if="loading" class="twitter-setup__loading"><InkLoading /></div>
+    <template v-else>
+      <p v-if="error" class="twitter-setup__error" role="alert">{{ error }}</p>
+      <div v-if="currentStep === 0" class="twitter-setup__panel">
+        <h3>Choose a Core Peer</h3>
+        <p>The OAuth callback runs on a Core Peer, while setup applies to the deployment.</p>
+        <InkDropdown
+          v-if="candidates.length"
+          v-model="selectedPeerId"
+          :options="peerOptions"
+          label="Core Peer"
+        />
+        <p v-else>No live Core Peer can manage the installed Twitter Extension.</p>
+        <InkButton
+          v-if="selectedCandidate && !selectedCoreEnabled"
+          text="Enable Twitter on this Core Peer"
+          theme="primary"
+          :is-loading="pending === 'enable-core'"
+          :disabled="busy"
+          @click="enableSelectedCore"
+        />
+      </div>
+      <div v-else-if="currentStep === 1" class="twitter-setup__panel">
+        <h3>Connect an X account</h3>
+        <p>Register your own X OAuth 2.0 application with this callback URL:</p>
+        <code>{{ status?.callback_url }}</code>
+        <InkInput v-model="clientId" label="Client ID" required :disabled="busy" />
+        <label class="twitter-setup__field">
+          Client Secret
+          <input
+            v-model="clientSecret"
+            type="password"
+            autocomplete="off"
+            required
+            :disabled="busy"
+          />
+        </label>
+        <div class="twitter-setup__actions">
+          <InkButton
+            text="Save OAuth App"
+            :is-loading="pending === 'save-oauth-app'"
+            :disabled="busy || !clientId || !clientSecret"
+            @click="saveOAuthApp"
+          />
+          <InkButton
+            v-if="status?.oauth_app_configured"
+            text="Create authorization link"
+            theme="primary"
+            :is-loading="pending === 'begin-oauth'"
+            :disabled="busy"
+            @click="beginOAuth"
+          />
+          <InkButton
+            v-if="status?.connected"
+            text="Disconnect"
+            theme="danger"
+            :is-loading="pending === 'disconnect'"
+            :disabled="busy"
+            @click="disconnect"
+          />
+        </div>
+        <a
+          v-if="transaction?.authorize_url"
+          :href="transaction.authorize_url"
+          target="_blank"
+          rel="noopener noreferrer"
+          class="twitter-setup__oauth-link"
+          >Open X authorization</a
+        >
+        <p v-if="transaction && ['pending', 'exchanging'].includes(transaction.status)">
+          Waiting for authorization to return to Core…
+        </p>
+        <p v-if="status?.connected">Connected as @{{ status.handle }}.</p>
+      </div>
+      <div v-else-if="currentStep === 2" class="twitter-setup__panel">
+        <div>
+          <h3>Set up bookmark collection</h3>
+          <p>Choose an existing Bookmark Source or create one for this deployment.</p>
+        </div>
+        <div v-if="sources.length" class="twitter-setup__section">
+          <h4>Bookmark Source</h4>
+          <InkDropdown
+            v-model="selectedSourceId"
+            :options="sourceOptions"
+            label="Bookmark Source"
+            :disabled="busy"
+          />
+        </div>
+        <div v-else class="twitter-setup__empty">
+          <h4>No Bookmark Sources yet</h4>
+          <p>Create one to store collection cursor and source-specific settings.</p>
+        </div>
+        <div v-if="creatingSource" class="twitter-setup__section">
+          <h4>New Bookmark Source</h4>
+          <p>Give the deployment resource a recognizable nickname.</p>
+          <InkInput v-model="sourceNickname" label="Source nickname" :disabled="busy" />
+          <InkButton
+            text="Create Bookmark Source"
+            :is-loading="pending === 'create-source'"
+            :disabled="busy || !sourceNickname.trim()"
+            @click="createSource"
+          />
+        </div>
+        <div v-if="selectedSource" class="twitter-setup__section">
+          <h4>Collection schedule</h4>
+          <p>Choose when Core should collect bookmarks each day.</p>
+          <InkPicker
+            v-model="scheduleTime"
+            type="time"
+            label="Collect bookmarks daily at"
+            :formatter="
+              (value: Date) => value.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' })
+            "
+          >
+            <template #default="{ closePopup }"
+              ><InkDatetimePickerView
+                v-model="scheduleTime"
+                mode="time"
+                hour-format="24" /><InkButton text="Done" theme="primary" @click="closePopup"
+            /></template>
+          </InkPicker>
+          <p class="twitter-setup__hint">Time uses the Core deployment timezone.</p>
+          <InkButton
+            text="Continue"
+            theme="primary"
+            :is-loading="pending === 'save-schedule'"
+            :disabled="busy"
+            @click="saveSchedule"
+          />
+        </div>
+      </div>
+      <div v-else class="twitter-setup__panel">
+        <h3>{{ setupReady ? 'Twitter is ready' : 'Review and start' }}</h3>
+        <p>Confirm the deployment resources before starting bookmark collection.</p>
+        <dl>
+          <dt>Account</dt>
+          <dd>@{{ status?.handle }}</dd>
+          <dt>Bookmark Source</dt>
+          <dd>{{ selectedSource?.nickname || `#${selectedSource?.id}` }}</dd>
+          <dt>Schedule</dt>
+          <dd>{{ selectedCron?.schedule }}</dd>
+        </dl>
+        <div class="twitter-setup__actions">
+          <InkButton
+            text="Back"
+            theme="subtle"
+            :disabled="busy"
+            @click="currentStep = 2"
+          /><InkButton
+            v-if="!setupReady"
+            text="Start collecting bookmarks"
+            theme="primary"
+            :is-loading="pending === 'finish'"
+            :disabled="busy || !selectedCron"
+            @click="finish"
+          />
+        </div>
+      </div>
+    </template>
+    <div class="twitter-setup__toolbar">
+      <InkButton text="Close" theme="subtle" @click="close" />
+    </div>
+  </section>
+</template>
+
+<style lang="scss" scoped src="./twitterSetupWizard.scss" />
diff --git a/extensions/twitter/src/index.ts b/extensions/twitter/src/index.ts
index d685fd2..7bb8264 100644
--- a/extensions/twitter/src/index.ts
+++ b/extensions/twitter/src/index.ts
@@ -12,8 +12,13 @@
 
 import { type ExtensionModule } from '@inkcre/core'
 import './resolver'
+import TwitterSetupWizard from './components/twitterSetupWizard/twitterSetupWizard.vue'
 
 const Extension: ExtensionModule = {
+  setup: {
+    component: TwitterSetupWizard,
+  },
+
   async initialize() {},
 
