Replace the confidential teaser with a real setup view, live lane card, bounded cancellable polling, and a recheck action that returns the refreshed providers payload. The off lane now reports off instead of verifying, verified requires current owner-safe provenance, and last-known verified provenance is exposed separately so it is never rendered as current verification. Move the confidential trust beats and state/action copy into shared constants, update the init route to confidential-setup, and refresh the API baseline from the providers route. The client treats early_access as terminal and keeps the lane off instead of rendering it as an error or provisioning success; blocked attestation states expose check again and continue to fail closed without inference content. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>