diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 33a2777..d8e0641 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -125,9 +125,11 @@ jobs:
       - name: breaker acceptance vs CorPay
         run: bash evals/skills/breaker/accept.sh samples/corpay
 
-  # The U2 exit gate (console RFC D3): the REAL console driven against a REAL Goldpath
-  # app — capability discovery, the confirm gate, a run reaching terminal, and the repair
-  # queue replayed. Behaviour only; no screenshot diffing.
+  # The console exit gate (console RFC D3): the REAL console driven against a REAL
+  # Goldpath app — capability discovery, the confirm gate, a run reaching terminal, the
+  # repair queue replayed (U2), and the bulk intake journey end to end: upload → the
+  # engine's own validation report → refused approval → rejection with evidence →
+  # approval of a clean file (U3). Behaviour only; no screenshot diffing.
   console-smoke:
     runs-on: ubuntu-latest
     timeout-minutes: 25
diff --git a/CLAUDE.md b/CLAUDE.md
index f04a7f0..326769b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -22,11 +22,12 @@ not propose anything that contradicts them; changes only via a superseding ADR).
 - "latest" dependencies are forbidden; everything is pinned. Air-gapped networks are a first-class scenario.
 - Code style: `.editorconfig` + analyzers + `dotnet format`; XML summaries mandatory on public APIs.
 
-## Status (2026-07-24)
-Phases 0–1 and the hardening set (H1–H8) are complete; the `0.1.0-preview.2` train is on
-nuget.org (plus `specdrift` 0.4.1 as tool/MCP/Docker/Action). Phase D shipped the CorPay
+## Status (2026-07-27)
+Phases 0–1 and the hardening set (H1–H8) are complete; the `0.1.0-preview.3` train is on
+nuget.org (plus `specdrift` 0.4.2 as tool/MCP/Docker/Action). Phase D shipped the CorPay
 reference app (`samples/corpay`, proven nightly against the published packages). The UI
-phase is active (`docs/rfc/goldpath-console.md`, U1 in flight). Live status ledgers —
+phase is active (`docs/rfc/goldpath-console.md`: U1–U2 met, U3 in flight — the bulk
+intake panel is proven in the nightly console smoke). Live status ledgers —
 keep them updated in the same PR that changes reality: `docs/strategy/ai-sdlc-status.md`
 (AI-assisted SDLC vs reality) and `docs/strategy/coverage-matrix.md` (capability × sample).
 Roadmap gates: `docs/strategy/foundation.md` §12.
diff --git a/docs/rfc/README.md b/docs/rfc/README.md
index ee01791..c4b9029 100644
--- a/docs/rfc/README.md
+++ b/docs/rfc/README.md
@@ -38,6 +38,6 @@ All "implemented" modules are published on nuget.org at `0.1.0-preview.2`.
 | [goldpath-versioning](goldpath-versioning.md) | SemVer & support promise (H7) | accepted (binding) |
 | [goldpath-event-contracts](goldpath-event-contracts.md) | event contracts idiom (per-app `<Name>.Contracts`) | accepted (2026-07-14) |
 | [goldpath-skills-v1](goldpath-skills-v1.md) | the AI skill layer v1 | implemented — ships inside the template; field status: `../strategy/ai-sdlc-status.md` §2 |
-| [goldpath-console](goldpath-console.md) | Goldpath.Console (the UI phase) | accepted — U1 in flight |
+| [goldpath-console](goldpath-console.md) | Goldpath.Console (the UI phase) | accepted — U1–U2 met, U3 in flight |
 | [goldpath-ai](goldpath-ai.md) | Goldpath.Ai — opt-in runtime AI (gateway · tool registry · decision record · confidence gate) | **ACCEPTED** (2026-07-26, D1–D4 as recommended) — implementation opens after the UI phase |
 | [spec-engine-v1](spec-engine-v1.md) | specdrift (separate repo) | implemented — 0.4.2 published (NuGet tool + MCP + Docker + Action) |
diff --git a/docs/rfc/goldpath-console.md b/docs/rfc/goldpath-console.md
index f51f013..1a0f449 100644
--- a/docs/rfc/goldpath-console.md
+++ b/docs/rfc/goldpath-console.md
@@ -73,7 +73,7 @@ custom-develop ON, with the same kit, the same way they add features to the back
 |---|---|---|
 | U1 | `ui/kit`: tokens + primitives + composites | component tests green; kit gallery page |
 | U2 | Run console over the registry (single-app path) | **MET** (2026-07-26): `scripts/console-smoke.sh` drives the real console against a real Goldpath app (Postgres + Quartz + the frozen surface) — capability discovery, confirm gate, run reaching terminal, repair queue replayed; runs nightly |
-| U3 | Module panels (bulk/campaign/notification/archival), capability-lit | each panel drives its module's real verbs in smoke |
+| U3 | Module panels (bulk/campaign/notification/archival), capability-lit | each panel drives its module's real verbs in smoke — **bulk MET** (2026-07-27): the smoke host composes bulk, and Playwright uploads a real file, reads the report the engine wrote, is refused by the engine when invalid rows block approval, rejects with the mandatory reason, then approves a clean file; campaign/notification/archival remain open |
 | U4 | Cross-service registry + triage home + auth story + `MapGoldpathConsole()` + GmConsole in nightly | the full D3 bar; CorPay screenshots into the README |
 
 ## 6. Non-goals
diff --git a/docs/strategy/ai-sdlc-status.md b/docs/strategy/ai-sdlc-status.md
index 4b81b5a..3233672 100644
--- a/docs/strategy/ai-sdlc-status.md
+++ b/docs/strategy/ai-sdlc-status.md
@@ -30,7 +30,7 @@ document exists to prevent.
 | Skill quality (evals) | eval set per skill; a skill that fails evals is not released (§6.2) | **PARTIAL** — as of 2026-07-24 the 4 acceptance runners are portable (published specdrift tool, no local-checkout assumption; failures print their output) and the deterministic half runs nightly (`evals-acceptance`: runner syntax + breaker vs CorPay). The LLM half — running the skills themselves per fixture — stays deferred until an agent-in-CI story exists (P2) | nightly `evals-acceptance` job | agent-in-CI story (P2) unlocks full skill-run evals |
 | Model proficiency matrix | skill × model → pass-rate matrix (§6.2) | **NOT BUILT** — Phase 2 (needs the eval lane first) | — | after the eval lane |
 | Release / DevOps | release train + delivery telemetry (§6.5) | Train **SHIPPED-PROVEN** (OIDC trusted publishing, license gate, roll script); delivery report **NOT BUILT** — Phase 2 | release workflow + license gate | — |
-| Operations | admin APIs + ops packs + console (§7.1) | Admin APIs + dashboards + runbooks **SHIPPED-PROVEN** per module; console **PARTIAL** (U1 in progress, RFC accepted) | admin contract frozen + integration proofs | console phases U1–U4 |
+| Operations | admin APIs + ops packs + console (§7.1) | Admin APIs + dashboards + runbooks **SHIPPED-PROVEN** per module; console **PARTIAL** (U1–U2 met; U3's bulk intake panel proven in the nightly console smoke, three module panels open) | admin contract frozen + integration proofs | console phases U1–U4 |
 | Pipeline (chained skills + human gates) | §6.1 level 3 | **NOT BUILT** — Phase 2 by written deferral (§12) | — | — |
 | Domain memory | project knowledge that grows with every run (§6.3) | **NOT BUILT** — `domain-memory-v1.md` is a v0.1 draft | — | Phase 2/3 |
 
