Phase 3a — PREVIEW ONLY. This console reads and previews; it does not provision. No credential is minted, no live state is changed.