From 868cd1a487a729439897dbe95558ef43739fac2c Mon Sep 17 00:00:00 2001
From: TheMeinerLP <github@themeinerlp.dev>
Date: Sun, 23 Aug 2026 15:31:34 +0200
Subject: [PATCH] feat(console): make the consent roster a list somebody can
 work through

The page rendered one card per person, fetched every consent record a
guild ever had in one request, sorted them in the browser, and offered
exactly one action per card behind its own confirmation. A guild with
four hundred participants sent four hundred records to draw the first
ten, and withdrawing consent for four people was four confirmations.

It is now a paginated UiDisclosureList. A row says who and where they
stand; opening it reveals the policy version, the grant, the scope, the
withdrawal date, the recordings held and the withdrawal itself. The
window is the API's limit/offset, the page number is in the address, and
the order is SQL's -- orderConsents is deliberately no longer called,
because a second ordering over a page whose neighbours the reader cannot
see is a list that disagrees with its own pager.

Several people can be withdrawn at once. The confirmation names every
one of them before anything happens to anybody, including the ones whose
rows the reader has paged away from, and the answer is rendered one
person at a time: the endpoint answers 200 for a mixed result on purpose,
so "seven withdrawn, two already withdrawn, one had no record" has to be
legible per person rather than collapsed into a sentence.

Ids are secondary now. The guild directory was parsed and consumed
nowhere; the roster asks it for the people the consent record has no
name for. Somebody neither can name still renders -- as their bare id,
with a sentence saying which of the two reasons applies -- because a
person quietly missing from a consent roster is a roster that is wrong
about who may be recorded.

The effective instant is UiDatePicker, which already calls the module
that decided this question. The hand-rolled datetime-local goes, and
with it the third implementation of that arithmetic.
---
 .../app/components/ui/UiDisclosureList.vue    |  11 +-
 console/app/pages/admin/consents.vue          | 925 +++++++++++++-----
 console/app/utils/consentRoster.ts            | 632 ++++++++++++
 console/app/utils/consents.ts                 |  64 +-
 console/i18n/locales/de.json                  |  38 +-
 console/i18n/locales/en.json                  |  38 +-
 console/test/consentRoster.spec.ts            | 555 +++++++++++
 console/test/consents.spec.ts                 |  38 +-
 8 files changed, 2023 insertions(+), 278 deletions(-)
 create mode 100644 console/app/utils/consentRoster.ts
 create mode 100644 console/test/consentRoster.spec.ts

diff --git a/console/app/components/ui/UiDisclosureList.vue b/console/app/components/ui/UiDisclosureList.vue
index 9a2845e..508c90c 100644
--- a/console/app/components/ui/UiDisclosureList.vue
+++ b/console/app/components/ui/UiDisclosureList.vue
@@ -1,4 +1,4 @@
-<script setup lang="ts">
+<script setup lang="ts" generic="Row extends UiRow">
 /**
  * A list whose rows open, with checkboxes for the actions that apply to
  * more than one of them.
@@ -20,6 +20,13 @@
  * - **A row's summary and its revealed actions are the caller's markup**,
  *   so they arrive as slots. This component owns the disclosure, not what
  *   is disclosed.
+ *
+ * It is generic in its row type, and that is not decoration. A caller has
+ * more to say about a row than an id — a consent, a person, a job — and a
+ * list that narrowed every row to `UiRow` on the way into the slot would
+ * force the page to look the row back up by index in a second array. That
+ * lookup is exactly how one name ends up beside somebody else's record the
+ * first time the two arrays stop being the same length.
  */
 import {
   type UiRow,
@@ -35,7 +42,7 @@ import {
 
 const props = withDefaults(
   defineProps<{
-    rows: readonly UiRow[]
+    rows: readonly Row[]
     /** The ids ticked, across every page. Absent means no checkboxes. */
     selected?: readonly string[] | null
     /** The word for the bulk action, which goes into the sentence saying
diff --git a/console/app/pages/admin/consents.vue b/console/app/pages/admin/consents.vue
index 070929b..8e765b1 100644
--- a/console/app/pages/admin/consents.vue
+++ b/console/app/pages/admin/consents.vue
@@ -3,31 +3,59 @@
  * Who has consented to being recorded in one guild, and the one thing an
  * administrator can do about it from here: withdraw a consent.
  *
- * Everything that is a *decision* -- which row comes first, what a state
- * badge says, whether a revoke is offered at all, how a refusal reads as a
- * sentence, how a moment is written -- lives in `~/utils/consents` and is
- * tested there. What is left in this file is layout, request plumbing and
- * per-row state. The guild picker is not reimplemented either: it is the
- * same functions the Bot Settings page uses, down to the remembered choice,
- * so switching servers on one admin page carries to the other.
+ * Everything that is a *decision* -- what a state badge says, whether a
+ * revoke is offered at all, how a refusal reads as a sentence, how a moment
+ * is written, which name goes in front of a snowflake, what a batch would
+ * apply to -- lives in `~/utils/consents` and `~/utils/consentRoster` and
+ * is tested there. What is left in this file is layout, request plumbing
+ * and per-row state. The guild picker is not reimplemented either: it is
+ * the same functions the Bot Settings page uses, down to the remembered
+ * choice, so switching servers on one admin page carries to the other.
  *
  * Two things this page refuses to do, both on purpose:
  *
  * - **It never lets a withdrawal read as more than it is.** The Discord
  *   role stays, and the recordings stay. Both limits are said in the
  *   confirmation, before the act, and again in the panel afterwards -- not
- *   only in a footnote nobody reads twice.
+ *   only in a footnote nobody reads twice. The batch confirmation says them
+ *   too, in the plural.
  * - **It never offers an action it knows will fail.** A consent already
- *   withdrawn has no button at all, only the sentence saying when it went.
+ *   withdrawn has no button at all, only the sentence saying when it went,
+ *   and its checkbox is disabled so that "select this page" cannot promise
+ *   a withdrawal the API answers `already_revoked` to.
  *
- * **The withdrawal now carries an effective instant, and its default is
- * still now.** Pressing straight through the confirmation without opening
- * the instant control sends no instant at all, exactly as this page always
- * has, so no existing habit breaks. Opening it buys the two cases §5.4 of
- * the personalisation spec makes expressible: a past instant, which is a
- * statement about recordings that already exist, and a future one, which is
- * a scheduled withdrawal the bot honours through the five-second consent
- * cache it already has.
+ * ## What this page stopped doing
+ *
+ * It used to render an `<article>` per person, fetch **every** consent
+ * record a guild ever had in one request, and sort them in the browser. A
+ * guild with four hundred participants sent four hundred records to draw
+ * the first ten, and withdrawing consent for four people was four separate
+ * confirmations.
+ *
+ * Now it asks for one page, the page number is in the address so a page is
+ * a place somebody can link to, and the order is SQL's. **`orderConsents`
+ * is deliberately not called here any more**: a second ordering applied on
+ * top of the server's would reshuffle a page whose neighbours the reader
+ * cannot see, which is a list that disagrees with its own pager.
+ *
+ * ## The names
+ *
+ * A consent record carries a display name only if Sturnus has seen the
+ * person in a recorded session. `GET .../directory` holds one for everybody
+ * in the guild, and the roster consults it. Somebody neither can name still
+ * renders -- as their bare id, with a sentence saying which of the two
+ * reasons applies -- because a person quietly missing from a consent roster
+ * is a roster that is wrong about who may be recorded.
+ *
+ * ## The effective instant
+ *
+ * `UiDatePicker` emits ISO-8601 with a real offset, and it does so by
+ * calling `~/utils/effectiveInstant` -- the module that worked out that the
+ * offset belongs to the *chosen* moment rather than to today. This page
+ * used to hand-roll a `datetime-local` inside a `<details>` and attach the
+ * offset itself. It no longer does: three implementations of one piece of
+ * daylight-saving arithmetic is two too many, and they would disagree first
+ * on the page that matters most.
  *
  * **This file mixes two languages of string, and the mix is deliberate.**
  * Everything already here is English prose, because the whole
@@ -36,21 +64,41 @@
  * `$t` under `admin.consents.*`, the namespace `i18n/README.md` already
  * reserves for this page, so the sweep has less to do rather than more.
  */
+import UiDatePicker from '~/components/ui/UiDatePicker.vue'
+import UiDisclosureList from '~/components/ui/UiDisclosureList.vue'
+import UiPagination from '~/components/ui/UiPagination.vue'
+import UiSelect from '~/components/ui/UiSelect.vue'
+import {
+  type BulkRevokeResult,
+  type RosterEntry,
+  type RosterPerson,
+  batchVerdict,
+  bulkConfirmation,
+  bulkOutcomeRows,
+  bulkRevokeBody,
+  bulkTally,
+  chosenPeople,
+  grantFloor,
+  latestGrant,
+  nameNote,
+  parseBulkRevoke,
+  parseConsentPage,
+  rememberPeople,
+  rosterCount,
+  rosterEntries,
+  rosterInForce,
+  rosterSummary,
+} from '~/utils/consentRoster'
 import {
   AUDIT_LOG_NOTE,
   ROLE_STAYS_NOTE,
   type ConsentRow,
   type RevokeOutcome,
-  activeCount,
   consentBadge,
   describeConsentError,
   grantedLine,
-  identityNote,
   isStaleRow,
-  orderConsents,
-  parseConsents,
   parseRevokeResult,
-  personLabel,
   policyLine,
   recordingsLine,
   revocability,
@@ -59,20 +107,14 @@ import {
   scopeLineKey,
   withdrawnLine,
 } from '~/utils/consents'
-import {
-  effectiveConsequence,
-  effectiveKind,
-  effectiveOutcome,
-  isoFromLocalInput,
-  localInputFromIso,
-  localOffsetMinutes,
-  offsetLabel,
-  validateEffectiveAt,
-} from '~/utils/effectiveInstant'
+import { type NamedRow, parseDirectory } from '~/utils/directory'
+import { effectiveConsequence, effectiveKind, effectiveOutcome, validateEffectiveAt } from '~/utils/effectiveInstant'
 import type { Line } from '~/utils/myConsents'
+import { PAGE_SIZE, isPastTheEnd, offsetForPage, pageFromQuery } from '~/utils/paging'
 import {
   chooseGuild,
   guildLabel,
+  guildOptions,
   parseGuilds,
   readSelectedGuild,
   writeSelectedGuild,
@@ -81,6 +123,9 @@ import {
 useHead({ title: 'Consents' })
 
 const api = useApi()
+const route = useRoute()
+const router = useRouter()
+const say = useSay()
 
 const { data: guildData, error: guildError } = await useAsyncData('consent-guilds', async () =>
   parseGuilds(await api('/guilds')),
@@ -104,6 +149,34 @@ function selectGuild(guildId: string) {
   if (import.meta.client) writeSelectedGuild(window.localStorage, guildId)
 }
 
+/** The dropdown's model is nullable so that a page resetting a filter has
+ *  a way to say so. This page has no such state: there is always a guild
+ *  whose roster is being read, and clearing it would leave the list below
+ *  belonging to nothing. */
+function chooseGuildFromMenu(guildId: string | null) {
+  if (guildId !== null) selectGuild(guildId)
+}
+
+const guildChoices = computed(() => guildOptions(guilds.value))
+const currentGuild = computed(() => guilds.value.find((guild) => guild.id === selected.value) ?? null)
+
+/* -------------------------------------------------------------------- */
+/* One page of the roster                                               */
+/* -------------------------------------------------------------------- */
+
+/** The page number lives in the address, so that a page of the roster is a
+ *  place: the back button lands where the reader left it, and "the third
+ *  page of this server's consents" is something one person can send
+ *  another. */
+const page = computed(() => pageFromQuery(route.query.page))
+
+function goToPage(next: number) {
+  // Page one carries no `?page=1`. The first page is the address of the
+  // list itself, and two URLs for one page is two entries in somebody's
+  // history that render identically.
+  router.push({ path: route.path, query: next > 1 ? { page: String(next) } : {} })
+}
+
 // The guild the rows belong to travels *with* the rows rather than in a ref
 // of its own. A ref set inside the fetcher would be null after hydration --
 // the server ran the fetch, the client did not -- and the list would vanish
@@ -117,10 +190,38 @@ const {
   'consent-people',
   async () => {
     const guildId = selected.value
-    if (!guildId) return { guildId: null as string | null, rows: [] as ConsentRow[] }
+    if (!guildId) return { guildId: null as string | null, page: parseConsentPage(null, PAGE_SIZE) }
+    const offset = offsetForPage(page.value, PAGE_SIZE)
     return {
       guildId,
-      rows: orderConsents(parseConsents(await api(`/guilds/${guildId}/consents`))),
+      page: parseConsentPage(
+        await api(`/guilds/${guildId}/consents?limit=${PAGE_SIZE}&offset=${offset}`),
+        PAGE_SIZE,
+      ),
+    }
+  },
+  { watch: [selected, page] },
+)
+
+/**
+ * The guild's own names for its members.
+ *
+ * Fetched beside the roster rather than inside it, and failing quietly: a
+ * directory that cannot be read is a roster with fewer names on it, never a
+ * roster that refuses to render. The people it would have named still
+ * appear, as their ids, with the sentence that says the directory was not
+ * readable -- which is a different sentence from the one for a member the
+ * directory genuinely does not hold.
+ */
+const { data: directoryData } = await useAsyncData(
+  'consent-directory',
+  async () => {
+    const guildId = selected.value
+    if (!guildId) return { guildId: null as string | null, members: null as NamedRow[] | null }
+    try {
+      return { guildId, members: parseDirectory(await api(`/guilds/${guildId}/directory`)).members }
+    } catch {
+      return { guildId, members: null as NamedRow[] | null }
     }
   },
   { watch: [selected] },
@@ -131,11 +232,63 @@ const {
  *  is the exact mistake the switcher exists to prevent, and a list that
  *  lingers for a few hundred milliseconds under the new heading is long
  *  enough to click. */
-const rows = computed(() =>
-  consentData.value && consentData.value.guildId === selected.value ? consentData.value.rows : [],
+const held = computed(() =>
+  consentData.value && consentData.value.guildId === selected.value ? consentData.value.page : null,
+)
+const rows = computed<ConsentRow[]>(() => held.value?.rows ?? [])
+const total = computed(() => held.value?.total ?? 0)
+const offset = computed(() => held.value?.offset ?? 0)
+
+const members = computed<NamedRow[] | null>(() =>
+  directoryData.value && directoryData.value.guildId === selected.value
+    ? directoryData.value.members
+    : null,
+)
+
+const entries = computed<RosterEntry[]>(() => rosterEntries(rows.value, members.value))
+const inForce = computed(() => rows.value.filter((row) => row.active).length)
+const summary = computed(() => rosterSummary(total.value, offset.value, rows.value.length))
+/** A link to a page the roster no longer has. Not the same as "nobody has
+ *  consented", and telling somebody that instead would be a console
+ *  reporting a stale bookmark as a fact about their server. */
+const beyondTheEnd = computed(() => isPastTheEnd(total.value, rows.value.length, page.value))
+
+/* -------------------------------------------------------------------- */
+/* The selection                                                        */
+/* -------------------------------------------------------------------- */
+
+const picked = ref<readonly string[]>([])
+
+/**
+ * Everybody the reader has seen, kept by id.
+ *
+ * A selection outlives the page it was made on -- that is what
+ * `selectionSummary` announces -- so the confirmation has to name people
+ * whose rows are no longer in hand. Remembering them as they go past is the
+ * only way to state exactly who a batch applies to without a second
+ * request, and a confirmation that could not name them would be a
+ * confirmation of a number.
+ */
+const known = ref<Record<string, RosterPerson>>({})
+
+watch(
+  entries,
+  (seen) => {
+    known.value = rememberPeople(
+      known.value,
+      seen.map((entry) => entry.person),
+    )
+  },
+  { immediate: true },
 )
-const inForce = computed(() => activeCount(rows.value))
-const currentGuild = computed(() => guilds.value.find((guild) => guild.id === selected.value) ?? null)
+
+const chosen = computed(() => chosenPeople(known.value, picked.value))
+const verdict = computed(() => batchVerdict(picked.value))
+const confirmation = computed(() => bulkConfirmation(chosen.value))
+
+/* -------------------------------------------------------------------- */
+/* Per-row state                                                        */
+/* -------------------------------------------------------------------- */
 