diff --git a/tests/Goldpath.Jobs.TestHost/Program.cs b/tests/Goldpath.Jobs.TestHost/Program.cs
index 65cf5b4..98c5f8c 100644
--- a/tests/Goldpath.Jobs.TestHost/Program.cs
+++ b/tests/Goldpath.Jobs.TestHost/Program.cs
@@ -84,12 +84,26 @@ static async Task RunConsoleHostAsync(string connectionString, string url)
     var consoleOrigin = Environment.GetEnvironmentVariable("GOLDPATH_CONSOLE_ORIGIN") ?? "http://localhost:5201";
     web.Services.AddCors(cors => cors.AddDefaultPolicy(policy => policy
         .WithOrigins(consoleOrigin).AllowAnyHeader().AllowAnyMethod().AllowCredentials()));
+    // Bulk is composed too, so the console's capability probe LIGHTS the intake panel and
+    // the U3 gate can drive the real four-eyes verbs (upload → validate → approve/reject).
+    web.Services.AddScoped<IGoldpathBulkRowHandler<ClusterPaymentRow>, SmokePaymentHandler>();
+    web.AddGoldpathBulk<WebApplicationBuilder, ClusterDb>(bulk =>
+    {
+        bulk.ChunkSize = 5;
+        bulk.AddBatch<ClusterPaymentRow>("payments", b => b
+            .MaxRows(10_000)
+            .RowKey(r => r.EndToEndId));
+    });
+
     web.AddGoldpathJobs<WebApplicationBuilder, ClusterDb>(jobs =>
     {
         jobs.SchedulerName = "console-smoke";
         jobs.ConnectionName = "jobsdb";
         jobs.CheckinInterval = TimeSpan.FromSeconds(1);
         jobs.AddJob<SmokeJob>();
+        // Validation runs on a tight cron so the smoke can WAIT for a real report instead
+        // of forging one; execution stays far-future — the gate decides when rows move.
+        jobs.AddGoldpathBulkJobs<ClusterDb>(validateCron: "0/5 * * * * ?", executeCron: "0 0 0 1 1 ? 2099");
     });
 
     var app = web.Build();
@@ -104,6 +118,7 @@ static async Task RunConsoleHostAsync(string connectionString, string url)
     app.Urls.Add(url);
     app.UseCors();
     app.MapGoldpathJobsAdmin<ClusterDb>(exposeUnsecured: true);
+    app.MapGoldpathBulkAdmin<ClusterDb>(exposeUnsecured: true);
     await app.StartAsync();
     Console.WriteLine("CONSOLEHOST-READY");
     await app.WaitForShutdownAsync();
@@ -205,6 +220,21 @@ public async Task ExecuteChunkAsync(GoldpathJobChunk chunk, GoldpathJobContext c
         }
     }
 
+    /// <summary>The console smoke's row handler: records the payment, no artificial delay.</summary>
+    public sealed class SmokePaymentHandler(ClusterDb db) : IGoldpathBulkRowHandler<ClusterPaymentRow>
+    {
+        public async Task ExecuteAsync(ClusterPaymentRow row, GoldpathBulkRowContext context, CancellationToken cancellationToken)
+        {
+            db.PaymentSink.Add(new PaymentSinkEntry
+            {
+                EndToEndId = row.EndToEndId,
+                RowNumber = context.RowNumber,
+                Instance = Environment.ProcessId.ToString(),
+            });
+            await db.SaveChangesAsync(cancellationToken);
+        }
+    }
+
     /// <summary>Chaining proof: must run exactly once, AFTER the slow job completes.</summary>
     public sealed class ChainedProofJob : IGoldpathJob
     {
diff --git a/ui/console/e2e/console.spec.ts b/ui/console/e2e/console.spec.ts
index cadc8b5..5f36f29 100644
--- a/ui/console/e2e/console.spec.ts
+++ b/ui/console/e2e/console.spec.ts
@@ -11,9 +11,10 @@ test.describe("the run console against a real Goldpath app", () => {
     await page.goto(`/?base=${encodeURIComponent(service)}`);
 
     await expect(page.getByRole("button", { name: "Runs" })).toBeVisible();
-    // This host composes jobs ONLY — the other four surfaces answer 404, so no panels.
-    await expect(page.getByRole("button", { name: "Bulk intake" })).toHaveCount(0);
+    // This host composes jobs + bulk; the other three surfaces answer 404, so no panels.
+    await expect(page.getByRole("button", { name: "Bulk intake" })).toBeVisible();
     await expect(page.getByRole("button", { name: "Campaigns" })).toHaveCount(0);
+    await expect(page.getByRole("button", { name: "Archival" })).toHaveCount(0);
   });
 
   test("triggers a job, watches the run finish, and replays its repair item", async ({ page }) => {
@@ -22,20 +23,23 @@ test.describe("the run console against a real Goldpath app", () => {
     // The fleet appears because the executor exists (zero-config discovery).
     await expect(page.getByRole("button", { name: /console-smoke/ })).toBeVisible();
 
-    // Trigger through the confirm gate — the console never fires a verb on one click.
-    await page.getByRole("button", { name: "trigger" }).click();
+    // Scope the verb to ITS job row: this fleet also carries the bulk validate/execute
+    // jobs, so an unscoped "trigger" would be three buttons and one ambiguous click.
+    const smokeJob = page.locator("li", { hasText: "SmokeJob" });
+    await smokeJob.getByRole("button", { name: "trigger" }).click();
     const dialog = page.getByRole("alertdialog");
     await expect(dialog).toContainText("audited");
     await dialog.getByRole("button", { name: "trigger" }).click();
     await expect(page.getByRole("status")).toBeVisible();
 
     // The run appears and reaches a terminal state — polled through the real API.
+    const smokeRun = page.getByRole("row", { name: /SmokeJob/ }).first();
     await expect(async () => {
       await page.goto(`/?base=${encodeURIComponent(service)}`);
-      await expect(page.getByText("Completed").first()).toBeVisible({ timeout: 5_000 });
+      await expect(smokeRun).toContainText("Completed", { timeout: 5_000 });
     }).toPass({ timeout: 60_000 });
 
