diff --git a/packages/webapp/src/CloudApp.tsx b/packages/webapp/src/CloudApp.tsx
index 4c3d7361..eabe48d6 100644
--- a/packages/webapp/src/CloudApp.tsx
+++ b/packages/webapp/src/CloudApp.tsx
@@ -9,7 +9,7 @@ import {
   type MouseEvent as ReactMouseEvent,
 } from 'react';
 import { createClient, type WebDAVClient } from 'webdav';
-import { ApiAdapter, ApiError, type TenantMe } from './api-adapter';
+import { ApiAdapter, ApiError, workspaceFromWire, type TenantMe } from './api-adapter';
 import type { ControlPlaneClient } from './api';
 import type { CredentialRequestView } from '@blitzos/schema';
 import { SPAWN_SESSION_LABELS, type SpawnSessionType } from './NewTabMenu';
@@ -78,11 +78,13 @@ import {
 } from './sessions-page-state';
 import {
   clampDrawerWidth,
+  defaultGlobalWebAppState,
   defaultWorkspaceFiles,
   isManagedWorkspaceTab,
   tabRegion,
   withPreviewTabPath,
   type StorageNamespace,
+  type GlobalWebAppStateV1,
   type WorkspaceDrawerSegment,
   type WorkspaceRegion,
   type WorkspaceTab,
@@ -215,6 +217,8 @@ function CloudAppContent({ client, resolver }: CloudAppProps) {
   const [terminalSignInUrl, setTerminalSignInUrl] = useState<string | null>(null);
   const [showPasteCodeModal, setShowPasteCodeModal] = useState(false);
   const [pendingRequests, setPendingRequests] = useState<CredentialRequestView[]>([]);
+  const pendingRequestsRef = useRef(pendingRequests);
+  pendingRequestsRef.current = pendingRequests;
   const [pendingRequestsError, setPendingRequestsError] = useState<string | null>(null);
   // The grant-approval feed (plans/ORG-CREDENTIALS.md §7a): a pending
   // proposal addressed to this member pops the dialog on whichever page they
@@ -224,6 +228,10 @@ function CloudAppContent({ client, resolver }: CloudAppProps) {
     !signedOut && store.viewer !== null,
     store.viewer?.membership.id ?? null,
   );
+  const [grantProposalError, setGrantProposalError] = useState<{
+    proposalId: string;
+    message: string;
+  } | null>(null);
   // The latest `blitz connections open` focus for the active workspace; a
   // fresh object per event so the panel re-selects on a repeat ask.
   const [connectionsFocus, setConnectionsFocus] = useState<ConnectionsPanelFocus | null>(null);
@@ -260,6 +268,17 @@ function CloudAppContent({ client, resolver }: CloudAppProps) {
   // authority for their own rows, so such a request is discarded rather than
   // briefly (or permanently) rolling the UI backward.
   const workspaceMutationEpoch = useRef(0);
+  const pendingMachineStarts = useRef(new Set<string>());
+  const pendingWorkspaceRenames = useRef(new Map<string, symbol>());
+  const acknowledgedGlobalDoc = useRef<{
+    namespace: string;
+    value: GlobalWebAppStateV1;
+    json: string;
+  } | null>(null);
+  const attemptedGlobalDoc = useRef<{ namespace: string; json: string } | null>(null);
+  const currentGlobalDoc = useRef<{ namespace: string; json: string } | null>(null);
+  const globalSaveRequest = useRef<symbol | null>(null);
+  const [globalSaveVersion, setGlobalSaveVersion] = useState(0);
   const firstWorkspacePrompted = useRef(false);
   // Visit once, then retain: tab switches preserve live state without eagerly
   // opening every saved terminal and WebGL surface.
@@ -333,6 +352,18 @@ function CloudAppContent({ client, resolver }: CloudAppProps) {
     if (cause instanceof ApiError && cause.status === 401) return;
     setError(caughtErrorMessage(cause, 'Could not save webApp state.'));
   }, []);
+  const rememberGlobalState = useCallback((
+    doc: GlobalWebAppStateV1,
+    namespaceValue: StorageNamespace,
+  ) => {
+    const json = JSON.stringify(doc);
+    const namespace = `${namespaceValue.orgId}:${namespaceValue.membershipId}`;
+    // A save from the organization we just left may still settle. It cannot
+    // acknowledge or reconcile this namespace.
+    globalSaveRequest.current = null;
+    acknowledgedGlobalDoc.current = { namespace, value: doc, json };
+    attemptedGlobalDoc.current = { namespace, json };
+  }, []);
   const {
     transitionStage: organizationTransitionStage,
     createOrgName,
@@ -381,7 +412,11 @@ function CloudAppContent({ client, resolver }: CloudAppProps) {
       const records = await api.listWorkspaces();
       if (mutationEpoch !== workspaceMutationEpoch.current) return;
       rememberWorkspaceEndpoints(workspaceEndpoints.current, records, resolver, true);
-      dispatch({ type: 'workspace_records_refreshed', records });
+      dispatch({
+        type: 'workspace_records_refreshed',
+        records,
+        heldWorkspaceIds: [...pendingMachineStarts.current],
+      });
     } catch (refreshError) {
       if (!(refreshError instanceof ApiError && refreshError.status === 401)) {
         console.warn('Unable to refresh workspace status', refreshError);
@@ -600,6 +635,7 @@ function CloudAppContent({ client, resolver }: CloudAppProps) {
     dispatch,
     setLoaded,
     setError,
+    onGlobalStateLoaded: rememberGlobalState,
   });
 
   useEffect(() => {
@@ -719,22 +755,6 @@ function CloudAppContent({ client, resolver }: CloudAppProps) {
     refreshWorkspaceRecords,
   });
 
-  useEffect(() => {
-    if (
-      !loaded
-      || !storageNamespace
-      || store.workspaces.some(({ pendingCreate }) => pendingCreate)
-    ) return;
-    const timer = window.setTimeout(() => {
-      void api.putGlobalWebAppState({
-        version: 1,
-        activeWorkspaceId,
-        order: store.workspaces.map(({ id }) => id),
-      }).catch(handlePersistenceError);
-    }, 150);
-    return () => window.clearTimeout(timer);
-  }, [activeWorkspaceId, api, handlePersistenceError, loaded, storageNamespace, store.workspaces]);
-
   const navigateToWorkspacePage = useCallback((workspaceId: string) => {
     // COME BACK WHERE THE MEMBER LEFT. Without this the switch pushes a path
     // with no chat segment and sets `chat: null`, so returning to a workspace
@@ -747,6 +767,101 @@ function CloudAppContent({ client, resolver }: CloudAppProps) {
     setRoute(remembered === null ? { workspaceId, page: 'webApp', chat: null } : parseAppRoute(path));
   }, []);
 
+  const applyGlobalState = useCallback((doc: GlobalWebAppStateV1) => {
+    const workspaces = storeRef.current.workspaces;
+    const liveIds = new Set(workspaces.map(({ id }) => id));
+    const order = [
+      ...doc.order.filter((id, index) => liveIds.has(id) && doc.order.indexOf(id) === index),
+      ...workspaces.map(({ id }) => id).filter((id) => !doc.order.includes(id)),
+    ];
+    commitWorkspaceMutation({ type: 'workspace_order_reconciled', order });
+    const active = selectControllableWorkspaceId(workspaces, doc.activeWorkspaceId);
+    const activeChanged = activeWorkspaceIdRef.current !== active;
+    activeWorkspaceIdRef.current = active;
+    setActiveWorkspaceId(active);
+    if (!activeChanged || parseAppRoute(window.location.pathname).page !== 'webApp') return;
+    const path = active ? workspacePath(active) : '/';
+    window.history.replaceState({}, '', path);
+    setRoute(active
+      ? { workspaceId: active, page: 'webApp', chat: null }
+      : { workspaceId: null, page: 'drive' });
+  }, [commitWorkspaceMutation]);
+
+  if (loaded && storageNamespace !== null) {
+    currentGlobalDoc.current = {
+      namespace: `${storageNamespace.orgId}:${storageNamespace.membershipId}`,
+      json: JSON.stringify({
+        version: 1,
+        activeWorkspaceId,
+        order: store.workspaces.map(({ id }) => id),
+      } satisfies GlobalWebAppStateV1),
+    };
+  }
+
+  useEffect(() => {
+    if (
+      !loaded
+      || !storageNamespace
+      || store.workspaces.some(({ pendingCreate }) => pendingCreate)
+      || globalSaveRequest.current !== null
+    ) return;
+    const namespace = `${storageNamespace.orgId}:${storageNamespace.membershipId}`;
+    const doc: GlobalWebAppStateV1 = {
+      version: 1,
+      activeWorkspaceId,
+      order: store.workspaces.map(({ id }) => id),
+    };
+    const json = JSON.stringify(doc);
+    if (attemptedGlobalDoc.current?.namespace === namespace
+      && attemptedGlobalDoc.current.json === json) return;
+    const timer = window.setTimeout(() => {
+      const request = Symbol(namespace);
+      globalSaveRequest.current = request;
+      attemptedGlobalDoc.current = { namespace, json };
+      void api.putGlobalWebAppState(doc)
+        .then((response) => {
+          if (globalSaveRequest.current !== request) return;
+          const canonical = response.doc ?? defaultGlobalWebAppState();
+          const canonicalJson = JSON.stringify(canonical);
+          acknowledgedGlobalDoc.current = {
+            namespace,
+            value: canonical,
+            json: canonicalJson,
+          };
+          attemptedGlobalDoc.current = { namespace, json: canonicalJson };
+          // A later selection or reorder waits behind this write. Do not let
+          // the older response erase it before its own save begins.
+          if (currentGlobalDoc.current?.namespace !== namespace
+            || currentGlobalDoc.current.json !== json) return;
+          applyGlobalState(canonical);
+        })
+        .catch((cause: Error) => {
+          if (globalSaveRequest.current !== request) return;
+          const acknowledged = acknowledgedGlobalDoc.current;
+          if (acknowledged?.namespace === namespace) {
+            attemptedGlobalDoc.current = { namespace, json: acknowledged.json };
+            applyGlobalState(acknowledged.value);
+          }
+          handlePersistenceError(cause);
+        })
+        .finally(() => {
+          if (globalSaveRequest.current !== request) return;
+          globalSaveRequest.current = null;
+          setGlobalSaveVersion((version) => version + 1);
+        });
+    }, 150);
+    return () => window.clearTimeout(timer);
+  }, [
+    activeWorkspaceId,
+    api,
+    applyGlobalState,
+    globalSaveVersion,
+    handlePersistenceError,
+    loaded,
+    storageNamespace,
+    store.workspaces,
+  ]);
+
   // WHERE EACH WORKSPACE IS BEING LEFT. Recorded only for a path that carries a
   // real chat address: the bare `/workspaces/:id` is what the restore above
   // exists to improve on, so writing it would erase the memory on the way out.
@@ -877,10 +992,38 @@ function CloudAppContent({ client, resolver }: CloudAppProps) {
    * so it goes through the same PATCH the settings tab writes; the tile shows
    * the new name at once and the next poll agrees. */
   const renameWorkspace = useCallback((workspaceId: string, name: string) => {
-    dispatch({ type: 'workspace_renamed', workspaceId, title: name });
+    const preceding = storeRef.current.workspaces.find(({ id }) => id === workspaceId);
+    if (preceding === undefined) return;
+    const attempt = Symbol(workspaceId);
+    pendingWorkspaceRenames.current.set(workspaceId, attempt);
+    setError(null);
+    commitWorkspaceMutation({ type: 'workspace_renamed', workspaceId, title: name });
     void client.updateWorkspace(workspaceId, { name })
-      .catch((caught: Error) => setError(caught.message));
-  }, [client]);
+      .then(({ workspace }) => {
+        if (pendingWorkspaceRenames.current.get(workspaceId) !== attempt) return;
+        pendingWorkspaceRenames.current.delete(workspaceId);
+        const canonical = workspaceFromWire(workspace);
+        commitWorkspaceMutation({ type: 'workspace_record_updated', record: canonical });
+        commitWorkspaceMutation({
+          type: 'workspace_renamed',
+          workspaceId,
+          title: canonical.name,
+        });
+      })
+      .catch((cause: unknown) => {
+        if (pendingWorkspaceRenames.current.get(workspaceId) !== attempt) return;
+        pendingWorkspaceRenames.current.delete(workspaceId);
+        commitWorkspaceMutation({
+          type: 'workspace_renamed',
+          workspaceId,
+          title: preceding.title,
+        });
+        setError(`Could not rename “${preceding.title}”: ${caughtErrorMessage(
+          cause,
+          'The control plane request failed.',
+        )}`);
+      });
+  }, [client, commitWorkspaceMutation]);
 
   const retryWorkspace = useCallback(async (workspaceId: string) => {
     const workspace = storeRef.current.workspaces.find(({ id }) => id === workspaceId);
@@ -898,18 +1041,56 @@ function CloudAppContent({ client, resolver }: CloudAppProps) {
   /**
    * Start the viewer's own machine in the active workspace, from the pane that
    * replaces the loading spinner while it is stopped (`WorkspaceStoppedState`).
-   * The refresh is what moves the pane on: the record comes back `creating`,
-   * the poll hurries for a transitioning workspace, and `running` follows.
+   * The local row moves the pane on while the start response is pending. Its
+   * answer commits the machine, then the poll follows later transitions.
    */
   const startMyMachine = useCallback(async () => {
     const workspace = storeRef.current.workspaces.find(({ id }) => id === activeWorkspaceId);
+    if (workspace === undefined) throw new Error('The active workspace is unavailable.');
     const membershipId = storeRef.current.viewer?.membership.id ?? null;
-    const machine = workspace?.members
+    const machine = workspace.members
       .find((member) => member.membershipId === membershipId)?.machine ?? null;
     if (machine === null) throw new Error('You have no machine in this workspace to start.');
-    await client.startMachine(machine.id);
-    await refreshWorkspaceRecords();
-  }, [activeWorkspaceId, client, refreshWorkspaceRecords]);
+    pendingMachineStarts.current.add(workspace.id);
+    commitWorkspaceMutation({
+      type: 'workspace_member_machine_updated',
+      workspaceId: workspace.id,
+      membershipId: machine.membershipId,
+      machine: { ...machine, state: 'provisioning', error: null },
+      lifecycleStatus: 'creating',
+    });
+    try {
+      const { machine: canonical } = await client.startMachine(machine.id);
+      commitWorkspaceMutation({
+        type: 'workspace_member_machine_updated',
+        workspaceId: workspace.id,
+        membershipId: machine.membershipId,
+        machine: canonical,
+        lifecycleStatus: canonical.state === 'running' ? 'running'
+          : canonical.state === 'stopped' ? 'stopped'
+          : canonical.state === 'error' ? 'error'
+          : canonical.state === 'destroying' || canonical.state === 'destroyed'
+            ? 'destroying'
+            : 'creating',
+      });
+      pendingMachineStarts.current.delete(workspace.id);
+      void refreshWorkspaceRecords();
+    } catch (caught) {
+      commitWorkspaceMutation({
+        type: 'workspace_member_machine_updated',
+        workspaceId: workspace.id,
+        membershipId: machine.membershipId,
+        machine,
+        lifecycleStatus: 'stopped',
+      });
+      pendingMachineStarts.current.delete(workspace.id);
+      setError(`Could not start your machine in “${workspace.title}”: ${caughtErrorMessage(
+        caught,
+        'The control plane request failed.',
+      )}`);
+      throw caught;
+    }
+  }, [activeWorkspaceId, client, commitWorkspaceMutation, refreshWorkspaceRecords]);
 