 /** The person whose confirmation panel is open. One at a time: two open
  *  panels with the same red button on each is how the wrong one is
@@ -151,15 +304,16 @@ const outcomes = ref<Record<string, RevokeOutcome | null>>({})
 const instantOutcomes = ref<Record<string, Line[]>>({})
 
 /**
- * The instant the open confirmation would take effect, as the browser's own
- * control writes it -- wall-clock time with no zone.
+ * The instant the open confirmation would take effect, as an ISO-8601
+ * string with its offset already attached -- `UiDatePicker` emits nothing
+ * else.
  *
- * Empty means *now*, and empty is the default. One value rather than one
- * per row because only one confirmation is ever open: two remembered
- * instants would be one instant attached to the wrong person the moment a
- * panel is closed and another opened.
+ * Null means *now*, and null is the default. One value rather than one per
+ * row because only one confirmation is ever open: two remembered instants
+ * would be one instant attached to the wrong person the moment a panel is
+ * closed and another opened.
  */
-const effectiveLocal = ref('')
+const effectiveAt = ref<string | null>(null)
 
 // A moment chosen for one person must never survive into another's
 // confirmation. It is the single most dangerous piece of state on this
@@ -167,74 +321,137 @@ const effectiveLocal = ref('')
 // instant that quietly carried over would be applied to somebody nobody
 // chose it for.
 watch(confirming, () => {
-  effectiveLocal.value = ''
+  effectiveAt.value = null
 })
 
-/** The instant, with its offset, or null when the control was left alone.
- *  The offset is the browser's *for the chosen wall clock*, not for today,
- *  so a January instant chosen in July carries January's offset. */
-const chosenInstant = computed(() =>
-  effectiveLocal.value
-    ? isoFromLocalInput(effectiveLocal.value, localOffsetMinutes(effectiveLocal.value))
-    : null,
-)
-
-/** What the reader is told their local time will be sent as. Named rather
- *  than implied: this is the field the API answers 400 to when it arrives
- *  naive, and an administrator who can see the offset can see it is right. */
-const chosenOffset = computed(() => offsetLabel(localOffsetMinutes(effectiveLocal.value)))
-
 /** Why the chosen instant cannot be sent, or null when it can. Null while
  *  the control is untouched: "now" is always legal. */
 function instantProblem(row: ConsentRow): Line | null {
-  if (!effectiveLocal.value) return null
-  const verdict = validateEffectiveAt(chosenInstant.value, row.granted_at)
-  return verdict.ok ? null : verdict.problem
+  if (!effectiveAt.value) return null
+  const verdictFor = validateEffectiveAt(effectiveAt.value, row.granted_at)
+  return verdictFor.ok ? null : verdictFor.problem
 }
 
 /**
  * What the confirmation gains because of the instant that was chosen.
  *
  * Nothing at all for "now", which is what keeps the unchanged path
- * unchanged. `new Date()` is read here rather than held in a ref because
- * this only ever runs in a browser -- the panel exists after a click --
- * and because a clock captured once would call a future instant "past" for
- * anybody who left the tab open.
+ * unchanged. `new Date()` is read inside `effectiveKind` rather than held
+ * in a ref because this only ever runs in a browser -- the panel exists
+ * after a click -- and because a clock captured once would call a future
+ * instant "past" for anybody who left the tab open.
  */
 function instantConsequence(row: ConsentRow): Line[] {
-  if (!effectiveLocal.value || instantProblem(row)) return []
+  if (!effectiveAt.value || instantProblem(row)) return []
   return effectiveConsequence(
-    effectiveKind(chosenInstant.value),
-    chosenInstant.value,
+    effectiveKind(effectiveAt.value),
+    effectiveAt.value,
     row.recordings_with_audio,
   )
 }
 
-/** The earliest instant the control will offer, in the reader's own zone.
- *  A bound they can see beats one they discover by tripping over it, and
- *  the offset is read from the grant instant itself so a date in another
- *  daylight-saving period is not an hour out. */
-function grantedFloor(row: ConsentRow): string | undefined {
-  if (!row.granted_at) return undefined
-  const at = new Date(row.granted_at)
-  if (Number.isNaN(at.getTime())) return undefined
-  return localInputFromIso(row.granted_at, at.getTimezoneOffset()) ?? undefined
+/** The earliest day the picker will offer, in the reader's own zone. A
+ *  bound they can see beats one they discover by tripping over it, and the
+ *  offset is read from the grant instant itself so a date in another
+ *  daylight-saving period is not a day out. */
+function floorOf(iso: string | null): string | null {
+  if (!iso) return null
+  const at = new Date(iso)
+  return Number.isNaN(at.getTime()) ? null : grantFloor(iso, at.getTimezoneOffset())
 }
 
-// Every guild has its own people, and a panel or an outcome left over from
-// the previous selection would sit on whichever row happened to land in the
-// same position -- attached to a person it says nothing true about.
-watch(selected, () => {
-  confirming.value = null
-  busy.value = {}
-  failures.value = {}
-  outcomes.value = {}
-  instantOutcomes.value = {}
+/** Why a withdrawal is not offered. Empty when it is. Written out here
+ *  rather than inline in the template because a discriminated union does
+ *  not narrow across two separate calls, and calling it twice in one
+ *  expression is how the second call ends up asking a different question
+ *  than the first. */
+function blockedReason(row: ConsentRow): string {
+  const verdictFor = revocability(row)
+  return verdictFor.revocable ? '' : verdictFor.reason
+}
+
+/* -------------------------------------------------------------------- */
+/* The batch                                                            */
+/* -------------------------------------------------------------------- */
+
+const bulkOpen = ref(false)
+const bulkBusy = ref(false)
+const bulkFailure = ref('')
+const bulkResult = ref<BulkRevokeResult | null>(null)
+const bulkEffectiveAt = ref<string | null>(null)
+
+/** The floor for a batch is the *latest* grant among the people chosen. An
+ *  instant legal for nine and not the tenth would earn nine withdrawals and
+ *  one `effective_before_grant`, which is a half-applied act explained
+ *  afterwards rather than a whole one refused before. */
+const bulkFloor = computed(() => latestGrant(chosen.value))
+
+const bulkProblem = computed<Line | null>(() => {
+  if (!bulkEffectiveAt.value) return null
+  const verdictFor = validateEffectiveAt(bulkEffectiveAt.value, bulkFloor.value)
+  return verdictFor.ok ? null : verdictFor.problem
+})
+
+const bulkConsequence = computed<Line[]>(() => {
+  if (!bulkEffectiveAt.value || bulkProblem.value) return []
+  // No count of recordings here. The figure `effectiveConsequence` names
+  // belongs to one person, and summing it over a selection whose off-page
+  // members this page holds no counts for would be a number invented to
+  // fill a sentence. The per-row panel still names it for each of them.
+  return effectiveConsequence(effectiveKind(bulkEffectiveAt.value), bulkEffectiveAt.value, 0)
 })
 
-async function commit(row: ConsentRow) {
+const outcomeRows = computed(() =>
+  bulkResult.value ? bulkOutcomeRows(bulkResult.value, known.value) : [],
+)
+const tally = computed(() => (bulkResult.value ? bulkTally(bulkResult.value) : null))
+
+function openBulk() {
+  bulkResult.value = null
+  bulkFailure.value = ''
+  bulkEffectiveAt.value = null
+  bulkOpen.value = true
+}
+
+async function commitBulk() {
+  if (!verdict.value.ok || bulkProblem.value) return
+  const guildId = selected.value
+  const body = bulkRevokeBody(picked.value, bulkEffectiveAt.value)
+  bulkOpen.value = false
+  bulkFailure.value = ''
+  bulkResult.value = null
+  bulkBusy.value = true
+  try {
+    const answer = await api<unknown>(`/guilds/${guildId}/consents/revoke`, {
+      method: 'POST',
+      body,
+    })
+    // The endpoint's own answer decides what is reported, never the fact
+    // that the call did not throw. It answers 200 for a mixed result on
+    // purpose, so every person in the body gets their own sentence below.
+    bulkResult.value = parseBulkRevoke(answer)
+    // Cleared on the way out rather than kept: the rows below have just
+    // changed state, and a selection still standing over them is a second
+    // press away from a batch that is now entirely refusals. `known` stays,
+    // because the outcome list underneath still has to name these people.
+    picked.value = []
+    await refresh()
+  } catch (error) {
+    bulkFailure.value = describeConsentError(error)
+    await refresh()
+  } finally {
+    bulkBusy.value = false
+  }
+}
+
+/* -------------------------------------------------------------------- */
+/* One person at a time                                                 */
+/* -------------------------------------------------------------------- */
+
+async function commit(entry: RosterEntry) {
+  const row = entry.row
   if (instantProblem(row)) return
-  const instant = chosenInstant.value
+  const instant = effectiveAt.value
   confirming.value = null
   failures.value[row.discord_user_id] = ''
   outcomes.value[row.discord_user_id] = null
@@ -255,7 +472,7 @@ async function commit(row: ConsentRow) {
     // as a refusal: the only person who would find out otherwise is the one
     // still being recorded.
     const result = parseRevokeResult(answer)
-    outcomes.value[row.discord_user_id] = revokeOutcome(row, result)
+    outcomes.value[row.discord_user_id] = revokeOutcome(row, result, entry.person.label)
     // Only when the write went through. Repeating "it takes effect on
     // Tuesday" under a refusal would describe a withdrawal that does not
     // exist.
@@ -275,15 +492,23 @@ async function commit(row: ConsentRow) {
   }
 }
 
-/** Why a withdrawal is not offered. Empty when it is. Written out here
- *  rather than inline in the template because a discriminated union does
- *  not narrow across two separate calls, and calling it twice in one
- *  expression is how the second call ends up asking a different question
- *  than the first. */
-function blockedReason(row: ConsentRow): string {
-  const verdict = revocability(row)
-  return verdict.revocable ? '' : verdict.reason
-}
+// Every guild has its own people, and a panel, a selection or an outcome
+// left over from the previous one would sit on whichever row happened to
+// land in the same position -- attached to a person it says nothing true
+// about.
+watch(selected, () => {
+  confirming.value = null
+  busy.value = {}
+  failures.value = {}
+  outcomes.value = {}
+  instantOutcomes.value = {}
+  picked.value = []
+  known.value = {}
+  bulkOpen.value = false
+  bulkResult.value = null
+  bulkFailure.value = ''
+  if (page.value !== 1) goToPage(1)
+})
 