   async activate() {
diff --git a/extensions/twitter/src/setup-api.ts b/extensions/twitter/src/setup-api.ts
new file mode 100644
index 0000000..bbec90d
--- /dev/null
+++ b/extensions/twitter/src/setup-api.ts
@@ -0,0 +1,252 @@
+import {
+  InstalledExtensionSchema,
+  Cron,
+  CronForm,
+  ExtensionModel,
+  Peer,
+  PeerManager,
+  PeerProtocolResponseSchema,
+  Source,
+  SourceForm,
+  type InstalledExtension,
+  type JsonValue,
+} from '@inkcre/core'
+import { z } from 'zod'
+
+const EXTENSION_NAME = 'inkcre/twitter'
+const EXTENSION_MANAGEMENT_CAPABILITY = 'core.extension.management.v1'
+const TWITTER_SETUP_STATUS_CAPABILITY = 'inkcre.twitter.setup.status.v1'
+const TWITTER_OAUTH_APP_CONFIGURE_CAPABILITY = 'inkcre.twitter.oauth-app.configure.v1'
+const TWITTER_OAUTH_BEGIN_CAPABILITY = 'inkcre.twitter.oauth.begin.v1'
+const TWITTER_OAUTH_TRANSACTION_READ_CAPABILITY = 'inkcre.twitter.oauth.transaction.read.v1'
+const TWITTER_OAUTH_DISCONNECT_CAPABILITY = 'inkcre.twitter.oauth.disconnect.v1'
+const BOOKMARK_SOURCE_TYPE = 'extensions.twitter.bookmark.Source'
+const SOURCE_COLLECT_JOB_TYPE = 'core.source.collect.v1'
+
+function hasAuthorityUserInfo(value: string): boolean {
+  return /^[a-z][a-z0-9+.-]*:\/\/[^/?#]*@/i.test(value)
+}
+
+const HttpUrlSchema = z.url().refine((value) => {
+  const protocol = new URL(value).protocol
+  return (protocol === 'http:' || protocol === 'https:') && !hasAuthorityUserInfo(value)
+}, 'URL must use HTTP or HTTPS.')
+
+const HttpsUrlSchema = z
+  .url()
+  .refine(
+    (value) => new URL(value).protocol === 'https:' && !hasAuthorityUserInfo(value),
+    'Authorization URL must use HTTPS without embedded credentials.'
+  )
+
+export const TwitterSetupStatusSchema = z.object({
+  backend: z.string(),
+  callback_url: HttpUrlSchema,
+  oauth_app_configured: z.boolean(),
+  client_id: z.string().nullable(),
+  connected: z.boolean(),
+  user_id: z.string().nullable(),
+  handle: z.string().nullable(),
+  scopes: z.array(z.string()),
+  reconnect_required: z.boolean(),
+})
+
+export const OAuthTransactionSchema = z.object({
+  id: z.string().uuid(),
+  status: z.enum(['pending', 'exchanging', 'succeeded', 'failed', 'expired']),
+  authorize_url: HttpsUrlSchema.nullable(),
+  expires_at: z.coerce.date(),
+  error: z.string().nullable(),
+})
+
+export type TwitterSetupStatus = z.infer<typeof TwitterSetupStatusSchema>
+export type OAuthTransaction = z.infer<typeof OAuthTransactionSchema>
+
+export interface CorePeerCandidate {
+  peer: Peer
+  extension: InstalledExtension
+  enabled: boolean
+  setupAvailable: boolean
+}
+
+function advertises(peer: Peer, capability: string): boolean {
+  try {
+    return peer.capabilitySnapshot().some((candidate) => candidate.id === capability)
+  } catch {
+    return false
+  }
+}
+
+export async function discoverCoreCandidates(signal?: AbortSignal): Promise<CorePeerCandidate[]> {
+  signal?.throwIfAborted()
+  const [extension, peers] = await Promise.all([
+    ExtensionModel.get(EXTENSION_NAME),
+    PeerManager.listLive(),
+  ])
+  signal?.throwIfAborted()
+  if (!extension) return []
+  return peers
+    .filter((peer) => advertises(peer, EXTENSION_MANAGEMENT_CAPABILITY))
+    .map((peer) => ({
+      peer,
+      extension,
+      enabled: extension.enabled.includes(peer.id),
+      setupAvailable: advertises(peer, TWITTER_SETUP_STATUS_CAPABILITY),
+    }))
+}
+
+export class TwitterSetupAPI {
+  constructor(readonly peer: Peer) {}
+
+  enableCore(signal?: AbortSignal): Promise<InstalledExtension> {
+    return executeCapability(
+      this.peer,
+      EXTENSION_MANAGEMENT_CAPABILITY,
+      { action: 'enable', extension: EXTENSION_NAME },
+      InstalledExtensionSchema,
+      signal
+    )
+  }
+
+  status(signal?: AbortSignal): Promise<TwitterSetupStatus> {
+    return executeCapability(
+      this.peer,
+      TWITTER_SETUP_STATUS_CAPABILITY,
+      {},
+      TwitterSetupStatusSchema,
+      signal
+    )
+  }
+
+  saveOAuthApp(
+    clientId: string,
+    clientSecret: string,
+    confirmAccountReset: boolean,
+    signal?: AbortSignal
+  ): Promise<TwitterSetupStatus> {
+    return executeCapability(
+      this.peer,
+      TWITTER_OAUTH_APP_CONFIGURE_CAPABILITY,
+      {
+        client_id: clientId,
+        client_secret: clientSecret,
+        confirm_account_reset: confirmAccountReset,
+      },
+      TwitterSetupStatusSchema,
+      signal
+    )
+  }
+
+  beginOAuth(signal?: AbortSignal): Promise<OAuthTransaction> {
+    return executeCapability(
+      this.peer,
+      TWITTER_OAUTH_BEGIN_CAPABILITY,
+      {},
+      OAuthTransactionSchema,
+      signal
+    )
+  }
+
+  oauthTransaction(transactionId: string, signal?: AbortSignal): Promise<OAuthTransaction> {
+    return executeCapability(
+      this.peer,
+      TWITTER_OAUTH_TRANSACTION_READ_CAPABILITY,
+      { transaction_id: transactionId },
+      OAuthTransactionSchema,
+      signal
+    )
+  }
+
+  disconnect(signal?: AbortSignal): Promise<TwitterSetupStatus> {
+    return executeCapability(
+      this.peer,
+      TWITTER_OAUTH_DISCONNECT_CAPABILITY,
+      {},
+      TwitterSetupStatusSchema,
+      signal
+    )
+  }
+}
+
+export interface BookmarkCollectionSetup {
+  sources: Source[]
+  source: Source | null
+  cron: Cron | null
+}
+
+export class TwitterBookmarkSetup {
+  static async read(sourceId?: number | null): Promise<BookmarkCollectionSetup> {
+    const sources = (await Source.getAll()).filter((source) => source.type === BOOKMARK_SOURCE_TYPE)
+    const source =
+      sources.find((candidate) => candidate.id === sourceId) ??
+      (sourceId == null && sources.length === 1 ? sources[0]! : null)
+    const crons = source ? await Cron.getBySource(source.id) : []
+    const cron =
+      crons.find(
+        (candidate) =>
+          candidate.job_type === SOURCE_COLLECT_JOB_TYPE &&
+          candidate.job_parameters.source === source?.id
+      ) ?? null
+    return { sources, source, cron }
+  }
+
+  static async createSource(nickname: string): Promise<Source> {
+    return new SourceForm({
+      type: BOOKMARK_SOURCE_TYPE,
+      nickname,
+      config: {},
+      state: {},
+      storage: null,
+    }).create()
+  }
+
+  static async saveSchedule(source: Source, hour: number, minute: number): Promise<Cron> {
+    const current = await this.read(source.id)
+    const form = new CronForm({
+      schedule: `${minute} ${hour} * * *`,
+      enabled: current.cron?.enabled ?? false,
+      job_type: SOURCE_COLLECT_JOB_TYPE,
+      job_parameters: { source: source.id, config: { full: false, result_limit: 40 } },
+      job_timeout_seconds: current.cron?.job_timeout_seconds ?? null,
+    })
+    return current.cron ? current.cron.update(form) : form.create()
+  }
+
+  static async finish(source: Source, cron: Cron): Promise<Cron> {
+    const enabled = await cron.update(
+      new CronForm({
+        schedule: cron.schedule,
+        enabled: true,
+        job_type: SOURCE_COLLECT_JOB_TYPE,
+        job_parameters: { source: source.id, config: { full: false, result_limit: 40 } },
+        job_timeout_seconds: cron.job_timeout_seconds,
+      })
+    )
+    await enabled.runNow()
+    return enabled
+  }
+}
+
+async function executeCapability<Result>(
+  peer: Peer,
+  capability: string,
+  command: JsonValue,
+  schema: z.ZodType<Result>,
+  signal?: AbortSignal
+): Promise<Result> {
+  signal?.throwIfAborted()
+  const delegated = await PeerManager.delegate(capability, { body: command }, peer.id)
+  signal?.throwIfAborted()
+  const response = PeerProtocolResponseSchema.parse(delegated)
+  if (response.status < 200 || response.status >= 300 || response.body === undefined) {
+    const detail =
+      typeof response.body === 'object' &&
+      response.body !== null &&
+      !Array.isArray(response.body) &&
+      typeof response.body.detail === 'string'
+        ? response.body.detail
+        : `Peer capability ${capability} returned HTTP ${response.status}.`
+    throw new Error(detail)
+  }
+  return schema.parse(response.body)
+}
diff --git a/packages/core/package.json b/packages/core/package.json
index 85fc067..fc6d45a 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@inkcre/core",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "files": [
     "dist"
   ],
diff --git a/packages/core/src/auth/store.ts b/packages/core/src/auth/store.ts
index 65f29bd..5889613 100644
--- a/packages/core/src/auth/store.ts
+++ b/packages/core/src/auth/store.ts
@@ -5,6 +5,21 @@ import { peerJwtContract } from '../database'
 
 const JWT_CLOCK_SKEW_SECONDS = 5
 
+export async function signDatabaseToken(jwtSecret: string): Promise<string> {
+  if (!jwtSecret) throw new Error('JWT_SECRET not configured')
+
+  const secret = new TextEncoder().encode(jwtSecret)
+  // A Peer and its PostgREST boundary may not share an exact wall clock.
+  const issuedAt = Math.floor(Date.now() / 1000) - JWT_CLOCK_SKEW_SECONDS
+  return new SignJWT({ role: peerJwtContract.role })
+    .setProtectedHeader({ alg: peerJwtContract.algorithm })
+    .setIssuedAt(issuedAt)
+    .setExpirationTime(issuedAt + peerJwtContract.maximum_lifetime_seconds)
+    .setIssuer(peerJwtContract.issuer)
+    .setAudience(peerJwtContract.audience)
+    .sign(secret)
+}
+
 /**
  * Create an auth store instance.
  * Returns reactive token and token management functions.
@@ -13,24 +28,8 @@ export function createAuthStore(configStoreIns = configStore) {
   const token = ref<string | undefined>(undefined)
 
   async function newToken(): Promise<string> {
-    if (!configStoreIns.metaConfig.INKCRE_JWT_SECRET) {
-      throw new Error('JWT_SECRET not configured')
-    }
-
     try {
-      const secret = new TextEncoder().encode(configStoreIns.metaConfig.INKCRE_JWT_SECRET)
-      // A Peer and its PostgREST boundary may not share an exact wall clock.
-      // Backdate the bounded token instead of leaking clock-skew handling into callers.
-      const issuedAt = Math.floor(Date.now() / 1000) - JWT_CLOCK_SKEW_SECONDS
-      const signedToken = await new SignJWT({
-        role: peerJwtContract.role,
-      })
-        .setProtectedHeader({ alg: peerJwtContract.algorithm })
-        .setIssuedAt(issuedAt)
-        .setExpirationTime(issuedAt + peerJwtContract.maximum_lifetime_seconds)
-        .setIssuer(peerJwtContract.issuer)
-        .setAudience(peerJwtContract.audience)
-        .sign(secret)
+      const signedToken = await signDatabaseToken(configStoreIns.metaConfig.INKCRE_JWT_SECRET)
 
       token.value = signedToken
       return signedToken
diff --git a/packages/core/src/base/db-api.ts b/packages/core/src/base/db-api.ts
index 0ccb677..9d85491 100644
--- a/packages/core/src/base/db-api.ts
+++ b/packages/core/src/base/db-api.ts
@@ -6,6 +6,7 @@ import type { Database, InkcreSchema, RelationName, RelationRow } from '../datab
 
 type RelationInsert<Relation extends RelationName> = InkcreSchema['Tables'][Relation]['Insert']
 type RelationUpdate<Relation extends RelationName> = InkcreSchema['Tables'][Relation]['Update']
+export type DatabaseTokenProvider = () => Promise<string>
 
 function encodeTransportValue<Value>(value: unknown): Value {
   const encoded = JSON.stringify(value)
@@ -110,13 +111,14 @@ export class DBAPIClient<
     protected relation: Relation,
     protected defSchema?: { parse(input: unknown): DT },
     public schemaName: 'inkcre' = 'inkcre',
-    baseUrl: string = ''
+    baseUrl: string = '',
+    tokenProvider: DatabaseTokenProvider = () => authStore.getToken()
   ) {
     super(normalizePostgrestBaseUrl(baseUrl), {
       schema: schemaName,
       // Custom fetch to dynamically inject auth token on each request
       fetch: async (input, init) => {
-        const token = await authStore.getToken()
+        const token = await tokenProvider()
         const headers = new Headers(init?.headers)
         headers.set('Authorization', `Bearer ${token}`)
         return fetch(input, { ...init, headers })
@@ -130,7 +132,7 @@ export class DBAPIClient<
         (newVal) => {
           this.url = normalizePostgrestBaseUrl(newVal)
         },
-        { immediate: true }
+        { immediate: true, flush: 'sync' }
       )
     }
   }
diff --git a/packages/core/src/config/schema.ts b/packages/core/src/config/schema.ts
index f02c7d7..bac5f56 100644
--- a/packages/core/src/config/schema.ts
+++ b/packages/core/src/config/schema.ts
@@ -35,27 +35,41 @@ export const AIConfigSchema = z.object({
  * Contains URLs and secrets needed to fetch and initialize app config
  */
 const UnconfiguredUrlSchema = z.union([z.literal(''), z.url()])
-const UnconfiguredPeerIdSchema = z.union([z.literal(''), z.uuid()])
+const GeneratedPeerIdSchema = z.preprocess(
+  (value) => (value === '' ? undefined : value),
+  z.uuid().default(() => crypto.randomUUID())
+)
 