   const cancelConfirmation = useCallback(() => {
     setConfirmation(null);
@@ -1348,9 +1529,20 @@ function CloudAppContent({ client, resolver }: CloudAppProps) {
     request: CredentialRequestView,
     action: 'approve' | 'deny',
   ) => {
-    if (action === 'approve') await client.approveCredentialRequest(request.id);
-    else await client.denyCredentialRequest(request.id);
+    const index = pendingRequestsRef.current.findIndex(({ id }) => id === request.id);
     setPendingRequests((current) => current.filter(({ id }) => id !== request.id));
+    try {
+      if (action === 'approve') await client.approveCredentialRequest(request.id);
+      else await client.denyCredentialRequest(request.id);
+    } catch (caught) {
+      setPendingRequests((current) => {
+        if (current.some(({ id }) => id === request.id)) return current;
+        const restored = [...current];
+        restored.splice(Math.max(index, 0), 0, request);
+        return restored;
+      });
+      throw caught;
+    }
   }, [client]);
   const activePendingRequests = useMemo(
     () => pendingRequests.filter(({ workspace_id }) => workspace_id === activeWorkspaceId),
@@ -1783,10 +1975,24 @@ function CloudAppContent({ client, resolver }: CloudAppProps) {
           orgName: store.viewer.org.name || store.viewer.org.slug,
         }}
         workspaces={store.workspaces.map(({ id, title, members }) => ({ id, name: title, members }))}
+        initialError={grantProposalError?.proposalId === grantProposals.active.id
+          ? grantProposalError.message
+          : null}
         onClose={() => {
           if (grantProposals.active !== null) grantProposals.dismiss(grantProposals.active.id);
         }}
-        onResolved={grantProposals.settled}
+        onResolveStarted={(proposalId) => {
+          setGrantProposalError(null);
+          grantProposals.dismiss(proposalId);
+        }}
+        onResolveFailed={(proposalId, message) => {
+          setGrantProposalError({ proposalId, message });
+          grantProposals.reopen(proposalId);
+        }}
+        onResolved={(proposal) => {
+          setGrantProposalError(null);
+          grantProposals.settled(proposal);
+        }}
       />
     )}
     {dialogViewer !== null && <ShellDialogs
diff --git a/packages/webapp/src/GrantApprovalDialog.tsx b/packages/webapp/src/GrantApprovalDialog.tsx
index 94775342..351bfeae 100644
--- a/packages/webapp/src/GrantApprovalDialog.tsx
+++ b/packages/webapp/src/GrantApprovalDialog.tsx
@@ -161,6 +161,9 @@ export function GrantApprovalDialog({
   workspaces,
   onClose,
   onResolved,
+  onResolveStarted,
+  onResolveFailed,
+  initialError,
 }: {
   client: Pick<ControlPlaneClient, 'listOrgCredentials' | 'listMembers' | 'resolveGrantProposal'>;
   proposal: GrantProposalView;
@@ -170,13 +173,18 @@ export function GrantApprovalDialog({
   onClose: () => void;
   /** The server's answer, once the person approved or rejected. */
   onResolved: (proposal: GrantProposalView) => void;
+  /** Hide the pending proposal while its decision is in flight. */
+  onResolveStarted?: (proposalId: string) => void;
+  /** Restore a rejected optimistic decision with its visible refusal. */
+  onResolveFailed?: (proposalId: string, message: string) => void;
+  initialError?: string | null;
 }) {
   const closeButton = useRef<HTMLButtonElement>(null);
   const [credentials, setCredentials] = useState<OrgCredentialView[] | null>(null);
   const [members, setMembers] = useState<MemberView[]>([]);
   const [edits, setEdits] = useState<ProposalEdit[]>(() => initialEdits(proposal));
   const [busy, setBusy] = useState(false);
-  const [error, setError] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(initialError ?? null);
 
   useEffect(() => { closeButton.current?.focus(); }, []);
   useEffect(() => {
@@ -217,6 +225,7 @@ export function GrantApprovalDialog({
     if (busy) return;
     setBusy(true);
     setError(null);
+    onResolveStarted?.(proposal.id);
     try {
       const response = await client.resolveGrantProposal(proposal.id, {
         approve,
@@ -224,7 +233,9 @@ export function GrantApprovalDialog({
       });
       onResolved(response.proposal);
     } catch (caught) {
-      setError(caughtErrorMessage(caught, approve ? 'Approval failed.' : 'Rejection failed.'));
+      const message = caughtErrorMessage(caught, approve ? 'Approval failed.' : 'Rejection failed.');
+      if (onResolveFailed === undefined) setError(message);
+      else onResolveFailed(proposal.id, message);
     } finally {
       setBusy(false);
     }
diff --git a/packages/webapp/src/InlineComputeCredentialSetup.tsx b/packages/webapp/src/InlineComputeCredentialSetup.tsx
index c315ad4f..262cf392 100644
--- a/packages/webapp/src/InlineComputeCredentialSetup.tsx
+++ b/packages/webapp/src/InlineComputeCredentialSetup.tsx
@@ -54,7 +54,12 @@ function InlineProviderCredential({
       <div className="settings-credential-row">
         <KeyIcon className="settings-compute-glyph" />
         <div>
-          <h3>Add your {computeCredentialProviderTitle(provider)} key</h3>
+          <div className="settings-credential-row__title">
+            <h3>Add your {computeCredentialProviderTitle(provider)} key</h3>
+            {saving && (
+              <span className="workspace-state-badge workspace-state-badge--pending">validating</span>
+            )}
+          </div>
           <p>{details?.detail}</p>
         </div>
       </div>
diff --git a/packages/webapp/src/WorkspaceConnectionsPanel.tsx b/packages/webapp/src/WorkspaceConnectionsPanel.tsx
index 28c95e52..9b1171de 100644
--- a/packages/webapp/src/WorkspaceConnectionsPanel.tsx
+++ b/packages/webapp/src/WorkspaceConnectionsPanel.tsx
@@ -50,15 +50,29 @@ export function WorkspaceRequestsPanel({
   onConnect?: (connectionName: string) => void;
 }) {
   const [resolving, setResolving] = useState<string | null>(null);
+  const [pendingRemovals, setPendingRemovals] = useState<ReadonlySet<string>>(() => new Set());
   const [error, setError] = useState<string | null>(null);
+  const requestKey = requests.map(({ id }) => id).join(' ');
+  useEffect(() => {
+    const serverIds = new Set(requestKey === '' ? [] : requestKey.split(' '));
+    setPendingRemovals((current) => new Set(
+      [...current].filter((id) => serverIds.has(id)),
+    ));
+  }, [requestKey]);
 
   const resolve = async (request: CredentialRequestView, action: 'approve' | 'deny') => {
     if (resolving !== null) return;
     setResolving(request.id);
+    setPendingRemovals((current) => new Set([...current, request.id]));
     setError(null);
     try {
       await onResolve(request, action);
     } catch (caught) {
+      setPendingRemovals((current) => {
+        const next = new Set(current);
+        next.delete(request.id);
+        return next;
+      });
       setError(caughtErrorMessage(caught, `Request ${action} failed.`));
     } finally {
       setResolving(null);
@@ -70,7 +84,7 @@ export function WorkspaceRequestsPanel({
       {(error ?? loadError) && <p className="webapp-form-message" role="alert">{error ?? loadError}</p>}
       {requests.length > 0 && (
         <div className="wsc-list">
-          {requests.map((request) => (
+          {requests.filter(({ id }) => !pendingRemovals.has(id)).map((request) => (
             <article className="wsc-tile wsc-tile--static wsc-tile--wanted" key={request.id}>
               <div className="wsc-tile__head">
                 <ProviderGlyph className="wsc-tile__glyph" provider={request.connection_name} />
@@ -227,6 +241,7 @@ export function WorkspaceConnectionsPanel({
   ) => Promise<void>;
 }) {
   const [connected, noteConnected] = useConnectedProviders(workspaceConnections ?? []);
+  const [autoResolveError, setAutoResolveError] = useState<string | null>(null);
   // Which provider row to open, and a version so asking twice for the same
   // one re-opens a row the person closed. Two things ask: an agent's
   // `blitz connections open`, and Connect on a request in the inbox.
@@ -239,17 +254,23 @@ export function WorkspaceConnectionsPanel({
     ask(connectionsFocus.provider);
   }, [ask, connectionsFocus]);
 
-  /** A provider just became usable here. The inbox entry that asked for it is
-   * the same question, so answering one answers the other. Nothing is pushed
-   * at the box: the next token ask reads the allow-list this write just
-   * changed. */
+  /** The local allow-list follows the press while the request is in flight. */
   const onConnected = useCallback((connectionName: string) => {
     noteConnected(connectionName, true);
+  }, [noteConnected]);
+
+  /** The mint is now authoritative, so the inbox entry can be approved. */
+  const onConnectionAcknowledged = useCallback((connectionName: string) => {
+    setAutoResolveError(null);
     const pending = pendingRequests.find(
       (request) => request.connection_name === connectionName,
     );
-    if (pending !== undefined) void onResolveRequest(pending, 'approve');
-  }, [noteConnected, onResolveRequest, pendingRequests]);
+    if (pending !== undefined) {
+      void onResolveRequest(pending, 'approve').catch((caught) => {
+        setAutoResolveError(caughtErrorMessage(caught, 'Request approval failed.'));
+      });
+    }
+  }, [onResolveRequest, pendingRequests]);
 
   const onDisconnected = useCallback((connectionName: string) => {
     noteConnected(connectionName, false);
@@ -261,6 +282,9 @@ export function WorkspaceConnectionsPanel({
   const wanted = pendingRequests.length > 0 || (pendingRequestsError ?? null) !== null;
   return (
     <div className="workspace-connections">
+      {autoResolveError !== null && (
+        <p className="webapp-form-message" role="alert">{autoResolveError}</p>
+      )}
       {wanted && (
         <>
           <h3 className="workspace-sect workspace-sect--pending">Wanted here</h3>
@@ -290,6 +314,7 @@ export function WorkspaceConnectionsPanel({
         focusVersion={opened?.version ?? 0}
         readOnly={readOnly}
         onConnected={onConnected}
+        onConnectionAcknowledged={onConnectionAcknowledged}
         onDisconnected={onDisconnected}
       />
     </div>
diff --git a/packages/webapp/src/WorkspaceCredentialsTab.tsx b/packages/webapp/src/WorkspaceCredentialsTab.tsx
index 35262615..1859654a 100644
--- a/packages/webapp/src/WorkspaceCredentialsTab.tsx
+++ b/packages/webapp/src/WorkspaceCredentialsTab.tsx
@@ -43,6 +43,7 @@ export function WorkspaceCredentialsTab({
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
   const [form, setForm] = useState<{ kind: 'add' } | { kind: 'rotate'; name: string } | null>(null);
+  const [pendingPut, setPendingPut] = useState<PutOrgCredentialRequest | null>(null);
 
   const reload = useCallback(async (signal?: AbortSignal) => {
     try {
@@ -77,11 +78,25 @@ export function WorkspaceCredentialsTab({
     { credential, path: workspaceReadPath(credential, workspaceId, viewerMembershipId) }));
 
   const put = async (input: PutOrgCredentialRequest) => {
-    await client.putOrgCredential(input);
-    setForm(null);
-    await reload();
+    setPendingPut(input);
+    try {
+      const { credential } = await client.putOrgCredential(input);
+      setCredentials((current) => {
+        const index = current.findIndex(({ name }) => name === credential.name);
+        if (index < 0) return [credential, ...current];
+        const next = [...current];
+        next[index] = credential;
+        return next;
+      });
+      setForm(null);
+    } finally {
+      setPendingPut(null);
+    }
   };
 
+  const pendingAddsRow = pendingPut !== null
+    && !credentials.some(({ name }) => name === pendingPut.name);
+
   return (
     <section
       id="workspace-details-credentials-panel"
@@ -100,16 +115,28 @@ export function WorkspaceCredentialsTab({
         {error !== null && <p className="workspace-details-error" role="alert">{error}</p>}
         <div className="workspace-credential-rows">
           {loading && <p className="workspace-members-empty" role="status">Loading credentials…</p>}
-          {!loading && visible.length === 0 && (
+          {!loading && visible.length === 0 && !pendingAddsRow && (
             <p className="workspace-members-empty">No organization credential reaches this workspace yet.</p>
           )}
+          {pendingAddsRow && pendingPut !== null && (
+            <div className="workspace-credential-row" key={`pending:${pendingPut.name}`}>
+              <span className="workspace-credential-name">
+                <strong><code>{pendingPut.name}</code></strong>
+                {pendingPut.comment !== undefined && pendingPut.comment !== null && <small>{pendingPut.comment}</small>}
+              </span>
+              <span className="workspace-credential-added">saving</span>
+              <span />
+            </div>
+          )}
           {visible.map(({ credential, path }) => (
             <div className="workspace-credential-row" key={credential.id}>
               <span className="workspace-credential-name">
                 <strong><code>{credential.name}</code></strong>
                 {credential.comment !== null && <small>{credential.comment}</small>}
               </span>
-              <span className="workspace-credential-added">{PATH_LABELS[path]}</span>
+              <span className="workspace-credential-added">
+                {pendingPut?.name === credential.name ? 'rotating' : PATH_LABELS[path]}
+              </span>
               {credential.grants.length > 0 ? (
                 <button
                   className="webapp-action"
diff --git a/packages/webapp/src/connections/WorkspaceProviderRows.tsx b/packages/webapp/src/connections/WorkspaceProviderRows.tsx
index ab4e0d71..7f68bef2 100644
--- a/packages/webapp/src/connections/WorkspaceProviderRows.tsx
+++ b/packages/webapp/src/connections/WorkspaceProviderRows.tsx
@@ -6,8 +6,6 @@ import type {
 import { useCallback, useEffect, useState, type FormEvent } from 'react';
 import type { ControlPlaneClient } from '../api';
 import { caughtErrorMessage } from '../error-message';
-import { ModalOverlay } from '../ModalOverlay';
-import { settingsPath } from '../sessions-page-state';
 import {
   grantInput,
   lockedInstanceBaseUrl,
@@ -106,6 +104,7 @@ export function WorkspaceProviderRows({
   focusVersion,
   readOnly,
   onConnected,
+  onConnectionAcknowledged,
   onDisconnected,
 }: {
   client: ProviderRowsClient;
@@ -118,6 +117,8 @@ export function WorkspaceProviderRows({
   readOnly?: boolean;
   /** This workspace may now pull the provider. */
   onConnected: (connectionName: string) => void;
+  /** The mint succeeded, so any request that asked for it may be approved. */
+  onConnectionAcknowledged?: (connectionName: string) => void;
   /** This workspace may no longer pull the provider. */
   onDisconnected: (connectionName: string) => void;
 }) {
@@ -129,6 +130,8 @@ export function WorkspaceProviderRows({
   const [replacing, setReplacing] = useState<string | null>(null);
   const [formVersion, setFormVersion] = useState(0);
   const [saving, setSaving] = useState(false);
+  const [connecting, setConnecting] = useState<string | null>(null);
+  const [backedOverrides, setBackedOverrides] = useState<ReadonlySet<string>>(() => new Set());
   const [error, setError] = useState<string | null>(null);
   const [removing, setRemoving] = useState<string | null>(null);
 