-    await page.locator("table button").first().click();
+    await smokeRun.getByRole("button").first().click();
     const detail = page.getByTestId("run-detail");
     await expect(detail).toBeVisible();
     await expect(detail).toContainText("Completed:");            // chunk counts by status
@@ -49,4 +53,81 @@ test.describe("the run console against a real Goldpath app", () => {
     await replayDialog.getByRole("button", { name: "replay-items" }).click();
     await expect(page.getByRole("status")).toBeVisible();
   });
+
+  test("uploads a batch, reads the real validation report, and works the four-eyes gate", async ({ page }) => {
+    const openBulk = async () => {
+      await page.goto(`/?base=${encodeURIComponent(service)}`);
+      await page.getByRole("button", { name: "Bulk intake" }).click();
+      await expect(page.getByTestId("bulk-panel")).toBeVisible();
+    };
+
+    const upload = async (name: string, csv: string) => {
+      await page.getByLabel("batch file").setInputFiles({ name, mimeType: "text/csv", buffer: Buffer.from(csv) });
+      await page.getByRole("button", { name: "upload" }).click();
+      const dialog = page.getByRole("alertdialog", { name: "confirm upload" });
+      await expect(dialog).toContainText(`Upload ${name} into payments?`);
+      await dialog.getByRole("button", { name: "upload" }).click();
+      await expect(page.getByText(/Received — batch .* is queued for validation/)).toBeVisible();
+    };
+
+    // The newest batch is the first row (the contract orders by receipt, newest first).
+    const newest = page.getByRole("row", { name: /payments/ }).first();
+    const waitForState = async (state: string) =>
+      expect(async () => {
+        await openBulk();
+        // Read the state from the batch ROW: the filter's <option> list carries every
+        // state name too, so an unscoped text match would pass before anything happened.
+        await expect(newest).toContainText(state, { timeout: 5_000 });
+      }).toPass({ timeout: 60_000 });
+
+    // ── act 1: a file with a structurally broken line
+    await openBulk();
+    await upload("payments.csv", "EndToEndId,Amount\nE2E-1,10.00\nE2E-2,20.00\nE2E-3,30.00,stray\n");
+    await waitForState("Validated");
+
+    await newest.getByRole("button").first().click();
+    const detail = page.getByTestId("batch-detail");
+    // The report the ENGINE wrote — the broken line, named by its own message.
+    await expect(detail).toContainText("expected 2 fields");
+
+    // The gate refuses to fire without evidence.
+    await page.getByRole("button", { name: "reject" }).click();
+    const rejectDialog = page.getByRole("alertdialog", { name: "confirm reject" });
+    await expect(rejectDialog.getByRole("button", { name: "reject" })).toBeDisabled();
+    await rejectDialog.getByRole("button", { name: "cancel" }).click();
+
+    // And the ENGINE refuses this approval: invalid rows block it. The console shows the
+    // refusal verbatim — that message is how the operator learns what to do next.
+    await page.getByRole("button", { name: "approve" }).click();
+    const blocked = page.getByRole("alertdialog", { name: "confirm approve" });
+    await expect(blocked).toContainText("audited");
+    await blocked.getByRole("button", { name: "approve" }).click();
+    await expect(page.getByText(/1 invalid rows block approval/)).toBeVisible();
+
+    // ── act 2: the operator rejects it, with the reason the contract demands
+    await page.getByRole("button", { name: "reject" }).click();
+    const rejecting = page.getByRole("alertdialog", { name: "confirm reject" });
+    await rejecting.getByLabel("reason (required)").fill("line 3 is malformed — resend the export");
+    await rejecting.getByRole("button", { name: "reject" }).click();
+    await waitForState("Rejected");
+
+    await newest.getByRole("button").first().click();
+    await expect(detail).toContainText("line 3 is malformed — resend the export");
+
+    // ── act 3: the fixed file passes the gate, and the decision becomes a server fact
+    await openBulk();
+    await upload("payments-fixed.csv", "EndToEndId,Amount\nE2E-4,10.00\nE2E-5,20.00\n");
+    await waitForState("Validated");
+
+    await newest.getByRole("button").first().click();
+    await page.getByRole("button", { name: "approve" }).click();
+    const approving = page.getByRole("alertdialog", { name: "confirm approve" });
+    await approving.getByLabel("note (optional)").fill("checked against the ledger");
+    await approving.getByRole("button", { name: "approve" }).click();
+    await expect(page.getByText("approved", { exact: true })).toBeVisible();
+
+    await waitForState("Approved");
+    await newest.getByRole("button").first().click();
+    await expect(detail).toContainText("checked against the ledger");
+  });
 });
diff --git a/ui/console/src/BulkPanel.test.tsx b/ui/console/src/BulkPanel.test.tsx
new file mode 100644
index 0000000..8773478
--- /dev/null
+++ b/ui/console/src/BulkPanel.test.tsx
@@ -0,0 +1,262 @@
+import { render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { AdminClient, type BulkBatchInfo, type BulkDefinitionStatus, type BulkRowError } from "./adminClient";
+import { BulkPanel } from "./BulkPanel";
+
+const batch = (over: Partial<BulkBatchInfo> = {}): BulkBatchInfo => ({
+  id: "3f7a0c9e-0000-4000-8000-000000000001",
+  definition: "payments",
+  state: "Validated",
+  tenant: "acme",
+  totalRows: 120,
+  validRows: 118,
+  invalidRows: 2,
+  executedRows: 0,
+  failedRows: 0,
+  runId: null,
+  receivedAt: "2026-07-27T09:00:00Z",
+  validatedAt: "2026-07-27T09:01:00Z",
+  ...over,
+});
+
+const definition = (over: Partial<BulkDefinitionStatus> = {}): BulkDefinitionStatus => ({
+  name: "payments",
+  batchesByState: { Validated: 1, Completed: 4 },
+  awaitingApproval: 1,
+  oldestAwaitingApprovalSeconds: 7200,
+  ...over,
+});
+
+const finding = (row: number): BulkRowError => ({
+  id: row,
+  batchId: batch().id,
+  rowNumber: row,
+  field: "Amount",
+  message: "amount must be greater than zero",
+});
+
+interface Routes {
+  definitions?: unknown;
+  batches?: unknown;
+  batch?: unknown;
+  errors?: (afterRow: number) => BulkRowError[];
+  verb?: { status: number; body: unknown };
+  upload?: { status: number; body: unknown };
+}
+
+function client(routes: Routes = {}) {
+  const posted: { url: string; body: BodyInit | null | undefined }[] = [];
+  const fetched: string[] = [];
+  const fetcher = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = String(input);
+    const json = (body: unknown, status = 200) =>
+      new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+
+    if (init?.method === "POST") {
+      posted.push({ url, body: init.body });
+      if (/\/bulk\/batches\/[^/?]+\?/.test(url)) {
+        const uploaded = routes.upload ?? { status: 200, body: batch({ id: "new-batch", state: "Received" }) };
+        return json(uploaded.body, uploaded.status);
+      }
+
+      const verb = routes.verb ?? { status: 200, body: { ok: true, message: "approved" } };
+      return json(verb.body, verb.status);
+    }
+
+    fetched.push(url);
+    if (url.includes("/errors?")) {
+      const afterRow = Number(new URL(url, "http://x").searchParams.get("afterRow") ?? 0);
+      return json(routes.errors ? routes.errors(afterRow) : [finding(4), finding(9)]);
+    }
+
+    if (url.includes("/bulk/batches?")) return json(routes.batches ?? [batch()]);
+    if (url.includes("/bulk/batches/")) return json(routes.batch ?? batch());
+    if (url.endsWith("/bulk/definitions")) return json(routes.definitions ?? [definition()]);
+    return new Response("not found", { status: 404 });
+  }) as typeof fetch;
+
+  return { client: new AdminClient({ fetcher }), posted, fetched };
+}
+
+const openBatch = async (id = batch().id) => userEvent.click(await screen.findByRole("button", { name: id }));
+
+describe("the bulk intake panel (upload → report → four-eyes gate)", () => {
+  it("leads with what is waiting at the gate, and how long it has waited", async () => {
+    const { client: api } = client();
+    render(<BulkPanel client={api} />);
+
+    const banner = await screen.findByRole("status");
+    expect(banner).toHaveTextContent("payments: 1 awaiting approval (oldest 2h)");
+  });
+
+  it("says nothing about the gate when nothing waits there", async () => {
+    const { client: api } = client({
+      definitions: [definition({ awaitingApproval: 0, oldestAwaitingApprovalSeconds: null })],
+    });
+    render(<BulkPanel client={api} />);
+
+    await screen.findByRole("heading", { name: "Definitions" });
+    expect(screen.queryByRole("status")).toBeNull();
+  });
+
+  it("filters batches by STATE only — the contract has no definition filter to send", async () => {
+    const { client: api, fetched } = client();
+    render(<BulkPanel client={api} />);
+
+    await userEvent.selectOptions(await screen.findByLabelText("State"), "Validated");
+
+    await waitFor(() => expect(fetched.some((url) => url.includes("state=Validated"))).toBe(true));
+    expect(fetched.every((url) => !url.includes("definition="))).toBe(true);
+  });
+
+  it("opens a batch and shows the row ledger the server reported", async () => {
+    const { client: api } = client();
+    render(<BulkPanel client={api} />);
+
+    await openBatch();
+
+    const detail = await screen.findByTestId("batch-detail");
+    expect(detail).toHaveTextContent("120");
+    expect(detail).toHaveTextContent("118");
+    // Two findings, same teaching message — the report lists both rows, not one.
+    expect(within(detail).getAllByText("amount must be greater than zero")).toHaveLength(2);
+  });
+
+  it("walks the validation report by keyset — afterRow is the last row number seen", async () => {
+    const pages: Record<number, BulkRowError[]> = {
+      0: Array.from({ length: 100 }, (_, index) => finding(index + 1)),
+      100: [finding(101)],
+    };
+    const { client: api, fetched } = client({ errors: (afterRow) => pages[afterRow] ?? [] });
+    render(<BulkPanel client={api} />);
+
+    await openBatch();
+    await userEvent.click(await screen.findByRole("button", { name: /more/i }));
+
+    await waitFor(() => expect(fetched.some((url) => url.includes("afterRow=100"))).toBe(true));
+  });
+
+  it("the gate appears only on a validated batch", async () => {
+    const { client: api } = client({ batch: batch({ state: "Completed", invalidRows: 0 }), batches: [batch({ state: "Completed" })] });
+    render(<BulkPanel client={api} />);
+
+    await openBatch();
+    await screen.findByTestId("batch-detail");
+
+    expect(screen.queryByRole("button", { name: "approve" })).toBeNull();
+    expect(screen.queryByRole("button", { name: "reject" })).toBeNull();