-export const MetaConfigSchema = z.object({
+const CurrentMetaConfigSchema = z.object({
   INKCRE_PGREST_URL: UnconfiguredUrlSchema.default(''),
   INKCRE_JWT_SECRET: z.string().default(''),
-  INKCRE_PEER_ID: UnconfiguredPeerIdSchema.default(''),
+  INKCRE_PEER_ID: GeneratedPeerIdSchema,
 })
 
+/** Preserve one browser origin's old technical identity during the Peer cutover. */
+export const MetaConfigSchema = z.preprocess((value) => {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) return value
+  const input = value as Record<string, unknown>
+  if (input.INKCRE_PEER_ID !== undefined) return input
+  const priorIdentity = input.client_id ?? input.INKCRE_CLIENT_ID
+  return priorIdentity === undefined ? input : { ...input, INKCRE_PEER_ID: priorIdentity }
+}, CurrentMetaConfigSchema)
+
 export type MetaConfig = z.infer<typeof MetaConfigSchema>
 
 /**
  * App configuration schema (runtime)
  * Contains extension registry URL, AI settings, and runtime app configuration
  */
-export const PeerConfigSchema = z.object({
-  // Deployment-owned Peer configuration supplies this URL. Static artifacts
-  // deliberately keep the unconfigured state instead of embedding an origin.
-  extension_registry_url: UnconfiguredUrlSchema.default(''),
-  peer_http_timeout_ms: z.number().int().positive().default(30_000),
-  ai: AIConfigSchema.default(() => AIConfigSchema.parse({})),
-})
+export const PeerConfigSchema = z
+  .object({
+    // Deployment-owned Peer configuration supplies this URL. Static artifacts
+    // deliberately keep the unconfigured state instead of embedding an origin.
+    extension_registry_url: UnconfiguredUrlSchema.default(''),
+    peer_http_timeout_ms: z.number().int().positive().default(30_000),
+    ai: AIConfigSchema.default(() => AIConfigSchema.parse({})),
+  })
+  .passthrough()
 
 /**
  * Config type
diff --git a/packages/core/src/config/store.ts b/packages/core/src/config/store.ts
index 9fdd641..754fccf 100644
--- a/packages/core/src/config/store.ts
+++ b/packages/core/src/config/store.ts
@@ -7,6 +7,7 @@ import { loadConfig as zodLoadConfig } from 'zod-config'
 
 // Lazy import Peer to avoid circular imports
 const lazyPeer = async () => (await import('../peer/peer')).Peer
+const lazyWebPeerRuntime = async () => (await import('../peer/runtime')).WebPeerRuntime
 
 const unconfiguredAdapter: ConfigAdapterWithWrite = {
   name: 'unconfigured',
@@ -46,7 +47,7 @@ export const useConfigStore = defineStore('inkcre-config', () => {
   }
 
   async function loadPeerConfig(): Promise<void> {
-    if (!metaConfig.value.INKCRE_PEER_ID) {
+    if (!metaConfig.value.INKCRE_PGREST_URL || !metaConfig.value.INKCRE_JWT_SECRET) {
       peerConfig.value = PeerConfigSchema.parse({})
       return
     }
@@ -72,10 +73,39 @@ export const useConfigStore = defineStore('inkcre-config', () => {
     }
   }
 
+  async function connectAndSave(metaCandidate: MetaConfig, peerCandidate: PeerConfig) {
+    error.value = null
+    const nextMeta = MetaConfigSchema.parse(metaCandidate)
+    const nextPeer = PeerConfigSchema.parse(peerCandidate)
+    let candidateRuntime: InstanceType<Awaited<ReturnType<typeof lazyWebPeerRuntime>>> | null = null
+
+    try {
+      const WebPeerRuntime = await lazyWebPeerRuntime()
+      const connection = await WebPeerRuntime.connect(nextMeta, nextPeer)
+      candidateRuntime = connection.runtime
+      await metaAdapter.value.write(nextMeta)
+      metaConfig.value = nextMeta
+      peerConfig.value = nextPeer
+      return candidateRuntime
+    } catch (err) {
+      candidateRuntime?.stop()
+      error.value = err as Error
+      throw err
+    }
+  }
+
   async function resetMeta(): Promise<void> {
-    metaConfig.value = MetaConfigSchema.parse({})
-    peerConfig.value = PeerConfigSchema.parse({})
-    await saveMeta()
+    const resetMetaConfig = MetaConfigSchema.parse({})
+    const resetPeerConfig = PeerConfigSchema.parse({})
+    error.value = null
+    try {
+      await metaAdapter.value.write(resetMetaConfig)
+      metaConfig.value = resetMetaConfig
+      peerConfig.value = resetPeerConfig
+    } catch (err) {
+      error.value = err as Error
+      throw err
+    }
   }
 
   return {
@@ -86,6 +116,7 @@ export const useConfigStore = defineStore('inkcre-config', () => {
     error,
     initializeMeta,
     loadPeerConfig,
+    connectAndSave,
     saveMeta,
     resetMeta,
   }
diff --git a/packages/core/src/cron/cron.ts b/packages/core/src/cron/cron.ts
index a47bc70..3642f62 100644
--- a/packages/core/src/cron/cron.ts
+++ b/packages/core/src/cron/cron.ts
@@ -42,6 +42,25 @@ export class Cron extends Z.class({
     )
   }
 