 /** Three states, three colours. Rendering "withdrawn" and "the policy
  *  version they agreed to has moved on" in the same grey would hide which
@@ -363,40 +588,39 @@ const TONE_COLOUR: Record<string, string> = {
       >
         <!-- With more than one guild the switcher is the only thing
              standing between an administrator and withdrawing a consent in
-             the wrong server, so the current one is named here and its id
-             repeated underneath. -->
-        <label
-          v-if="guilds.length > 1"
-          class="mb-2 block text-xs font-medium uppercase tracking-wide"
-          :style="{ color: 'var(--text-muted)' }"
-          for="guild-switcher"
-        >
-          Which server
-        </label>
-        <select
-          v-if="guilds.length > 1"
-          id="guild-switcher"
-          class="w-full rounded-lg border px-3 py-2 text-sm"
-          :style="{
-            borderColor: 'var(--border)',
-            background: 'var(--surface-raised)',
-            color: 'var(--text)',
-          }"
-          :value="selected"
-          @change="selectGuild(($event.target as HTMLSelectElement).value)"
-        >
-          <option v-for="guild in guilds" :key="guild.id" :value="guild.id">
-            {{ guildLabel(guild) }}
-          </option>
-        </select>
-        <p v-else class="text-sm">
-          <span :style="{ color: 'var(--text-muted)' }">Showing</span>
-          <span class="ml-1 font-medium">{{ currentGuild ? guildLabel(currentGuild) : '—' }}</span>
-        </p>
-        <p v-if="currentGuild" class="mt-2 text-xs" :style="{ color: 'var(--text-muted)' }">
-          Guild ID
-          <code class="rounded bg-[var(--surface-raised)] px-1 font-mono">{{ currentGuild.id }}</code>
-        </p>
+             the wrong server. The server is named by its *name*, and its id
+             rides along as the row's subtext — which is what `detail` is
+             for, and why the id is not repeated in a paragraph underneath. -->
+        <template v-if="guilds.length > 1">
+          <!-- A caption rather than a `<label for>`: the control is a
+               button wearing `role="combobox"` and it carries its own
+               accessible name. Two names for one control is how a screen
+               reader ends up reading the caption twice. -->
+          <p
+            class="mb-2 text-xs font-medium uppercase tracking-wide"
+            :style="{ color: 'var(--text-muted)' }"
+          >
+            {{ $t('admin.consents.roster.server') }}
+          </p>
+          <UiSelect
+            :model-value="selected"
+            :options="guildChoices"
+            :label="$t('admin.consents.roster.server')"
+            @update:model-value="chooseGuildFromMenu"
+          />
+        </template>
+        <template v-else>
+          <p class="text-sm">
+            <span :style="{ color: 'var(--text-muted)' }">Showing</span>
+            <span class="ml-1 font-medium">{{ currentGuild ? guildLabel(currentGuild) : '—' }}</span>
+          </p>
+          <p v-if="currentGuild" class="mt-2 text-xs" :style="{ color: 'var(--text-muted)' }">
+            Guild ID
+            <code class="rounded bg-[var(--surface-raised)] px-1 font-mono">{{
+              currentGuild.id
+            }}</code>
+          </p>
+        </template>
       </section>
 
       <p
@@ -409,19 +633,40 @@ const TONE_COLOUR: Record<string, string> = {
 
       <template v-else>
         <p
-          v-if="consentStatus === 'pending'"
+          v-if="consentStatus === 'pending' && held === null"
           class="text-sm"
           :style="{ color: 'var(--text-muted)' }"
         >
           Reading this server's consents…
         </p>
 
+        <!-- A link to a page that has since emptied. Saying "nobody has
+             consented" here would be a stale bookmark reported as a fact
+             about the server. -->
+        <section
+          v-else-if="beyondTheEnd"
+          class="rounded-xl border p-6"
+          :style="{ borderColor: 'var(--border)', background: 'var(--surface)' }"
+        >
+          <p class="mb-3 text-sm" :style="{ color: 'var(--text-muted)' }">
+            {{ $t('admin.consents.roster.beyondEnd') }}
+          </p>
+          <button
+            type="button"
+            class="rounded-lg border px-3 py-1.5 text-sm transition-colors hover:bg-[var(--surface-raised)]"
+            :style="{ borderColor: 'var(--border)' }"
+            @click="goToPage(1)"
+          >
+            {{ $t('admin.consents.roster.backToFirst') }}
+          </button>
+        </section>
+
         <!-- A guild with no consent records at all is not a blank page. It
              is a server where nobody has run /consent grant yet, which is
              worth saying outright: an administrator wondering why a meeting
              recorded nothing usually ends up here. -->
         <section
-          v-else-if="rows.length === 0"
+          v-else-if="total === 0"
           class="rounded-xl border p-6"
           :style="{ borderColor: 'var(--border)', background: 'var(--surface)' }"
         >
@@ -439,64 +684,258 @@ const TONE_COLOUR: Record<string, string> = {
         </section>
 
         <template v-else>
+          <p class="mb-1 text-sm" :style="{ color: 'var(--text-muted)' }">
+            {{ say(rosterCount(total)) }}
+          </p>
+          <!-- Two sentences rather than one. The total is the API's and
+               describes the whole server; "in force" can only be counted
+               over the rows in hand, and one sentence carrying both would
+               silently say "3 of 400" while counting 3 of 20. -->
           <p class="mb-4 text-sm" :style="{ color: 'var(--text-muted)' }">
-            {{ rows.length }} {{ rows.length === 1 ? 'person has' : 'people have' }} a consent
-            record here; {{ inForce }} of them
-            {{ inForce === 1 ? 'is' : 'are' }} in force right now.
+            {{ say(rosterInForce(inForce, rows.length)) }}
           </p>
 
-          <div class="flex flex-col gap-4">
-            <article
-              v-for="row in rows"
-              :key="row.discord_user_id"
-              class="rounded-xl border p-4"
-              :style="{ borderColor: 'var(--border)', background: 'var(--surface)' }"
+          <!-- The batch confirmation sits above the list, next to the bar
+               that opened it. A destructive panel that appears somewhere
+               the reader is not looking is a panel that gets confirmed
+               without being read. -->
+          <section
+            v-if="bulkOpen"
+            class="mb-4 rounded-xl border p-4"
+            :style="{
+              borderColor: 'var(--color-brand-red)',
+              background: 'var(--surface-raised)',
+            }"
+          >
+            <h2 class="mb-2 text-sm font-semibold">{{ say(confirmation.title) }}</h2>
+
+            <p
+              v-if="!verdict.ok"
+              class="mb-3 rounded-lg border p-2 text-sm"
+              :style="{ borderColor: 'var(--danger)', color: 'var(--danger)' }"
             >
-              <header class="mb-3 flex flex-col gap-2 sm:flex-row sm:items-start sm:justify-between">
-                <div>
-                  <h2 class="text-sm font-semibold">{{ personLabel(row) }}</h2>
-                  <code class="font-mono text-xs" :style="{ color: 'var(--text-muted)' }">{{
-                    row.discord_user_id
-                  }}</code>
-                </div>
+              {{ say(verdict.problem) }}
+            </p>
+
+            <template v-else>
+              <!-- Exactly who, by name, before anything happens to
+                   anybody. The reader may be on a different page from the
+                   rows they ticked, so a confirmation naming a count and
+                   not the people would be a confirmation they cannot
+                   check. -->
+              <p class="mb-1 text-sm" :style="{ color: 'var(--text-muted)' }">
+                {{ say(confirmation.lead) }}
+              </p>
+              <ul class="mb-3 flex flex-col gap-1">
+                <li
+                  v-for="who in confirmation.people"
+                  :key="who.id"
+                  class="text-sm"
+                >
+                  <span class="font-medium">{{ who.label }}</span>
+                  <span
+                    v-if="who.source !== 'record' && who.source !== 'directory'"
+                    class="ml-2 text-xs"
+                    :style="{ color: 'var(--text-muted)' }"
+                  >{{ $t('admin.consents.roster.userId') }}</span>
+                </li>
+              </ul>
+
+              <!-- Three sentences, kept as three, for the same reason the
+                   single-row confirmation keeps its three: a paragraph
+                   carrying all of them is skimmed exactly where the reader
+                   most needs to notice that the roles and the recordings
+                   are not part of this. -->
+              <p
+                v-for="consequence in confirmation.consequences"
+                :key="consequence.key"
+                class="mb-2 text-sm"
+                :style="{ color: 'var(--text-muted)' }"
+              >
+                {{ say(consequence) }}
+              </p>
+
+              <div class="mt-3 rounded-lg border p-3" :style="{ borderColor: 'var(--border)' }">
+                <p class="mb-1 text-xs font-medium uppercase tracking-wide" :style="{ color: 'var(--text-muted)' }">
+                  {{ $t('admin.consents.bulk.effectiveLegend') }}
+                </p>
+                <p class="mb-2 text-xs" :style="{ color: 'var(--text-muted)' }">
+                  {{ $t('admin.consents.bulk.effectiveNote') }}
+                </p>
+                <!-- The picker emits ISO-8601 with the offset of the
+                     *chosen* moment, because it calls the module that
+                     worked that out. Nothing here attaches an offset. -->
+                <UiDatePicker
+                  v-model="bulkEffectiveAt"
+                  :label="$t('admin.consents.bulk.effectiveLegend')"
+                  :min="floorOf(bulkFloor)"
+                  :invalid="Boolean(bulkProblem)"
+                />
+                <button
+                  v-if="bulkEffectiveAt"
+                  type="button"
+                  class="mt-2 rounded-lg border px-3 py-1.5 text-xs transition-colors hover:bg-[var(--surface)]"
+                  :style="{ borderColor: 'var(--border)' }"
+                  @click="bulkEffectiveAt = null"
+                >
+                  {{ $t('admin.consents.effective.reset') }}
+                </button>
+              </div>
+
+              <p
+                v-for="line in bulkConsequence"
+                :key="line.key"
+                class="mt-2 text-sm"
+                :style="{ color: 'var(--text-muted)' }"
+              >
+                {{ $t(line.key, line.values ?? {}) }}
+              </p>
+
+              <p
+                v-if="bulkProblem"
+                class="mt-2 rounded-lg border p-2 text-sm"
+                :style="{ borderColor: 'var(--danger)', color: 'var(--danger)' }"
+              >
+                {{ $t(bulkProblem.key, bulkProblem.values ?? {}) }}
+              </p>
+            </template>
+
+            <div class="mt-3 flex flex-wrap gap-2">
+              <button
+                type="button"
+                class="rounded-lg px-3 py-1.5 text-sm font-medium text-white transition-opacity hover:opacity-90 disabled:opacity-40"
+                :style="{ background: 'var(--color-brand-red)' }"
+                :disabled="!verdict.ok || Boolean(bulkProblem) || bulkBusy"
+                @click="commitBulk"
+              >
+                {{ bulkBusy ? $t('admin.consents.bulk.working') : say(confirmation.confirmLabel) }}
+              </button>
+              <button
+                type="button"
+                class="rounded-lg border px-3 py-1.5 text-sm transition-colors hover:bg-[var(--surface)]"
+                :style="{ borderColor: 'var(--border)' }"
+                @click="bulkOpen = false"
+              >
+                {{ $t('admin.consents.bulk.cancel') }}
+              </button>
+            </div>
+          </section>
+
+          <!-- The mixed answer, person by person. This is the whole reason
+               the endpoint answers 200 for a partial success: "some were
+               refused" is an administrator who has to withdraw all ten
+               again one at a time to find out which. -->
+          <section
+            v-if="bulkResult"
+            class="mb-4 rounded-xl border p-4"
+            :style="{ borderColor: 'var(--border)', background: 'var(--surface)' }"
+          >
+            <p v-if="tally" class="text-sm font-semibold">{{ say(tally) }}</p>
+            <p class="mt-1 mb-2 text-sm" :style="{ color: 'var(--text-muted)' }">
+              {{ $t('admin.consents.bulk.perPerson') }}
+            </p>
+            <ul class="flex flex-col gap-2">
+              <li
+                v-for="result in outcomeRows"
+                :key="result.person.id"
+                class="rounded-lg border-l-2 pl-3"
+                :style="{ borderColor: TONE_COLOUR[result.tone] }"
+              >
+                <p class="text-sm font-medium">{{ result.person.label }}</p>
+                <p class="text-sm" :style="{ color: 'var(--text-muted)' }">
+                  {{ say(result.sentence) }}
+                </p>
+                <p
+                  v-for="line in result.detail"
+                  :key="line.key"
+                  class="text-sm"
+                  :style="{ color: 'var(--text-muted)' }"
+                >
+                  {{ $t(line.key, line.values ?? {}) }}
+                </p>
+              </li>
+            </ul>
+            <button
+              type="button"
+              class="mt-3 rounded-lg border px-3 py-1.5 text-xs transition-colors hover:bg-[var(--surface-raised)]"
+              :style="{ borderColor: 'var(--border)' }"
+              @click="bulkResult = null"
+            >
+              {{ $t('admin.consents.bulk.dismiss') }}
+            </button>
+          </section>
+
+          <p
+            v-if="bulkFailure"
+            class="mb-4 rounded-xl border p-4 text-sm"
+            :style="{ borderColor: 'var(--color-brand-red)' }"
+          >
+            {{ bulkFailure }}
+          </p>
+
+          <UiDisclosureList
+            v-model:selected="picked"
+            :rows="entries"
+            :bulk-action="$t('admin.consents.bulk.action')"
+            :label="$t('admin.consents.roster.list')"
+            @bulk="openBulk"
+          >
+            <!-- Collapsed: who, and where they stand. Nothing else — an
+                 administrator scans this list for a person, and a row that
+                 also carried the policy version and two dates would be a
+                 row nobody scans. -->
+            <template #row="{ row: entry }">
+              <span class="flex min-w-0 flex-wrap items-baseline gap-x-3 gap-y-1">
+                <span class="truncate font-medium">{{ entry.person.label }}</span>
+                <!-- The bare id is still a person, and the marker says so
+                     at a glance. The sentence explaining which of the two
+                     reasons applies is inside the row, where there is
+                     space for it. -->
+                <span
+                  v-if="entry.person.source !== 'record' && entry.person.source !== 'directory'"
+                  class="shrink-0 text-xs"
+                  :style="{ color: 'var(--text-muted)' }"
+                >{{ $t('admin.consents.roster.userId') }}</span>
                 <span
-                  class="shrink-0 self-start rounded-full border px-2.5 py-1 text-xs font-medium"
+                  class="shrink-0 rounded-full border px-2 py-0.5 text-xs font-medium"
                   :style="{
-                    borderColor: TONE_COLOUR[consentBadge(row).tone],
-                    color: TONE_COLOUR[consentBadge(row).tone],
+                    borderColor: TONE_COLOUR[consentBadge(entry.row).tone],
+                    color: TONE_COLOUR[consentBadge(entry.row).tone],
                   }"
                 >
-                  {{ consentBadge(row).label }}
+                  {{ consentBadge(entry.row).label }}
                 </span>
-              </header>
+              </span>
+            </template>
 