@@ -150,7 +153,14 @@ export function WorkspaceProviderRows({
   useEffect(() => {
     const abort = new AbortController();
     void client.listConnectionGrants(abort.signal).then(
-      (response) => setGrants(response.grants),
+      (response) => {
+        setGrants(response.grants);
+        // Once the refetch contains a pasted grant, its temporary backing can
+        // retire; a later server-side revoke must be able to remove it again.
+        setBackedOverrides((current) => new Set([...current].filter((name) => (
+          !response.grants.some(({ provider }) => provider === name)
+        ))));
+      },
       () => undefined,
     );
     return () => abort.abort();
@@ -196,14 +206,18 @@ export function WorkspaceProviderRows({
   const connectNow = async (row: ProviderRow) => {
     if (saving) return;
     setSaving(true);
+    setConnecting(row.name);
     setError(null);
+    onConnected(row.name);
     try {
       await client.mintWorkspaceConnection(workspaceId, row.name);
-      onConnected(row.name);
+      onConnectionAcknowledged?.(row.name);
       close();
     } catch (caught) {
+      onDisconnected(row.name);
       setError(caughtErrorMessage(caught, 'Connect failed.'));
     } finally {
+      setConnecting(null);
       setSaving(false);
     }
   };
@@ -212,10 +226,11 @@ export function WorkspaceProviderRows({
     if (removing !== null) return;
     setRemoving(row.name);
     setError(null);
+    onDisconnected(row.name);
     try {
       await client.disconnectWorkspaceConnection(workspaceId, row.name);
-      onDisconnected(row.name);
     } catch (caught) {
+      onConnected(row.name);
       setError(caughtErrorMessage(caught, 'Disconnect failed.'));
     } finally {
       setRemoving(null);
@@ -231,20 +246,26 @@ export function WorkspaceProviderRows({
     // A grant is always filed under the catalog id; the control plane refuses
     // any other name, and the form's name field is read-only for that reason.
     const provider = row.name;
+    const wasConnected = row.connected;
     setSaving(true);
+    setConnecting(provider);
     setError(null);
+    if (!wasConnected) onConnected(provider);
     try {
       await client.putConnectionGrant(provider, grantInput(entry, data));
+      setBackedOverrides((current) => new Set([...current, provider]));
       // A key pasted inside a workspace was pasted in order to connect it, so
       // the workspace is connected without a second click.
       await client.mintWorkspaceConnection(workspaceId, provider);
-      onConnected(provider);
+      onConnectionAcknowledged?.(provider);
       form.reset();
       setGrantsVersion((current) => current + 1);
       close();
     } catch (caught) {
+      if (!wasConnected) onDisconnected(provider);
       setError(caughtErrorMessage(caught, 'Connect failed.'));
     } finally {
+      setConnecting(null);
       setSaving(false);
     }
   };
@@ -257,7 +278,7 @@ export function WorkspaceProviderRows({
       {error !== null && <p className="webapp-form-message" role="alert">{error}</p>}
       <div className="wsc-list">
         {rows.map((row) => {
-          const backed = isBacked(row);
+          const backed = isBacked(row) || backedOverrides.has(row.name);
           const isOpen = expanded === row.name;
           const showForm = replacing === row.name || (!backed && row.entry !== null);
           const oauthHref = row.entry?.oauthConfigured === true
@@ -270,7 +291,9 @@ export function WorkspaceProviderRows({
             && ((row.entry.personalTokenLabel !== null
               && !(row.entry.personalTokenFallbackOnly && oauthHref !== null))
               || (row.entry.oauthAvailable && oauthHref !== null));
-          const state = tileState(row, backed, memberPath);
+          const state = connecting === row.name
+            ? { kind: 'on' as const, word: 'Connecting' }
+            : tileState(row, backed, memberPath);
           return (
             <article
               className={`wsc-tile wsc-tile--${state.kind}${
diff --git a/packages/webapp/src/settings/ComputeCredentialsPanel.tsx b/packages/webapp/src/settings/ComputeCredentialsPanel.tsx
index 4417ec15..5a3637c1 100644
--- a/packages/webapp/src/settings/ComputeCredentialsPanel.tsx
+++ b/packages/webapp/src/settings/ComputeCredentialsPanel.tsx
@@ -109,15 +109,19 @@ export function ComputeCredentialsPanel({
     setDeleteTarget(null);
     setDeleting(provider);
     setError(null);
+    const preceding = credentials[provider];
+    setCredentials((current) => {
+      const next = { ...current };
+      delete next[provider];
+      return next;
+    });
     try {
       await client.deleteComputeCredential(orgId, provider);
-      setCredentials((current) => {
-        const next = { ...current };
-        delete next[provider];
-        return next;
-      });
       if (editing === provider) setEditing(null);
     } catch (caught) {
+      if (preceding !== undefined) {
+        setCredentials((current) => ({ ...current, [provider]: preceding }));
+      }
       setError(caughtErrorMessage(caught, 'Credential deletion failed.'));
     } finally {
       setDeleting(null);
@@ -138,6 +142,9 @@ export function ComputeCredentialsPanel({
         <div className="settings-credential-list" aria-label="Cloud compute providers">
           {COMPUTE_CREDENTIAL_PROVIDER_DETAILS.map((provider) => {
             const stored = credentials[provider.id];
+            const transition = saving === provider.id
+              ? 'validating'
+              : deleting === provider.id ? 'deleting' : null;
             const validated = stored === undefined ? null : validatedTime(stored.validated_at);
             const open = editing === provider.id;
             return (
@@ -147,10 +154,10 @@ export function ComputeCredentialsPanel({
                   <div>
                     <div className="settings-credential-row__title">
                       <h3>{provider.title}</h3>
-                      <span className={stored === undefined
+                      <span className={stored === undefined && transition === null
                         ? 'workspace-state-badge'
-                        : 'workspace-state-badge workspace-state-badge--active'}>
-                        {stored === undefined ? 'not set' : 'validated'}
+                        : `workspace-state-badge workspace-state-badge--${transition === null ? 'active' : 'pending'}`}>
+                        {transition ?? (stored === undefined ? 'not set' : 'validated')}
                       </span>
                     </div>
                     <p>{provider.detail}</p>
@@ -162,8 +169,11 @@ export function ComputeCredentialsPanel({
                     <button
                       className="webapp-action"
                       type="button"
+                      disabled={transition !== null}
                       onClick={() => setEditing(open ? null : provider.id)}
-                    >{open ? 'Cancel' : stored === undefined ? 'Add key' : 'Replace'}</button>
+                    >{deleting === provider.id
+                        ? 'Deleting…'
+                        : open ? 'Cancel' : stored === undefined ? 'Add key' : 'Replace'}</button>
                     {stored !== undefined && (
                       <button
                         className="webapp-action webapp-action--danger"
diff --git a/packages/webapp/src/settings/ConnectionsPanel.tsx b/packages/webapp/src/settings/ConnectionsPanel.tsx
index a3a13ef1..99209ad9 100644
--- a/packages/webapp/src/settings/ConnectionsPanel.tsx
+++ b/packages/webapp/src/settings/ConnectionsPanel.tsx
@@ -48,10 +48,17 @@ export function ConnectionsPanel({ client }: { client: ControlPlaneClient }) {
     setRevokeTarget(null);
     setRevoking(grant.provider);
     setError(null);
+    const index = grants.findIndex(({ provider }) => provider === grant.provider);
+    setGrants((current) => current.filter(({ provider }) => provider !== grant.provider));
     try {
       await client.deleteConnectionGrant(grant.provider);
-      await reload();
     } catch (caught) {
+      setGrants((current) => {
+        if (current.some(({ provider }) => provider === grant.provider)) return current;
+        const restored = [...current];
+        restored.splice(Math.max(index, 0), 0, grant);
+        return restored;
+      });
       setError(caughtErrorMessage(caught, 'Revoke failed.'));
     } finally {
       setRevoking(null);
diff --git a/packages/webapp/src/settings/InvitesPanel.tsx b/packages/webapp/src/settings/InvitesPanel.tsx
index 988e1b1a..8e3fd2e1 100644
--- a/packages/webapp/src/settings/InvitesPanel.tsx
+++ b/packages/webapp/src/settings/InvitesPanel.tsx
@@ -12,12 +12,19 @@ interface SeatRefusal {
   seatsNeeded: number;
 }
 
+interface PendingInvite {
+  id: string;
+  email: string | null;
+  role: 'admin' | 'member';
+}
+
 function currency(seats: number, monthlyPerSeat: number): string {
   return `$${(seats * monthlyPerSeat).toLocaleString('en-US')}`;
 }
 
 export function InvitesPanel({ client }: { client: ControlPlaneClient }) {
   const [invites, setInvites] = useState<InviteView[]>([]);
+  const [pendingInvites, setPendingInvites] = useState<PendingInvite[]>([]);
   const [usage, setUsage] = useState<OrgUsageResponse | null>(null);
   const [email, setEmail] = useState('');
   const [role, setRole] = useState<'admin' | 'member'>('member');
@@ -99,10 +106,17 @@ export function InvitesPanel({ client }: { client: ControlPlaneClient }) {
         event.preventDefault();
         if (loading || creating) return;
         const input = { email: email.trim() || undefined, role };
+        const pending: PendingInvite = {
+          id: `pending-invite-${crypto.randomUUID()}`,
+          email: input.email ?? null,
+          role,
+        };
+        setPendingInvites((current) => [pending, ...current]);
         setCreating(true);
         setError(null);
         setRefusal(null);
         void client.createInvite(input).then((created) => {
+          setPendingInvites((current) => current.filter(({ id }) => id !== pending.id));
           setOneTimeLink(window.location.origin + '/invite/' + created.code);
           setInvites((current) => [
             created.invite,
@@ -110,6 +124,7 @@ export function InvitesPanel({ client }: { client: ControlPlaneClient }) {
           ]);
           setEmail('');
         }).catch((caught: Error) => {
+          setPendingInvites((current) => current.filter(({ id }) => id !== pending.id));
           if (caught instanceof ApiRequestError && caught.paymentUrl !== null) {
             setRefusal({
               message: caught.message,
@@ -161,6 +176,14 @@ export function InvitesPanel({ client }: { client: ControlPlaneClient }) {
       )}
       {error && <p className="webapp-form-message" role="alert">{error}</p>}
       <div className="settings-people">
+        {pendingInvites.map((invite) => (
+          <div className="settings-person" key={invite.id}>
+            <span className="settings-person-copy">
+              <strong>{invite.email ?? 'Anyone with the link'}</strong>
+              <span>{invite.role} · creating</span>
+            </span>
+          </div>
+        ))}
         {invites.map((invite) => (
           <div className="settings-person" key={invite.id}>
             <span className="settings-person-copy">
diff --git a/packages/webapp/src/settings/MembersPanel.tsx b/packages/webapp/src/settings/MembersPanel.tsx
index aa750df7..b86de7a9 100644
--- a/packages/webapp/src/settings/MembersPanel.tsx
+++ b/packages/webapp/src/settings/MembersPanel.tsx
@@ -1,5 +1,5 @@
 import { useCallback, useEffect, useState } from 'react';
-import type { ControlPlaneClient, MemberView } from '../api';
+import type { ControlPlaneClient, InviteView, MemberView } from '../api';
 import { ConfirmationDialog } from '../ConfirmationDialog';
 import { DriveAvatar } from '../files/DriveAvatar';
 import { PanelHeader } from './primitives';
@@ -17,6 +17,12 @@ export function MembersPanel({
   onLeft: () => void;
 }) {
   const [members, setMembers] = useState<MemberView[]>([]);
+  const [createdInvites, setCreatedInvites] = useState<InviteView[]>([]);
+  const [pendingInvite, setPendingInvite] = useState<{
+    id: string;
+    email: string;
+    role: 'admin' | 'member';
+  } | null>(null);
   const [confirmLeave, setConfirmLeave] = useState(false);
   const [email, setEmail] = useState('');
   const [role, setRole] = useState<'admin' | 'member'>('member');
@@ -73,12 +79,24 @@ export function MembersPanel({
       {admin && (
         <form className="settings-form" onSubmit={(event) => {
           event.preventDefault();
+          const pending = {
+            id: `pending-invite-${crypto.randomUUID()}`,
+            email: email.trim(),
+            role,
+          };
+          setPendingInvite(pending);
           setCreatingInvite(true);
           setError(null);
           void client.createInvite({ email, role }).then((created) => {
+            setPendingInvite(null);
+            setCreatedInvites((current) => [
+              created.invite,
+              ...current.filter(({ id }) => id !== created.invite.id),
+            ]);
             setOneTimeLink(window.location.origin + '/invite/' + created.code);
             setEmail('');
           }).catch((cause: unknown) => {
+            setPendingInvite(null);
             setError(cause instanceof Error ? cause.message : 'Could not create invite.');
           }).finally(() => setCreatingInvite(false));
         }}>
@@ -104,6 +122,22 @@ export function MembersPanel({
       )}
       {error && <p className="webapp-form-message" role="alert">{error}</p>}
       <div className="settings-people">
+        {pendingInvite !== null && (
+          <div className="settings-person" key={pendingInvite.id}>
+            <span className="settings-person-copy">
+              <strong>{pendingInvite.email}</strong>
+              <span>{pendingInvite.role} · creating invite</span>
+            </span>
+          </div>
+        )}
+        {createdInvites.map((invite) => (
+          <div className="settings-person" key={invite.id}>
+            <span className="settings-person-copy">
+              <strong>{invite.email ?? 'Anyone with the link'}</strong>
+              <span>{invite.role} · invited</span>
+            </span>
+          </div>
+        ))}
         {members.map((member) => {
           const pending = pendingMemberIds.has(member.id);
           return (
diff --git a/packages/webapp/src/settings/OrgCredentialImport.tsx b/packages/webapp/src/settings/OrgCredentialImport.tsx
index 883e86db..379e4686 100644
--- a/packages/webapp/src/settings/OrgCredentialImport.tsx
+++ b/packages/webapp/src/settings/OrgCredentialImport.tsx
@@ -31,10 +31,13 @@ function importSummary(response: ImportOrgCredentialsResponse): string {
 export function OrgCredentialImport({
   onImport,
   onImported,
+  onPendingChange,
 }: {
   onImport: (input: ImportOrgCredentialsRequest) => Promise<ImportOrgCredentialsResponse>;
   /** The list to refresh once keys have landed. */
   onImported: () => void;
+  /** The dry-run rows become the optimistic import until the write settles. */
+  onPendingChange?: (preview: ImportOrgCredentialsResponse | null) => void;
 }) {
   const [text, setText] = useState('');
   const [fileName, setFileName] = useState('');
@@ -70,6 +73,8 @@ export function OrgCredentialImport({
   }, [text, onImport]);
 
   const runImport = () => {
+    if (preview === null) return;
+    onPendingChange?.(preview);
     onImport({ text })
       .then((response) => {
         setError(null);
@@ -78,7 +83,10 @@ export function OrgCredentialImport({
         setFileName('');
         onImported();
       })
-      .catch((caught: Error) => setError(caughtErrorMessage(caught, 'The import failed.')));
+      .catch((caught: Error) => {
+        onPendingChange?.(null);
+        setError(caughtErrorMessage(caught, 'The import failed.'));
+      });
   };
 
   const chooseFile = (file: File | undefined) => {
diff --git a/packages/webapp/src/settings/OrgCredentialsPanel.tsx b/packages/webapp/src/settings/OrgCredentialsPanel.tsx
index d2c7ff69..2c7248cc 100644
--- a/packages/webapp/src/settings/OrgCredentialsPanel.tsx
+++ b/packages/webapp/src/settings/OrgCredentialsPanel.tsx
@@ -1,4 +1,5 @@
 import type {
+  ImportOrgCredentialsResponse,
   OrgCredentialGrantView,
   OrgCredentialView,
   PutOrgCredentialRequest,
@@ -65,6 +66,8 @@ export function OrgCredentialsPanel({
   const [savingGrants, setSavingGrants] = useState(false);
   const [revokeTarget, setRevokeTarget] = useState<OrgCredentialView | null>(null);
   const [revoking, setRevoking] = useState<string | null>(null);
+  const [pendingPut, setPendingPut] = useState<PutOrgCredentialRequest | null>(null);
+  const [pendingImport, setPendingImport] = useState<ImportOrgCredentialsResponse | null>(null);
 
   const admin = viewer.membership.role === 'admin';
 