+  });
+
+  it("approving posts the frozen route through the confirm gate", async () => {
+    const { client: api, posted } = client();
+    render(<BulkPanel client={api} />);
+
+    await openBatch();
+    await userEvent.click(await screen.findByRole("button", { name: "approve" }));
+    const dialog = screen.getByRole("alertdialog", { name: "confirm approve" });
+    await userEvent.click(within(dialog).getByRole("button", { name: "approve" }));
+
+    await waitFor(() => expect(posted).toHaveLength(1));
+    expect(posted[0].url).toContain(`/goldpath/admin/bulk/batches/${batch().id}/approve`);
+  });
+
+  it("rejecting refuses to fire without the evidence note the contract demands", async () => {
+    const { client: api, posted } = client();
+    render(<BulkPanel client={api} />);
+
+    await openBatch();
+    await userEvent.click(await screen.findByRole("button", { name: "reject" }));
+
+    const dialog = screen.getByRole("alertdialog", { name: "confirm reject" });
+    const confirm = within(dialog).getByRole("button", { name: "reject" });
+    expect(confirm).toBeDisabled();
+
+    await userEvent.type(within(dialog).getByLabelText("reason (required)"), "duplicate file");
+    await userEvent.click(confirm);
+
+    await waitFor(() => expect(posted).toHaveLength(1));
+    expect(posted[0].url).toContain(`/goldpath/admin/bulk/batches/${batch().id}/reject`);
+    expect(JSON.parse(String(posted[0].body))).toEqual({ note: "duplicate file" });
+  });
+
+  it("a refusal from the engine surfaces verbatim — the console never paraphrases", async () => {
+    const { client: api } = client({
+      verb: { status: 400, body: { ok: false, message: "the batch is not awaiting approval" } },
+    });
+    render(<BulkPanel client={api} />);
+
+    await openBatch();
+    await userEvent.click(await screen.findByRole("button", { name: "approve" }));
+    const dialog = screen.getByRole("alertdialog", { name: "confirm approve" });
+    await userEvent.click(within(dialog).getByRole("button", { name: "approve" }));
+
+    expect(await screen.findByText("the batch is not awaiting approval")).toBeInTheDocument();
+  });
+
+  it("uploads the file as a RAW body to the definition's route", async () => {
+    const { client: api, posted } = client();
+    render(<BulkPanel client={api} />);
+
+    await userEvent.upload(
+      await screen.findByLabelText("batch file"),
+      new File(["id,amount\n1,10"], "payments.csv", { type: "text/csv" }),
+    );
+    await userEvent.click(screen.getByRole("button", { name: "upload" }));
+    const dialog = screen.getByRole("alertdialog", { name: "confirm upload" });
+    expect(dialog).toHaveTextContent("Upload payments.csv into payments?");
+    await userEvent.click(within(dialog).getByRole("button", { name: "upload" }));
+
+    await waitFor(() => expect(posted).toHaveLength(1));
+    expect(posted[0].url).toContain("/goldpath/admin/bulk/batches/payments?fileName=payments.csv");
+    expect(posted[0].body).toBeInstanceOf(File);
+  });
+
+  it("a failed upload never reads as success", async () => {
+    const { client: api } = client({ upload: { status: 500, body: {} } });
+    render(<BulkPanel client={api} />);
+
+    await userEvent.upload(
+      await screen.findByLabelText("batch file"),
+      new File(["broken"], "payments.csv", { type: "text/csv" }),
+    );
+    await userEvent.click(screen.getByRole("button", { name: "upload" }));
+    await userEvent.click(within(screen.getByRole("alertdialog")).getByRole("button", { name: "upload" }));
+
+    expect(await screen.findByText(/did not reach the server/)).toBeInTheDocument();
+  });
+
+  it("a definition list that will not load says so instead of showing an empty panel", async () => {
+    const fetcher = (async () => new Response("", { status: 503 })) as typeof fetch;
+    render(<BulkPanel client={new AdminClient({ fetcher })} />);
+
+    expect(await screen.findByRole("alert")).toHaveTextContent(/bulk definitions could not be loaded/i);
+  });
+
+  it("the gate's outcome OUTLIVES the gate — approving unmounts the buttons, not the message", async () => {
+    // The server's truth changes under the panel: the batch leaves the gated state, so
+    // the approve/reject controls disappear on the refresh that follows the verb.
+    let state = "Validated";
+    const fetcher = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      const json = (body: unknown) => new Response(JSON.stringify(body), { status: 200, headers: { "content-type": "application/json" } });
+      if (init?.method === "POST") {
+        state = "Approved";
+        return json({ ok: true, message: "approved" });
+      }
+
+      if (url.includes("/errors?")) return json([]);
+      if (url.includes("/bulk/batches?")) return json([batch({ state })]);
+      if (url.includes("/bulk/batches/")) return json(batch({ state }));
+      return json([definition()]);
+    }) as typeof fetch;
+
+    render(<BulkPanel client={new AdminClient({ fetcher })} />);
+
+    await openBatch();
+    await userEvent.click(await screen.findByRole("button", { name: "approve" }));
+    await userEvent.click(within(screen.getByRole("alertdialog")).getByRole("button", { name: "approve" }));
+
+    await waitFor(() => expect(screen.queryByRole("button", { name: "approve" })).toBeNull());
+    expect(screen.getByText("approved")).toBeInTheDocument();
+  });
+});
diff --git a/ui/console/src/BulkPanel.tsx b/ui/console/src/BulkPanel.tsx
new file mode 100644
index 0000000..c959551
--- /dev/null
+++ b/ui/console/src/BulkPanel.tsx
@@ -0,0 +1,364 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import { Banner, KeysetTable, StateBadge, VerbButton } from "@goldpath/kit";
+import type { VerbOutcome } from "@goldpath/kit";
+import type { AdminClient, BulkBatchInfo, BulkDefinitionStatus, BulkRowError } from "./adminClient";
+
+export interface BulkPanelProps {
+  client: AdminClient;
+}
+
+/** The verb envelope, adapted to the kit's outcome type — refusals stay data. */
+async function asOutcome(call: Promise<{ ok: boolean; message: string }>): Promise<VerbOutcome> {
+  const result = await call;
+  return result.ok ? { kind: "ok", message: result.message } : { kind: "refused", message: result.message };
+}
+
+/** The states the intake surface can filter by — the engine's own enum, in its order. */
+const STATES = [
+  "Received",
+  "Validating",
+  "Validated",
+  "Approved",
+  "Rejected",
+  "Executing",
+  "Completed",
+  "CompletedWithFailures",
+] as const;
+
+/** The gate only opens on a validated batch; everywhere else the decision is already made. */
+const GATED = "Validated";
+
+function ageWords(seconds: number): string {
+  if (seconds < 90) return `${Math.round(seconds)}s`;
+  if (seconds < 5400) return `${Math.round(seconds / 60)}m`;
+  return `${Math.round(seconds / 3600)}h`;
+}
+
+/**
+ * The bulk intake panel (console RFC §3): upload → validation report → the four-eyes gate.
+ * The run half of a batch lives in the RUN console (a batch executes as a run) — this
+ * screen owns only what the intake surface owns, and links the two by run id.
+ */
+export function BulkPanel({ client }: BulkPanelProps) {
+  const [definitions, setDefinitions] = useState<BulkDefinitionStatus[] | null>(null);
+  const [state, setState] = useState<string>("");
+  const [selectedId, setSelectedId] = useState<string | null>(null);
+  const [selected, setSelected] = useState<BulkBatchInfo | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  // The gate's outcome lives HERE, not in the buttons: approving moves the batch out of
+  // the gated state, so the gate — and any message inside it — unmounts on the refresh.
+  const [decision, setDecision] = useState<VerbOutcome | null>(null);
+  const [refreshToken, setRefreshToken] = useState(0);
+  const fileInput = useRef<HTMLInputElement>(null);
+  const [uploadInto, setUploadInto] = useState<string>("");
+  const [file, setFile] = useState<File | null>(null);
+
+  const refresh = () => setRefreshToken((token) => token + 1);
+
+  /** A gate decision: keep the message, then re-read the batch it changed. */
+  const settle = (outcome: VerbOutcome) => {
+    setDecision(outcome);
+    refresh();
+  };
+
+  useEffect(() => {
+    let live = true;
+    client
+      .bulkDefinitions()
+      .then((found) => {
+        if (!live) return;
+        setDefinitions(found);
+        setUploadInto((current) => current || found[0]?.name || "");
+      })
+      .catch(() => live && setError("the bulk definitions could not be loaded"));
+    return () => {
+      live = false;
+    };
+  }, [client, refreshToken]);
+
+  const loadBatches = useCallback(
+    async (_cursor: string | null, take: number) => {
+      // The batch list is take-bounded, not cursor-paged (frozen contract): one page,
+      // honestly ended — the table stops instead of faking a cursor it was never given.
+      const batches = await client.bulkBatches({ state: state || undefined, take });
+      return { items: batches, nextCursor: null };
+    },
+    [client, state, refreshToken],
+  );
+
+  // The validation report IS keyset-paged: the cursor is the last row number of the page.
+  const loadErrors = useCallback(
+    async (cursor: string | null, take: number) => {
+      if (!selectedId) return { items: [] as BulkRowError[], nextCursor: null };
+      const errors = await client.bulkErrors(selectedId, { afterRow: cursor ? Number(cursor) : 0, take });
+      const last = errors.at(-1);
+      // A short page is the end; a full page hands back the last row number as the cursor.
+      return { items: errors, nextCursor: errors.length < take || !last ? null : String(last.rowNumber) };
+    },
+    [client, selectedId, refreshToken],
+  );
+
+  // The open batch RE-FETCHES on refresh rather than closing: a gate outcome renders
+  // inside this panel, so tearing it down would hide the message just produced.
+  useEffect(() => {
+    setDecision(null);   // a decision belongs to the batch it was made on
+  }, [selectedId]);
+
+  useEffect(() => {
+    if (!selectedId) {
+      setSelected(null);
+      return;
+    }
+
+    let live = true;
+    client
+      .batch(selectedId)
+      .then((batch) => live && setSelected(batch))
+      .catch(() => live && setError(`batch ${selectedId} could not be opened`));
+    return () => {
+      live = false;
+    };
+  }, [client, selectedId, refreshToken]);
+
+  // Upload is the one intake verb that is NOT the admin envelope (it answers the batch it
+  // created), so the outcome is built here — honestly: a failed post must not read "ok".
+  const upload = async (): Promise<VerbOutcome> => {
+    if (!file || !uploadInto) return { kind: "error", status: 0 };