-              <!-- The badge's long form is on the row rather than in a
-                   tooltip: the difference between "withdrawn" and "the
-                   policy version moved on" decides what to do next, and
-                   nobody hovers to find that out. -->
+            <template #actions="{ row: entry }">
+              <!-- The badge's long form is here rather than in a tooltip:
+                   the difference between "withdrawn" and "the policy
+                   version moved on" decides what to do next, and nobody
+                   hovers to find that out. -->
               <p class="text-sm" :style="{ color: 'var(--text-muted)' }">
-                {{ consentBadge(row).detail }}
+                {{ consentBadge(entry.row).detail }}
               </p>
 
               <p
-                v-if="identityNote(row)"
+                v-if="nameNote(entry.person)"
                 class="mt-2 text-xs"
                 :style="{ color: 'var(--text-muted)' }"
               >
-                {{ identityNote(row) }}
+                {{ say(nameNote(entry.person)) }}
               </p>
 
               <dl class="mt-3 grid grid-cols-1 gap-x-6 gap-y-1 text-xs sm:grid-cols-2">
                 <div>
                   <dt class="inline font-medium">Policy version ·</dt>
                   <dd class="inline" :style="{ color: 'var(--text-muted)' }">
-                    {{ policyLine(row) }}
+                    {{ policyLine(entry.row) }}
                   </dd>
                 </div>
                 <div>
                   <dt class="inline font-medium">Granted ·</dt>
                   <dd class="inline" :style="{ color: 'var(--text-muted)' }">
-                    {{ grantedLine(row) }}
+                    {{ grantedLine(entry.row) }}
                   </dd>
                 </div>
                 <!-- On the roster so that "who agreed to video" is a
@@ -508,62 +947,76 @@ const TONE_COLOUR: Record<string, string> = {
                 <div>
                   <dt class="inline font-medium">{{ $t('admin.consents.scope.label') }} ·</dt>
                   <dd class="inline" :style="{ color: 'var(--text-muted)' }">
-                    {{ $t(scopeLineKey(row)) }}
+                    {{ $t(scopeLineKey(entry.row)) }}
                   </dd>
                 </div>
-                <div v-if="withdrawnLine(row)">
+                <div v-if="withdrawnLine(entry.row)">
                   <dt class="inline font-medium">Withdrawn ·</dt>
                   <dd class="inline" :style="{ color: 'var(--text-muted)' }">
-                    {{ withdrawnLine(row) }}
+                    {{ withdrawnLine(entry.row) }}
                   </dd>
                 </div>
-                <!-- On the row as well as in the confirmation, because it
-                     answers the question an administrator is usually really
-                     asking. Somebody who came to erase a person's audio has
-                     come to the wrong page, and finds that out here. -->
+                <!-- Inside the row as well as in the confirmation, because
+                     it answers the question an administrator is usually
+                     really asking. Somebody who came to erase a person's
+                     audio has come to the wrong page, and finds that out
+                     here. -->
                 <div>
                   <dt class="inline font-medium">Recordings held ·</dt>
                   <dd class="inline" :style="{ color: 'var(--text-muted)' }">
-                    {{ recordingsLine(row) }}
+                    {{ recordingsLine(entry.row) }}
+                  </dd>
+                </div>
+                <!-- The id is secondary everywhere else on this page, and
+                     this is the one place it is still worth having: it is
+                     what an administrator quotes in a ticket. -->
+                <div>
+                  <dt class="inline font-medium">{{ $t('admin.consents.roster.userId') }} ·</dt>
+                  <dd class="inline">
+                    <code class="font-mono" :style="{ color: 'var(--text-muted)' }">{{
+                      entry.row.discord_user_id
+                    }}</code>
                   </dd>
                 </div>
               </dl>
 
               <div class="mt-3 flex flex-wrap items-center gap-2">
                 <button
-                  v-if="revocability(row).revocable"
+                  v-if="revocability(entry.row).revocable"
                   type="button"
                   class="rounded-lg border px-3 py-1.5 text-sm font-medium transition-colors hover:bg-[var(--surface-raised)] disabled:opacity-40"
                   :style="{ borderColor: 'var(--color-brand-red)', color: 'var(--color-brand-red)' }"
-                  :disabled="busy[row.discord_user_id]"
-                  @click="confirming = row.discord_user_id"
+                  :disabled="busy[entry.row.discord_user_id]"
+                  @click="confirming = entry.row.discord_user_id"
                 >
-                  {{ busy[row.discord_user_id] ? 'Withdrawing…' : 'Withdraw consent' }}
+                  {{ busy[entry.row.discord_user_id] ? 'Withdrawing…' : 'Withdraw consent' }}
                 </button>
                 <!-- No button for a consent already withdrawn. The API
                      answers 409, and an interface that offers an action it
                      knows will fail is worse than one that explains why it
                      cannot. -->
                 <span v-else class="text-xs" :style="{ color: 'var(--text-muted)' }">
-                  {{ blockedReason(row) }}
+                  {{ blockedReason(entry.row) }}
                 </span>
               </div>
 
               <div
-                v-if="confirming === row.discord_user_id"
+                v-if="confirming === entry.row.discord_user_id"
                 class="mt-3 rounded-lg border p-3"
                 :style="{
                   borderColor: 'var(--color-brand-red)',
                   background: 'var(--surface-raised)',
                 }"
               >
-                <p class="mb-2 text-sm font-semibold">{{ revokeConfirmation(row).title }}</p>
+                <p class="mb-2 text-sm font-semibold">
+                  {{ revokeConfirmation(entry.row, entry.person.label).title }}
+                </p>
                 <!-- Three sentences, kept as three. A single paragraph
                      carrying all of them is one that gets skimmed, exactly
                      where the reader most needs to notice that the role and
                      the recordings are not part of this. -->
                 <p
-                  v-for="consequence in revokeConfirmation(row).consequences"
+                  v-for="consequence in revokeConfirmation(entry.row, entry.person.label).consequences"
                   :key="consequence"
                   class="mb-2 text-sm"
                   :style="{ color: 'var(--text-muted)' }"
@@ -571,67 +1024,45 @@ const TONE_COLOUR: Record<string, string> = {
                   {{ consequence }}
                 </p>
 
-                <!-- The effective instant, folded away by default. Closed,
-                     this confirmation is the one that has always been here
-                     and the button below sends the request it has always
-                     sent. Open, it is where a withdrawal becomes a
-                     statement about a moment rather than about now.
-
-                     A native `datetime-local`: it is the control every
-                     phone already knows how to present, and reimplementing
-                     a date picker to look the same on three platforms is
-                     how a date picker ends up unusable on one of them. -->
-                <details class="mt-3 rounded-lg border p-3" :style="{ borderColor: 'var(--border)' }">
-                  <summary class="cursor-pointer text-sm font-medium">
-                    {{ $t('admin.consents.effective.toggle') }}
-                  </summary>
-                  <p class="mt-2 text-xs" :style="{ color: 'var(--text-muted)' }">
-                    {{ $t('admin.consents.effective.nowNote') }}
-                  </p>
-                  <p class="mt-1 text-xs" :style="{ color: 'var(--text-muted)' }">
-                    {{ $t('admin.consents.effective.help') }}
-                  </p>
-                  <label
-                    class="mt-3 mb-1 block text-xs font-medium uppercase tracking-wide"
+                <!-- The effective instant. Left alone, this confirmation
+                     sends the request it has always sent; used, it is where
+                     a withdrawal becomes a statement about a moment rather
+                     than about now. -->
+                <div class="mt-3 rounded-lg border p-3" :style="{ borderColor: 'var(--border)' }">
+                  <p
+                    class="mb-1 text-xs font-medium uppercase tracking-wide"
                     :style="{ color: 'var(--text-muted)' }"
-                    :for="`effective-${row.discord_user_id}`"
                   >
                     {{ $t('admin.consents.effective.legend') }}
-                  </label>
-                  <input
-                    :id="`effective-${row.discord_user_id}`"
-                    v-model="effectiveLocal"
-                    type="datetime-local"
-                    class="w-full rounded-lg border px-3 py-2 text-sm"
-                    :min="grantedFloor(row)"
-                    :style="{
-                      borderColor: 'var(--control-border)',
-                      background: 'var(--surface)',
-                      color: 'var(--text)',
-                    }"
-                  >
-                  <!-- The offset is said out loud. It is the field the API
-                       answers 400 to when it arrives naive, and an
-                       administrator who can read it can see it is right. -->
-                  <p class="mt-1 text-xs" :style="{ color: 'var(--text-muted)' }">
-                    {{ $t('admin.consents.effective.zone', { offset: chosenOffset }) }}
                   </p>
+                  <p class="text-xs" :style="{ color: 'var(--text-muted)' }">
+                    {{ $t('admin.consents.effective.nowNote') }}
+                  </p>
+                  <p class="mt-1 mb-2 text-xs" :style="{ color: 'var(--text-muted)' }">
+                    {{ $t('admin.consents.effective.help') }}
+                  </p>
+                  <UiDatePicker
+                    v-model="effectiveAt"
+                    :label="$t('admin.consents.effective.legend')"
+                    :min="floorOf(entry.row.granted_at)"
+                    :invalid="Boolean(instantProblem(entry.row))"
+                  />
                   <button
-                    v-if="effectiveLocal"
+                    v-if="effectiveAt"
                     type="button"
                     class="mt-2 rounded-lg border px-3 py-1.5 text-xs transition-colors hover:bg-[var(--surface)]"
                     :style="{ borderColor: 'var(--border)' }"
-                    @click="effectiveLocal = ''"
+                    @click="effectiveAt = null"
                   >
                     {{ $t('admin.consents.effective.reset') }}
                   </button>
-                </details>
+                </div>
 
                 <!-- Said before the confirmation is pressed, never after.
                      Choosing a past instant and being shown nothing would
                      let somebody believe they had erased something. -->
                 <p
-                  v-for="line in instantConsequence(row)"
+                  v-for="line in instantConsequence(entry.row)"
                   :key="line.key"
                   class="mt-2 text-sm"
                   :style="{ color: 'var(--text-muted)' }"
@@ -640,11 +1071,11 @@ const TONE_COLOUR: Record<string, string> = {
                 </p>
 
                 <p
-                  v-if="instantProblem(row)"
+                  v-if="instantProblem(entry.row)"
                   class="mt-2 rounded-lg border p-2 text-sm"
                   :style="{ borderColor: 'var(--danger)', color: 'var(--danger)' }"
                 >
-                  {{ $t(instantProblem(row)!.key, instantProblem(row)!.values ?? {}) }}
+                  {{ $t(instantProblem(entry.row)!.key, instantProblem(entry.row)!.values ?? {}) }}
                 </p>
 
                 <div class="mt-3 flex flex-wrap gap-2">
@@ -652,10 +1083,10 @@ const TONE_COLOUR: Record<string, string> = {
                     type="button"
                     class="rounded-lg px-3 py-1.5 text-sm font-medium text-white transition-opacity hover:opacity-90 disabled:opacity-40"
                     :style="{ background: 'var(--color-brand-red)' }"
-                    :disabled="Boolean(instantProblem(row))"
-                    @click="commit(row)"
+                    :disabled="Boolean(instantProblem(entry.row))"
+                    @click="commit(entry)"
                   >
-                    {{ revokeConfirmation(row).confirmLabel }}
+                    {{ revokeConfirmation(entry.row, entry.person.label).confirmLabel }}
                   </button>
                   <button
                     type="button"
@@ -669,23 +1100,25 @@ const TONE_COLOUR: Record<string, string> = {
               </div>
 
               <div
-                v-if="outcomes[row.discord_user_id]"
+                v-if="outcomes[entry.row.discord_user_id]"
                 class="mt-3 rounded-lg border p-3"
                 :style="{
-                  borderColor: TONE_COLOUR[outcomes[row.discord_user_id]!.tone],
+                  borderColor: TONE_COLOUR[outcomes[entry.row.discord_user_id]!.tone],
                   background: 'var(--surface-raised)',
                 }"
               >
-                <p class="text-sm font-semibold">{{ outcomes[row.discord_user_id]!.headline }}</p>
+                <p class="text-sm font-semibold">
+                  {{ outcomes[entry.row.discord_user_id]!.headline }}
+                </p>
                 <p class="mt-1 text-sm" :style="{ color: 'var(--text-muted)' }">
-                  {{ outcomes[row.discord_user_id]!.detail }}
+                  {{ outcomes[entry.row.discord_user_id]!.detail }}
                 </p>
                 <!-- What the API says it did with the instant, from its own
                      answer rather than from the request: the console's
                      arithmetic and the API's are two arithmetics, and only
                      one of them has the recordings table. -->
                 <p
-                  v-for="line in instantOutcomes[row.discord_user_id] ?? []"
+                  v-for="line in instantOutcomes[entry.row.discord_user_id] ?? []"
                   :key="line.key"
                   class="mt-1 text-sm"
                   :style="{ color: 'var(--text-muted)' }"
@@ -695,13 +1128,25 @@ const TONE_COLOUR: Record<string, string> = {
               </div>
 