@@ -117,20 +120,47 @@ export function OrgCredentialsPanel({
   const canEdit = (credential: OrgCredentialView) => admin || credential.grants.length > 0;
 
   const put = async (input: PutOrgCredentialRequest) => {
-    await client.putOrgCredential(input);
-    setRotating(null);
-    await reload();
+    setPendingPut(input);
+    try {
+      const { credential } = await client.putOrgCredential(input);
+      setCredentials((current) => {
+        const index = current.findIndex(({ name }) => name === credential.name);
+        if (index < 0) return [credential, ...current];
+        const next = [...current];
+        next[index] = credential;
+        return next;
+      });
+      setRotating(null);
+    } finally {
+      setPendingPut(null);
+    }
   };
 
   const saveGrants = async () => {
     if (grantsEditor === null || savingGrants) return;
     setSavingGrants(true);
     setError(null);
+    const preceding = credentials.find(({ name }) => name === grantsEditor.name) ?? null;
+    if (preceding !== null) {
+      setCredentials((current) => current.map((credential) => credential.name === grantsEditor.name
+        ? { ...credential, grants: grantsEditor.grants }
+        : credential));
+    }
     try {
-      await client.replaceOrgCredentialGrants(grantsEditor.name, { grants: grantsEditor.grants });
+      const { credential } = await client.replaceOrgCredentialGrants(
+        grantsEditor.name,
+        { grants: grantsEditor.grants },
+      );
+      setCredentials((current) => current.map((entry) => entry.name === credential.name
+        ? credential
+        : entry));
       setGrantsEditor(null);
-      await reload();
     } catch (caught) {
+      if (preceding !== null) {
+        setCredentials((current) => current.map((credential) => credential.name === preceding.name
+          ? preceding
+          : credential));
+      }
       setError(caughtErrorMessage(caught, 'The grants were not saved.'));
     } finally {
       setSavingGrants(false);
@@ -142,18 +172,34 @@ export function OrgCredentialsPanel({
     setRevokeTarget(null);
     setRevoking(credential.name);
     setError(null);
+    const index = credentials.findIndex(({ id }) => id === credential.id);
+    setCredentials((current) => current.filter(({ id }) => id !== credential.id));
     try {
       await client.revokeOrgCredential(credential.name);
       if (grantsEditor?.name === credential.name) setGrantsEditor(null);
       if (rotating === credential.name) setRotating(null);
-      await reload();
     } catch (caught) {
+      setCredentials((current) => {
+        if (current.some(({ id }) => id === credential.id)) return current;
+        const restored = [...current];
+        restored.splice(Math.max(index, 0), 0, credential);
+        return restored;
+      });
       setError(caughtErrorMessage(caught, 'Revoke failed.'));
     } finally {
       setRevoking(null);
     }
   };
 
+  const importingNames = new Set(pendingImport?.results
+    .filter(({ outcome }) => outcome === 'stored' || outcome === 'rotated')
+    .map(({ name }) => name) ?? []);
+  const pendingAddedNames = [...importingNames].filter((name) => (
+    !credentials.some((credential) => credential.name === name)
+  ));
+  const pendingPutAddsRow = pendingPut !== null
+    && !credentials.some(({ name }) => name === pendingPut.name);
+
   return (
     <section className="settings-panel settings-org-credentials" role="tabpanel" aria-label="Credentials">
       <PanelHeader
@@ -173,17 +219,42 @@ export function OrgCredentialsPanel({
         </div>
         {loading ? (
           <p className="settings-credential-state">Loading credentials…</p>
-        ) : credentials.length === 0 ? (
+        ) : credentials.length === 0 && !pendingPutAddsRow && pendingAddedNames.length === 0 ? (
           <p className="settings-credential-state">
             No credentials yet. Add one below, or import a .env file.
           </p>
         ) : (
           <div className="settings-credential-list">
+            {pendingPutAddsRow && pendingPut !== null && (
+              <article className="settings-credential-row org-credential-row" key={`pending:${pendingPut.name}`}>
+                <div>
+                  <div className="settings-credential-row__title">
+                    <h3><code>{pendingPut.name}</code></h3>
+                    <span className="workspace-state-badge workspace-state-badge--pending">saving</span>
+                  </div>
+                  {pendingPut.comment !== undefined && pendingPut.comment !== null && <p>{pendingPut.comment}</p>}
+                  <GrantChips grants={pendingPut.grants ?? []} subjects={subjects} />
+                </div>
+              </article>
+            )}
+            {pendingAddedNames.map((name) => (
+              <article className="settings-credential-row org-credential-row" key={`importing:${name}`}>
+                <div className="settings-credential-row__title">
+                  <h3><code>{name}</code></h3>
+                  <span className="workspace-state-badge workspace-state-badge--pending">importing</span>
+                </div>
+              </article>
+            ))}
             {credentials.map((credential) => (
               <article className="settings-credential-row org-credential-row" key={credential.id}>
                 <div>
                   <div className="settings-credential-row__title">
                     <h3><code>{credential.name}</code></h3>
+                    {(pendingPut?.name === credential.name || importingNames.has(credential.name)) && (
+                      <span className="workspace-state-badge workspace-state-badge--pending">
+                        {importingNames.has(credential.name) ? 'importing' : 'rotating'}
+                      </span>
+                    )}
                   </div>
                   {credential.comment !== null && <p>{credential.comment}</p>}
                   <small>added by {creatorLabel(credential)} · {dateLabel(credential.createdAt)}</small>
@@ -270,7 +341,10 @@ export function OrgCredentialsPanel({
       <section className="cfg-section" aria-label="Import a .env file">
         <OrgCredentialImport
           onImport={client.importOrgCredentials}
-          onImported={() => { void reload(); }}
+          onPendingChange={setPendingImport}
+          onImported={() => {
+            void reload().finally(() => setPendingImport(null));
+          }}
         />
       </section>
 
diff --git a/packages/webapp/src/settings/RequestsPanel.tsx b/packages/webapp/src/settings/RequestsPanel.tsx
index 01ebd331..52b9aa33 100644
--- a/packages/webapp/src/settings/RequestsPanel.tsx
+++ b/packages/webapp/src/settings/RequestsPanel.tsx
@@ -57,12 +57,15 @@ export function RequestsPanel({
     if (resolving !== null || request.state !== 'pending') return;
     setResolving(request.id);
     setError(null);
+    setRequests((current) => current.map((entry) => entry.id === request.id
+      ? { ...entry, state: 'denied' }
+      : entry));
     try {
       await client.denyCredentialRequest(request.id);
+    } catch (caught) {
       setRequests((current) => current.map((entry) => entry.id === request.id
-        ? { ...entry, state: 'denied' }
+        ? request
         : entry));
-    } catch (caught) {
       setError(caughtErrorMessage(caught, 'Dismiss failed.'));
     } finally {
       setResolving(null);
diff --git a/packages/webapp/src/settings/UsagePanel.tsx b/packages/webapp/src/settings/UsagePanel.tsx
index de1a156c..aa5495dc 100644
--- a/packages/webapp/src/settings/UsagePanel.tsx
+++ b/packages/webapp/src/settings/UsagePanel.tsx
@@ -26,12 +26,17 @@ export function UsagePanel({ client }: { client: ControlPlaneClient }) {
   }, [client]);
 
   const toggle = (enabled: boolean) => {
-    if (busy) return;
+    if (busy || state === null) return;
+    const preceding = state;
+    setState({ ...state, enabled });
     setBusy(true);
     setError(null);
     void client.putUsageCapture(enabled)
       .then(setState)
-      .catch((caught: Error) => setError(caught.message))
+      .catch((caught: Error) => {
+        setState(preceding);
+        setError(caught.message);
+      })
       .finally(() => setBusy(false));
   };
 
diff --git a/packages/webapp/src/use-workspace-lifecycle.ts b/packages/webapp/src/use-workspace-lifecycle.ts
index 2c96ae3e..57caac6b 100644
--- a/packages/webapp/src/use-workspace-lifecycle.ts
+++ b/packages/webapp/src/use-workspace-lifecycle.ts
@@ -7,6 +7,7 @@ import {
   defaultGlobalWebAppState,
   reconcileUiPreferences,
   type StorageNamespace,
+  type GlobalWebAppStateV1,
   type WorkspaceWebAppStateV1,
 } from './storage.js';
 import type { IdentityRecord } from './protocol.js';
@@ -32,6 +33,7 @@ type WorkspaceBootstrapOptions = {
   dispatch: Dispatch<WorkspaceAction>;
   setLoaded: StateSetter<boolean>;
   setError: StateSetter<string | null>;
+  onGlobalStateLoaded: (doc: GlobalWebAppStateV1, namespace: StorageNamespace) => void;
 };
 
 export function useWorkspaceBootstrap({
@@ -47,6 +49,7 @@ export function useWorkspaceBootstrap({
   dispatch,
   setLoaded,
   setError,
+  onGlobalStateLoaded,
 }: WorkspaceBootstrapOptions): void {
   useEffect(() => {
     if (signedOut) return;
@@ -86,6 +89,7 @@ export function useWorkspaceBootstrap({
           records.map(({ id }) => id),
         );
         if (!mounted) return;
+        onGlobalStateLoaded(globalState.doc ?? defaultGlobalWebAppState(), namespace);
         rememberWorkspaceEndpoints(workspaceEndpoints.current, records, resolver, true);
         const routeWorkspaceId = parseAppRoute(window.location.pathname).workspaceId;
         const requestedWorkspaceId = routeWorkspaceId ?? preferences.activeWorkspaceId;
@@ -114,6 +118,7 @@ export function useWorkspaceBootstrap({
     setLoaded,
     setIdentityOnly,
     setStorageNamespace,
+    onGlobalStateLoaded,
     signedOut,
     workspaceEndpoints,
   ]);
diff --git a/packages/webapp/src/use-workspace-persistence.ts b/packages/webapp/src/use-workspace-persistence.ts
index 0d0a899d..e9afcfe3 100644
--- a/packages/webapp/src/use-workspace-persistence.ts
+++ b/packages/webapp/src/use-workspace-persistence.ts
@@ -7,6 +7,7 @@ import {
   workspaceWebAppState,
   type WorkspaceFiles,
   type WorkspaceTabs,
+  type WorkspaceWebAppStateV1,
 } from './storage.js';
 import type { Agent } from './protocol.js';
 
@@ -42,16 +43,25 @@ export function useWorkspacePersistence(
     value: WorkspaceFiles;
   }>(() => ({ workspaceId: '', value: defaultWorkspaceFiles() }));
   const [serverSeededId, setServerSeededId] = useState('');
-  // The doc last agreed with the server, as sent-on-the-wire JSON. The
-  // workspace poll rebuilds workspace objects every 15s, which re-runs the
-  // save effect; without this an idle tab would re-PUT its held snapshot on
-  // every tick and — because the doc is shared and read newest-first — undo
-  // whatever another account did in the meantime.
-  const syncedDoc = useRef<{ workspaceId: string; json: string }>({ workspaceId: '', json: '' });
+  // The last server-acknowledged document is the rollback snapshot. The last
+  // attempted JSON separately prevents a rejected write from looping on every
+  // poll render while its restored snapshot is applied.
+  const acknowledgedDoc = useRef<{
+    workspaceId: string;
+    value: WorkspaceWebAppStateV1;
+    json: string;
+  } | null>(null);
+  const attemptedDoc = useRef<{ workspaceId: string; json: string }>({ workspaceId: '', json: '' });
+  const currentDoc = useRef<{ workspaceId: string; json: string }>({ workspaceId: '', json: '' });
+  const saveRequest = useRef<symbol | null>(null);
+  const [saveVersion, setSaveVersion] = useState(0);
 
   useEffect(() => {
     setServerSeededId('');
-    syncedDoc.current = { workspaceId: '', json: '' };
+    acknowledgedDoc.current = null;
+    attemptedDoc.current = { workspaceId: '', json: '' };
+    currentDoc.current = { workspaceId: '', json: '' };
+    saveRequest.current = null;
     if (!enabled || !activeWorkspaceId) {
       setWorkspaceTabs({
         workspaceId: activeWorkspaceId,
@@ -75,7 +85,9 @@ export function useWorkspacePersistence(
         setWorkspaceFiles({ workspaceId: activeWorkspaceId, value: state.drawer });
         // Adopting the server's doc is not an edit, so it must not echo back
         // as a write that outranks another account's newer save.
-        syncedDoc.current = { workspaceId: activeWorkspaceId, json: JSON.stringify(state) };
+        const json = JSON.stringify(state);
+        acknowledgedDoc.current = { workspaceId: activeWorkspaceId, value: state, json };
+        attemptedDoc.current = { workspaceId: activeWorkspaceId, json };
         setServerSeededId(activeWorkspaceId);
       })
       .catch((cause: Error) => {
@@ -96,6 +108,24 @@ export function useWorkspacePersistence(
     };
   }, [activeWorkspaceId, api, enabled, onError]);
 