+    try {
+      const batch = await client.uploadBatch(uploadInto, file);
+      // The chosen file is deliberately NOT cleared here: the upload button renders only
+      // while a file is selected, so clearing it would unmount the very button whose
+      // banner carries the outcome (the U2 gate's teardown lesson, found again here).
+      setSelectedId(batch.id);
+      refresh();
+      return { kind: "ok", message: `${batch.state} — batch ${batch.id} is queued for validation` };
+    } catch {
+      return { kind: "error", status: 0 };
+    }
+  };
+
+  if (definitions === null && !error) {
+    return <p className="text-sm text-muted-foreground">Loading bulk definitions…</p>;
+  }
+
+  const waiting = (definitions ?? []).filter((definition) => definition.awaitingApproval > 0);
+
+  return (
+    <div data-testid="bulk-panel" className="space-y-6">
+      {error && <Banner tone="danger">{error}</Banner>}
+
+      {waiting.length > 0 && (
+        <Banner tone="warning" live="status">
+          {waiting
+            .map((definition) => {
+              const age = definition.oldestAwaitingApprovalSeconds;
+              return `${definition.name}: ${definition.awaitingApproval} awaiting approval${age ? ` (oldest ${ageWords(age)})` : ""}`;
+            })
+            .join(" · ")}
+        </Banner>
+      )}
+
+      <section>
+        <h2 className="mb-2 text-sm font-medium text-muted-foreground">Definitions</h2>
+        <ul className="space-y-2">
+          {(definitions ?? []).map((definition) => (
+            <li key={definition.name} className="flex flex-wrap items-center gap-2 rounded-md border border-border/60 px-3 py-2">
+              <span className="text-sm font-medium">{definition.name}</span>
+              {Object.entries(definition.batchesByState).map(([batchState, count]) => (
+                <span key={batchState} className="text-xs text-faint">
+                  {batchState}: {count}
+                </span>
+              ))}
+              {Object.keys(definition.batchesByState ?? {}).length === 0 && (
+                <span className="text-xs text-faint">no batches yet</span>
+              )}
+            </li>
+          ))}
+        </ul>
+      </section>
+
+      <section>
+        <h2 className="mb-2 text-sm font-medium text-muted-foreground">Upload</h2>
+        <div className="flex flex-wrap items-center gap-2">
+          <label className="text-xs text-muted-foreground" htmlFor="bulk-definition">
+            Definition
+          </label>
+          <select
+            id="bulk-definition"
+            className="rounded-md border border-border bg-background px-2 py-1 text-sm"
+            value={uploadInto}
+            onChange={(event) => setUploadInto(event.target.value)}
+          >
+            {(definitions ?? []).map((definition) => (
+              <option key={definition.name} value={definition.name}>
+                {definition.name}
+              </option>
+            ))}
+          </select>
+          <input
+            ref={fileInput}
+            type="file"
+            aria-label="batch file"
+            // The native control is kept (it is the accessible one); only its button half
+            // is dressed in the kit's language so it does not read as a foreign widget.
+            className="max-w-xs text-sm text-muted-foreground file:mr-3 file:rounded-md file:border file:border-border file:bg-background file:px-3 file:py-1.5 file:text-sm file:font-medium file:text-foreground hover:file:bg-accent"
+            onChange={(event) => setFile(event.target.files?.[0] ?? null)}
+          />
+          {file && (
+            <VerbButton
+              label="upload"
+              confirm={`Upload ${file.name} into ${uploadInto}?`}
+              execute={upload}
+            />
+          )}
+        </div>
+        <p className="mt-1 text-xs text-faint">
+          The file is posted as a raw body, exactly as <code>curl --data-binary</code> would — the console adds no
+          format the API does not already accept.
+        </p>
+      </section>
+
+      <section>
+        <h2 className="mb-2 text-sm font-medium text-muted-foreground">Batches</h2>
+        <div className="mb-2 flex flex-wrap items-center gap-2">
+          <label className="text-xs text-muted-foreground" htmlFor="bulk-state">
+            State
+          </label>
+          <select
+            id="bulk-state"
+            className="rounded-md border border-border bg-background px-2 py-1 text-sm"
+            value={state}
+            onChange={(event) => {
+              setState(event.target.value);
+              setSelectedId(null);
+            }}
+          >
+            <option value="">all states</option>
+            {STATES.map((option) => (
+              <option key={option} value={option}>
+                {option}
+              </option>
+            ))}
+          </select>
+        </div>
+
+        <KeysetTable<BulkBatchInfo>
+          key={`${state}-${refreshToken}`}
+          columns={[
+            {
+              header: "Batch",
+              cell: (batch) => (
+                <button className="font-mono text-xs underline-offset-2 hover:underline" onClick={() => setSelectedId(batch.id)}>
+                  {batch.id}
+                </button>
+              ),
+            },
+            { header: "Definition", cell: (batch) => batch.definition },
+            { header: "State", cell: (batch) => <StateBadge state={batch.state} /> },
+            { header: "Rows", align: "right", cell: (batch) => `${batch.validRows}/${batch.totalRows}` },
+            { header: "Invalid", align: "right", cell: (batch) => batch.invalidRows },
+          ]}
+          loadPage={loadBatches}
+          rowKey={(batch) => batch.id}
+          emptyMessage="No batches in this state."
+        />
+      </section>
+
+      {selected && (
+        <section data-testid="batch-detail" className="rounded-lg border border-border p-4">
+          <div className="mb-3 flex flex-wrap items-center gap-3">
+            <h2 className="text-sm font-medium">
+              Batch {selected.id} · {selected.definition}
+            </h2>
+            <StateBadge state={selected.state} />
+            {selected.tenant && <span className="text-xs text-faint">tenant {selected.tenant}</span>}
+            {selected.runId && <span className="text-xs text-faint">run {selected.runId}</span>}
+            {selected.state === GATED && (
+              <span className="ml-auto flex flex-wrap gap-2">
+                <VerbButton
+                  label="approve"
+                  confirm={`Approve ${selected.validRows} valid rows of this batch for execution?`}
+                  note={{ label: "note (optional)" }}
+                  execute={(note) => asOutcome(client.approveBatch(selected.id, note || undefined))}
+                  onDone={settle}
+                  quiet
+                />
+                <VerbButton
+                  label="reject"
+                  confirm="Reject this batch? Nothing will execute."
+                  // The contract makes the note MANDATORY here — it is the gate's evidence.
+                  note={{ label: "reason (required)", required: true }}
+                  execute={(note) => asOutcome(client.rejectBatch(selected.id, note ?? ""))}
+                  onDone={settle}
+                  quiet
+                  destructive
+                />
+              </span>
+            )}
+          </div>
+
+          {decision && decision.kind !== "error" && (
+            // The engine's own words, verbatim — a refusal here teaches the fix
+            // ("invalid rows block approval…"), so it must never be paraphrased.
+            <Banner tone={decision.kind === "ok" ? "success" : "danger"} live={decision.kind === "ok" ? "status" : "alert"}>
+              {decision.message}
+            </Banner>
+          )}
+
+          {decision?.kind === "error" && (
+            <Banner tone="warning">the decision did not reach the server — it may not have been recorded</Banner>
+          )}
+
+          <dl className="mt-3 grid grid-cols-2 gap-x-6 gap-y-1 text-xs sm:grid-cols-4">
+            <div>
+              <dt className="text-faint">Total rows</dt>
+              <dd>{selected.totalRows}</dd>
+            </div>
+            <div>
+              <dt className="text-faint">Valid</dt>
+              <dd>{selected.validRows}</dd>
+            </div>
+            <div>
+              <dt className="text-faint">Invalid</dt>
+              <dd className={selected.invalidRows > 0 ? "text-danger" : undefined}>{selected.invalidRows}</dd>
+            </div>
+            <div>
+              <dt className="text-faint">Executed / failed</dt>
+              <dd>
+                {selected.executedRows} / <span className={selected.failedRows > 0 ? "text-danger" : undefined}>{selected.failedRows}</span>
+              </dd>
+            </div>
+          </dl>
+
+          {selected.decidedAt && (
+            // The decision evidence, as the server recorded it — the actor comes from the
+            // token, never from this screen.
+            <p className="mt-3 text-xs text-muted-foreground">
+              {selected.state === "Rejected" ? "Rejected" : "Approved"} by {selected.decidedBy ?? "unknown"} at{" "}
+              {selected.decidedAt}
+              {selected.decisionNote ? ` — “${selected.decisionNote}”` : ""}
+            </p>
+          )}
+
+          <h3 className="mb-1 mt-4 text-xs text-muted-foreground">
+            Validation report{selected.invalidRows === 0 ? " — no findings" : ""}
+          </h3>
+          {selected.invalidRows > 0 && (
+            <KeysetTable<BulkRowError>
+              key={`${selected.id}-${refreshToken}`}
+              columns={[
+                { header: "Row", align: "right", cell: (row) => (row.rowNumber === 0 ? "file" : row.rowNumber) },
+                { header: "Field", cell: (row) => row.field },
+                { header: "Finding", cell: (row) => row.message },
+              ]}
+              loadPage={loadErrors}
+              rowKey={(row) => String(row.id)}
+              take={100}
+              emptyMessage="No findings recorded for this batch."
+            />
+          )}
+        </section>
+      )}
+    </div>
+  );
+}
diff --git a/ui/console/src/Console.test.tsx b/ui/console/src/Console.test.tsx
index 7f83bb1..2af9187 100644
--- a/ui/console/src/Console.test.tsx
+++ b/ui/console/src/Console.test.tsx
@@ -40,13 +40,19 @@ describe("the console shell (capability discovery decides what EXISTS)", () => {
     expect(await screen.findByText(/No Goldpath admin surface answered here/)).toBeInTheDocument();
   });
 