               <p
-                v-if="failures[row.discord_user_id]"
+                v-if="failures[entry.row.discord_user_id]"
                 class="mt-3 rounded-lg border p-3 text-sm"
                 :style="{ borderColor: 'var(--color-brand-red)' }"
               >
-                {{ failures[row.discord_user_id] }}
+                {{ failures[entry.row.discord_user_id] }}
               </p>
-            </article>
+            </template>
+          </UiDisclosureList>
+
+          <div class="mt-4 flex flex-col items-center gap-2">
+            <UiPagination
+              :page="page"
+              :total="total"
+              :size="PAGE_SIZE"
+              @update:page="goToPage"
+            />
+            <p v-if="summary" class="text-sm" :style="{ color: 'var(--text-muted)' }">
+              {{ say(summary) }}
+            </p>
           </div>
         </template>
       </template>
diff --git a/console/app/utils/consentRoster.ts b/console/app/utils/consentRoster.ts
new file mode 100644
index 0000000..7c26460
--- /dev/null
+++ b/console/app/utils/consentRoster.ts
@@ -0,0 +1,632 @@
+/**
+ * The consent roster as something somebody can work through: one page at a
+ * time, several people at once, and a name in front of every snowflake.
+ *
+ * `~/utils/consents` decides what *one* consent means — its badge, its
+ * sentence, whether a withdrawal may be offered at all — and none of that
+ * is re-decided here. What this module adds is everything that only exists
+ * once the roster is bigger than a screen:
+ *
+ * - **A page of it, rather than all of it.** `GET .../consents` now
+ *   answers `{consents, total, limit, offset}`, and `total` counts
+ *   *people* rather than consent rows — the table is append-only, so a
+ *   count of rows would grow every time somebody re-granted. The old page
+ *   fetched every record a guild ever had and sorted them in the browser;
+ *   the order is SQL's now, and `orderConsents` is deliberately not called
+ *   from the page any more. A second ordering applied on top of the
+ *   server's would reshuffle a page whose neighbours the reader cannot
+ *   see, which is a list that disagrees with its own pager.
+ * - **A name for people the consent record has none for.** `personLabel`
+ *   falls back to `Discord user 100…`, which is honest and unreadable. The
+ *   guild directory holds display names for exactly these people, and this
+ *   module is where the two meet. Somebody the directory cannot resolve
+ *   still renders — as the bare id, with a sentence saying why — never as
+ *   a blank and never silently dropped.
+ * - **A withdrawal that names more than one person.** The dangerous one.
+ *   Everything below about the batch exists to keep two promises: the
+ *   confirmation states exactly who it will apply to before it applies to
+ *   anything, and the answer is legible per person afterwards. `POST
+ *   .../consents/revoke` answers 200 for a mixed result on purpose, so
+ *   "seven withdrawn, two already withdrawn, one had no record" is the
+ *   ordinary case and not an error condition.
+ *
+ * **The batch bound and the page size are the same bound.** The API caps a
+ * batch at exactly one page of the roster it is withdrawn from, so an
+ * interface can never build a request it could not have shown. This module
+ * therefore refuses an oversized selection out loud rather than letting
+ * the reader discover it as a 400 — and nothing here offers a "select all
+ * matching" that could exceed it, because no such request exists.
+ *
+ * **Every function here returns a translation key, never a sentence.**
+ * `i18n/README.md` reserves `admin.consents.*` for this page and says why.
+ * The English prose still in `~/utils/consents` predates that rule and
+ * moves when the sweep reaches it; nothing new is written in it.
+ */
+import { type ConsentRow, parseConsents, revocability } from '~/utils/consents'
+import type { NamedRow } from '~/utils/directory'
+import { effectiveOutcome, localInputFromIso } from '~/utils/effectiveInstant'
+import type { Message } from '~/utils/message'
+import type { Line } from '~/utils/myConsents'
+import { pageSummary } from '~/utils/paging'
+import type { UiRow } from '~/utils/uiDisclosureList'
+import type { Day } from '~/utils/uiDatePicker'
+
+/**
+ * The most people one withdrawal may name.
+ *
+ * The API's own `MAX_REVOCATIONS_PER_REQUEST`, restated here so the
+ * console refuses a request it knows will be refused rather than sending
+ * it. It is deliberately equal to the largest page the roster endpoint
+ * will serve: the biggest legal batch is exactly one page, which is what
+ * makes "never offer a selection you could not have shown" a property of
+ * the two endpoints rather than a rule this file has to remember.
+ */
+export const MAX_BATCH = 100
+
+/* -------------------------------------------------------------------- */
+/* One page of the roster                                                */
+/* -------------------------------------------------------------------- */
+
+export interface ConsentPage {
+  rows: ConsentRow[]
+  /**
+   * How many **people** have a consent record in this guild — not how many
+   * consent rows exist. The table is append-only, so somebody who granted,
+   * withdrew and granted again is three rows and one person, and a pager
+   * built on the row count would offer pages that hold nobody new.
+   */
+  total: number
+  limit: number
+  offset: number
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+/** A whole non-negative number, or the fallback. A negative offset or a
+ *  fractional total is a defect upstream, and arithmetic built on it
+ *  produces a pager that offers page −1. */
+function asCount(value: unknown, fallback: number): number {
+  if (typeof value !== 'number' || !Number.isFinite(value) || value < 0) return fallback
+  return Math.floor(value)
+}
+
+/**
+ * One page of the roster, envelope and all.
+ *
+ * The rows themselves go through `parseConsents`, which already tolerates
+ * every shape this endpoint has ever sent. What is read here is the window
+ * around them, and each field falls back to something that describes a
+ * *single-page* list rather than to zero: an API that sends no `total` is
+ * one that predates paging, and a console that then rendered "0 people"
+ * over twenty visible rows would be reporting its own parser as a fact
+ * about the guild.
+ */
+export function parseConsentPage(payload: unknown, asked: number): ConsentPage {
+  const rows = parseConsents(payload)
+  const envelope = isRecord(payload) ? payload : {}
+  return {
+    rows,
+    total: asCount(envelope.total, rows.length),
+    limit: asCount(envelope.limit, asked),
+    offset: asCount(envelope.offset, 0),
+  }
+}
+
+/**
+ * What this page of the list is showing, in words.
+ *
+ * The arithmetic is `~/utils/paging`'s and is not done twice: it already
+ * decided that the upper bound is the last row actually on screen rather
+ * than `offset + size`, which is what stops a roster of 47 announcing
+ * "41–60 of 47". Only the noun belongs to this page, so only the key is
+ * replaced — and which of the two keys it is, is read from the shape of
+ * the params rather than from the key it came back with, so renaming a
+ * key over there cannot silently pick the plural sentence here.
+ */
+export function rosterSummary(total: number, offset: number, shown: number): Message | null {
+  const summary = pageSummary(total, offset, shown)
+  if (!summary) return null
+  const several = summary.params !== undefined && 'to' in summary.params
+  return {
+    key: several ? 'admin.consents.roster.showing' : 'admin.consents.roster.showingOne',
+    params: summary.params,
+  }
+}
+
+/**
+ * How many people the guild holds a consent record for, and how many of
+ * the ones on this page are in force.
+ *
+ * Two sentences rather than one, and the split is the honest part. The
+ * total comes from the API and describes the whole guild; "in force" can
+ * only be counted over the rows actually in hand, and the page this list
+ * used to be said both about the same set because it had every row. A
+ * single sentence would now silently mean "3 of 400 are in force" while
+ * counting 3 of the 20 on screen.
+ */
+export function rosterCount(total: number): Message {
+  return { key: 'admin.consents.roster.total', params: { count: total } }
+}
+
+export function rosterInForce(inForce: number, shown: number): Message {
+  return {
+    key: 'admin.consents.roster.inForce',
+    params: { count: inForce, shown },
+  }
+}
+
+/* -------------------------------------------------------------------- */
+/* Putting a name to a snowflake                                         */
+/* -------------------------------------------------------------------- */
+
+/**
+ * Where the name on a row came from, which decides what has to be said
+ * underneath it.
+ *
+ * - `record` — the consent row carried a display name. Nothing to add.
+ * - `directory` — the guild directory supplied one. Worth a note: the name
+ *   describes Discord as the last mirror sweep saw it, and the consent
+ *   record itself still has none.
+ * - `unresolved` — the directory was read and holds no entry for this id.
+ * - `unknown` — there was no directory to ask, because the request for it
+ *   failed or has not arrived. Not the same fact as `unresolved`, and
+ *   rendering both as "could not be resolved" would tell somebody their
+ *   guild is missing a member when the console simply did not look.
+ */
+export type NameSource = 'record' | 'directory' | 'unresolved' | 'unknown'
+
+export interface RosterPerson {
+  id: string
+  /** What to render. Never empty, and the whole id when there is no name:
+   *  snowflakes minted in the same era share their leading digits, so a
+   *  truncated one names a group rather than a person. */
+  label: string
+  source: NameSource
+  /**
+   * When their consent was granted, carried alongside the name so that a
+   * bulk withdrawal's effective instant can still be checked against it
+   * after the reader has paged away from the row. A selection outlives the
+   * page it was made on; the facts needed to validate it have to as well.
+   */
+  grantedAt: string | null
+}
+
+/**
+ * One person, named as well as this console can name them.
+ *
+ * `members` is `null` when there is no directory to consult, which is a
+ * different answer from an empty one — see `NameSource`. A directory row
+ * whose name is its own id is treated as no name at all: `parseDirectory`
+ * falls back to the id for a member Discord sent no name for, and copying
+ * that into the label would turn "unresolved" into "resolved to a
+ * snowflake" without changing a single character on screen.
+ */
+export function rosterPerson(
+  row: ConsentRow,
+  members: readonly NamedRow[] | null,
+): RosterPerson {
+  const id = row.discord_user_id
+  const base = { id, grantedAt: row.granted_at }
+  if (row.display_name) return { ...base, label: row.display_name, source: 'record' }
+  if (members === null) return { ...base, label: id, source: 'unknown' }
+  const found = members.find((member) => member.id === id)
+  if (found && found.name !== id) return { ...base, label: found.name, source: 'directory' }
+  return { ...base, label: id, source: 'unresolved' }
+}
+
+/**
+ * The sentence a row needs under its name, or `null` when it needs none.
+ *
+ * A bare snowflake where every other row has a name reads as a fault in
+ * the console, and it is not one: consent is given by a Discord command,
+ * and a display name is only learned when somebody turns up in a session
+ * that was recorded. The three cases that produce one are three different
+ * facts and get three different sentences — a name borrowed from the
+ * directory is not the same claim as no name anywhere, and no name
+ * anywhere is not the same as not having looked.
+ */
+export function nameNote(person: RosterPerson): Message | null {
+  switch (person.source) {
+    case 'record':
+      return null
+    case 'directory':
+      return { key: 'admin.consents.roster.fromDirectory' }
+    case 'unresolved':
+      return { key: 'admin.consents.roster.unresolved' }
+    default:
+      return { key: 'admin.consents.roster.unlisted' }
+  }
+}
+
+/* -------------------------------------------------------------------- */
+/* Which rows a bulk action may touch                                    */
+/* -------------------------------------------------------------------- */
+
+/**
+ * A row of the list: the consent, the person, and whether a bulk action may
+ * touch them.
+ *
+ * One shape rather than three parallel arrays indexed by position. The
+ * disclosure list hands a row back to its slots, so what it is given is
+ * what the template gets — and a lookup by index into a second array is
+ * exactly how a name ends up beside somebody else's consent when one of
+ * the two is filtered and the other is not.
+ */
+export interface RosterEntry extends UiRow {
+  row: ConsentRow
+  person: RosterPerson
+}
+
+/**
+ * The page as rows, with the already-withdrawn ones locked out of the
+ * selection.
+ *
+ * `revocability` decides, exactly as it does for the single-row button:
+ * this page never offers an action it knows will fail, and a header
+ * checkbox that ticked a withdrawn consent would promise a withdrawal the
+ * API answers `already_revoked` to. Leaving them unselectable is also what
+ * keeps "select this page" honest — the count it produces is the count the
+ * request will carry.
+ *
+ * A *lapsed* consent is still selectable, for the reason `revocability`
+ * gives: the record is still there, and withdrawing removes it rather than
+ * waiting for it.
+ */
+export function rosterEntries(
+  rows: readonly ConsentRow[],
+  members: readonly NamedRow[] | null,
+): RosterEntry[] {
+  return rows.map((row) => ({
+    id: row.discord_user_id,
+    selectable: revocability(row).revocable,
+    row,
+    person: rosterPerson(row, members),
+  }))
+}
+
+/**
+ * Everybody ever ticked, remembered by id.
+ *
+ * A selection survives a page change on purpose — that is the whole reason
+ * `selectionSummary` exists — which means the confirmation has to name
+ * people whose rows are no longer in hand. Remembering them as they are
+ * seen is the only way to state exactly who a withdrawal applies to
+ * without a second request, and a confirmation that could not name them
+ * would be a confirmation of a number.
+ */
+export function rememberPeople(
+  known: Readonly<Record<string, RosterPerson>>,
+  people: readonly RosterPerson[],
+): Record<string, RosterPerson> {
+  const next = { ...known }
+  for (const person of people) next[person.id] = person
+  return next
+}
+
+/**
+ * The selection, as people.
+ *
+ * An id nobody has a record of still comes back — as itself, marked
+ * `unknown` — rather than being dropped. A person quietly missing from the
+ * list in a confirmation is the one case this whole panel exists to
+ * prevent: the reader would approve a withdrawal for a set of names and
+ * the request would carry one more.
+ */
+export function chosenPeople(
+  known: Readonly<Record<string, RosterPerson>>,
+  selected: readonly string[],
+): RosterPerson[] {
+  return selected.map(
+    (id) => known[id] ?? { id, label: id, source: 'unknown' as const, grantedAt: null },
+  )
+}
+
+/* -------------------------------------------------------------------- */
+/* Whether the batch may be sent                                         */
+/* -------------------------------------------------------------------- */
+
+export type BatchVerdict = { ok: true } | { ok: false, problem: Message }
+
+/**
+ * Whether this selection is a request the API will accept.
+ *
+ * Both refusals are client-side and both produce a sentence rather than a
+ * 400 whose body `useApi` deliberately throws away. The oversized one is
+ * the one that matters: a selection grows a page at a time, so the reader
+ * who reaches the bound reached it gradually and has no way of knowing
+ * where it is unless the console says so with the number in it.
+ */
+export function batchVerdict(selected: readonly string[]): BatchVerdict {
+  if (selected.length === 0) {
+    return { ok: false, problem: { key: 'admin.consents.bulk.none' } }
+  }
+  if (selected.length > MAX_BATCH) {
+    return {
+      ok: false,
+      problem: {
+        key: 'admin.consents.bulk.tooMany',
+        params: { count: selected.length, max: MAX_BATCH },
+      },
+    }
+  }
+  return { ok: true }
+}
+
+/**
+ * The latest moment any of these consents was granted, or `null`.
+ *
+ * The floor for a bulk withdrawal's effective instant. A withdrawal cannot
+ * take effect before the consent it withdraws, and the API checks that per
+ * person — so an instant legal for nine people and not for the tenth earns
+ * nine withdrawals and one `effective_before_grant`. Checking against the
+ * latest grant refuses that whole batch up front, with a sentence naming
+ * the moment, rather than half-applying it and explaining afterwards.
+ *
+ * A consent whose grant instant was never recorded contributes no bound,
+ * because a missing field is not a constraint.
+ */
+export function latestGrant(people: readonly RosterPerson[]): string | null {
+  let latest: string | null = null
+  let at = Number.NEGATIVE_INFINITY
+  for (const person of people) {
+    if (!person.grantedAt) continue
+    const when = Date.parse(person.grantedAt)
+    if (Number.isNaN(when) || when <= at) continue
+    at = when
+    latest = person.grantedAt
+  }
+  return latest
+}
+
+/**
+ * The earliest day the picker will offer, in the reader's own zone.
+ *
+ * A bound somebody can see beats one they discover by tripping over it.
+ * The offset is a parameter rather than read from a `Date` in here: the
+ * whole daylight-saving correctness of this feature is that the offset
+ * belongs to the *chosen* moment, and a function that read the browser's
+ * current one would be an hour out for half the year — see
+ * `~/utils/effectiveInstant`.
+ */
+export function grantFloor(iso: string | null, offsetMinutes: number): Day | null {
+  if (!iso) return null
+  const local = localInputFromIso(iso, offsetMinutes)
+  return local ? local.slice(0, 10) : null
+}
+
+/* -------------------------------------------------------------------- */
+/* What must be said before a batch is sent                              */
+/* -------------------------------------------------------------------- */
+
+export interface BulkConfirmation {
+  /** How many, in the heading, so the size of the act is the first thing
+   *  read rather than something counted off a list. */
+  title: Message
+  lead: Message
+  /**
+   * Exactly who, by name, and in the order they were ticked. Not a count,
+   * and not "the selected rows": the reader may be looking at a different
+   * page entirely, and a confirmation they cannot check against is a
+   * confirmation of nothing.
+   */
+  people: RosterPerson[]
+  /**
+   * Three sentences, kept as three, for the reason
+   * `~/utils/consents` keeps the single-row ones as three: a paragraph
+   * carrying all of them is skimmed exactly where the reader most needs to
+   * notice that the roles and the recordings are not part of this.
+   */
+  consequences: Message[]
+  confirmLabel: Message
+}
+
+export function bulkConfirmation(people: readonly RosterPerson[]): BulkConfirmation {
+  return {
+    title: { key: 'admin.consents.bulk.title', params: { count: people.length } },
+    lead: { key: 'admin.consents.bulk.lead', params: { count: people.length } },
+    people: [...people],
+    consequences: [
+      { key: 'admin.consents.bulk.roleStays' },
+      { key: 'admin.consents.bulk.recordingsKept' },
+      { key: 'admin.consents.bulk.audit' },
+    ],
+    confirmLabel: { key: 'admin.consents.bulk.confirm' },
+  }
+}
+
+/**
+ * The request body, from the selection and the chosen instant.
+ *
+ * Ids stay strings — a snowflake exceeds JavaScript's safe integer range,
+ * and the API refuses a JSON number rather than coercing it, precisely so
+ * that an id which lost its last digits can never be mistaken for one that
+ * did not. Repeats are dropped here rather than earning a 400: the API
+ * refuses a duplicate because it answers one outcome per name and cannot
+ * say which of two identical names an outcome belongs to, which is a
+ * reason to send each name once, not a reason to send the request twice.
+ *
+ * **No instant, no field.** Pressing straight through without opening the
+ * control sends the body it always would have, and the API stamps its own
+ * `now` — so "the default is now" stays a fact about the wire.
+ */
+export function bulkRevokeBody(
+  selected: readonly string[],
+  instant: string | null,
+): { discord_user_ids: string[], effective_at?: string } {
+  const ids: string[] = []
+  for (const id of selected) {
+    if (!ids.includes(id)) ids.push(id)
+  }
+  return instant ? { discord_user_ids: ids, effective_at: instant } : { discord_user_ids: ids }
+}
+
+/* -------------------------------------------------------------------- */
+/* What the API answered, person by person                               */
+/* -------------------------------------------------------------------- */
+
+export interface PersonOutcome {
+  discord_user_id: string
+  revoked: boolean
+  /** One of the bounded literals the single-person endpoint uses, or
+   *  `null`. The two endpoints share the vocabulary on purpose, so this
+   *  console writes one sentence per refusal rather than two. */
+  refusal: string | null
+  effective_at: string | null
+  recordings_from_effective_at: number
+}
+
+export interface BulkRevokeResult {
+  guild_id: string | null
+  requested: number
+  revoked: number
+  refused: number
+  outcomes: PersonOutcome[]
+}
+
+function asText(value: unknown): string | null {
+  if (value === null || value === undefined) return null
+  const text = typeof value === 'string' ? value : String(value)
+  return text.trim() === '' ? null : text
+}
+
+/**
+ * The batch endpoint's answer.
+ *
+ * `revoked` is read strictly, per person, for the reason
+ * `parseRevokeResult` reads it strictly: a body this console cannot make
+ * sense of must never be reported as a successful withdrawal, because the
+ * only person who would find out otherwise is the one still being
+ * recorded. An outcome naming nobody is dropped — there is no person it
+ * could be shown against — and the tallies are recounted from the outcomes
+ * rather than taken from the envelope, so a `revoked: 7` beside six
+ * successful outcomes cannot put a number on screen that the list below it
+ * contradicts.
+ */
+export function parseBulkRevoke(payload: unknown): BulkRevokeResult {
+  const envelope = isRecord(payload) ? payload : {}
+  const raw = Array.isArray(envelope.outcomes) ? envelope.outcomes : []
+  const outcomes: PersonOutcome[] = []
+  for (const entry of raw) {
+    if (!isRecord(entry)) continue
+    const id = asText(entry.discord_user_id) ?? asText(entry.user_id)
+    if (!id) continue
+    outcomes.push({
+      discord_user_id: id,
+      revoked: entry.revoked === true,
+      refusal: asText(entry.refusal),
+      effective_at: asText(entry.effective_at),
+      recordings_from_effective_at: asCount(entry.recordings_from_effective_at, 0),
+    })
+  }
+  const revoked = outcomes.filter((outcome) => outcome.revoked).length
+  return {
+    guild_id: asText(envelope.guild_id),
+    requested: asCount(envelope.requested, outcomes.length),
+    revoked,
+    refused: outcomes.length - revoked,
+    outcomes,
+  }
+}
+
+export interface OutcomeRow {
+  person: RosterPerson
+  tone: 'done' | 'refused'
+  /** What happened to this one person, in one sentence. */
+  sentence: Message
+  /**
+   * What the API says it did with the instant, borrowed entire from
+   * `~/utils/effectiveInstant`. The console's arithmetic and the API's are
+   * two arithmetics and only one of them has the recordings table, so this
+   * is built from the echoed `effective_at` rather than from the request.
+   */
+  detail: Line[]
+}
+
+/**
+ * One row per person, and never one sentence for the batch.
+ *
+ * This is the whole reason the endpoint answers 200 for a mixed result. A
+ * batch of ten that came back as "some were refused" is an administrator
+ * who now has to withdraw all ten again one at a time to find out which;
+ * "already withdrawn" against a name is something they can act on, and
+ * "Sturnus holds no consent record for this person at all" against another
+ * sends them somewhere different.
+ *
+ * The outcomes are matched to people by id rather than by position. The
+ * API does answer index-for-index, and relying on that would mean a single
+ * dropped entry renames every outcome after it — which is the one kind of
+ * error here that is invisible on screen, because the wrong sentence
+ * against the wrong name still reads perfectly.
+ */
+export function bulkOutcomeRows(
+  result: BulkRevokeResult,
+  known: Readonly<Record<string, RosterPerson>>,
+): OutcomeRow[] {
+  return result.outcomes.map((outcome) => {
+    const person = known[outcome.discord_user_id] ?? {
+      id: outcome.discord_user_id,
+      label: outcome.discord_user_id,
+      source: 'unknown' as const,
+      grantedAt: null,
+    }
+    if (outcome.revoked) {
+      return {
+        person,
+        tone: 'done' as const,
+        sentence: { key: 'admin.consents.bulk.outcomeWithdrawn' },
+        // The instant is not restated in the sentence above. It is
+        // `effectiveOutcome`'s to say, it is already said in that voice
+        // everywhere else on this page, and two renderings of one moment
+        // are two chances to render it differently.
+        detail: effectiveOutcome(outcome.effective_at, outcome.recordings_from_effective_at),
+      }
+    }
+    return {
+      person,
+      tone: 'refused' as const,
+      sentence: { key: refusalKey(outcome.refusal) },
+      // No instant line under a refusal. Repeating "it takes effect on
+      // Tuesday" beneath "nothing was withdrawn" would describe a
+      // withdrawal that does not exist.
+      detail: [],
+    }
+  })
+}
+
+/**
+ * A refusal, as a key.
+ *
+ * The literals are the API's and are bounded; the default covers both an
+ * unnamed refusal and one this console predates. It has to be true of
+ * every case it can stand in for, which is why it says what is certain —
+ * nothing of theirs changed — rather than guessing at a cause.
+ */
+export function refusalKey(refusal: string | null): string {
+  switch (refusal) {
+    case 'already_revoked':
+      return 'admin.consents.bulk.outcomeAlready'
+    case 'no_consent_on_record':
+      return 'admin.consents.bulk.outcomeNoRecord'
+    case 'effective_before_grant':
+      return 'admin.consents.bulk.outcomeBeforeGrant'
+    default:
+      return 'admin.consents.bulk.outcomeRefused'
+  }
+}
+
+/**
+ * The headline over the per-person list.
+ *
+ * A tally, and only ever a tally: it says how many of the names given came
+ * back withdrawn, and the rows underneath say which. Collapsing the whole
+ * answer into this sentence is exactly what the per-person list exists to
+ * prevent, so it deliberately does not attempt to name the refusals.
+ */
+export function bulkTally(result: BulkRevokeResult): Message {
+  return {
+    key: 'admin.consents.bulk.tally',
+    params: { count: result.revoked, requested: result.requested },
+  }
+}
diff --git a/console/app/utils/consents.ts b/console/app/utils/consents.ts
index 9093098..6fab93a 100644
--- a/console/app/utils/consents.ts
+++ b/console/app/utils/consents.ts
@@ -154,21 +154,16 @@ export function personLabel(row: ConsentRow): string {
 }
 