+  if (
+    metadata !== null
+    && workspaceTabs.workspaceId === activeWorkspaceId
+    && workspaceFiles.workspaceId === activeWorkspaceId
+    && workspaceTabs.loaded
+  ) {
+    currentDoc.current = {
+      workspaceId: activeWorkspaceId,
+      json: JSON.stringify(workspaceWebAppState(
+        metadata.title,
+        metadata.serverName,
+        metadata.agentDefault,
+        workspaceTabs.value,
+        workspaceFiles.value,
+      )),
+    };
+  }
+
   useEffect(() => {
     if (
       !enabled
@@ -106,6 +136,7 @@ export function useWorkspacePersistence(
       || !workspaceTabs.loaded
       || serverSeededId !== activeWorkspaceId
       || !metadata.canWrite
+      || saveRequest.current !== null
     ) return;
     const doc = workspaceWebAppState(
       metadata.title,
@@ -115,16 +146,56 @@ export function useWorkspacePersistence(
       workspaceFiles.value,
     );
     const json = JSON.stringify(doc);
-    if (syncedDoc.current.workspaceId === activeWorkspaceId && syncedDoc.current.json === json) {
+    if (attemptedDoc.current.workspaceId === activeWorkspaceId && attemptedDoc.current.json === json) {
       return;
     }
     const timer = window.setTimeout(() => {
-      syncedDoc.current = { workspaceId: activeWorkspaceId, json };
-      void api.putWorkspaceWebAppState(activeWorkspaceId, doc).catch((cause: Error) => {
-        // The attempt stays recorded so a rejected doc is not re-sent on every
-        // poll tick; the next real edit produces different JSON and retries.
-        onError(cause);
-      });
+      const request = Symbol(activeWorkspaceId);
+      saveRequest.current = request;
+      attemptedDoc.current = { workspaceId: activeWorkspaceId, json };
+      void api.putWorkspaceWebAppState(activeWorkspaceId, doc)
+        .then((response) => {
+          if (saveRequest.current !== request) return;
+          const canonical = response.doc ?? defaultWorkspaceWebAppState();
+          const canonicalJson = JSON.stringify(canonical);
+          acknowledgedDoc.current = {
+            workspaceId: activeWorkspaceId,
+            value: canonical,
+            json: canonicalJson,
+          };
+          attemptedDoc.current = { workspaceId: activeWorkspaceId, json: canonicalJson };
+          // A newer local edit waits behind this write and gets its own turn.
+          if (currentDoc.current.workspaceId !== activeWorkspaceId
+            || currentDoc.current.json !== json) return;
+          setWorkspaceTabs((current) => current.workspaceId === activeWorkspaceId
+            ? { ...current, value: canonical.tabs }
+            : current);
+          setWorkspaceFiles((current) => current.workspaceId === activeWorkspaceId
+            ? { workspaceId: activeWorkspaceId, value: canonical.drawer }
+            : current);
+        })
+        .catch((cause: Error) => {
+          if (saveRequest.current !== request) return;
+          const acknowledged = acknowledgedDoc.current;
+          if (acknowledged?.workspaceId === activeWorkspaceId) {
+            attemptedDoc.current = {
+              workspaceId: activeWorkspaceId,
+              json: acknowledged.json,
+            };
+            setWorkspaceTabs((current) => current.workspaceId === activeWorkspaceId
+              ? { ...current, value: acknowledged.value.tabs }
+              : current);
+            setWorkspaceFiles((current) => current.workspaceId === activeWorkspaceId
+              ? { workspaceId: activeWorkspaceId, value: acknowledged.value.drawer }
+              : current);
+          }
+          onError(cause);
+        })
+        .finally(() => {
+          if (saveRequest.current !== request) return;
+          saveRequest.current = null;
+          setSaveVersion((version) => version + 1);
+        });
     }, 150);
     return () => window.clearTimeout(timer);
   }, [
@@ -133,6 +204,7 @@ export function useWorkspacePersistence(
     enabled,
     metadata,
     onError,
+    saveVersion,
     serverSeededId,
     workspaceFiles,
     workspaceTabs,
diff --git a/packages/webapp/src/workspace-store.ts b/packages/webapp/src/workspace-store.ts
index 34f7cf1a..34eeb3ba 100644
--- a/packages/webapp/src/workspace-store.ts
+++ b/packages/webapp/src/workspace-store.ts
@@ -52,14 +52,20 @@ export type WorkspaceAction =
   | { type: 'workspace_create_started'; workspace: CloudWorkspaceModel }
   | { type: 'workspace_create_committed'; temporaryId: string; record: WorkspaceRecord; agentDefault: Agent }
   | { type: 'workspace_create_rolled_back'; temporaryId: string }
-  | { type: 'workspace_records_refreshed'; records: WorkspaceRecord[] }
+  | { type: 'workspace_records_refreshed'; records: WorkspaceRecord[]; heldWorkspaceIds?: string[] }
   | { type: 'workspace_record_updated'; record: WorkspaceRecord }
   | { type: 'workspace_resume_failed'; workspaceId: string; errorDetail: string }
   | { type: 'workspace_deleted'; workspaceId: string }
   | { type: 'workspace_delete_rolled_back'; workspace: CloudWorkspaceModel; index: number }
   | { type: 'workspace_member_upserted'; workspaceId: string; member: WorkspaceMemberView }
   | { type: 'workspace_member_removed'; workspaceId: string; membershipId: string }
-  | { type: 'workspace_member_machine_updated'; workspaceId: string; membershipId: string; machine: MachineView | null }
+  | {
+      type: 'workspace_member_machine_updated';
+      workspaceId: string;
+      membershipId: string;
+      machine: MachineView | null;
+      lifecycleStatus?: RestWorkspaceStatus;
+    }
   | {
       type: 'workspace_settings_updated';
       workspaceId: string;
@@ -70,7 +76,8 @@ export type WorkspaceAction =
     }
   | { type: 'workspace_renamed'; workspaceId: string; title: string }
   | { type: 'agent_default_changed'; workspaceId: string; agent: Agent }
-  | { type: 'workspace_reordered'; sourceId: string; targetId: string };
+  | { type: 'workspace_reordered'; sourceId: string; targetId: string }
+  | { type: 'workspace_order_reconciled'; order: string[] };
 
 export const initialWorkspaceStore: WorkspaceStoreState = { workspaces: [], viewer: null };
 
@@ -276,11 +283,15 @@ export function workspaceReducer(state: WorkspaceStoreState, action: WorkspaceAc
       };
     case 'workspace_records_refreshed': {
       const recordsById = new Map(action.records.map((record) => [record.id, record]));
+      const heldWorkspaceIds = new Set(action.heldWorkspaceIds ?? []);
       return {
         ...state,
         workspaces: state.workspaces.flatMap((workspace) => {
           // The control plane cannot list a create it has not answered yet.
           if (workspace.pendingCreate) return [workspace];
+          // A lifecycle mutation can activate the fast poll before its write
+          // settles. Keep that exact row until the mutation has an answer.
+          if (heldWorkspaceIds.has(workspace.id)) return [workspace];
           const record = recordsById.get(workspace.id);
           // Same rule as `workspaces_loaded`: a poll that catches the member's
           // machine mid-replacement must not evict the workspace from the rail.
@@ -292,6 +303,7 @@ export function workspaceReducer(state: WorkspaceStoreState, action: WorkspaceAc
     case 'workspace_record_updated':
       return mapWorkspace(state, action.record.id, (workspace) => ({
         ...workspace,
+        serverName: action.record.name,
         machineType: action.record.machineType ?? workspace.machineType,
         volumeId: action.record.volumeId ?? null,
         lifecycleStatus: lifecycleStatusFor(action.record, state.viewer?.membership.id ?? null),
@@ -342,6 +354,7 @@ export function workspaceReducer(state: WorkspaceStoreState, action: WorkspaceAc
     case 'workspace_member_machine_updated':
       return mapWorkspace(state, action.workspaceId, (workspace) => ({
         ...workspace,
+        lifecycleStatus: action.lifecycleStatus ?? workspace.lifecycleStatus,
         members: workspace.members.map((member) => member.membershipId === action.membershipId
           ? { ...member, machine: action.machine }
           : member),
@@ -365,6 +378,16 @@ export function workspaceReducer(state: WorkspaceStoreState, action: WorkspaceAc
       workspaces.splice(targetIndex, 0, moved);
       return { ...state, workspaces };
     }
+    case 'workspace_order_reconciled': {
+      const order = new Map(action.order.map((id, index) => [id, index]));
+      return {
+        ...state,
+        workspaces: [...state.workspaces].sort((left, right) => (
+          (order.get(left.id) ?? Number.MAX_SAFE_INTEGER)
+          - (order.get(right.id) ?? Number.MAX_SAFE_INTEGER)
+        )),
+      };
+    }
   }
 }
 
diff --git a/packages/webapp/test/WorkspaceDetailsDialog.test.tsx b/packages/webapp/test/WorkspaceDetailsDialog.test.tsx
index c04fcd96..4837a886 100644
--- a/packages/webapp/test/WorkspaceDetailsDialog.test.tsx
+++ b/packages/webapp/test/WorkspaceDetailsDialog.test.tsx
@@ -485,12 +485,23 @@ describe('WorkspaceDetailsDialog', () => {
   });
 
   it('adds and rotates through the org-level form, a new key granted to this workspace', async () => {
-    const putOrgCredential = vi.fn().mockResolvedValue({ credential: null });
-    const listOrgCredentials = vi.fn().mockResolvedValue({ credentials: [{
+    const existing: OrgCredentialView = {
       id: 'cred-1', name: 'STRIPE_API_KEY', comment: null, createdByMembershipId: 'membership-1',
       createdAt: 1, updatedAt: 1,
       grants: [{ subjectKind: 'workspace', subjectId: workspace.id, access: 'read' }],
-    }] });
+    };
+    const putOrgCredential = vi.fn(async (input: { name: string; grants?: OrgCredentialView['grants'] }) => ({
+      credential: input.name === existing.name
+        ? { ...existing, updatedAt: 3 }
+        : {
+            ...existing,
+            id: 'cred-database',
+            name: input.name,
+            updatedAt: 2,
+            grants: input.grants ?? [],
+          },
+    }));
+    const listOrgCredentials = vi.fn().mockResolvedValue({ credentials: [existing] });
     const view = await render(dialog({ client: client({ listOrgCredentials, putOrgCredential }) }));
     await settle();
     await act(async () => tab(view.container, 'Credentials')?.click());
@@ -515,8 +526,9 @@ describe('WorkspaceDetailsDialog', () => {
       grants: [{ subjectKind: 'workspace', subjectId: workspace.id, access: 'read' }],
     });
     await settle();
-    // The tab re-reads after the write rather than inventing a row.
-    expect(listOrgCredentials).toHaveBeenCalledTimes(2);
+    // The returned canonical row replaces the placeholder without another read.
+    expect(view.container.textContent).toContain('DATABASE_URLgranted to this workspace');
+    expect(listOrgCredentials).toHaveBeenCalledTimes(1);
 
     await act(async () => view.container.querySelector<HTMLButtonElement>('button[aria-label="Rotate STRIPE_API_KEY"]')?.click());
     const rotateForm = view.container.querySelector('form[aria-label="Rotate STRIPE_API_KEY"]');
@@ -530,6 +542,41 @@ describe('WorkspaceDetailsDialog', () => {
     await view.unmount();
   });
 
+  it('shows a workspace credential placeholder and removes it with an error on rejection', async () => {
+    const request = deferred<Awaited<ReturnType<ControlPlaneClient['putOrgCredential']>>>();
+    const view = await render(dialog({
+      client: client({
+        listOrgCredentials: vi.fn(async () => ({ credentials: [] })),
+        putOrgCredential: vi.fn(() => request.promise),
+      }),
+    }));
+    await settle();
+    await act(async () => tab(view.container, 'Credentials')?.click());
+    await settle();
+    const buttonNamed = (text: string) => [...view.container.querySelectorAll<HTMLButtonElement>('button')]
+      .find((button) => button.textContent?.trim() === text);
+    await act(async () => buttonNamed('Add a credential')?.click());
+    const form = view.container.querySelector<HTMLFormElement>('form[aria-label="Add a credential"]');
+    if (form === null) throw new Error('workspace credential form is missing');
+    const name = form.querySelector<HTMLInputElement>('[aria-label="Credential name"]');
+    const value = form.querySelector<HTMLInputElement>('[aria-label="Credential value"]');
+    if (name === null || value === null) throw new Error('workspace credential fields are missing');
+    await act(async () => {
+      typeInto(name, 'DATABASE_URL');
+      typeInto(value, 'never-render-this');
+      buttonNamed('Save credential')?.click();
+    });
+    expect(view.container.textContent).toContain('DATABASE_URLsaving');
+    expect(view.container.textContent).not.toContain('never-render-this');
+
+    request.reject(new Error('workspace credential refused'));
+    await settle();
+    expect(view.container.textContent).not.toContain('DATABASE_URLsaving');
+    expect(form.querySelector('[role="alert"]')?.textContent)
+      .toBe('workspace credential refused');
+    await view.unmount();
+  });
+
   it('offers clone and delete from the footer, and names the default machine type', async () => {
     const onClone = vi.fn();
     const onDelete = vi.fn();
diff --git a/packages/webapp/test/admin-connections.test.tsx b/packages/webapp/test/admin-connections.test.tsx
index 4802d4be..f0847e59 100644
--- a/packages/webapp/test/admin-connections.test.tsx
+++ b/packages/webapp/test/admin-connections.test.tsx
@@ -9,7 +9,7 @@ import { describe, expect, it, vi } from 'vitest';
 import type { ControlPlaneClient } from '../src/api.js';
 import { WorkspaceProviderRows } from '../src/connections/WorkspaceProviderRows.js';
 import { ConnectionsPanel } from '../src/settings/ConnectionsPanel.js';
-import { render, settle } from './dom.js';
+import { deferred, render, settle } from './dom.js';
 
 function client(overrides: Partial<ControlPlaneClient> = {}): ControlPlaneClient {
   return {
@@ -223,6 +223,43 @@ describe('settings connections panel (revoke-only)', () => {
     expect(revokes.length).toBe(2);
     await view.unmount();
   });
+
+  it('removes a personal grant immediately and restores its index on rejection', async () => {
+    const grant = {
+      provider: 'linear',
+      manifestId: 'linear',
+      kind: 'oauth' as const,
+      label: null,
+      scopes: ['read'],
+      createdAt: 1,
+      updatedAt: 1,
+      accessExpiresAt: null,
+    };
+    const revoke = deferred<void>();
+    const view = await render(<ConnectionsPanel client={client({
+      listConnectionGrants: vi.fn(async () => ({ grants: [grant, { ...grant, provider: 'notion' }] })),
+      deleteConnectionGrant: vi.fn(() => revoke.promise),
+    })} />);
+    await settle();
+    const linearRow = [...view.container.querySelectorAll<HTMLElement>('.settings-credential-row')]
+      .find((row) => row.textContent?.includes('linear'));
+    if (linearRow === undefined) throw new Error('linear grant row is missing');
+    await act(async () => click([...linearRow.querySelectorAll('button')]
+      .find((button) => button.textContent === 'Revoke')!));
+    await act(async () => click([...document.body.querySelectorAll('button')]
+      .find((button) => button.textContent === 'Revoke connection')!));
+    expect([...view.container.querySelectorAll('.settings-credential-row h3')]
+      .map((heading) => heading.textContent)).toEqual(['notion']);
+
+    revoke.reject(new Error('personal revoke refused'));
+    await settle();
+    const providers = [...view.container.querySelectorAll('.settings-credential-row h3')]
+      .map((heading) => heading.textContent);
+    expect(providers).toEqual(['linear', 'notion']);
+    expect(view.container.querySelector('[role="alert"]')?.textContent)
+      .toBe('personal revoke refused');
+    await view.unmount();
+  });
 });
 