-  it("a composed-but-unbuilt panel is honest about U3 instead of faking a screen", async () => {
+  it("a composed-but-unbuilt panel is honest instead of faking a screen", async () => {
     render(<Console fetcher={service({ "/campaign/": 200 })} />);
 
-    expect(await screen.findByText(/its panel ships in U3/)).toBeInTheDocument();
+    expect(await screen.findByText(/its panel is not built yet/)).toBeInTheDocument();
     expect(screen.getByRole("button", { name: "Campaigns" })).toHaveAttribute("aria-current", "page");
   });
 
+  it("lands on the bulk panel when bulk is the only composed module", async () => {
+    render(<Console fetcher={service({ "/bulk/definitions": 200 })} />);
+
+    expect(await screen.findByTestId("bulk-panel")).toBeInTheDocument();
+  });
+
   it("lands on the run console when jobs is present", async () => {
     render(<Console fetcher={service({ "/jobs/fleets": 200 })} />);
 
diff --git a/ui/console/src/Console.tsx b/ui/console/src/Console.tsx
index 49f23e3..cfb89d3 100644
--- a/ui/console/src/Console.tsx
+++ b/ui/console/src/Console.tsx
@@ -3,6 +3,7 @@ import { AppShell, Banner } from "@goldpath/kit";
 import type { ShellNavItem } from "@goldpath/kit";
 import { AdminClient, MODULES, type ModuleName } from "./adminClient";
 import { RunConsole } from "./RunConsole";
+import { BulkPanel } from "./BulkPanel";
 
 export interface ConsoleProps {
   /** Service root; omit for same-origin (the console is served BY the app it drives). */
@@ -25,8 +26,8 @@ const SECTION_LABEL: Record<ModuleName, string> = {
 /**
  * The console shell: capability discovery decides what EXISTS, the shell renders only
  * that (console RFC §2). A module the app never composed is an absent section — never a
- * dead link, never a manifest upload. Panels beyond the run console land in U3; until
- * then a present-but-unbuilt capability says so honestly instead of pretending.
+ * dead link, never a manifest upload. A capability whose panel is not built yet says so
+ * honestly instead of pretending (the remaining U3 panels land slice by slice).
  */
 export function Console({ baseUrl, title = "Goldpath console", fetcher, now }: ConsoleProps) {
   const client = useMemo(() => new AdminClient({ baseUrl, fetcher }), [baseUrl, fetcher]);
@@ -81,9 +82,11 @@ export function Console({ baseUrl, title = "Goldpath console", fetcher, now }: C
         <RunConsole client={client} now={now} />
       )}
 