 /**
- * The line under a nameless row, or `null` when there is a name.
+ * There is no `identityNote` here any more.
  *
- * A bare snowflake where every other row has a name reads as a fault in the
- * console. It is not one: consent is given in a Discord command, and a
- * display name is only learned when somebody turns up in a session that was
- * recorded. Saying so is the difference between "this row is broken" and
- * "this person has consented and has not been in a meeting yet".
+ * The sentence under a nameless row used to be built from the consent
+ * record alone, and it therefore claimed Sturnus had "never had a name to
+ * learn". That is no longer true: the roster consults the guild directory,
+ * which holds display names for exactly these people, and the three
+ * outcomes of asking it -- a name, no entry, no directory to ask -- are
+ * three different facts needing three different sentences. `nameNote` in
+ * `~/utils/consentRoster` says them, in keys rather than in English.
  */
-export function identityNote(row: ConsentRow): string | null {
-  if (row.display_name) return null
-  return (
-    'No display name on record: this is their Discord user id. They gave consent but have not '
-    + 'been in a recorded session since, so Sturnus has never had a name to learn.'
-  )
-}
 
 /* -------------------------------------------------------------------- */
 /* What state a consent is in                                            */
@@ -348,13 +343,20 @@ export const ROLE_STAYS_NOTE =
 