 /** The provider connect surface as production hosts it: expanded inside a
diff --git a/packages/webapp/test/compute-credentials.test.tsx b/packages/webapp/test/compute-credentials.test.tsx
index 53ee71e2..1796023f 100644
--- a/packages/webapp/test/compute-credentials.test.tsx
+++ b/packages/webapp/test/compute-credentials.test.tsx
@@ -9,8 +9,9 @@ import type {
   ComputeCredentialsClient,
 } from '../src/compute-credentials-api.js';
 import { ComputeCredentialsPanel } from '../src/settings/ComputeCredentialsPanel.js';
+import { InlineComputeCredentialSetup } from '../src/InlineComputeCredentialSetup.js';
 import { SettingsPage } from '../src/SettingsPage.js';
-import { render, settle } from './dom.js';
+import { deferred, render, settle } from './dom.js';
 
 function missing(): ApiRequestError {
   return new ApiRequestError('compute credential not found', 404, null);
@@ -126,6 +127,32 @@ describe('compute credential settings', () => {
     await view.unmount();
   });
 
+  it('marks a compute row validating immediately and restores not-set on rejection', async () => {
+    const request = deferred<ComputeCredentialMetadata>();
+    const view = await render(<ComputeCredentialsPanel
+      client={client({ putComputeCredential: vi.fn(() => request.promise) })}
+      orgId="org-one"
+    />);
+    await settle();
+    const card = providerCard(view.container, 'Hetzner Cloud');
+    await act(async () => button(card, 'Add key').click());
+    card.querySelector<HTMLInputElement>('input[name="token"]')!.value = 'one-use-secret';
+    await act(async () => card.querySelector('form')?.dispatchEvent(new Event('submit', {
+      bubbles: true,
+      cancelable: true,
+    })));
+    expect(card.textContent).toContain('validating');
+    expect(card.textContent).not.toContain('validated');
+
+    request.reject(new Error('compute save refused'));
+    await settle();
+    expect(card.textContent).toContain('not set');
+    expect(card.textContent).not.toContain('validating');
+    expect(view.container.querySelector('[role="alert"]')?.textContent)
+      .toBe('compute save refused');
+    await view.unmount();
+  });
+
   it('replaces the paste form with metadata and never renders the saved key', async () => {
     const metadata: ComputeCredentialMetadata = {
       provider: 'hetzner',
@@ -215,4 +242,66 @@ describe('compute credential settings', () => {
     expect(button(card, 'Add key')).not.toBeNull();
     await view.unmount();
   });
+
+  it('removes compute metadata immediately and restores it on delete rejection', async () => {
+    const stored: ComputeCredentialMetadata = {
+      provider: 'aws',
+      validated_at: 1_700_000_000_000,
+      created_by: 'membership-one',
+    };
+    const request = deferred<void>();
+    const view = await render(<ComputeCredentialsPanel
+      client={client({
+        getComputeCredential: vi.fn(async (_orgId, provider) => {
+          if (provider === 'aws') return stored;
+          throw missing();
+        }),
+        deleteComputeCredential: vi.fn(() => request.promise),
+      })}
+      orgId="org-one"
+    />);
+    await settle();
+    const card = providerCard(view.container, 'Amazon Web Services');
+    await act(async () => button(card, 'Delete').click());
+    await act(async () => button(document.body, 'Delete credential').click());
+    expect(card.textContent).toContain('deleting');
+    expect(card.querySelector('time')).toBeNull();
+
+    request.reject(new Error('compute delete refused'));
+    await settle();
+    expect(card.textContent).toContain('validated');
+    expect(card.querySelector('time')?.dateTime).toBe('2023-11-14T22:13:20.000Z');
+    expect(view.container.querySelector('[role="alert"]')?.textContent)
+      .toBe('compute delete refused');
+    await view.unmount();
+  });
+
+  it('marks inline compute setup validating and restores the form on rejection', async () => {
+    const request = deferred<ComputeCredentialMetadata>();
+    const view = await render(<InlineComputeCredentialSetup
+      providers={['hetzner']}
+      orgId="org-one"
+      admin
+      saveCredential={vi.fn(() => request.promise)}
+      onSaved={vi.fn(async () => undefined)}
+    />);
+    const input = view.container.querySelector<HTMLInputElement>('input[name="token"]');
+    if (input === null) throw new Error('inline token field is missing');
+    await act(async () => {
+      Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')
+        ?.set?.call(input, 'inline-secret');
+      input.dispatchEvent(new Event('input', { bubbles: true }));
+    });
+    await act(async () => button(view.container, 'Validate and show machines').click());
+    expect(view.container.textContent).toContain('validating');
+    expect(button(view.container, 'Validating…').disabled).toBe(true);
+
+    request.reject(new Error('inline compute refused'));
+    await settle();
+    expect(view.container.textContent).not.toContain('validating');
+    expect(button(view.container, 'Validate and show machines').disabled).toBe(false);
+    expect(view.container.querySelector('[role="alert"]')?.textContent)
+      .toBe('inline compute refused');
+    await view.unmount();
+  });
 });
diff --git a/packages/webapp/test/credentials-surfaces-v2.test.tsx b/packages/webapp/test/credentials-surfaces-v2.test.tsx
index 16cbfa51..ef117357 100644
--- a/packages/webapp/test/credentials-surfaces-v2.test.tsx
+++ b/packages/webapp/test/credentials-surfaces-v2.test.tsx
@@ -15,6 +15,7 @@ import {
 import { buildRows } from '../src/connections/WorkspaceProviderRows.js';
 import { WorkspaceRailStrip } from '../src/WorkspaceRailStrip.js';
 import { MembersPanel } from '../src/settings/MembersPanel.js';
+import { RequestsPanel } from '../src/settings/RequestsPanel.js';
 import { deferred, render, settle } from './dom.js';
 
 function client(overrides: Partial<ControlPlaneClient> = {}): ControlPlaneClient {
@@ -258,12 +259,80 @@ describe('v2 credential surfaces', () => {
       .find((button) => button.textContent === 'Adding…');
     expect(add?.disabled).toBe(true);
     expect(input.value).toBe('person@example.com');
+    expect(view.container.textContent).toContain('person@example.commember · creating invite');
+    expect(view.container.querySelector('[aria-label="Member invite link"]')).toBeNull();
     request.resolve(response);
     await settle();
 
     expect(createInvite).toHaveBeenCalledWith({ email: 'person@example.com', role: 'member' });
     expect(view.container.querySelector<HTMLInputElement>('[aria-label="Member invite link"]')?.value)
       .toBe(`${window.location.origin}/invite/one-time-code`);
+    expect(view.container.textContent).toContain('person@example.commember · invited');
+    expect(view.container.textContent).not.toContain('creating invite');
+    await view.unmount();
+  });
+
+  it('removes a rejected member invite placeholder and shows the refusal', async () => {
+    const request = deferred<Awaited<ReturnType<ControlPlaneClient['createInvite']>>>();
+    const view = await render(<MembersPanel
+      client={client({ createInvite: vi.fn(() => request.promise) })}
+      admin
+      orgName="Example"
+      onLeft={() => undefined}
+    />);
+    await settle();
+    const input = view.container.querySelector<HTMLInputElement>('input[type="email"]');
+    if (input === null) throw new Error('member invite input is missing');
+    await act(async () => {
+      Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')
+        ?.set?.call(input, 'rejected@example.com');
+      input.dispatchEvent(new Event('input', { bubbles: true }));
+      view.container.querySelector('form')?.dispatchEvent(
+        new Event('submit', { bubbles: true, cancelable: true }),
+      );
+    });
+    expect(view.container.textContent).toContain('rejected@example.commember · creating invite');
+
+    request.reject(new Error('member invite refused'));
+    await settle();
+    expect(view.container.textContent).not.toContain('creating invite');
+    expect(view.container.querySelector('[role="alert"]')?.textContent)
+      .toBe('member invite refused');
+    await view.unmount();
+  });
+
+  it('marks an org request denied immediately and restores pending on rejection', async () => {
+    const request: CredentialRequestView = {
+      id: 'org-request',
+      workspace_id: 'workspace-one',
+      connection_name: 'linear',
+      requested_scopes: [],
+      created_at: Date.now(),
+      requester: null,
+    };
+    const denial = deferred<void>();
+    const view = await render(<RequestsPanel
+      client={client({
+        listCredentialRequests: vi.fn(async (_signal, state) => ({
+          requests: state === 'pending' ? [request] : [],
+        })),
+        denyCredentialRequest: vi.fn(() => denial.promise),
+      })}
+      proposals={[]}
+      onOpenWorkspace={() => undefined}
+      onReviewProposal={() => undefined}
+    />);
+    await settle();
+    await act(async () => click(buttonIn(view.container, 'Dismiss')));
+    expect(view.container.querySelector('.settings-request-row .workspace-state-badge')?.textContent)
+      .toBe('denied');
+
+    denial.reject(new Error('org deny refused'));
+    await settle();
+    expect(view.container.querySelector('.settings-request-row .workspace-state-badge')?.textContent)
+      .toBe('pending');
+    expect(buttonIn(view.container, 'Dismiss').disabled).toBe(false);
+    expect(view.container.querySelector('[role="alert"]')?.textContent).toBe('org deny refused');
     await view.unmount();
   });
 
@@ -423,6 +492,33 @@ describe('v2 credential surfaces', () => {
     await view.unmount();
   });
 
+  it('hides a denied request immediately and restores it with the refusal', async () => {
+    const request: CredentialRequestView = {
+      id: 'request-rejected',
+      workspace_id: 'workspace-one',
+      connection_name: 'github',
+      requested_scopes: [],
+      created_at: Date.now(),
+      requester: null,
+    };
+    const denial = deferred<void>();
+    const view = await render(<WorkspaceConnectionsPanel
+      client={client()}
+      workspaceId="workspace-one"
+      pendingRequests={[request]}
+      onResolveRequest={() => denial.promise}
+    />);
+    await settle();
+    await act(async () => click(buttonIn(view.container, 'Dismiss')));
+    expect(view.container.textContent).not.toContain('@github');
+
+    denial.reject(new Error('deny refused'));
+    await settle();
+    expect(view.container.textContent).toContain('@github');
+    expect(view.container.querySelector('[role="alert"]')?.textContent).toBe('deny refused');
+    await view.unmount();
+  });
+
   it('still speaks when the request list fails to load', async () => {
     const view = await render(
       <WorkspaceConnectionsPanel
@@ -649,6 +745,56 @@ describe('workspace provider rows', () => {
     await view.unmount();
   });
 
+  it('shows an existing-grant connect immediately and restores it on mint rejection', async () => {
+    const mint = deferred<Awaited<ReturnType<ControlPlaneClient['mintWorkspaceConnection']>>>();
+    const wire = client({
+      mintWorkspaceConnection: vi.fn(() => mint.promise),
+      listConnectionCatalog: vi.fn(async () => ({ providers: [linear] })),
+      listConnectionGrants: vi.fn(async () => ({ grants: [accountGrant('linear')] })),
+    });
+    const view = await render(connectionsPanel(wire));
+    await settle();
+    await act(async () => click(pressTile(rowFor(view.container, 'Linear'))));
+    await act(async () => click(buttonIn(rowFor(view.container, 'Linear'), 'Connect')));
+    expect(stateWord(rowFor(view.container, 'Linear'))).toBe('Connecting');
+
+    mint.reject(new Error('mint refused'));
+    await settle();
+    expect(stateWord(rowFor(view.container, 'Linear'))).toBe('Connect');
+    expect(view.container.querySelector('[role="alert"]')?.textContent).toBe('mint refused');
+    await view.unmount();
+  });
+
+  it('shows paste-and-connect immediately and restores it on mint rejection', async () => {
+    const mint = deferred<Awaited<ReturnType<ControlPlaneClient['mintWorkspaceConnection']>>>();
+    const wire = client({
+      putConnectionGrant: vi.fn(async () => undefined),
+      mintWorkspaceConnection: vi.fn(() => mint.promise),
+      listConnectionCatalog: vi.fn(async () => ({ providers: [linear] })),
+    });
+    const view = await render(connectionsPanel(wire));
+    await settle();
+    await act(async () => click(pressTile(rowFor(view.container, 'Linear'))));
+    const token = rowFor(view.container, 'Linear').querySelector<HTMLInputElement>('input[name="token"]');
+    if (token === null) throw new Error('linear token field is missing');
+    await act(async () => {
+      Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')
+        ?.set?.call(token, 'lin-secret');
+      token.dispatchEvent(new Event('input', { bubbles: true }));
+      rowFor(view.container, 'Linear').querySelector('form')?.dispatchEvent(
+        new Event('submit', { bubbles: true, cancelable: true }),
+      );
+      await Promise.resolve();
+    });
+    expect(stateWord(rowFor(view.container, 'Linear'))).toBe('Connecting');
+
+    mint.reject(new Error('paste mint refused'));
+    await settle();
+    expect(stateWord(rowFor(view.container, 'Linear'))).toBe('Connect');
+    expect(view.container.querySelector('[role="alert"]')?.textContent).toBe('paste mint refused');
+    await view.unmount();
+  });
+
   it('offers a connected row Replace key and a Disconnect that acts at once', async () => {
     const disconnectWorkspaceConnection = vi.fn(async () => undefined);
     const deleteConnectionGrant = vi.fn(async () => undefined);
@@ -689,6 +835,80 @@ describe('workspace provider rows', () => {
     await view.unmount();
   });
 