+  async update(form: CronForm): Promise<Cron> {
+    return Cron.parse(
+      (
+        await Cron.dbApi
+          .from()
+          .update({
+            schedule: form.schedule,
+            enabled: form.enabled,
+            job_type: form.job_type,
+            job_parameters: form.job_parameters as never,
+            job_timeout_seconds: form.job_timeout_seconds,
+          })
+          .eq('id', this.id)
+          .select()
+          .single()
+      ).data
+    )
+  }
+
   async delete(): Promise<void> {
     await Cron.dbApi.from().delete().eq('id', this.id)
   }
diff --git a/packages/core/src/extension/host.ts b/packages/core/src/extension/host.ts
deleted file mode 100644
index e95e527..0000000
--- a/packages/core/src/extension/host.ts
+++ /dev/null
@@ -1,431 +0,0 @@
-import { satisfies, valid as validSemVer, validRange } from 'semver'
-import type { MFImplementation } from './module-federation'
-import {
-  InstalledExtensionSchema,
-  InstallExtensionInputSchema,
-  ExtensionVersionSchema,
-  type ExtensionModule,
-  type InstalledExtension,
-  type InstallExtensionInput,
-} from './model'
-import type {
-  ExtensionRelease,
-  ExtensionReleaseReader,
-  ModuleFederationDistribution,
-} from './registry'
-import type { ExtensionStatePort } from './state'
-
-const WEB_HOST_SDK = '@inkcre/core'
-
-export class WebExtensionHostError extends Error {
-  constructor(message: string) {
-    super(message)
-    this.name = 'WebExtensionHostError'
-  }
-}
-
-export class WebExtensionIncompatibleError extends WebExtensionHostError {
-  constructor(name: string, version: string, reason: string) {
-    super(`Cannot run ${name}@${version} in this Web Host: ${reason}`)
-    this.name = 'WebExtensionIncompatibleError'
-  }
-}
-
-export class WebExtensionEnabledError extends WebExtensionHostError {
-  constructor(name: string) {
-    super(`Cannot change or uninstall ${name} while one or more Peers remain enabled.`)
-    this.name = 'WebExtensionEnabledError'
-  }
-}
-
-export interface WebExtensionHostOptions {
-  state: ExtensionStatePort
-  releases: ExtensionReleaseReader
-  moduleFederation: () => MFImplementation
-  currentPeerId: () => string | undefined
-  hostSdkVersion: string
-  warn?: (message: string) => void
-}
-
-interface RunningExtension {
-  installed: InstalledExtension
-  lifecycle: WebExtensionLifecycle
-}
-
-/** Platform-specific Host for native Module Federation Extension Releases. */
-export class WebExtensionHost {
-  private readonly state: ExtensionStatePort
-  private readonly releases: ExtensionReleaseReader
-  private readonly moduleFederation: () => MFImplementation
-  private readonly currentPeerId: () => string | undefined
-  private readonly hostSdkVersion: string
-  private readonly warn: (message: string) => void
-  private readonly running = new Map<string, RunningExtension>()
-  private readonly runtimeErrors = new Map<string, Error>()
-  private operationTail: Promise<void> = Promise.resolve()
-
-  constructor(options: WebExtensionHostOptions) {
-    if (validSemVer(options.hostSdkVersion) !== options.hostSdkVersion) {
-      throw new TypeError('Web Host SDK version must be strict SemVer.')
-    }
-    this.state = options.state
-    this.releases = options.releases
-    this.moduleFederation = options.moduleFederation
-    this.currentPeerId = options.currentPeerId
-    this.hostSdkVersion = options.hostSdkVersion
-    this.warn = options.warn ?? console.warn
-  }
-
-  list(): Promise<InstalledExtension[]> {
-    return this.state.list()
-  }
-
-  getRuntimeError(name: string): Error | null {
-    return this.runtimeErrors.get(name) ?? null
-  }
-
-  async install(input: InstallExtensionInput): Promise<InstalledExtension> {
-    const exact = InstallExtensionInputSchema.parse(input)
-    return this.exclusively(async () => {
-      const release = await this.preflight(exact.name, exact.version, true)
-      const installed = InstalledExtensionSchema.parse({
-        name: release.name,
-        version: release.version,
-        enabled: [],
-        nickname: release.nickname,
-        config: {},
-        config_schema: null,
-      })
-      return this.state.install(installed)
-    })
-  }
-
-  updateConfig(name: string, config: Record<string, unknown>): Promise<InstalledExtension> {
-    return this.exclusively(() => this.state.updateConfig(name, config))
-  }
-
-  changeVersion(name: string, version: string): Promise<InstalledExtension> {
-    const exactVersion = ExtensionVersionSchema.parse(version)
-    return this.exclusively(async () => {
-      const installed = await this.requireInstalled(name)
-      if (installed.enabled.length > 0 || this.running.has(name)) {
-        throw new WebExtensionEnabledError(name)
-      }
-      if (installed.version === exactVersion) return installed
-      const release = await this.preflight(name, exactVersion, true)
-      return this.state.changeVersion(name, exactVersion, release.nickname)
-    })
-  }
-
-  enable(name: string): Promise<InstalledExtension> {
-    return this.exclusively(() => this.enableCurrentPeer(name))
-  }
-
-  disable(name: string): Promise<InstalledExtension> {
-    return this.exclusively(() => this.disableCurrentPeer(name))
-  }
-
-  uninstall(name: string): Promise<void> {
-    return this.exclusively(async () => {
-      const installed = await this.requireInstalled(name)
-      if (installed.enabled.length > 0 || this.running.has(name)) {
-        throw new WebExtensionEnabledError(name)
-      }
-      await this.state.uninstall(name)
-      this.runtimeErrors.delete(name)
-    })
-  }
-
-  /** Start only exact installed rows enabled for this Web Peer. */
-  async startup(): Promise<void> {
-    const peerId = this.currentPeerId()
-    if (!peerId) return
-
-    await this.exclusively(async () => {
-      const installedExtensions = await this.state.list()
-      const enabledExtensions = installedExtensions.filter((extension) =>
-        extension.enabled.includes(peerId)
-      )
-      const failures: Error[] = []
-
-      for (const installed of enabledExtensions) {
-        try {
-          await this.start(installed)
-        } catch (error) {
-          const failure = asError(error)
-          this.runtimeErrors.set(installed.name, failure)
-          failures.push(failure)
-        }
-      }
-
-      if (failures.length > 0) {
-        throw combineErrors('Web Extension startup failed.', failures)
-      }
-    })
-  }
-
-  /** Stop volatile runtimes without changing durable enabled intent. */
-  async shutdown(): Promise<void> {
-    await this.exclusively(async () => {
-      const failures: Error[] = []
-      for (const [name, runtime] of this.running) {
-        try {
-          await runtime.lifecycle.stop()
-          this.running.delete(name)
-        } catch (error) {
-          failures.push(asError(error))
-        }
-      }
-      if (failures.length > 0) throw combineErrors('Web Extension shutdown failed.', failures)
-    })
-  }
-
-  private async enableCurrentPeer(name: string): Promise<InstalledExtension> {
-    const peerId = this.requireCurrentPeerId()
-    const installed = await this.requireInstalled(name)
-    if (!this.running.has(name)) {
-      await this.start(installed)
-    }
-    if (installed.enabled.includes(peerId)) return installed
-
-    const runtime = this.running.get(name)
-    if (!runtime) throw new WebExtensionHostError(`Runtime ${name} did not start.`)
-
-    try {
-      const enabled = InstalledExtensionSchema.parse(
-        await this.state.setPeerEnabled(name, peerId, true)
-      )
-      if (!enabled.enabled.includes(peerId)) {
-        throw new WebExtensionHostError(`State port did not enable ${name} for the current Peer.`)
-      }
-      if (enabled.version !== installed.version) {
-        const versionConflict = new WebExtensionHostError(
-          `${name} changed from ${installed.version} to ${enabled.version} during enable; retry against the new exact Release.`
-        )
-        try {
-          await this.state.setPeerEnabled(name, peerId, false)
-        } catch (rollbackError) {
-          throw combineErrors('Enable version conflict and durable intent rollback failed.', [
-            versionConflict,
-            asError(rollbackError),
-          ])
-        }
-        throw versionConflict
-      }
-      runtime.installed = enabled
-      return enabled
-    } catch (persistenceError) {
-      try {
-        await runtime.lifecycle.stop()
-        this.running.delete(name)
-      } catch (cleanupError) {
-        throw combineErrors('Enable persistence and runtime compensation failed.', [
-          asError(persistenceError),
-          asError(cleanupError),
-        ])
-      }
-      throw persistenceError
-    }
-  }
-
-  private async disableCurrentPeer(name: string): Promise<InstalledExtension> {
-    const peerId = this.requireCurrentPeerId()
-    const installed = await this.requireInstalled(name)
-    if (!installed.enabled.includes(peerId)) return installed
-
-    const runtime = this.running.get(name)
-    if (runtime) {
-      await runtime.lifecycle.stop()
-      this.running.delete(name)
-    }
-
-    try {
-      const disabled = InstalledExtensionSchema.parse(
-        await this.state.setPeerEnabled(name, peerId, false)
-      )
-      if (disabled.enabled.includes(peerId)) {
-        throw new WebExtensionHostError(`State port did not disable ${name} for the current Peer.`)
-      }
-      this.runtimeErrors.delete(name)
-      return disabled
-    } catch (persistenceError) {
-      if (!runtime) throw persistenceError
-      try {
-        await this.start(installed)
-      } catch (restartError) {
-        throw combineErrors('Disable persistence and runtime restoration failed.', [
-          asError(persistenceError),
-          asError(restartError),
-        ])
-      }
-      throw persistenceError
-    }
-  }
-
-  private async start(installed: InstalledExtension): Promise<void> {
-    if (this.running.has(installed.name)) return
-
-    const release = await this.preflight(installed.name, installed.version, false)
-    const distribution = release.module_federation
-    if (!distribution) {
-      throw new WebExtensionIncompatibleError(
-        installed.name,
-        installed.version,
-        'the Release has no Module Federation Distribution.'
-      )
-    }
-
-    const manifestUrl = this.releases.resolveManifestUrl(distribution.manifest_url)
-    const remoteName = webExtensionRemoteName(installed.name)
-    const lifecycle = new WebExtensionLifecycle(async () => {
-      const moduleFederation = this.moduleFederation()
-      moduleFederation.registerRemotes([{ name: remoteName, entry: manifestUrl }], { force: true })
-      const loaded = await moduleFederation.loadRemote<
-        ExtensionModule | { default: ExtensionModule }
-      >(remoteName)
-      if (!loaded) {
-        throw new WebExtensionHostError(`${installed.name} returned no Module Federation module.`)
-      }
-      return 'default' in loaded ? loaded.default : loaded
-    })
-
-    await lifecycle.start()
-    this.running.set(installed.name, { installed, lifecycle })
-    this.runtimeErrors.delete(installed.name)
-  }
-
-  private async preflight(
-    name: string,
-    version: string,
-    requirePublished: boolean
-  ): Promise<ExtensionRelease> {
-    const release = await this.releases.get(name, version)
-    if (requirePublished && release.state !== 'published') {
-      throw new WebExtensionHostError(
-        `Only a published Release can be installed: ${name}@${version}.`
-      )
-    }
-    if (!requirePublished && release.state !== 'published' && release.state !== 'yanked') {
-      throw new WebExtensionHostError(
-        `Exact installed Release ${name}@${version} is not executable in state ${release.state}.`
-      )
-    }
-    if (release.state === 'yanked') {
-      this.warn(`Starting exact installed yanked Release ${name}@${version}.`)
-    }
-
-    const distribution = release.module_federation
-    if (!distribution) {
-      throw new WebExtensionIncompatibleError(
-        name,
-        version,
-        'the Release has no Module Federation Distribution.'
-      )
-    }
-    this.assertHostSdkCompatible(name, version, distribution)
-    return release
-  }
-
-  private assertHostSdkCompatible(
-    name: string,
-    version: string,
-    distribution: ModuleFederationDistribution
-  ): void {
-    if (distribution.host_sdk !== WEB_HOST_SDK) {
-      throw new WebExtensionIncompatibleError(
-        name,
-        version,
-        `expected Host SDK ${WEB_HOST_SDK}, received ${distribution.host_sdk}.`
-      )
-    }
-
-    const hostRange = distribution.host_sdk_version.replace(/,/g, ' ')
-    if (!validRange(hostRange) || !satisfies(this.hostSdkVersion, hostRange)) {
-      throw new WebExtensionIncompatibleError(
-        name,
-        version,
-        `Host SDK ${this.hostSdkVersion} does not satisfy ${distribution.host_sdk_version}.`
-      )
-    }
-  }
-
-  private async requireInstalled(name: string): Promise<InstalledExtension> {
-    const installed = await this.state.get(name)
-    if (!installed) throw new WebExtensionHostError(`Extension ${name} is not installed.`)
-    return InstalledExtensionSchema.parse(installed)
-  }
-
-  private requireCurrentPeerId(): string {
-    const peerId = this.currentPeerId()
-    if (!peerId) throw new WebExtensionHostError('INKCRE_PEER_ID is required for Extension state.')
-    return peerId
-  }
-
-  private async exclusively<T>(operation: () => Promise<T>): Promise<T> {
-    let release: (() => void) | undefined
-    const previous = this.operationTail
-    this.operationTail = new Promise<void>((resolve) => {
-      release = resolve
-    })
-    await previous
-    try {
-      return await operation()
-    } finally {
-      release?.()
-    }
-  }
-}
-
-class WebExtensionLifecycle {
-  private extensionModule: ExtensionModule | null = null
-  private active = false
-
-  constructor(private readonly load: () => Promise<ExtensionModule>) {}
-
-  async start(): Promise<void> {
-    if (this.extensionModule) return
-
-    const extensionModule = await this.load()
-    this.extensionModule = extensionModule
-    try {
-      await extensionModule.initialize?.()
-      await extensionModule.activate?.()
-      this.active = true
-    } catch (startError) {
-      try {
-        await this.stop()
-      } catch (cleanupError) {
-        throw combineErrors('Extension start and compensation failed.', [
-          asError(startError),
-          asError(cleanupError),
-        ])
-      }
-      throw startError
-    }
-  }
-
-  async stop(): Promise<void> {
-    const extensionModule = this.extensionModule
-    if (!extensionModule) return
-
-    if (this.active) {
-      await extensionModule.deactivate?.()
-      this.active = false
-    }
-    await extensionModule.dispose?.()
-    this.extensionModule = null
-  }
-}
-
-export function webExtensionRemoteName(name: string): string {
-  return `extension.${name.replace('/', '.')}`
-}
-
-function asError(error: unknown): Error {
-  return error instanceof Error ? error : new Error(String(error))
-}
-
-function combineErrors(message: string, errors: Error[]): Error {
-  if (errors.length === 1) return errors[0]
-  return new WebExtensionHostError(`${message} ${errors.map((error) => error.message).join(' | ')}`)
-}
diff --git a/packages/core/src/extension/index.ts b/packages/core/src/extension/index.ts
index 02fa927..91de33c 100644
--- a/packages/core/src/extension/index.ts
+++ b/packages/core/src/extension/index.ts
@@ -3,39 +3,18 @@ export {
   ExtensionVersionSchema,
   InstalledExtensionSchema,
   InstallExtensionInputSchema,
+  ExtensionModel,
+  ExtensionPersistenceError,
   type ExtensionModule,
+  type ExtensionSetupContribution,
   type InstalledExtension,
   type InstallExtensionInput,
+  type ExtensionModelInstallInput,
 } from './model'
 