 /**
  * Nothing already recorded is deleted, and the count says how much that is
- * for this person specifically. A general sentence about retention is easy
+ * for this person specifically.
+ *
+ * The name is a parameter with `personLabel` as its default, here and in
+ * the two functions below it. The roster resolves the nameless against the
+ * guild directory, and a confirmation that said "Withdraw Discord user
+ * 100000000000000001's consent?" under a row headed "Ada Lovelace" would be
+ * a confirmation the reader cannot match to the thing they clicked. The
+ * default keeps every caller that has no better name unchanged. A general sentence about retention is easy
  * to read past; "and the four recordings that already contain their audio
  * stay" is not.
  */
-export function recordingsKeptNote(row: ConsentRow): string {
+export function recordingsKeptNote(row: ConsentRow, label: string = personLabel(row)): string {
   const held = row.recordings_with_audio
-  const who = personLabel(row)
+  const who = label
   if (held === 0) {
     return (
       `Nothing already recorded is deleted. Sturnus holds no recordings containing ${who}’s audio `
@@ -394,10 +396,13 @@ export interface RevokeConfirmation {
  * cannot be undone from this console: only the person themselves can grant
  * consent again, with `/consent grant` in Discord.
  */
-export function revokeConfirmation(row: ConsentRow): RevokeConfirmation {
+export function revokeConfirmation(
+  row: ConsentRow,
+  label: string = personLabel(row),
+): RevokeConfirmation {
   return {
-    title: `Withdraw ${personLabel(row)}’s consent?`,
-    consequences: [ROLE_STAYS_NOTE, recordingsKeptNote(row), AUDIT_LOG_NOTE],
+    title: `Withdraw ${label}’s consent?`,
+    consequences: [ROLE_STAYS_NOTE, recordingsKeptNote(row, label), AUDIT_LOG_NOTE],
     confirmLabel: 'Yes, withdraw this consent',
   }
 }
@@ -497,7 +502,11 @@ export interface RevokeOutcome {
  * moment somebody is most likely to believe more happened than did is the
  * moment they have just watched a row change state.
  */
-export function revokeOutcome(row: ConsentRow, result: RevokeResult): RevokeOutcome {
+export function revokeOutcome(
+  row: ConsentRow,
+  result: RevokeResult,
+  label: string = personLabel(row),
+): RevokeOutcome {
   if (!result.revoked) {
     return {
       tone: 'refused',
@@ -513,7 +522,7 @@ export function revokeOutcome(row: ConsentRow, result: RevokeResult): RevokeOutc
         + 'their audio are untouched'
   return {
     tone: 'done',
-    headline: `${personLabel(row)}’s consent is withdrawn.`,
+    headline: `${label}’s consent is withdrawn.`,
     detail:
       'Recording of them stops within about five seconds, mid-session if a meeting is running. '
       + `Their Discord consent role is unchanged, ${recordings}, and this is in the audit log. `
@@ -561,6 +570,19 @@ export function isStaleRow(error: unknown): boolean {
  */
 export function describeConsentError(error: unknown): string {
   switch (statusOf(error)) {
+    case 400:
+      // Two requests on this page can earn a 400, and this sentence has to
+      // be true of both: a page of the roster the API will not serve — a
+      // hand-edited `?page=`, or a bookmark to a page that has since gone —
+      // and a withdrawal naming nobody, the same person twice, or more
+      // people than one request may carry. Both are the console asking for
+      // something malformed rather than the guild being in a state that
+      // refuses it, and in neither case did anything change.
+      return (
+        'Sturnus will not serve that request: it asks for a page of the roster that does not '
+        + 'exist, or names a set of people it cannot accept. Nothing was changed — go back to the '
+        + 'first page and start again.'
+      )
     case 401:
       return 'Your session has ended. Sign in again, then retry — nothing was withdrawn.'
     case 403:
diff --git a/console/i18n/locales/de.json b/console/i18n/locales/de.json
index 91a7e20..2cb8b81 100644
--- a/console/i18n/locales/de.json
+++ b/console/i18n/locales/de.json
@@ -436,6 +436,20 @@
       "errorStatus": "Sturnus hat mit {status} geantwortet und konnte die Zahlen dieses Servers nicht erstellen. Über den Grund ist nichts bekannt."
     },
     "consents": {
+      "roster": {
+        "server": "Welcher Server",
+        "list": "Einwilligungsliste",
+        "showing": "Angezeigt: {from}–{to} von {total}",
+        "showingOne": "Angezeigt: {from} von {total}",
+        "total": "{count} Person hat in diesem Server einen Einwilligungseintrag. | {count} Personen haben in diesem Server einen Einwilligungseintrag.",
+        "inForce": "{count} der {shown} auf dieser Seite ist derzeit gültig. | {count} der {shown} auf dieser Seite sind derzeit gültig.",
+        "beyondEnd": "Diese Seite der Liste gibt es nicht mehr — die Liste hat sich geändert, seit dieser Link entstanden ist. Es fehlt niemand; alle stehen auf einer früheren Seite.",
+        "backToFirst": "Zurück zur ersten Seite",
+        "userId": "Discord-Benutzer-ID",
+        "fromDirectory": "Name aus dem Discord-Verzeichnis dieses Servers; der Einwilligungseintrag selbst trägt keinen.",
+        "unresolved": "Nirgends ein Name: Der Einwilligungseintrag trägt keinen, und das Discord-Verzeichnis dieses Servers kennt diese ID nicht — deshalb steht hier die blanke Discord-Benutzer-ID. Eine Einwilligung entsteht per Discord-Befehl, und einen Namen lernt Sturnus erst, wenn jemand in einer aufgezeichneten Sitzung auftaucht.",
+        "unlisted": "Kein Name im Einwilligungseintrag, und das Discord-Verzeichnis dieses Servers war gerade nicht lesbar — deshalb steht hier die blanke Discord-Benutzer-ID."
+      },
       "scope": {
         "label": "Umfang",
         "audio": "Nur Audio",
@@ -446,7 +460,6 @@
         "legend": "Wirksam ab",
         "nowNote": "Sofort, sofern hier kein anderer Zeitpunkt gewählt wird. Ohne diesen Bereich zu öffnen, verhält sich das Zurücknehmen genau wie bisher.",
         "help": "Ein Zeitpunkt in der Vergangenheit ist eine Aussage über bereits vorhandene Aufnahmen. Ein Zeitpunkt in der Zukunft ist ein vorgemerktes Zurücknehmen: bis dahin wird weiter aufgenommen, danach endet es innerhalb von etwa fünf Sekunden.",
-        "zone": "Gilt als Ortszeit und wird als {offset} gegenüber UTC gesendet. Einen Zeitpunkt ohne Zeitzonenangabe weist Sturnus zurück.",
         "reset": "Zurück auf sofort",
         "unreadable": "Das ist kein Zeitpunkt, den diese Konsole lesen kann. Datum und Uhrzeit wählen oder zurück auf sofort.",
         "beforeGrant": "Diese Einwilligung wurde am {granted} erteilt. Ein Zurücknehmen kann nicht vor der Einwilligung wirken, die es zurücknimmt — diesen oder einen späteren Zeitpunkt wählen.",
@@ -459,6 +472,29 @@
         "fromNone": "Keine Aufnahme mit dieser Stimme fällt auf {when} oder danach.",
         "fromOne": "{count} Aufnahme mit dieser Stimme fällt auf {when} oder danach. Gelöscht wurde sie nicht.",
         "fromMany": "{count} Aufnahmen mit dieser Stimme fallen auf {when} oder danach. Gelöscht wurde keine davon."
+      },
+      "bulk": {
+        "action": "Einwilligung widerrufen",
+        "title": "Einwilligung von {count} Person widerrufen? | Einwilligung von {count} Personen widerrufen?",
+        "lead": "Betrifft genau diese Person und sonst niemanden: | Betrifft genau diese Personen und sonst niemanden:",
+        "roleStays": "Damit werden die von Sturnus gespeicherten Einwilligungseinträge widerrufen. Die Discord-Rolle für Einwilligung wird niemandem entzogen — die API hält bewusst kein Discord-Token und kann keine Rollen ändern. Die Aufzeichnung jeder dieser Personen endet trotzdem innerhalb von etwa fünf Sekunden, auch mitten in einer laufenden Sitzung, denn bei jedem Frame wird der gespeicherte Eintrag geprüft. Sollen auch die Rollen weg, dann in Discord entfernen.",
+        "recordingsKept": "Nichts bereits Aufgezeichnetes wird gelöscht. Jede Aufnahme, die deren Ton schon enthält, bleibt genau dort, wo sie ist; das Löschen ist ein eigener Schritt — /audio purge in Discord.",
+        "audit": "Das geht ins Audit-Log, eine Zeile je Person: das eigene Discord-Konto, wessen Einwilligung widerrufen wurde, und wann.",
+        "confirm": "Ja, diese Einwilligungen widerrufen",
+        "cancel": "Abbrechen",
+        "none": "Nichts ausgewählt, also gibt es nichts zu widerrufen.",
+        "tooMany": "Sturnus widerruft höchstens {max} Einwilligungen pro Anfrage, ausgewählt sind {count}. Diese Grenze entspricht genau einer Seite dieser Liste — also einen Teil der Auswahl aufheben und die Liste Seite für Seite abarbeiten.",
+        "effectiveLegend": "Wirksam ab, für alle oben genannten Personen",
+        "effectiveNote": "Jetzt, sofern hier kein anderer Zeitpunkt gewählt wird. Derselbe Zeitpunkt gilt für jede Person in diesem Widerruf.",
+        "working": "Wird widerrufen …",
+        "tally": "{count} der {requested} genannten Personen wurde widerrufen. | {count} der {requested} genannten Personen wurden widerrufen.",
+        "perPerson": "Was mit jeder einzelnen Person geschehen ist:",
+        "dismiss": "Ausblenden",
+        "outcomeWithdrawn": "Widerrufen.",
+        "outcomeAlready": "Bereits widerrufen — von jemand anderem oder in einem anderen Tab. Gerade hat sich nichts geändert, und es musste sich auch nichts ändern.",
+        "outcomeNoRecord": "Sturnus hat zu dieser Person überhaupt keinen Einwilligungseintrag, es gab also nichts zu widerrufen. Diese Person wird nicht aufgezeichnet.",
+        "outcomeBeforeGrant": "Abgelehnt: Der gewählte Zeitpunkt liegt vor der Einwilligung dieser Person, und ein Widerruf kann nicht vor der Einwilligung wirksam werden, die er widerruft.",
+        "outcomeRefused": "Abgelehnt, ohne dass Sturnus einen Grund genannt hat. Bei dieser Person hat sich nichts geändert."
       }
     },
     "settings": {
diff --git a/console/i18n/locales/en.json b/console/i18n/locales/en.json
index 19b554d..0bb5a22 100644
--- a/console/i18n/locales/en.json
+++ b/console/i18n/locales/en.json
@@ -436,6 +436,20 @@
       "errorStatus": "Sturnus answered {status} and could not produce this server's figures. Nothing is known about why."
     },
     "consents": {
+      "roster": {
+        "server": "Which server",
+        "list": "Consent roster",
+        "showing": "Showing {from}–{to} of {total}",
+        "showingOne": "Showing {from} of {total}",
+        "total": "{count} person has a consent record in this server. | {count} people have a consent record in this server.",
+        "inForce": "{count} of the {shown} on this page is in force right now. | {count} of the {shown} on this page are in force right now.",
+        "beyondEnd": "This page of the roster does not exist any more — the list has changed since this link was made. Nobody is missing; everybody is on an earlier page.",
+        "backToFirst": "Back to the first page",
+        "userId": "Discord user id",
+        "fromDirectory": "Name taken from this server's Discord directory; the consent record itself carries none.",
+        "unresolved": "No name anywhere: the consent record carries none, and this server's Discord directory has no entry for this id — so this row shows the bare Discord user id. Consent is given by a Discord command, and a name is only learned when somebody turns up in a session that was recorded.",
+        "unlisted": "No name on the consent record, and this server's Discord directory could not be read just now — so this row shows the bare Discord user id."
+      },
       "scope": {
         "label": "Scope",
         "audio": "Audio only",
@@ -446,7 +460,6 @@
         "legend": "Effective from",
         "nowNote": "Now, unless another moment is chosen here. Withdrawing without opening this behaves exactly as it always has.",
         "help": "A moment in the past is a statement about recordings that already exist. A moment in the future is a scheduled withdrawal: recording continues until then, and stops within about five seconds of it.",
-        "zone": "Read as your local time and sent as {offset} from UTC. Sturnus rejects a moment that carries no offset.",
         "reset": "Back to now",
         "unreadable": "That is not a moment this console can read. Pick a date and a time, or go back to now.",
         "beforeGrant": "This consent was granted {granted}. A withdrawal cannot take effect before the consent it withdraws — pick that moment or a later one.",
@@ -459,6 +472,29 @@
         "fromNone": "No recording containing their audio falls on or after {when}.",
         "fromOne": "{count} recording containing their audio falls on or after {when}. It was not deleted.",
         "fromMany": "{count} recordings containing their audio fall on or after {when}. None of them were deleted."
+      },
+      "bulk": {
+        "action": "Withdraw consent",
+        "title": "Withdraw consent for {count} person? | Withdraw consent for {count} people?",
+        "lead": "It applies to this person and to nobody else: | It applies to these people and to nobody else:",
+        "roleStays": "This withdraws the consent records Sturnus stores. It removes the Discord consent role from nobody — the API holds no Discord token, by design, and cannot change anybody's roles. Recording of each of them still stops within about five seconds, in the middle of a running session if there is one, because the stored record is what is checked on every frame. If the roles should go too, remove them in Discord.",
+        "recordingsKept": "Nothing already recorded is deleted. Every recording that already contains any of their audio stays exactly where it is; erasing one is a separate act — /audio purge in Discord.",
+        "audit": "This is written to the audit log, one line per person: your Discord account, whose consent you withdrew, and when.",
+        "confirm": "Yes, withdraw these consents",
+        "cancel": "Cancel",
+        "none": "Nothing is selected, so there is nothing to withdraw.",
+        "tooMany": "Sturnus withdraws at most {max} consents in one request, and {count} are selected. That bound is one page of this roster, so clear part of the selection and work through it a page at a time.",
+        "effectiveLegend": "Effective from, for everybody named above",
+        "effectiveNote": "Now, unless another moment is chosen here. The same moment applies to every person in this withdrawal.",
+        "working": "Withdrawing…",
+        "tally": "{count} of the {requested} named was withdrawn. | {count} of the {requested} named were withdrawn.",
+        "perPerson": "What happened to each of them:",
+        "dismiss": "Hide this",
+        "outcomeWithdrawn": "Withdrawn.",