+  it('disconnects a provider immediately and restores it on rejection', async () => {
+    const disconnect = deferred<void>();
+    const wire = client({
+      disconnectWorkspaceConnection: vi.fn(() => disconnect.promise),
+      listConnectionCatalog: vi.fn(async () => ({ providers: [linear] })),
+      listConnectionGrants: vi.fn(async () => ({ grants: [accountGrant('linear')] })),
+    });
+    const view = await render(connectionsPanel(wire, ['linear']));
+    await settle();
+    await act(async () => click(pressTile(rowFor(view.container, 'Linear'))));
+    await act(async () => click(buttonIn(rowFor(view.container, 'Linear'), 'Disconnect')));
+    expect(stateWord(rowFor(view.container, 'Linear'))).toBe('Connect');
+
+    disconnect.reject(new Error('disconnect refused'));
+    await settle();
+    expect(stateWord(rowFor(view.container, 'Linear'))).toBe('Connected');
+    expect(view.container.querySelector('[role="alert"]')?.textContent)
+      .toBe('disconnect refused');
+    await view.unmount();
+  });
+
+  it('restores an auto-approved request when approval fails after connecting', async () => {
+    const approval = deferred<void>();
+    const request: CredentialRequestView = {
+      id: 'request-linear',
+      workspace_id: 'workspace-one',
+      connection_name: 'linear',
+      requested_scopes: [],
+      created_at: Date.now(),
+      requester: null,
+    };
+    const wire = client({
+      mintWorkspaceConnection: vi.fn(async () => ({ lease: mintedLease('linear') })),
+      listConnectionCatalog: vi.fn(async () => ({ providers: [linear] })),
+      listConnectionGrants: vi.fn(async () => ({ grants: [accountGrant('linear')] })),
+    });
+    function Harness() {
+      const [requests, setRequests] = useState([request]);
+      return <WorkspaceConnectionsPanel
+        client={wire}
+        workspaceId="workspace-one"
+        pendingRequests={requests}
+        onResolveRequest={async (entry) => {
+          const index = requests.findIndex(({ id }) => id === entry.id);
+          setRequests((current) => current.filter(({ id }) => id !== entry.id));
+          try {
+            await approval.promise;
+          } catch (caught) {
+            setRequests((current) => {
+              const restored = [...current];
+              restored.splice(index, 0, entry);
+              return restored;
+            });
+            throw caught;
+          }
+        }}
+      />;
+    }
+    const view = await render(<Harness />);
+    await settle();
+    const linearRow = rowFor(view.container, 'Linear');
+    await act(async () => click(pressTile(linearRow)));
+    await act(async () => click(buttonIn(rowFor(view.container, 'Linear'), 'Connect')));
+    await settle();
+    expect(view.container.textContent).not.toContain('@linear');
+
+    approval.reject(new Error('approval refused'));
+    await settle();
+    expect(view.container.textContent).toContain('@linear');
+    expect(view.container.querySelector('[role="alert"]')?.textContent)
+      .toBe('approval refused');
+    await view.unmount();
+  });
+
   it('refetches grants every time a row opens', async () => {
     const listConnectionGrants = vi.fn(async () => ({ grants: [] }));
     const wire = client({
diff --git a/packages/webapp/test/grant-approval-dialog.test.tsx b/packages/webapp/test/grant-approval-dialog.test.tsx
index 697034c4..93b85535 100644
--- a/packages/webapp/test/grant-approval-dialog.test.tsx
+++ b/packages/webapp/test/grant-approval-dialog.test.tsx
@@ -1,5 +1,5 @@
 import type { GrantProposalView, OrgCredentialView } from '@blitzos/schema';
-import { act } from 'react';
+import { act, useState } from 'react';
 import { describe, expect, it, vi } from 'vitest';
 import type { ControlPlaneClient } from '../src/api.js';
 import {
@@ -13,7 +13,7 @@ import {
   initialEdits,
   isEdited,
 } from '../src/grant-approval-model.js';
-import { render, settle } from './dom.js';
+import { deferred, render, settle } from './dom.js';
 
 /** The mock's scenario (plans/mockups/grant-approval.html), on the wire. */
 function credential(name: string, comment: string, grants: OrgCredentialView['grants']): OrgCredentialView {
@@ -257,6 +257,45 @@ describe('GrantApprovalDialog', () => {
     await view.unmount();
   });
 
+  it.each([
+    ['Approve 4 changes', 'approval refused'],
+    ['Reject all', 'rejection refused'],
+  ])('hides %s immediately and reopens the proposal with its refusal', async (label, refusal) => {
+    const request = deferred<Awaited<ReturnType<ControlPlaneClient['resolveGrantProposal']>>>();
+    const wire = client({ resolveGrantProposal: vi.fn(() => request.promise) });
+    function Harness() {
+      const [open, setOpen] = useState(true);
+      const [error, setError] = useState<string | null>(null);
+      return open ? <GrantApprovalDialog
+        client={wire}
+        proposal={proposal}
+        viewer={{ membershipId: 'me', orgName: 'acme' }}
+        workspaces={workspaces}
+        initialError={error}
+        onClose={() => setOpen(false)}
+        onResolveStarted={() => {
+          setError(null);
+          setOpen(false);
+        }}
+        onResolveFailed={(_proposalId, message) => {
+          setError(message);
+          setOpen(true);
+        }}
+        onResolved={() => setOpen(false)}
+      /> : null;
+    }
+    const view = await render(<Harness />);
+    await settle();
+    await act(async () => button(view.container, label).click());
+    expect(view.container.querySelector('[role="dialog"]')).toBeNull();
+
+    request.reject(new Error(refusal));
+    await settle();
+    expect(view.container.querySelector('[role="dialog"]')).not.toBeNull();
+    expect(view.container.querySelector('[role="alert"]')?.textContent).toBe(refusal);
+    await view.unmount();
+  });
+
   it('closes without resolving: the proposal stays pending', async () => {
     const resolveGrantProposal = vi.fn();
     const onClose = vi.fn();
diff --git a/packages/webapp/test/org-credentials-panel.test.tsx b/packages/webapp/test/org-credentials-panel.test.tsx
index 0def201f..a67ec7e7 100644
--- a/packages/webapp/test/org-credentials-panel.test.tsx
+++ b/packages/webapp/test/org-credentials-panel.test.tsx
@@ -5,7 +5,7 @@ import type { ControlPlaneClient } from '../src/api.js';
 import type { TenantMe } from '../src/api-adapter.js';
 import { OrgCredentialsPanel } from '../src/settings/OrgCredentialsPanel.js';
 import { IMPORT_PREVIEW_DEBOUNCE_MS } from '../src/settings/OrgCredentialImport.js';
-import { render, settle } from './dom.js';
+import { deferred, render, settle } from './dom.js';
 import { workspaceViewFixture } from './workspace-fixtures.js';
 
 const viewer: TenantMe = {
@@ -162,6 +162,29 @@ describe('OrgCredentialsPanel', () => {
     await view.unmount();
   });
 
+  it('shows a pending credential row immediately and removes it on rejection', async () => {
+    const request = deferred<Awaited<ReturnType<ControlPlaneClient['putOrgCredential']>>>();
+    const view = await render(<OrgCredentialsPanel
+      client={client({ putOrgCredential: vi.fn(() => request.promise) })}
+      viewer={viewer}
+    />);
+    await settle();
+    const form = field<HTMLFormElement>(view.container, 'form[aria-label="Add a credential"]');
+    await act(async () => {
+      typeInto(field(form, '[aria-label="Credential name"]'), 'DATABASE_URL');
+      typeInto(field(form, '[aria-label="Credential value"]'), 'postgres://secret');
+      buttonNamed(form, 'Save credential').click();
+    });
+    expect(view.container.textContent).toContain('DATABASE_URLsaving');
+    expect(view.container.textContent).not.toContain('postgres://secret');
+
+    request.reject(new Error('credential refused'));
+    await settle();
+    expect(view.container.textContent).not.toContain('DATABASE_URLsaving');
+    expect(form.querySelector('[role="alert"]')?.textContent).toBe('credential refused');
+    await view.unmount();
+  });
+
   it('rotates with a write-only value field and touches neither comment nor grants', async () => {
     const putOrgCredential = vi.fn().mockResolvedValue({ credential: stripe });
     const view = await render(<OrgCredentialsPanel client={client({ putOrgCredential })} viewer={viewer} />);
@@ -185,6 +208,28 @@ describe('OrgCredentialsPanel', () => {
     await view.unmount();
   });
 
+  it('marks a rotation immediately and restores the canonical row on rejection', async () => {
+    const request = deferred<Awaited<ReturnType<ControlPlaneClient['putOrgCredential']>>>();
+    const view = await render(<OrgCredentialsPanel
+      client={client({ putOrgCredential: vi.fn(() => request.promise) })}
+      viewer={viewer}
+    />);
+    await settle();
+    await act(async () => field<HTMLButtonElement>(view.container, 'button[aria-label="Rotate STRIPE_API_KEY"]').click());
+    const form = field<HTMLFormElement>(view.container, 'form[aria-label="Rotate STRIPE_API_KEY"]');
+    await act(async () => {
+      typeInto(field(form, '[aria-label="Credential value"]'), 'new-secret');
+      buttonNamed(form, 'Rotate').click();
+    });
+    expect(view.container.textContent).toContain('STRIPE_API_KEYrotating');
+
+    request.reject(new Error('rotation refused'));
+    await settle();
+    expect(view.container.textContent).not.toContain('STRIPE_API_KEYrotating');
+    expect(form.querySelector('[role="alert"]')?.textContent).toBe('rotation refused');
+    await view.unmount();
+  });
+
   it('revokes after a confirmation', async () => {
     const revokeOrgCredential = vi.fn().mockResolvedValue(undefined);
     const view = await render(<OrgCredentialsPanel client={client({ revokeOrgCredential })} viewer={viewer} />);
@@ -197,6 +242,26 @@ describe('OrgCredentialsPanel', () => {
     await view.unmount();
   });
 
+  it('removes a credential immediately and restores its row on revoke rejection', async () => {
+    const request = deferred<void>();
+    const view = await render(<OrgCredentialsPanel
+      client={client({ revokeOrgCredential: vi.fn(() => request.promise) })}
+      viewer={viewer}
+    />);
+    await settle();
+    await act(async () => field<HTMLButtonElement>(view.container, 'button[aria-label="Revoke STRIPE_API_KEY"]').click());
+    await act(async () => buttonNamed(document.body, 'Revoke credential').click());
+    expect(view.container.textContent).not.toContain('STRIPE_API_KEY');
+
+    request.reject(new Error('revoke refused'));
+    await settle();
+    const names = [...view.container.querySelectorAll('.org-credential-row h3')]
+      .map((heading) => heading.textContent);
+    expect(names).toEqual(['STRIPE_API_KEY', 'SENTRY_DSN']);
+    expect(view.container.querySelector('[role="alert"]')?.textContent).toBe('revoke refused');
+    await view.unmount();
+  });
+
   it('edits a grant set and saves the whole audience', async () => {
     const replaceOrgCredentialGrants = vi.fn().mockResolvedValue({ credential: stripe });
     const view = await render(<OrgCredentialsPanel client={client({ replaceOrgCredentialGrants })} viewer={viewer} />);
@@ -218,6 +283,28 @@ describe('OrgCredentialsPanel', () => {
     await view.unmount();
   });
 
+  it('shows replacement grants immediately and restores them on rejection', async () => {
+    const request = deferred<Awaited<ReturnType<ControlPlaneClient['replaceOrgCredentialGrants']>>>();
+    const view = await render(<OrgCredentialsPanel
+      client={client({ replaceOrgCredentialGrants: vi.fn(() => request.promise) })}
+      viewer={viewer}
+    />);
+    await settle();
+    await act(async () => field<HTMLButtonElement>(view.container, 'button[aria-label="Edit grants for STRIPE_API_KEY"]').click());
+    const editor = field<HTMLElement>(view.container, '[aria-label="Grants for STRIPE_API_KEY"]');
+    await act(async () => buttonNamed(field(editor, '[aria-label="Access for payments"]'), 'write').click());
+    await act(async () => buttonNamed(editor, 'Save grants').click());
+    expect([...view.container.querySelectorAll('.org-credential-row .org-grant-chip')]
+      .map((chip) => chip.textContent)).toContain('workspace payments · write');
+
+    request.reject(new Error('grants refused'));
+    await settle();
+    expect([...view.container.querySelectorAll('.org-credential-row .org-grant-chip')]
+      .map((chip) => chip.textContent)).toContain('workspace payments · read');
+    expect(view.container.querySelector('[role="alert"]')?.textContent).toBe('grants refused');
+    await view.unmount();
+  });
+
   it('previews an env paste as a dry run, then imports the same text', async () => {
     const importOrgCredentials = vi.fn().mockResolvedValue({
       results: [
@@ -262,4 +349,40 @@ describe('OrgCredentialsPanel', () => {
     expect(listOrgCredentials).toHaveBeenCalledTimes(2);
     await view.unmount();
   });
+
+  it('uses preview rows while an import is pending and removes them on rejection', async () => {
+    const request = deferred<Awaited<ReturnType<ControlPlaneClient['importOrgCredentials']>>>();
+    const preview = {
+      results: [
+        { name: 'STRIPE_API_KEY', line: 1, outcome: 'rotated' as const },
+        { name: 'NEW_KEY', line: 2, outcome: 'stored' as const },
+      ],
+      linesRead: 2,
+    };
+    const importOrgCredentials = vi.fn((input: { text: string; dryRun?: boolean }) => (
+      input.dryRun === true ? Promise.resolve(preview) : request.promise
+    ));
+    const view = await render(<OrgCredentialsPanel
+      client={client({ importOrgCredentials })}
+      viewer={viewer}
+    />);
+    await settle();
+    await act(async () => typeInto(
+      field(view.container, '[aria-label="Env file text"]'),
+      'STRIPE_API_KEY=new\nNEW_KEY=value',
+    ));
+    await act(async () => {
+      await new Promise((resolve) => setTimeout(resolve, IMPORT_PREVIEW_DEBOUNCE_MS + 50));
+    });
+    await act(async () => buttonNamed(view.container, 'Import 2 keys').click());
+    expect(view.container.textContent).toContain('STRIPE_API_KEYimporting');
+    expect(view.container.textContent).toContain('NEW_KEYimporting');
+
+    request.reject(new Error('import refused'));
+    await settle();
+    expect(view.container.textContent).not.toContain('STRIPE_API_KEYimporting');
+    expect(view.container.textContent).not.toContain('NEW_KEYimporting');
+    expect(view.container.querySelector('[role="alert"]')?.textContent).toBe('import refused');
+    await view.unmount();
+  });
 });
diff --git a/packages/webapp/test/recipes.test.tsx b/packages/webapp/test/recipes.test.tsx
index ba1cc183..0cb3a074 100644
--- a/packages/webapp/test/recipes.test.tsx
+++ b/packages/webapp/test/recipes.test.tsx
@@ -13,7 +13,7 @@ import { RecipesHome } from '../src/files/RecipesHome.js';
 import { TemplatesHome } from '../src/files/TemplatesHome.js';
 import { SettingsPage } from '../src/SettingsPage.js';
 import { standaloneResolver } from '../src/resolver.js';
-import { render, settle } from './dom.js';
+import { deferred, render, settle } from './dom.js';
 import { workspaceViewFixture } from './workspace-fixtures.js';
 
 afterEach(() => vi.unstubAllGlobals());
@@ -576,6 +576,31 @@ describe('usage capture settings', () => {
       .not.toBeNull();
     await view.unmount();
   });
+
+  it('flips usage capture immediately and restores it with an error on rejection', async () => {
+    const request = deferred<Awaited<ReturnType<ControlPlaneClient['putUsageCapture']>>>();
+    const wire = client({
+      getUsageCapture: vi.fn(async () => ({ enabled: false, folderId: null })),
+      putUsageCapture: vi.fn(() => request.promise),
+    });
+    const view = await render(settingsPage(wire, 'admin'));
+    await settle();
+    const toggle = view.container.querySelector<HTMLInputElement>('input[role="switch"]');
+    if (toggle === null) throw new Error('usage switch is missing');
+
+    await act(async () => toggle.click());
+    expect(toggle.checked).toBe(true);
+    expect(toggle.disabled).toBe(true);
+    expect(view.container.textContent).toContain('Capture is on');
+
+    request.reject(new Error('capture refused'));
+    await settle();
+    expect(toggle.checked).toBe(false);
+    expect(toggle.disabled).toBe(false);
+    expect(view.container.textContent).toContain('Capture is off');
+    expect(view.container.querySelector('[role="alert"]')?.textContent).toBe('capture refused');
+    await view.unmount();
+  });
 });
 
 describe('recipe run flow', () => {
diff --git a/packages/webapp/test/seat-paywall.test.tsx b/packages/webapp/test/seat-paywall.test.tsx
index 8a838d64..c33ec4c2 100644
--- a/packages/webapp/test/seat-paywall.test.tsx
+++ b/packages/webapp/test/seat-paywall.test.tsx
@@ -146,10 +146,14 @@ describe('the seat paywall', () => {
       .find((button) => button.textContent === 'Creating…');
     expect(create?.disabled).toBe(true);
     expect(email.value).toBe(canonical.email);
+    expect(text(view.container)).toContain('nia@example.commember · creating');
+    expect(view.container.querySelector('[aria-label="Invite link"]')).toBeNull();
 
     request.resolve({ invite: canonical, code: 'one-time', ttlDays: 14 });
     await settle();
     expect(text(view.container)).toContain(canonical.email);
+    expect(text(view.container)).toContain('member · ready');
+    expect(text(view.container)).not.toContain('member · creating');
     expect(view.container.querySelector<HTMLInputElement>('[aria-label="Invite link"]')?.value)
       .toContain('one-time');
     expect(email.value).toBe('');
@@ -157,6 +161,31 @@ describe('the seat paywall', () => {
     await view.unmount();
   });
 