 export {
-  setMFImplementation,
-  getMFImplementation,
-  registerRemotes,
-  loadRemote,
-  isMFInitialized,
-  type RemoteConfig,
-  type RegisterRemotesOptions,
-  type MFImplementation,
-} from './module-federation'
-
-export {
-  ExtensionReleaseSchema,
-  RegistryExtensionReleaseReader,
-  type ExtensionRelease,
-  type ModuleFederationDistribution,
-  type ExtensionReleaseReader,
-} from './registry'
-
-export type { ExtensionStatePort } from './state'
-
-export { PostgrestExtensionStatePort, ExtensionStatePersistenceError } from './postgrest-state'
-
-export {
-  WebExtensionHost,
-  WebExtensionHostError,
-  WebExtensionIncompatibleError,
-  WebExtensionEnabledError,
-  webExtensionRemoteName,
-  type WebExtensionHostOptions,
-} from './host'
+  DEFAULT_EXTENSION_REGISTRY_ORIGIN,
+  EXTENSION_REGISTRY_CONFIG_KEY,
+  EXTENSION_REGISTRY_CONFIG_SCHEMA,
+  ExtensionRegistryOriginResolver,
+} from './registry-origin'
diff --git a/packages/core/src/extension/model.ts b/packages/core/src/extension/model.ts
index 0ee97f1..cc9f438 100644
--- a/packages/core/src/extension/model.ts
+++ b/packages/core/src/extension/model.ts
@@ -1,5 +1,7 @@
 import { parse as parseSemVer } from 'semver'
+import type { Component } from 'vue'
 import { z } from 'zod'
+import { APIError, DBAPIClient } from '../base'
 
 const EXTENSION_NAME_PATTERN =
   /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\/[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/
@@ -35,6 +37,188 @@ export const InstallExtensionInputSchema = InstalledExtensionSchema.pick({
 
 export type InstalledExtension = z.infer<typeof InstalledExtensionSchema>
 export type InstallExtensionInput = z.infer<typeof InstallExtensionInputSchema>
+export interface ExtensionModelInstallInput extends InstallExtensionInput {
+  nickname: string
+}
+
+const EXTENSION_MANAGEMENT_PROJECTION =
+  'name,version,enabled,nickname,config,config_schema' as const
+
+export class ExtensionPersistenceError extends Error {
+  constructor(operation: string, cause?: unknown) {
+    super(
+      `Extension state ${operation} failed${cause instanceof Error ? `: ${cause.message}` : ''}.`
+    )
+    this.name = 'ExtensionPersistenceError'
+  }
+}
+
+/** Rich deployment Extension aggregate backed by the canonical PostgREST relation. */
+export class ExtensionModel implements InstalledExtension {
+  static readonly #dbApi = new DBAPIClient<'extensions'>('extensions')
+
+  readonly name: string
+  readonly version: string
+  readonly enabled: string[]
+  readonly nickname: string | null
+  readonly config: Record<string, unknown>
+  readonly config_schema: Record<string, unknown> | null
+
+  constructor(row: InstalledExtension) {
+    const parsed = InstalledExtensionSchema.parse(row)
+    this.name = parsed.name
+    this.version = parsed.version
+    this.enabled = parsed.enabled
+    this.nickname = parsed.nickname
+    this.config = parsed.config
+    this.config_schema = parsed.config_schema
+  }
+
+  static async list(): Promise<ExtensionModel[]> {
+    const response = await this.#dbApi
+      .from()
+      .select(EXTENSION_MANAGEMENT_PROJECTION)
+      .order('name', { ascending: true })
+    assertSuccess(response, 'list')
+    return InstalledExtensionSchema.array()
+      .parse(response.data ?? [])
+      .map(this.fromRow)
+  }
+
+  static async get(name: string): Promise<ExtensionModel | null> {
+    const response = await this.#dbApi
+      .from()
+      .select(EXTENSION_MANAGEMENT_PROJECTION)
+      .eq('name', name)
+      .maybeSingle()
+    assertSuccess(response, 'read')
+    return response.data === null ? null : this.fromRow(response.data)
+  }
+
+  static async install(input: ExtensionModelInstallInput): Promise<ExtensionModel> {
+    const coordinate = InstallExtensionInputSchema.parse(input)
+    const exact = InstalledExtensionSchema.parse({
+      ...coordinate,
+      nickname: input.nickname,
+      enabled: [],
+      config: {},
+      config_schema: null,
+    })
+    const existing = await this.get(exact.name)
+    if (existing) {
+      if (existing.version === exact.version) return existing
+      throw new ExtensionPersistenceError(
+        'install',
+        new Error(
+          `${exact.name} is already installed at ${existing.version}; disable every Peer before an explicit version change.`
+        )
+      )
+    }
+
+    const response = await this.#dbApi
+      .insert({
+        name: exact.name,
+        version: exact.version,
+        nickname: exact.nickname,
+        config: exact.config,
+        config_schema: exact.config_schema,
+      })
+      .select(EXTENSION_MANAGEMENT_PROJECTION)
+      .single()
+    assertSuccess(response, 'install')
+    return this.fromRow(response.data)
+  }
+
+  async changeVersion(version: string, nickname: string): Promise<ExtensionModel> {
+    const exactVersion = ExtensionVersionSchema.parse(version)
+    const response = await ExtensionModel.#dbApi
+      .update({ version: exactVersion, nickname, config_schema: null })
+      .eq('name', this.name)
+      .filter('enabled', 'eq', '{}')
+      .select(EXTENSION_MANAGEMENT_PROJECTION)
+      .maybeSingle()
+    assertSuccess(response, 'change version')
+    if (response.data === null) {
+      throw new ExtensionPersistenceError(
+        'change version',
+        new Error(`Extension ${this.name} is missing or still enabled on a Peer.`)
+      )
+    }
+    return ExtensionModel.fromRow(response.data)
+  }
+
+  async updateConfig(config: Record<string, unknown>): Promise<ExtensionModel> {
+    const response = await ExtensionModel.#dbApi
+      .update({ config })
+      .eq('name', this.name)
+      .select(EXTENSION_MANAGEMENT_PROJECTION)
+      .single()
+    assertSuccess(response, 'update config')
+    return ExtensionModel.fromRow(response.data)
+  }
+
+  enablePeer(peerId: string): Promise<ExtensionModel> {
+    return this.setPeerEnabled(peerId, true)
+  }
+
+  disablePeer(peerId: string): Promise<ExtensionModel> {
+    return this.setPeerEnabled(peerId, false)
+  }
+
+  async uninstall(): Promise<void> {
+    const response = await ExtensionModel.#dbApi
+      .from()
+      .delete()
+      .eq('name', this.name)
+      .filter('enabled', 'eq', '{}')
+      .select('name')
+    assertSuccess(response, 'uninstall')
+    const deletedRows = InstalledExtensionSchema.pick({ name: true }).array().parse(response.data)
+    if (deletedRows.length !== 1) {
+      throw new ExtensionPersistenceError(
+        'uninstall',
+        new Error(`Extension ${this.name} is missing or still enabled on a Peer.`)
+      )
+    }
+  }
+
+  private async setPeerEnabled(peerId: string, enabled: boolean): Promise<ExtensionModel> {
+    const response = await ExtensionModel.#dbApi
+      .rpc('set_extension_peer_enabled', {
+        p_name: this.name,
+        p_peer_id: peerId,
+        p_enabled: enabled,
+      })
+      .select(EXTENSION_MANAGEMENT_PROJECTION)
+    assertSuccess(response, enabled ? 'enable Peer' : 'disable Peer')
+    const updated = InstalledExtensionSchema.array().parse(response.data ?? [])[0]
+    if (!updated) {
+      throw new ExtensionPersistenceError(
+        enabled ? 'enable Peer' : 'disable Peer',
+        new Error(`Extension ${this.name} does not exist.`)
+      )
+    }
+    return ExtensionModel.fromRow(updated)
+  }
+
+  private static fromRow(row: unknown): ExtensionModel {
+    return new ExtensionModel(InstalledExtensionSchema.parse(row))
+  }
+}
+
+function assertSuccess(response: { error?: { message: string } | null }, operation: string): void {
+  if (response.error) {
+    throw new ExtensionPersistenceError(
+      operation,
+      new APIError(response.error.message, 0, response.error)
+    )
+  }
+}
+
+/** Setup UI contributed by one already-running Web Extension. */
+export interface ExtensionSetupContribution {
+  component: Component
+}
 