-      {capabilities?.[section] === "present" && section !== "jobs" && (
+      {capabilities?.[section] === "present" && section === "bulk" && <BulkPanel client={client} />}
+
+      {capabilities?.[section] === "present" && section !== "jobs" && section !== "bulk" && (
         <p className="text-sm text-muted-foreground">
-          {SECTION_LABEL[section]} is composed into this app; its panel ships in U3. Until then drive it
+          {SECTION_LABEL[section]} is composed into this app; its panel is not built yet. Until then drive it
           through the admin API — the console adds no capability the API does not already expose.
         </p>
       )}
diff --git a/ui/console/src/adminClient.ts b/ui/console/src/adminClient.ts
index 50919d3..69a805c 100644
--- a/ui/console/src/adminClient.ts
+++ b/ui/console/src/adminClient.ts
@@ -74,6 +74,43 @@ export interface RunDetail {
   }[];
 }
 
+/** Intake numbers per definition — the panel's headline row. */
+export interface BulkDefinitionStatus {
+  name: string;
+  batchesByState: Record<string, number>;
+  awaitingApproval: number;
+  oldestAwaitingApprovalSeconds?: number | null;
+}
+
+/** One batch over the wire: the state machine's public face. */
+export interface BulkBatchInfo {
+  id: string;
+  definition: string;
+  state: string;
+  tenant?: string | null;
+  totalRows: number;
+  validRows: number;
+  invalidRows: number;
+  executedRows: number;
+  failedRows: number;
+  runId?: string | null;
+  receivedAt: string;
+  validatedAt?: string | null;
+  decidedAt?: string | null;
+  decidedBy?: string | null;
+  decisionNote?: string | null;
+  completedAt?: string | null;
+}
+
+/** One validation finding — teaching text, value-free by contract. */
+export interface BulkRowError {
+  id: number;
+  batchId: string;
+  rowNumber: number;
+  field: string;
+  message: string;
+}
+
 export interface AdminResult {
   ok: boolean;
   message: string;
@@ -194,4 +231,63 @@ export class AdminClient {
   replayItems(runId: string): Promise<AdminResult> {
     return this.verb(`/goldpath/admin/jobs/runs/${encodeURIComponent(runId)}/replay-items`);
   }
+
+  bulkDefinitions(): Promise<BulkDefinitionStatus[]> {
+    return this.get<BulkDefinitionStatus[]>("/goldpath/admin/bulk/definitions");
+  }
+
+  /**
+   * The batch list. The frozen surface filters by STATE (and tenant) only — there is no
+   * `definition` parameter, and the panel does NOT fake one client-side: narrowing the
+   * take-bounded page the server returned would read as "no batches" while plenty exist.
+   * The per-definition counts come from `/definitions`; issue #72 tracks adding the
+   * server-side filter.
+   */
+  bulkBatches(options: { state?: string; take?: number } = {}): Promise<BulkBatchInfo[]> {
+    const query = new URLSearchParams();
+    if (options.state) query.set("state", options.state);
+    query.set("take", String(Math.min(500, Math.max(1, options.take ?? 50))));
+    return this.get<BulkBatchInfo[]>(`/goldpath/admin/bulk/batches?${query.toString()}`);
+  }
+
+  /** The VALIDATION report — keyset-paged by row number (the contract's own cursor). */
+  bulkErrors(batchId: string, options: { afterRow?: number; take?: number } = {}): Promise<BulkRowError[]> {
+    const query = new URLSearchParams();
+    query.set("afterRow", String(options.afterRow ?? 0));
+    query.set("take", String(Math.min(500, Math.max(1, options.take ?? 100))));
+    return this.get<BulkRowError[]>(
+      `/goldpath/admin/bulk/batches/${encodeURIComponent(batchId)}/errors?${query.toString()}`,
+    );
+  }
+
+  approveBatch(batchId: string, note?: string): Promise<AdminResult> {
+    return this.verb(`/goldpath/admin/bulk/batches/${encodeURIComponent(batchId)}/approve`, { note: note ?? null });
+  }
+
+  rejectBatch(batchId: string, note: string): Promise<AdminResult> {
+    // The contract makes the note MANDATORY on reject — the refusal must teach later readers.
+    return this.verb(`/goldpath/admin/bulk/batches/${encodeURIComponent(batchId)}/reject`, { note });
+  }
+
+  /**
+   * Intake upload. The contract takes a RAW body on purpose (`curl --data-binary @file.csv`)
+   * — no multipart, no antiforgery coupling — so the console posts the file bytes as-is.
+   */
+  async uploadBatch(definition: string, file: File, tenant?: string): Promise<BulkBatchInfo> {
+    const query = new URLSearchParams({ fileName: file.name });
+    if (tenant) query.set("tenant", tenant);
+    const route = `/goldpath/admin/bulk/batches/${encodeURIComponent(definition)}?${query.toString()}`;
+    const response = await this.fetcher(`${this.baseUrl}${route}`, {
+      method: "POST",
+      credentials: "include",
+      headers: { accept: "application/json", "content-type": "application/octet-stream" },
+      body: file,
+    });
+    if (!response.ok) throw new AdminHttpError(response.status, route);
+    return (await response.json()) as BulkBatchInfo;
+  }
+
+  batch(batchId: string): Promise<BulkBatchInfo> {
+    return this.get<BulkBatchInfo>(`/goldpath/admin/bulk/batches/${encodeURIComponent(batchId)}`);
+  }
 }
diff --git a/ui/kit/src/components/VerbButton.test.tsx b/ui/kit/src/components/VerbButton.test.tsx
index ceec6b3..50d6a92 100644
--- a/ui/kit/src/components/VerbButton.test.tsx
+++ b/ui/kit/src/components/VerbButton.test.tsx
@@ -1,4 +1,4 @@
-import { render, screen } from "@testing-library/react";
+import { render, screen, waitFor, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import type { VerbOutcome } from "../adminResult";
 import { VerbButton } from "./VerbButton";
@@ -73,4 +73,68 @@ describe("the verb button (ui-standard-v1 §3/§4 — confirm-before-verb, verba
     expect(await screen.findByRole("status")).toHaveTextContent("now it worked");
     expect(screen.queryByRole("alert")).toBeNull();   // the old refusal strip is gone
   });
+
+  it("an evidence note is handed to the verb and cleared afterwards", async () => {
+    const seen: (string | undefined)[] = [];
+    render(
+      <VerbButton
+        label="reject"
+        confirm="Reject this batch?"
+        note={{ label: "reason (required)", required: true }}
+        execute={(note) => {
+          seen.push(note);
+          return Promise.resolve({ kind: "ok", message: "rejected" } as VerbOutcome);
+        }}
+      />,
+    );
+
+    await userEvent.click(screen.getByRole("button", { name: "reject" }));
+    const dialog = screen.getByRole("alertdialog");
+    // A required note is the gate: the verb cannot fire until the reason exists.
+    expect(within(dialog).getByRole("button", { name: "reject" })).toBeDisabled();
+
+    await userEvent.type(within(dialog).getByLabelText("reason (required)"), "  duplicate file  ");
+    await userEvent.click(within(dialog).getByRole("button", { name: "reject" }));
+
+    expect(await screen.findByText("rejected")).toBeInTheDocument();
+    expect(seen).toEqual(["duplicate file"]);   // trimmed — surrounding space is not evidence
+
+    // The next confirm starts empty: a stale reason must never ride along on another verb.
+    await userEvent.click(screen.getByRole("button", { name: "reject" }));
+    expect(within(screen.getByRole("alertdialog")).getByLabelText("reason (required)")).toHaveValue("");
+  });
+
+  it("an optional note lets the verb fire without one", async () => {
+    const seen: (string | undefined)[] = [];
+    render(
+      <VerbButton
+        label="approve"
+        confirm="Approve?"
+        note={{ label: "note (optional)" }}
+        execute={(note) => {
+          seen.push(note);
+          return Promise.resolve({ kind: "ok", message: "approved" } as VerbOutcome);
+        }}
+      />,
+    );
+
+    await userEvent.click(screen.getByRole("button", { name: "approve" }));
+    await userEvent.click(within(screen.getByRole("alertdialog")).getByRole("button", { name: "approve" }));
+
+    expect(await screen.findByText("approved")).toBeInTheDocument();
+    expect(seen).toEqual([""]);
+  });
+
+  it("a quiet verb stays silent — its composite owns the outcome", async () => {
+    const seen: VerbOutcome[] = [];
+    render(<VerbButton label="approve" confirm="Approve?" quiet execute={() => Promise.resolve(ok("approved"))} onDone={(o) => seen.push(o)} />);
+
+    await userEvent.click(screen.getByRole("button", { name: "approve" }));
+    await userEvent.click(within(screen.getByRole("alertdialog")).getByRole("button", { name: "approve" }));
+
+    // The outcome still REACHES the composite; only the button's own strip is suppressed,
+    // because a gate button unmounts the moment its verb changes the state.
+    await waitFor(() => expect(seen).toEqual([ok("approved")]));
+    expect(screen.queryByText("approved")).toBeNull();
+  });
 });
diff --git a/ui/kit/src/components/VerbButton.tsx b/ui/kit/src/components/VerbButton.tsx
index 52bba88..44909d1 100644
--- a/ui/kit/src/components/VerbButton.tsx
+++ b/ui/kit/src/components/VerbButton.tsx
@@ -7,12 +7,25 @@ export interface VerbButtonProps {
   label: string;
   /** The confirm question. Confirm-before-verb is NOT optional (ui-standard §3). */
   confirm: string;
-  /** Executes the verb — usually `() => executeVerb(url, init)`. */
-  execute: () => Promise<VerbOutcome>;
+  /** Executes the verb; receives the evidence note when the verb collects one. */
+  execute: (note?: string) => Promise<VerbOutcome>;
+  /**
+   * Turns the confirm step into an EVIDENCE step: the operator must type why before the
+   * verb runs (four-eyes gates, holds, erasures — the note is the audit trail's reason,
+   * and the server stores it). Omit for verbs that carry no reason.
+   */
+  note?: { label: string; required?: boolean };
   /** Fired after every settled outcome (refresh tables, close panels...). */
   onDone?: (outcome: VerbOutcome) => void;
   /** Marks destructive verbs (reject, erase, pause-all) — the tone, not the flow. */
   destructive?: boolean;
+  /**
+   * Suppresses the button's OWN outcome strip, for verbs whose control legitimately
+   * disappears once the verb lands (a four-eyes gate vanishes the moment the batch
+   * leaves the gated state). The composite must then render the outcome itself from
+   * `onDone` — otherwise the operator's confirmation dies with the button.
+   */
+  quiet?: boolean;
 }
 