+  it('removes a rejected pending invite row and shows the refusal', async () => {
+    const request = deferred<Awaited<ReturnType<ControlPlaneClient['createInvite']>>>();
+    const view = await render(<InvitesPanel client={client({
+      createInvite: vi.fn(() => request.promise),
+    })} />);
+    await settle();
+    const email = view.container.querySelector<HTMLInputElement>('input[type="email"]');
+    if (email === null) throw new Error('invite email field is missing');
+    await act(async () => {
+      Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')
+        ?.set?.call(email, 'rejected@example.com');
+      email.dispatchEvent(new Event('input', { bubbles: true }));
+      view.container.querySelector('form')?.dispatchEvent(
+        new Event('submit', { bubbles: true, cancelable: true }),
+      );
+    });
+    expect(text(view.container)).toContain('rejected@example.commember · creating');
+
+    request.reject(new Error('invite refused'));
+    await settle();
+    expect(text(view.container)).not.toContain('rejected@example.commember · creating');
+    expect(view.container.querySelector('[role="alert"]')?.textContent).toBe('invite refused');
+    await view.unmount();
+  });
+
   it('removes a revoked invite immediately and restores it on refusal', async () => {
     const invite: InviteView = {
       id: 'invite-one',
diff --git a/packages/webapp/test/shell-smoke.test.tsx b/packages/webapp/test/shell-smoke.test.tsx
index 10ff339d..f42006f5 100644
--- a/packages/webapp/test/shell-smoke.test.tsx
+++ b/packages/webapp/test/shell-smoke.test.tsx
@@ -1430,6 +1430,66 @@ describe("webapp shell smoke", () => {
       .toEqual([{ id: 1, type: "terminal" }]);
   });
 
+  it("shows a workspace-document edit immediately and applies the returned document", async () => {
+    window.history.replaceState({}, "", "/workspaces/workspace-running");
+    saveTabs("workspace-running", [{ id: 1, type: "terminal" }], 1);
+    const save = deferred<Awaited<ReturnType<ControlPlaneClient["putWorkspaceWebAppState"]>>>();
+    const wire = {
+      ...runningClient(),
+      putWorkspaceWebAppState: vi.fn(() => save.promise),
+    };
+    const view = await render(
+      <CloudApp client={wire} resolver={standaloneResolver({ files: 7445 })} />,
+    );
+    await settle();
+    await settle();
+    const connections = view.container.querySelector<HTMLButtonElement>(
+      '[aria-label="Workspace panels"] button[aria-label="Connections"]',
+    );
+    await click(connections);
+    expect(view.container.querySelector('.webapp-workspace-session[data-region="side"]'))
+      .not.toBeNull();
+    await act(async () => new Promise((resolve) => setTimeout(resolve, 200)));
+    expect(wire.putWorkspaceWebAppState).toHaveBeenCalledTimes(1);
+
+    const canonical = serverWorkspaceStates.get("workspace-running");
+    if (canonical === undefined) throw new Error("workspace document was not seeded");
+    save.resolve({ doc: canonical, updatedAt: 2 });
+    await settle();
+    expect(view.container.querySelector('.webapp-workspace-session[data-region="side"]'))
+      .toBeNull();
+    await view.unmount();
+  });
+
+  it("restores the acknowledged workspace document with a visible save error", async () => {
+    window.history.replaceState({}, "", "/workspaces/workspace-running");
+    saveTabs("workspace-running", [{ id: 1, type: "terminal" }], 1);
+    const save = deferred<Awaited<ReturnType<ControlPlaneClient["putWorkspaceWebAppState"]>>>();
+    const wire = {
+      ...runningClient(),
+      putWorkspaceWebAppState: vi.fn(() => save.promise),
+    };
+    const view = await render(
+      <CloudApp client={wire} resolver={standaloneResolver({ files: 7445 })} />,
+    );
+    await settle();
+    await settle();
+    await click(view.container.querySelector<HTMLButtonElement>(
+      '[aria-label="Workspace panels"] button[aria-label="Connections"]',
+    ));
+    expect(view.container.querySelector('.webapp-workspace-session[data-region="side"]'))
+      .not.toBeNull();
+    await act(async () => new Promise((resolve) => setTimeout(resolve, 200)));
+
+    save.reject(new Error("workspace document refused"));
+    await settle();
+    expect(view.container.querySelector('.webapp-workspace-session[data-region="side"]'))
+      .toBeNull();
+    expect(view.container.querySelector(".webapp-notice[role=alert]")?.textContent)
+      .toContain("workspace document refused");
+    await view.unmount();
+  });
+
 
   it("tears down retained panes when switching workspaces", async () => {
     window.history.replaceState({}, "", "/workspaces/workspace-running");
@@ -1548,6 +1608,37 @@ describe("a workspace whose own machine is stopped", () => {
     expect(view.container.textContent).toContain("allocating ·");
     await view.unmount();
   });
+
+  it("shows the starting pane immediately and restores stopped with an error on rejection", async () => {
+    window.history.replaceState({}, "", "/workspaces/workspace-stopped");
+    const request = deferred<Awaited<ReturnType<ControlPlaneClient["startMachine"]>>>();
+    const wire = {
+      ...client(),
+      me: vi.fn(async () => tenantMe),
+      poll: vi.fn(async () => ({ workspaces: [stoppedMine] })),
+      startMachine: vi.fn(() => request.promise),
+    };
+    const view = await render(
+      <CloudApp client={wire} resolver={standaloneResolver({ files: 7445 })} />,
+    );
+    await settle();
+    await settle();
+    const start = view.container.querySelector<HTMLButtonElement>(
+      ".workspace-stopped-state button",
+    );
+    await click(start);
+    expect(view.container.querySelector(".workspace-stopped-state")).toBeNull();
+    expect(view.container.textContent).toContain("allocating · cx23@fsn1");
+
+    request.reject(new Error("start refused"));
+    await settle();
+    expect(view.container.textContent).toContain("is stopped");
+    expect(view.container.querySelector(".workspace-stopped-state button")?.textContent)
+      .toBe("Start machine");
+    expect(view.container.querySelector(".webapp-notice[role=alert]")?.textContent)
+      .toContain("start refused");
+    await view.unmount();
+  });
 });
 
 const workspaceCreateMachine = {
@@ -1751,3 +1842,158 @@ describe("optimistic workspace creation", () => {
     await view.unmount();
   });
 });
+
+describe("workspace rail rename", () => {
+  async function renameFromRail(
+    view: Rendered,
+    currentName: string,
+    nextName: string,
+  ): Promise<void> {
+    const tile = view.container.querySelector<HTMLButtonElement>(
+      `button[aria-label="${currentName}"]`,
+    );
+    await act(async () => tile?.dispatchEvent(new MouseEvent("contextmenu", {
+      bubbles: true,
+      cancelable: true,
+      clientX: 10,
+      clientY: 10,
+    })));
+    const rename = [...view.container.querySelectorAll<HTMLButtonElement>('[role="menuitem"]')]
+      .find((item) => item.textContent === "Rename");
+    await click(rename);
+    const field = view.container.querySelector<HTMLInputElement>('[aria-label="Workspace name"]');
+    if (field === null) throw new Error("workspace rename field is missing");
+    await typeInto(field, nextName);
+    await act(async () => field.dispatchEvent(new KeyboardEvent("keydown", {
+      key: "Enter",
+      bubbles: true,
+    })));
+  }
+
+  it("renames immediately and restores the title with an error on rejection", async () => {
+    window.history.replaceState({}, "", "/workspaces/workspace-running");
+    const request = deferred<Awaited<ReturnType<ControlPlaneClient["updateWorkspace"]>>>();
+    const wire = {
+      ...runningClient(),
+      updateWorkspace: vi.fn(() => request.promise),
+    };
+    const view = await render(
+      <CloudApp client={wire} resolver={standaloneResolver({ files: 7445 })} />,
+    );
+    await settle();
+    await settle();
+    await renameFromRail(view, "workspace-running-name", "renamed-now");
+    expect(view.container.querySelector('button[aria-label="renamed-now"]')).not.toBeNull();
+
+    request.reject(new Error("rename refused"));
+    await settle();
+    expect(view.container.querySelector('button[aria-label="workspace-running-name"]'))
+      .not.toBeNull();
+    expect(view.container.querySelector(".webapp-notice[role=alert]")?.textContent)
+      .toContain("rename refused");
+    await view.unmount();
+  });
+
+  it("replaces the optimistic title with the canonical workspace response", async () => {
+    window.history.replaceState({}, "", "/workspaces/workspace-running");
+    const request = deferred<Awaited<ReturnType<ControlPlaneClient["updateWorkspace"]>>>();
+    const wire = {
+      ...runningClient(),
+      updateWorkspace: vi.fn(() => request.promise),
+    };
+    const view = await render(
+      <CloudApp client={wire} resolver={standaloneResolver({ files: 7445 })} />,
+    );
+    await settle();
+    await settle();
+    await renameFromRail(view, "workspace-running-name", "requested-name");
+    expect(view.container.querySelector('button[aria-label="requested-name"]')).not.toBeNull();
+
+    request.resolve({ workspace: workspaceViewFixture({
+      ...running,
+      id: "workspace-running",
+      name: "canonical-name",
+    }) });
+    await settle();
+    expect(view.container.querySelector('button[aria-label="canonical-name"]')).not.toBeNull();
+    expect(view.container.querySelector('button[aria-label="requested-name"]')).toBeNull();
+    await view.unmount();
+  });
+});
+
+describe("global workspace preferences", () => {
+  const acknowledged = {
+    version: 1 as const,
+    activeWorkspaceId: "workspace-running",
+    order: ["workspace-running", "workspace-two"],
+  };
+
+  function workspaceTileNames(container: ParentNode): Array<string | null> {
+    return [...container.querySelectorAll<HTMLButtonElement>(
+      '.shell-strip__tree > .shell-wtile',
+    )].map((tile) => tile.getAttribute('aria-label'));
+  }
+
+  it("selects immediately and applies the returned active workspace and rail order", async () => {
+    window.history.replaceState({}, "", "/workspaces/workspace-running");
+    const save = deferred<Awaited<ReturnType<ControlPlaneClient["putGlobalWebAppState"]>>>();
+    const wire = {
+      ...runningClient(),
+      poll: vi.fn(async () => ({ workspaces: [running, runningTwo] })),
+      getGlobalWebAppState: vi.fn(async () => ({ doc: acknowledged, updatedAt: 1 })),
+      putGlobalWebAppState: vi.fn(() => save.promise),
+    };
+    const view = await render(
+      <CloudApp client={wire} resolver={standaloneResolver({ files: 7445 })} />,
+    );
+    await settle();
+    await settle();
+    await click(view.container.querySelector('button[aria-label="workspace-two-name"]'));
+    expect(window.location.pathname).toBe('/workspaces/workspace-two');
+    expect(view.container.querySelector('button[aria-label="workspace-two-name"]')
+      ?.getAttribute('aria-current')).toBe('page');
+    await act(async () => new Promise((resolve) => setTimeout(resolve, 200)));
+    save.resolve({
+      doc: {
+        version: 1,
+        activeWorkspaceId: 'workspace-running',
+        order: ['workspace-two', 'workspace-running'],
+      },
+      updatedAt: 2,
+    });
+    await settle();
+
+    expect(window.location.pathname).toBe('/workspaces/workspace-running');
+    expect(workspaceTileNames(view.container))
+      .toEqual(['workspace-two-name', 'workspace-running-name']);
+    await view.unmount();
+  });
+
+  it("restores acknowledged active-workspace and order with a visible error", async () => {
+    window.history.replaceState({}, "", "/workspaces/workspace-running");
+    const save = deferred<Awaited<ReturnType<ControlPlaneClient["putGlobalWebAppState"]>>>();
+    const wire = {
+      ...runningClient(),
+      poll: vi.fn(async () => ({ workspaces: [running, runningTwo] })),
+      getGlobalWebAppState: vi.fn(async () => ({ doc: acknowledged, updatedAt: 1 })),
+      putGlobalWebAppState: vi.fn(() => save.promise),
+    };
+    const view = await render(
+      <CloudApp client={wire} resolver={standaloneResolver({ files: 7445 })} />,
+    );
+    await settle();
+    await settle();
+    await click(view.container.querySelector('button[aria-label="workspace-two-name"]'));
+    expect(window.location.pathname).toBe('/workspaces/workspace-two');
+    await act(async () => new Promise((resolve) => setTimeout(resolve, 200)));
+
+    save.reject(new Error('global preferences refused'));
+    await settle();
+    expect(window.location.pathname).toBe('/workspaces/workspace-running');
+    expect(workspaceTileNames(view.container))
+      .toEqual(['workspace-running-name', 'workspace-two-name']);
+    expect(view.container.querySelector('.webapp-notice[role=alert]')?.textContent)
+      .toContain('global preferences refused');
+    await view.unmount();
+  });
+});