 /** Default export exposed by a Web Extension's native Module Federation Remote. */
 export interface ExtensionModule {
@@ -42,4 +226,5 @@ export interface ExtensionModule {
   activate?(): Promise<void>
   deactivate?(): Promise<void>
   dispose?(): Promise<void>
+  setup?: ExtensionSetupContribution
 }
diff --git a/packages/core/src/extension/module-federation.ts b/packages/core/src/extension/module-federation.ts
deleted file mode 100644
index 28ebf0c..0000000
--- a/packages/core/src/extension/module-federation.ts
+++ /dev/null
@@ -1,78 +0,0 @@
-/**
- * Module Federation Abstraction Layer
- *
- * Provides environment-agnostic MF utilities. Apps inject their
- * MF implementation during initialization.
- */
-
-export interface RemoteConfig {
-  name: string
-  entry: string
-  type?: 'module' | 'script'
-}
-
-export interface RegisterRemotesOptions {
-  force?: boolean
-}
-
-export interface MFImplementation {
-  registerRemotes: (remotes: RemoteConfig[], options?: RegisterRemotesOptions) => void
-  loadRemote: <T>(remoteName: string) => Promise<T | null>
-}
-
-let _mfImplementation: MFImplementation | null = null
-
-/**
- * Set the Module Federation implementation.
- * Apps must call this during initialization.
- *
- * @example
- * ```typescript
- * import { init } from "@module-federation/enhanced/runtime";
- * import { setMFImplementation } from "@inkcre/core";
- *
- * const mf = init({...});
- * setMFImplementation({
- *   registerRemotes: (remotes) => mf.registerRemotes(remotes),
- *   loadRemote: (name) => mf.loadRemote(name)
- * });
- * ```
- */
-export function setMFImplementation(impl: MFImplementation): void {
-  _mfImplementation = impl
-}
-
-export function getMFImplementation(): MFImplementation {
-  if (!_mfImplementation) {
-    throw new Error('Module Federation not initialized. Call setMFImplementation() first.')
-  }
-  return _mfImplementation
-}
-
-/**
- * Register remote modules with the MF runtime.
- *
- * @param remotes - Array of remote configuration objects
- * @throws Error if MF not initialized
- */
-export function registerRemotes(remotes: RemoteConfig[], options?: RegisterRemotesOptions): void {
-  getMFImplementation().registerRemotes(remotes, options)
-}
-
-/**
- * Load a remote module.
- *
- * @param remoteName - The name of the remote module to load
- * @returns Promise resolving to the loaded module or null
- * @throws Error if MF not initialized
- */
-export async function loadRemote<T = any>(remoteName: string): Promise<T | null> {
-  return getMFImplementation().loadRemote<T>(remoteName)
-}
-
-/**
- * Check if Module Federation has been initialized.
- */
-export function isMFInitialized(): boolean {
-  return _mfImplementation !== null
-}
diff --git a/packages/core/src/extension/postgrest-state.ts b/packages/core/src/extension/postgrest-state.ts
deleted file mode 100644
index 9f1c90e..0000000
--- a/packages/core/src/extension/postgrest-state.ts
+++ /dev/null
@@ -1,131 +0,0 @@
-import { APIError, DBAPIClient } from '../base'
-import { InstalledExtensionSchema, type InstalledExtension } from './model'
-import type { ExtensionStatePort } from './state'
-
-export class ExtensionStatePersistenceError extends Error {
-  constructor(operation: string, cause?: unknown) {
-    super(
-      `Extension state ${operation} failed${cause instanceof Error ? `: ${cause.message}` : ''}.`
-    )
-    this.name = 'ExtensionStatePersistenceError'
-  }
-}
-
-/** PostgREST transport adapter for the canonical deployment Extension relation. */
-export class PostgrestExtensionStatePort implements ExtensionStatePort {
-  private readonly dbApi = new DBAPIClient<'extensions'>('extensions')
-
-  async list(): Promise<InstalledExtension[]> {
-    const response = await this.dbApi.from().select().order('name', { ascending: true })
-    assertSuccess(response, 'list')
-    return InstalledExtensionSchema.array().parse(response.data ?? [])
-  }
-
-  async get(name: string): Promise<InstalledExtension | null> {
-    const response = await this.dbApi.from().select().eq('name', name).maybeSingle()
-    assertSuccess(response, 'read')
-    return response.data === null ? null : InstalledExtensionSchema.parse(response.data)
-  }
-
-  async install(extension: InstalledExtension): Promise<InstalledExtension> {
-    const exact = InstalledExtensionSchema.parse(extension)
-    const existing = await this.get(exact.name)
-    if (existing) {
-      if (existing.version === exact.version) return existing
-      throw new ExtensionStatePersistenceError(
-        'install',
-        new Error(
-          `${exact.name} is already installed at ${existing.version}; disable every Peer before an explicit version change.`
-        )
-      )
-    }
-
-    const response = await this.dbApi
-      .insert({
-        name: exact.name,
-        version: exact.version,
-        nickname: exact.nickname,
-        config: exact.config,
-        config_schema: exact.config_schema,
-      })
-      .select()
-      .single()
-    assertSuccess(response, 'install')
-    return InstalledExtensionSchema.parse(response.data)
-  }
-
-  async updateConfig(name: string, config: Record<string, unknown>): Promise<InstalledExtension> {
-    const response = await this.dbApi.update({ config }).eq('name', name).select().single()
-    assertSuccess(response, 'update config')
-    return InstalledExtensionSchema.parse(response.data)
-  }
-
-  async changeVersion(
-    name: string,
-    version: string,
-    nickname: string
-  ): Promise<InstalledExtension> {
-    const response = await this.dbApi
-      .update({ version, nickname, config_schema: null })
-      .eq('name', name)
-      .filter('enabled', 'eq', '{}')
-      .select()
-      .maybeSingle()
-    assertSuccess(response, 'change version')
-    if (response.data === null) {
-      throw new ExtensionStatePersistenceError(
-        'change version',
-        new Error(`Extension ${name} is missing or still enabled on a Peer.`)
-      )
-    }
-    return InstalledExtensionSchema.parse(response.data)
-  }
-
-  async setPeerEnabled(
-    name: string,
-    peerId: string,
-    enabled: boolean
-  ): Promise<InstalledExtension> {
-    const response = await this.dbApi.rpc('set_extension_peer_enabled', {
-      p_name: name,
-      p_peer_id: peerId,
-      p_enabled: enabled,
-    })
-    assertSuccess(response, enabled ? 'enable Peer' : 'disable Peer')
-    const rows = InstalledExtensionSchema.array().parse(response.data ?? [])
-    const updated = rows[0]
-    if (!updated) {
-      throw new ExtensionStatePersistenceError(
-        enabled ? 'enable Peer' : 'disable Peer',
-        new Error(`Extension ${name} does not exist.`)
-      )
-    }
-    return updated
-  }
-
-  async uninstall(name: string): Promise<void> {
-    const response = await this.dbApi
-      .from()
-      .delete()
-      .eq('name', name)
-      .filter('enabled', 'eq', '{}')
-      .select('name')
-    assertSuccess(response, 'uninstall')
-    const deletedRows = InstalledExtensionSchema.pick({ name: true }).array().parse(response.data)
-    if (deletedRows.length !== 1) {
-      throw new ExtensionStatePersistenceError(
-        'uninstall',
-        new Error(`Extension ${name} is missing or still enabled on a Peer.`)
-      )
-    }
-  }
-}
-
-function assertSuccess(response: { error?: { message: string } | null }, operation: string): void {
-  if (response.error) {
-    throw new ExtensionStatePersistenceError(
-      operation,
-      new APIError(response.error.message, 0, response.error)
-    )
-  }
-}
diff --git a/packages/core/src/extension/registry-origin.ts b/packages/core/src/extension/registry-origin.ts
new file mode 100644
index 0000000..f6ee9c4
--- /dev/null
+++ b/packages/core/src/extension/registry-origin.ts
@@ -0,0 +1,66 @@
+import { z } from 'zod'
+import { APIError, DBAPIClient } from '../base'
+
+export const DEFAULT_EXTENSION_REGISTRY_ORIGIN = 'https://registry.inkcre.dev'
+export const EXTENSION_REGISTRY_CONFIG_KEY = 'extension.registry'
+export const EXTENSION_REGISTRY_CONFIG_SCHEMA = 'extension.registry.config.v1'
+
+const RegistryOriginSchema = z.string().transform((value, context) => {
+  try {
+    const hasAuthorityUserInfo = /^[a-z][a-z0-9+.-]*:\/\/[^/?#]*@/i.test(value)
+    const url = new URL(value)
+    if (
+      !['http:', 'https:'].includes(url.protocol) ||
+      hasAuthorityUserInfo ||
+      url.username ||
+      url.password ||
+      url.pathname !== '/' ||
+      url.search ||
+      url.hash
+    ) {
+      throw new Error('not an HTTP(S) origin')
+    }
+    return url.origin
+  } catch {
+    context.addIssue({
+      code: 'custom',
+      message: 'Extension Registry URL must be one HTTP(S) origin.',
+    })
+    return z.NEVER
+  }
+})
+
+const DeploymentRegistryConfigSchema = z.object({
+  schema: z.literal(EXTENSION_REGISTRY_CONFIG_SCHEMA),
+  value: z.object({ extension_registry_url: RegistryOriginSchema }),
+})
+
+/** Resolve one Registry operation from Peer owner, deployment, then product fallback. */
+export class ExtensionRegistryOriginResolver {
+  constructor(
+    private readonly peerOverride: () => string,
+    private readonly database = new DBAPIClient<'configs'>('configs')
+  ) {}
+
+  async resolve(): Promise<string> {
+    const peerOrigin = this.peerOverride()
+    if (peerOrigin) return RegistryOriginSchema.parse(peerOrigin)
+
+    const response = await this.database
+      .from()
+      .select('schema,value')
+      .eq('key', EXTENSION_REGISTRY_CONFIG_KEY)
+      .maybeSingle()
+    if (response.error) {
+      throw new APIError(
+        `Extension Registry deployment config failed: ${response.error.message}`,
+        response.status,
+        response.error
+      )
+    }
+    if (response.data !== null) {
+      return DeploymentRegistryConfigSchema.parse(response.data).value.extension_registry_url
+    }
+    return DEFAULT_EXTENSION_REGISTRY_ORIGIN
+  }
+}
diff --git a/packages/core/src/extension/registry.ts b/packages/core/src/extension/registry.ts
deleted file mode 100644
index 77d281a..0000000
--- a/packages/core/src/extension/registry.ts
+++ /dev/null
@@ -1,96 +0,0 @@
-import { z } from 'zod'
-import { ExtensionNameSchema, ExtensionVersionSchema } from './model'
-
-const ModuleFederationDistributionSchema = z.object({
-  manifest_url: z.string().min(1),
-  host_sdk: z.literal('@inkcre/core'),
-  host_sdk_version: z.string().min(1),
-})
-
-const PythonDistributionSchema = z.object({
-  project: z.string().min(1),
-  simple_url: z.string().min(1),
-  host_sdk: z.literal('core-py'),
-  host_sdk_version: z.string().min(1),
-  entry_point: z.object({
-    group: z.string().min(1),
-    name: z.string().min(1),
-    object: z.string().min(1),
-  }),
-})
-
-export const ExtensionReleaseSchema = z.object({
-  name: ExtensionNameSchema,
-  nickname: z.string(),
-  version: ExtensionVersionSchema,
-  state: z.enum(['preparing', 'published', 'yanked', 'blocked']),
-  python: PythonDistributionSchema.nullish(),
-  module_federation: ModuleFederationDistributionSchema.nullish(),
-})
-
-export type ExtensionRelease = z.infer<typeof ExtensionReleaseSchema>
-export type ModuleFederationDistribution = z.infer<typeof ModuleFederationDistributionSchema>
-
-export interface ExtensionReleaseReader {
-  get(name: string, version: string): Promise<ExtensionRelease>
-  resolveManifestUrl(manifestUrl: string): string
-}
-
-/** Public exact-Release reader for the Registry control plane. */
-export class RegistryExtensionReleaseReader implements ExtensionReleaseReader {
-  private readonly fetchImplementation: typeof globalThis.fetch
-  private readonly registryOrigin: () => string
-
-  constructor(
-    registryOrigin: string | (() => string),
-    fetchImplementation: typeof globalThis.fetch = globalThis.fetch
-  ) {
-    this.registryOrigin =
-      typeof registryOrigin === 'function' ? registryOrigin : () => registryOrigin
-    this.fetchImplementation = fetchImplementation.bind(globalThis)
-  }
-
-  async get(name: string, version: string): Promise<ExtensionRelease> {
-    const [namespace, localName] = splitExtensionName(ExtensionNameSchema.parse(name))
-    const exactVersion = ExtensionVersionSchema.parse(version)
-    const registryUrl = this.registryUrl()
-    const location = new URL(
-      `/v1/extensions/${encodeURIComponent(namespace)}/${encodeURIComponent(localName)}/releases/${encodeURIComponent(exactVersion)}`,
-      registryUrl
-    )
-    const response = await this.fetchImplementation(location, {
-      headers: { Accept: 'application/json' },
-    })
-    if (!response.ok) {
-      throw new Error(`Extension Registry release request failed with HTTP ${response.status}.`)
-    }
-
-    const release = ExtensionReleaseSchema.parse(await response.json())
-    if (release.name !== name || release.version !== exactVersion) {
-      throw new Error('Extension Registry returned a different exact Release coordinate.')
-    }
-    return release
-  }
-
-  resolveManifestUrl(manifestUrl: string): string {
-    const registryUrl = this.registryUrl()
-    const resolved = new URL(manifestUrl, registryUrl)
-    if (resolved.origin !== registryUrl.origin) {
-      throw new Error('Module Federation manifest must be hosted by the configured Registry.')
-    }
-    return resolved.href
-  }
-
-  private registryUrl(): URL {
-    const registryOrigin = this.registryOrigin()
-    if (!registryOrigin) {
-      throw new Error('Extension Registry URL is not configured.')
-    }
-    return new URL(registryOrigin)
-  }
-}
-
-function splitExtensionName(name: string): [string, string] {
-  const [namespace, localName] = name.split('/')
-  return [namespace, localName]
-}
diff --git a/packages/core/src/extension/state.ts b/packages/core/src/extension/state.ts
deleted file mode 100644
index ba8c5c0..0000000
--- a/packages/core/src/extension/state.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import type { InstalledExtension } from './model'
-
-/**
- * Deployment Extension state as operations, independent of SQL, PostgREST,
- * generated table types, and transport routes.
- */
-export interface ExtensionStatePort {
-  list(): Promise<InstalledExtension[]>
-  get(name: string): Promise<InstalledExtension | null>
-  install(extension: InstalledExtension): Promise<InstalledExtension>
-  changeVersion(name: string, version: string, nickname: string): Promise<InstalledExtension>
-  updateConfig(name: string, config: Record<string, unknown>): Promise<InstalledExtension>
-  setPeerEnabled(name: string, peerId: string, enabled: boolean): Promise<InstalledExtension>
-  uninstall(name: string): Promise<void>
-}
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index 32179c5..f621a60 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -20,37 +20,22 @@ export {
   ExtensionVersionSchema,
   InstalledExtensionSchema,
   InstallExtensionInputSchema,
+  ExtensionModel,
+  ExtensionPersistenceError,
   type ExtensionModule,
+  type ExtensionSetupContribution,
   type InstalledExtension,
   type InstallExtensionInput,
-  setMFImplementation,
-  getMFImplementation,
-  registerRemotes,
-  loadRemote,
-  isMFInitialized,
-  type RemoteConfig,
-  type RegisterRemotesOptions,
-  type MFImplementation,
-  ExtensionReleaseSchema,
-  RegistryExtensionReleaseReader,
-  type ExtensionRelease,
-  type ModuleFederationDistribution,
-  type ExtensionReleaseReader,
-  type ExtensionStatePort,
-  PostgrestExtensionStatePort,
-  ExtensionStatePersistenceError,
-  WebExtensionHost,
-  WebExtensionHostError,
-  WebExtensionIncompatibleError,
-  WebExtensionEnabledError,
-  webExtensionRemoteName,
-  type WebExtensionHostOptions,
+  type ExtensionModelInstallInput,
+  ExtensionRegistryOriginResolver,
+  DEFAULT_EXTENSION_REGISTRY_ORIGIN,
 } from './extension'
 