 type Phase =
@@ -27,29 +40,42 @@ type Phase =
  * TEACH — the UI never paraphrases them), and the audit hint reminds the operator the
  * server records every verb (the actor comes from the token, never the UI).
  */
-export function VerbButton({ label, confirm, execute, onDone, destructive = false }: VerbButtonProps) {
+export function VerbButton({ label, confirm, execute, onDone, destructive = false, note, quiet = false }: VerbButtonProps) {
   const [phase, setPhase] = useState<Phase>({ at: "rest" });
+  const [reason, setReason] = useState("");
+  const missingReason = note?.required === true && reason.trim().length === 0;
 
   const run = async () => {
     setPhase({ at: "executing" });
     let outcome: VerbOutcome;
     try {
-      outcome = await execute();
+      outcome = await execute(note ? reason.trim() : undefined);
     } catch {
       outcome = { kind: "error", status: 0 };   // transport failure — the verb may not have run
     }
 
     setPhase({ at: "settled", outcome });
+    setReason("");
     onDone?.(outcome);
   };
 
   if (phase.at === "confirming") {
     return (
-      <span role="alertdialog" aria-label={`confirm ${label}`} className="inline-flex items-center gap-2 rounded-md border border-border bg-background px-3 py-1.5 text-sm">
+      <span role="alertdialog" aria-label={`confirm ${label}`} className="inline-flex flex-wrap items-center gap-2 rounded-md border border-border bg-background px-3 py-1.5 text-sm">
         <span>{confirm}</span>
         <span className="text-xs text-faint">· audited</span>
+        {note && (
+          <input
+            aria-label={note.label}
+            placeholder={note.label}
+            value={reason}
+            onChange={(event) => setReason(event.target.value)}
+            className="w-56 rounded-md border border-border bg-background px-2 py-0.5 text-xs"
+          />
+        )}
         <button
-          className={`rounded-md border px-2 py-0.5 text-xs font-medium ${destructive ? "border-danger-border bg-danger-bg text-danger" : "border-border bg-background hover:bg-accent"}`}
+          className={`rounded-md border px-2 py-0.5 text-xs font-medium disabled:opacity-50 ${destructive ? "border-danger-border bg-danger-bg text-danger" : "border-border bg-background hover:bg-accent"}`}
+          disabled={missingReason}
           onClick={() => void run()}
         >
           {label}
@@ -71,16 +97,16 @@ export function VerbButton({ label, confirm, execute, onDone, destructive = fals
         {phase.at === "executing" ? "working…" : label}
       </button>
 
-      {phase.at === "settled" && phase.outcome.kind === "ok" && (
+      {!quiet && phase.at === "settled" && phase.outcome.kind === "ok" && (
         <Banner tone="success" live="status" dense>{phase.outcome.message}</Banner>
       )}
 
-      {phase.at === "settled" && phase.outcome.kind === "refused" && (
+      {!quiet && phase.at === "settled" && phase.outcome.kind === "refused" && (
         // The refusal surface: the envelope's message VERBATIM — it teaches the fix.
         <Banner tone="danger" dense>{phase.outcome.message}</Banner>
       )}
 
-      {phase.at === "settled" && phase.outcome.kind === "error" && (
+      {!quiet && phase.at === "settled" && phase.outcome.kind === "error" && (
         <Banner tone="warning" dense>
           {phase.outcome.status === 0
             ? "the request did not reach the server — the verb may not have run"
diff --git a/ui/kit/src/status.ts b/ui/kit/src/status.ts
index 07fbaac..ca4c6a7 100644
--- a/ui/kit/src/status.ts
+++ b/ui/kit/src/status.ts
@@ -13,6 +13,7 @@ const MAP: Record<string, StatusTone> = {
   Received: "info",
   Validating: "info",
   Validated: "warning", // awaiting the gate
+  Approved: "info",     // gate passed — work still ahead; Completed is the success end
   Executing: "info",
   CompletedWithFailures: "danger",
   Rejected: "danger",