 // Peer discovery and delegation
 export {
   Peer,
   PeerManager,
+  WebPeerRuntime,
   PeerHTTPOutbound,
   CapabilityDelegationUnavailable,
   PeerOutcomeUnknown,
diff --git a/packages/core/src/peer/index.ts b/packages/core/src/peer/index.ts
index 9f6d5d4..c863147 100644
--- a/packages/core/src/peer/index.ts
+++ b/packages/core/src/peer/index.ts
@@ -2,3 +2,4 @@ export * from './contracts'
 export * from './http'
 export * from './manager'
 export * from './peer'
+export * from './runtime'
diff --git a/packages/core/src/peer/runtime.ts b/packages/core/src/peer/runtime.ts
new file mode 100644
index 0000000..bef434c
--- /dev/null
+++ b/packages/core/src/peer/runtime.ts
@@ -0,0 +1,107 @@
+import { z } from 'zod'
+import { signDatabaseToken } from '../auth'
+import { APIError, DBAPIClient } from '../base'
+import {
+  MetaConfigSchema,
+  PeerConfigSchema,
+  type MetaConfig,
+  type PeerConfig,
+} from '../config/schema'
+import { Peer } from './peer'
+
+export const WEB_PEER_LEASE_TTL_SECONDS = 90
+export const WEB_PEER_LEASE_RENEW_INTERVAL_MS = 30_000
+
+type PeerDatabase = DBAPIClient<'peers', Peer>
+
+/** Browser ownership for one durable Peer identity and its database-time lease. */
+export class WebPeerRuntime {
+  private timer: ReturnType<typeof setInterval> | null = null
+  private registered = false
+
+  constructor(
+    readonly peerId: string,
+    private readonly database: PeerDatabase = Peer.dbApi,
+    private readonly warn: (message: string) => void = console.warn
+  ) {}
+
+  async register(): Promise<Peer> {
+    const response = await this.database
+      .upsert({
+        id: this.peerId,
+        name: 'Client Web',
+        config_schema: z.toJSONSchema(PeerConfigSchema),
+        capabilities: [],
+      })
+      .select()
+      .single()
+    assertSuccess(response, 'register')
+    const peer = Peer.parse(response.data)
+    this.registered = true
+    return peer
+  }
+
+  async renew(): Promise<Date> {
+    const response = await this.database.rpc('renew_peer_lease', {
+      peer: this.peerId,
+      ttl_seconds: WEB_PEER_LEASE_TTL_SECONDS,
+    })
+    assertSuccess(response, 'renew lease')
+    return z.coerce.date().parse(response.data)
+  }
+
+  async saveConfig(config: PeerConfig): Promise<Peer> {
+    const response = await this.database
+      .update({ config: PeerConfigSchema.parse(config) })
+      .eq('id', this.peerId)
+      .select()
+      .single()
+    assertSuccess(response, 'save config')
+    return Peer.parse(response.data)
+  }
+
+  async start(): Promise<void> {
+    if (this.timer !== null) return
+    if (!this.registered) await this.register()
+    await this.renew()
+    this.timer = setInterval(() => {
+      void this.renew().catch((error: unknown) => {
+        this.warn(
+          `Web Peer lease renewal failed: ${error instanceof Error ? error.message : String(error)}`
+        )
+      })
+    }, WEB_PEER_LEASE_RENEW_INTERVAL_MS)
+  }
+
+  stop(): void {
+    if (this.timer === null) return
+    clearInterval(this.timer)
+    this.timer = null
+  }
+
+  static async connect(
+    meta: MetaConfig,
+    config: PeerConfig
+  ): Promise<{ peer: Peer; runtime: WebPeerRuntime }> {
+    const exactMeta = MetaConfigSchema.parse(meta)
+    const exactConfig = PeerConfigSchema.parse(config)
+    const database = new DBAPIClient<'peers', Peer>(
+      'peers',
+      Peer,
+      'inkcre',
+      exactMeta.INKCRE_PGREST_URL,
+      () => signDatabaseToken(exactMeta.INKCRE_JWT_SECRET)
+    )
+    const runtime = new WebPeerRuntime(exactMeta.INKCRE_PEER_ID, database)
+    await runtime.register()
+    const peer = await runtime.saveConfig(exactConfig)
+    await runtime.start()
+    return { peer, runtime }
+  }
+}
+
+function assertSuccess(response: { error?: { message: string } | null }, operation: string): void {
+  if (response.error) {
+    throw new APIError(`Web Peer ${operation} failed: ${response.error.message}`, 0, response.error)
+  }
+}
diff --git a/pdm.lock b/pdm.lock
index 009e99e..a13054f 100644
--- a/pdm.lock
+++ b/pdm.lock
@@ -5,7 +5,7 @@
 groups = ["default"]
 strategy = ["inherit_metadata"]
 lock_version = "4.5.0"
-content_hash = "sha256:3127c3420995e55bce316643f65d2fcad0c590495101c40b5d5e9eacd3a69410"
+content_hash = "sha256:bb96fd8f2ae26ebe087a8994dd781ca818e851daa167633222c620945f45a29a"
 
 [[metadata.targets]]
 requires_python = "==3.13.*"
@@ -141,9 +141,9 @@ files = [
 
 [[package]]
 name = "inkcre-extension-toolkit"
-version = "0.1.0"
+version = "0.2.1"
 requires_python = "<3.14,>=3.12"
-url = "https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.1.0/inkcre_extension_toolkit-0.1.0-py3-none-any.whl"
+url = "https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.2.1/inkcre_extension_toolkit-0.2.1-py3-none-any.whl"
 summary = "Developer and delivery tooling for InKCre Extensions"
 groups = ["default"]
 dependencies = [
@@ -152,24 +152,25 @@ dependencies = [
     "semantic-version<3,>=2.10",
 ]
 files = [
-    {file = "inkcre_extension_toolkit-0.1.0-py3-none-any.whl", hash = "sha256:7ab1de5160d0bafbdf9f99b6b2a2b156a406b6f6afe14dc0342073620299bd64"},
+    {file = "inkcre_extension_toolkit-0.2.1-py3-none-any.whl", hash = "sha256:fffaad86db43d998731bfee69e992fa02d18ea2b428fdd00bda5ed6e311bf3de"},
 ]
 
 [[package]]
 name = "inkcre-extension-toolkit"
-version = "0.1.0"
+version = "0.2.1"
 extras = ["cli"]
 requires_python = "<3.14,>=3.12"
-url = "https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.1.0/inkcre_extension_toolkit-0.1.0-py3-none-any.whl"
+url = "https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.2.1/inkcre_extension_toolkit-0.2.1-py3-none-any.whl"
 summary = "Developer and delivery tooling for InKCre Extensions"
 groups = ["default"]
 dependencies = [
     "httpx<0.29,>=0.28",
-    "inkcre-extension-toolkit @ https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.1.0/inkcre_extension_toolkit-0.1.0-py3-none-any.whl",
+    "inkcre-extension-toolkit @ https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.2.1/inkcre_extension_toolkit-0.2.1-py3-none-any.whl",
     "typer<0.22,>=0.21",
+    "wheel<0.48,>=0.46",
 ]
 files = [
-    {file = "inkcre_extension_toolkit-0.1.0-py3-none-any.whl", hash = "sha256:7ab1de5160d0bafbdf9f99b6b2a2b156a406b6f6afe14dc0342073620299bd64"},
+    {file = "inkcre_extension_toolkit-0.2.1-py3-none-any.whl", hash = "sha256:fffaad86db43d998731bfee69e992fa02d18ea2b428fdd00bda5ed6e311bf3de"},
 ]
 
 [[package]]
@@ -342,3 +343,17 @@ files = [
     {file = "typing_inspection-0.4.4-py3-none-any.whl", hash = "sha256:65b8397ba37ccbce054456aaccddfc91e6e3083c92824df348d96ca832f3f147"},
     {file = "typing_inspection-0.4.4.tar.gz", hash = "sha256:547274fa6b0a561ccf549cc9524b999a578e737d015d8709d021f9d0d13bea47"},
 ]
+
+[[package]]
+name = "wheel"
+version = "0.47.0"
+requires_python = ">=3.9"
+summary = "Command line tool for manipulating wheel files"
+groups = ["default"]
+dependencies = [
+    "packaging>=24.0",
+]
+files = [
+    {file = "wheel-0.47.0-py3-none-any.whl", hash = "sha256:212281cab4dff978f6cedd499cd893e1f620791ca6ff7107cf270781e587eced"},
+    {file = "wheel-0.47.0.tar.gz", hash = "sha256:cc72bd1009ba0cf63922e28f94d9d83b920aa2bb28f798a31d0691b02fa3c9b3"},
+]
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 43ceda9..2204814 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -107,6 +107,9 @@ importers:
       '@inkcre/core':
         specifier: workspace:*
         version: link:../../packages/core
+      '@inkcre/extension-runtime-client-web':
+        specifier: https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.1.0/inkcre-extension-runtime-client-web-0.1.0.tgz
+        version: https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.1.0/inkcre-extension-runtime-client-web-0.1.0.tgz(@inkcre/core@packages+core)(@module-federation/runtime@0.21.6)
       '@inkcre/ui-web':
         specifier: 1.4.0
         version: 1.4.0(@codemirror/autocomplete@6.20.3)(@codemirror/commands@6.10.4)(@codemirror/lang-json@6.0.2)(@codemirror/lint@6.9.7)(@codemirror/state@6.7.1)(@codemirror/view@6.43.6)(@vueuse/core@14.3.0(vue@3.5.40(typescript@5.9.3)))(dayjs@1.11.21)(unocss@66.7.5(vite@7.3.6(@types/node@22.17.2)(jiti@2.7.0)(lightningcss@1.33.0)(sass-embedded@1.90.0)(sass@1.101.6)(yaml@2.9.0)))(vscode-json-languageservice@5.7.2)(vscode-languageserver-textdocument@1.0.12)(vue-router@4.5.1(vue@3.5.40(typescript@5.9.3)))(vue@3.5.40(typescript@5.9.3))
@@ -1132,6 +1135,13 @@ packages:
   '@iconify/utils@3.1.4':
     resolution: {integrity: sha512-b1S7B1k9ohZ+iNTi2ATxbRYG9fTrJmUT0rc46bvVnNxqNRGW7dyo/vRREwyniI5IRN2RSJHDcm+s3BjWrSAjHw==}
 
+  '@inkcre/extension-runtime-client-web@https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.1.0/inkcre-extension-runtime-client-web-0.1.0.tgz':
+    resolution: {integrity: sha512-UGDxtoN6Pcv+NCbr8InejfGg6UdvtCrZU7dZsx+Yev/aXmyA1YChfY7VicJTJRr5UIs9JbWe1smNwH1UB/bYQw==, tarball: https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.1.0/inkcre-extension-runtime-client-web-0.1.0.tgz}
+    version: 0.1.0
+    peerDependencies:
+      '@inkcre/core': '>=0.1.2 <0.2.0'
+      '@module-federation/runtime': '>=0.21.4 <0.23.0'
+
   '@inkcre/ui-web@1.4.0':
     resolution: {integrity: sha512-Sq5f/hFpOtuGNZwVB36JuMPoAJUvkWvrHogl/PauI4OuV2M/qExdVXrEZa76pbbn35Ic/dleEPyze6lJghxI5w==, tarball: https://npm.pkg.github.com/download/@inkcre/ui-web/1.4.0/356469307437642b43b7e67e82c9b60e52d4f926}
     peerDependencies:
@@ -6057,6 +6067,9 @@ packages:
       yaml:
         optional: true
 
+  zod@4.1.12:
+    resolution: {integrity: sha512-JInaHOamG8pt5+Ey8kGmdcAcg3OL9reK8ltczgHTAwNhMys/6ThXHityHxVV2p3fkw/c+MAvBHFVYHFZDmjMCQ==}
+
   zod@4.4.3:
     resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
 
@@ -6821,6 +6834,13 @@ snapshots:
       '@iconify/types': 2.0.0
       import-meta-resolve: 4.2.0
 
+  '@inkcre/extension-runtime-client-web@https://github.com/InKCre/ext-reg/releases/download/runtime-client-web-v0.1.0/inkcre-extension-runtime-client-web-0.1.0.tgz(@inkcre/core@packages+core)(@module-federation/runtime@0.21.6)':
+    dependencies:
+      '@inkcre/core': link:packages/core
+      '@module-federation/runtime': 0.21.6
+      semver: 7.8.5
+      zod: 4.1.12
+
   '@inkcre/ui-web@1.4.0(@codemirror/autocomplete@6.20.3)(@codemirror/commands@6.10.4)(@codemirror/lang-json@6.0.2)(@codemirror/lint@6.9.7)(@codemirror/state@6.7.1)(@codemirror/view@6.43.6)(@vueuse/core@14.3.0(vue@3.5.40(typescript@5.9.3)))(dayjs@1.11.21)(unocss@66.7.5(vite@7.3.6(@types/node@22.17.2)(jiti@2.7.0)(lightningcss@1.33.0)(sass-embedded@1.90.0)(sass@1.101.6)(yaml@2.9.0)))(vscode-json-languageservice@5.7.2)(vscode-languageserver-textdocument@1.0.12)(vue-router@4.5.1(vue@3.5.40(typescript@5.9.3)))(vue@3.5.40(typescript@5.9.3))':
     dependencies:
       '@codemirror/autocomplete': 6.20.3
@@ -11450,4 +11470,6 @@ snapshots:
       json5: 2.2.3
       yaml: 2.9.0
 
+  zod@4.1.12: {}
+
   zod@4.4.3: {}
diff --git a/pyproject.toml b/pyproject.toml
index 95bf6c8..d6a6b93 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -5,7 +5,7 @@ description = "Repository-level development tooling for the InKCre Web monorepo"
 requires-python = ">=3.13,<3.14"
 # Gate: generate and commit pdm.lock only after this immutable Toolkit wheel is published.
 dependencies = [
-  "inkcre-extension-toolkit[cli] @ https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.1.0/inkcre_extension_toolkit-0.1.0-py3-none-any.whl",
+  "inkcre-extension-toolkit[cli] @ https://github.com/InKCre/ext-reg/releases/download/toolkit-v0.2.1/inkcre_extension_toolkit-0.2.1-py3-none-any.whl",
 ]
 
 [tool.pdm]
diff --git a/scripts/check-local-runtime-contract.mjs b/scripts/check-local-runtime-contract.mjs
index b6f9a88..e682d38 100644
--- a/scripts/check-local-runtime-contract.mjs
+++ b/scripts/check-local-runtime-contract.mjs
@@ -134,6 +134,8 @@ const reviewedNonEnvironmentUrls = new Set(
     'https://github.com/vueuse/vueuse/blob/658444bf9f8b96118dbd06eba411bb6639e24e88/packages/core/useStorageAsync/index.ts',
     'https://openrouter.ai/api/v1',
     'https://platform.openai.com/api-keys',
+    // Public product infrastructure, not a deployment/runtime environment coordinate.
+    'https://registry.inkcre.dev',
   ].map((value) => new URL(value).href)
 )
 const absoluteUrlPattern = /https?:\/\/[^\s"'`<>),;，）、]+/g