+        "outcomeAlready": "Already withdrawn — by somebody else, or in another tab. Nothing changed just now, and nothing needed to.",
+        "outcomeNoRecord": "Sturnus holds no consent record for this person at all, so there was nothing to withdraw. They are not being recorded.",
+        "outcomeBeforeGrant": "Refused: the moment chosen falls before this person's consent was granted, and a withdrawal cannot take effect before the consent it withdraws.",
+        "outcomeRefused": "Refused, and Sturnus did not say why. Nothing of theirs was changed."
       }
     },
     "settings": {
diff --git a/console/test/consentRoster.spec.ts b/console/test/consentRoster.spec.ts
new file mode 100644
index 0000000..b0681e0
--- /dev/null
+++ b/console/test/consentRoster.spec.ts
@@ -0,0 +1,555 @@
+/**
+ * The consent roster as something somebody can work through.
+ *
+ * Three things are checked here, and all three are ways a paged list with
+ * a bulk action lies without looking wrong:
+ *
+ * - **A window that describes a different list than the one on screen.** A
+ *   `total` counting consent rows rather than people, a page summary
+ *   reading `41–60 of 47`, an envelope from an API that predates paging
+ *   reported as "0 people" over twenty visible rows.
+ * - **A name that is not this person's.** The directory resolves the
+ *   nameless, and the one thing it must never do is quietly hand back a
+ *   snowflake as though it were a name — nor drop somebody it cannot find.
+ * - **A batch that does something other than what the confirmation said.**
+ *   The confirmation names people whose rows the reader can no longer see,
+ *   the request may not exceed a bound the reader was never shown, and the
+ *   answer has to be legible one person at a time.
+ */
+import { describe, expect, it } from 'vitest'
+
+import type { ConsentRow } from '../app/utils/consents'
+import {
+  MAX_BATCH,
+  type RosterPerson,
+  batchVerdict,
+  bulkConfirmation,
+  bulkOutcomeRows,
+  bulkRevokeBody,
+  bulkTally,
+  chosenPeople,
+  grantFloor,
+  latestGrant,
+  nameNote,
+  parseBulkRevoke,
+  parseConsentPage,
+  refusalKey,
+  rememberPeople,
+  rosterCount,
+  rosterInForce,
+  rosterEntries,
+  rosterPerson,
+  rosterSummary,
+} from '../app/utils/consentRoster'
+
+function row(over: Partial<ConsentRow> = {}): ConsentRow {
+  return {
+    discord_user_id: '100000000000000001',
+    display_name: 'Ada',
+    policy_version: '3',
+    granted_at: '2026-01-04T10:00:00+00:00',
+    revoked_at: null,
+    active: true,
+    scope: 'audio',
+    recordings_with_audio: 0,
+    ...over,
+  }
+}
+
+function person(over: Partial<RosterPerson> = {}): RosterPerson {
+  return { id: 'a', label: 'Ada', source: 'record', grantedAt: null, ...over }
+}
+
+describe('one page of the roster', () => {
+  it('reads the rows and the window around them', () => {
+    const page = parseConsentPage(
+      { consents: [{ discord_user_id: '1' }, { discord_user_id: '2' }], total: 137, limit: 20, offset: 40 },
+      20,
+    )
+    expect(page.rows.map((held) => held.discord_user_id)).toEqual(['1', '2'])
+    expect(page.total).toBe(137)
+    expect(page.limit).toBe(20)
+    expect(page.offset).toBe(40)
+  })
+
+  it('reports a total the API sent even when it exceeds the rows in hand', () => {
+    // The whole point of the endpoint: `total` counts people in the guild,
+    // the rows count the page. A parser that reconciled them would be a
+    // pager that only ever offers one page.
+    const page = parseConsentPage({ consents: [{ discord_user_id: '1' }], total: 400 }, 20)
+    expect(page.total).toBe(400)
+  })
+
+  it('falls back to a single page rather than to zero', () => {
+    // An API that predates paging sends no envelope at all. Reporting "0
+    // people" over rows that are visibly there would put this console's
+    // parser on screen as a fact about the guild.
+    const page = parseConsentPage([{ discord_user_id: '1' }, { discord_user_id: '2' }], 20)
+    expect(page.total).toBe(2)
+    expect(page.limit).toBe(20)
+    expect(page.offset).toBe(0)
+  })
+
+  it('refuses a negative or fractional window', () => {
+    const page = parseConsentPage({ consents: [], total: -5, limit: 1.5, offset: -1 }, 20)
+    expect(page.total).toBe(0)
+    expect(page.limit).toBe(1)
+    expect(page.offset).toBe(0)
+  })
+
+  it('survives a payload that is not a page at all', () => {
+    const page = parseConsentPage('nonsense', 20)
+    expect(page.rows).toEqual([])
+    expect(page.total).toBe(0)
+  })
+})
+
+describe('saying which slice is on screen', () => {
+  it('names the range and the total', () => {
+    expect(rosterSummary(137, 40, 20)).toEqual({
+      key: 'admin.consents.roster.showing',
+      params: { from: 41, to: 60, total: 137 },
+    })
+  })
+
+  it('stops at the last row actually shown, not at the end of the window', () => {
+    // A roster of 47 announcing "41-60 of 47" is a list nobody trusts
+    // about anything else either.
+    expect(rosterSummary(47, 40, 7)?.params).toEqual({ from: 41, to: 47, total: 47 })
+  })
+
+  it('has a sentence of its own for a page holding one person', () => {
+    expect(rosterSummary(41, 40, 1)).toEqual({
+      key: 'admin.consents.roster.showingOne',
+      params: { from: 41, total: 41 },
+    })
+  })
+
+  it('says nothing at all about an empty list', () => {
+    // The empty state already says it in a full sentence; an arithmetical
+    // second saying of it underneath reads as a fault.
+    expect(rosterSummary(0, 0, 0)).toBeNull()
+  })
+
+  it('counts people for the guild and force for the page, in two sentences', () => {
+    // One sentence would now mean "3 of 400 are in force" while counting 3
+    // of the 20 rows in hand.
+    expect(rosterCount(400)).toEqual({ key: 'admin.consents.roster.total', params: { count: 400 } })
+    expect(rosterInForce(3, 20)).toEqual({
+      key: 'admin.consents.roster.inForce',
+      params: { count: 3, shown: 20 },
+    })
+  })
+})
+
+describe('putting a name to a snowflake', () => {
+  const MEMBERS = [{ id: '100000000000000001', name: 'Ada Lovelace' }]
+
+  it('prefers the name on the consent record', () => {
+    const named = rosterPerson(row({ display_name: 'Ada' }), MEMBERS)
+    expect(named).toMatchObject({ label: 'Ada', source: 'record' })
+    expect(nameNote(named)).toBeNull()
+  })
+
+  it('borrows a name from the guild directory, and says that it did', () => {
+    const named = rosterPerson(row({ display_name: null }), MEMBERS)
+    expect(named).toMatchObject({ label: 'Ada Lovelace', source: 'directory' })
+    expect(nameNote(named)).toEqual({ key: 'admin.consents.roster.fromDirectory' })
+  })
+
+  it('renders somebody the directory has no row for as their bare id, with a note', () => {
+    // Never a blank, and never silently dropped: this person consented,
+    // and a roster that omits them is a roster that is wrong about who
+    // may be recorded.
+    const named = rosterPerson(row({ display_name: null, discord_user_id: '999' }), MEMBERS)
+    expect(named).toMatchObject({ label: '999', source: 'unresolved' })
+    expect(nameNote(named)).toEqual({ key: 'admin.consents.roster.unresolved' })
+  })
+
+  it('will not accept a directory row whose name is its own id', () => {
+    // `parseDirectory` labels a member Discord sent no name for with their
+    // id. Copying that into the label would turn "unresolved" into
+    // "resolved" without changing a character on screen.
+    const named = rosterPerson(row({ display_name: null, discord_user_id: '77' }), [
+      { id: '77', name: '77' },
+    ])
+    expect(named.source).toBe('unresolved')
+  })
+
+  it('distinguishes "the directory has no such member" from "there was no directory"', () => {
+    // Two different facts. Telling somebody their guild is missing a
+    // member when the console simply did not look is a support ticket
+    // about Discord that belongs to the console.
+    const named = rosterPerson(row({ display_name: null }), null)
+    expect(named.source).toBe('unknown')
+    expect(nameNote(named)).toEqual({ key: 'admin.consents.roster.unlisted' })
+  })
+
+  it('carries the grant instant along with the name', () => {
+    // A selection outlives the page it was made on, so the facts needed to
+    // validate it have to as well.
+    expect(rosterPerson(row({ granted_at: '2026-01-04T10:00:00+00:00' }), null).grantedAt).toBe(
+      '2026-01-04T10:00:00+00:00',
+    )
+  })
+
+  it('names a whole page in the order it was given', () => {
+    const entries = rosterEntries(
+      [row({ discord_user_id: 'a' }), row({ discord_user_id: 'b' })],
+      null,
+    )
+    expect(entries.map((entry) => entry.person.id)).toEqual(['a', 'b'])
+  })
+})
+
+describe('which rows a bulk withdrawal may touch', () => {
+  it('locks an already-withdrawn consent out of the selection', () => {
+    // The API answers `already_revoked` every time, and a header checkbox
+    // that ticked one would promise a withdrawal that is then refused.
+    const entries = rosterEntries(
+      [
+        row({ discord_user_id: 'a' }),
+        row({ discord_user_id: 'b', revoked_at: '2026-02-01T00:00:00+00:00', active: false }),
+      ],
+      null,
+    )
+    expect(entries.map((entry) => [entry.id, entry.selectable])).toEqual([
+      ['a', true],
+      ['b', false],
+    ])
+  })
+
+  it('still offers a lapsed consent', () => {
+    // The record is still there; withdrawing removes it rather than
+    // waiting for it, which matters the moment somebody rolls
+    // `policy_version` back.
+    expect(rosterEntries([row({ active: false, revoked_at: null })], null)[0]?.selectable).toBe(true)
+  })
+
+  it('carries the consent and the person on the row itself', () => {
+    // One shape rather than two arrays indexed by position: a lookup by
+    // index is how a name ends up beside somebody else's consent.
+    const entry = rosterEntries([row({ display_name: null })], [
+      { id: '100000000000000001', name: 'Ada Lovelace' },
+    ])[0]
+    expect(entry?.row.discord_user_id).toBe('100000000000000001')
+    expect(entry?.person.label).toBe('Ada Lovelace')
+  })
+})
+
+describe('remembering who was ticked', () => {
+  it('keeps people the reader has paged away from', () => {
+    const known = rememberPeople({}, [person({ id: 'a' }), person({ id: 'b', label: 'Grace' })])
+    const later = rememberPeople(known, [person({ id: 'c', label: 'Alan' })])
+    expect(chosenPeople(later, ['a', 'c']).map((held) => held.label)).toEqual(['Ada', 'Alan'])
+  })
+
+  it('does not mutate what it was given', () => {
+    const known = {}
+    rememberPeople(known, [person({ id: 'a' })])
+    expect(known).toEqual({})
+  })
+
+  it('returns an unknown id as itself rather than dropping it', () => {
+    // A person quietly missing from a confirmation is the one failure this
+    // panel exists to prevent: the reader approves a list of names and the
+    // request carries one more.
+    expect(chosenPeople({}, ['404'])).toEqual([
+      { id: '404', label: '404', source: 'unknown', grantedAt: null },
+    ])
+  })
+
+  it('keeps the selection in the order it was made', () => {
+    const known = rememberPeople({}, [person({ id: 'a' }), person({ id: 'b', label: 'Grace' })])
+    expect(chosenPeople(known, ['b', 'a']).map((held) => held.id)).toEqual(['b', 'a'])
+  })
+})
+
+describe('whether the batch may be sent at all', () => {
+  it('accepts a selection within the bound', () => {
+    expect(batchVerdict(['a', 'b'])).toEqual({ ok: true })
+  })
+
+  it('refuses an empty selection', () => {
+    expect(batchVerdict([])).toEqual({
+      ok: false,
+      problem: { key: 'admin.consents.bulk.none' },
+    })
+  })
+
+  it('refuses more people than the API will take, and says the number', () => {
+    // A selection grows a page at a time, so whoever reaches the bound
+    // reached it gradually and cannot know where it is unless it is said.
+    const many = Array.from({ length: MAX_BATCH + 1 }, (_, index) => String(index))
+    expect(batchVerdict(many)).toEqual({
+      ok: false,
+      problem: {
+        key: 'admin.consents.bulk.tooMany',
+        params: { count: MAX_BATCH + 1, max: MAX_BATCH },
+      },
+    })
+  })
+
+  it('accepts exactly the bound', () => {
+    const exactly = Array.from({ length: MAX_BATCH }, (_, index) => String(index))
+    expect(batchVerdict(exactly).ok).toBe(true)
+  })
+})
+
+describe('the floor a bulk withdrawal may take effect from', () => {
+  it('is the latest grant among the people chosen', () => {
+    // An instant legal for nine people and not the tenth earns nine
+    // withdrawals and one refusal. Checking the latest refuses the batch
+    // up front instead.
+    expect(
+      latestGrant([
+        person({ grantedAt: '2026-01-04T10:00:00+00:00' }),
+        person({ grantedAt: '2026-03-09T08:00:00+00:00' }),
+        person({ grantedAt: '2026-02-01T00:00:00+00:00' }),
+      ]),
+    ).toBe('2026-03-09T08:00:00+00:00')
+  })
+
+  it('ignores a grant instant that was never recorded', () => {
+    expect(latestGrant([person({ grantedAt: null }), person({ grantedAt: 'not a moment' })])).toBeNull()
+  })
+
+  it('is null when nobody is chosen', () => {
+    expect(latestGrant([])).toBeNull()
+  })
+
+  it('becomes the earliest day the picker offers, in the reader’s own zone', () => {
+    // Berlin in January is +01:00, so 00:30 UTC is already the 5th there.
+    expect(grantFloor('2026-01-05T00:30:00+00:00', -60)).toBe('2026-01-05')
+    // And the same instant west of Greenwich is still the 4th.
+    expect(grantFloor('2026-01-05T00:30:00+00:00', 300)).toBe('2026-01-04')
+  })
+
+  it('offers no floor at all where there is no grant instant', () => {
+    expect(grantFloor(null, 0)).toBeNull()
+    expect(grantFloor('not a moment', 0)).toBeNull()
+  })
+})
+
+describe('what is said before a batch is sent', () => {
+  const PEOPLE = [person({ id: 'a' }), person({ id: 'b', label: 'Grace' })]
+
+  it('states exactly who, by name, and how many', () => {
+    const confirmation = bulkConfirmation(PEOPLE)
+    expect(confirmation.title).toEqual({
+      key: 'admin.consents.bulk.title',
+      params: { count: 2 },
+    })
+    expect(confirmation.people.map((held) => held.label)).toEqual(['Ada', 'Grace'])
+  })
+
+  it('keeps the three limits as three sentences', () => {
+    // A paragraph carrying all of them is skimmed exactly where the reader
+    // most needs to notice that the roles and the recordings are not part
+    // of this.
+    expect(bulkConfirmation(PEOPLE).consequences.map((held) => held.key)).toEqual([
+      'admin.consents.bulk.roleStays',
+      'admin.consents.bulk.recordingsKept',
+      'admin.consents.bulk.audit',
+    ])
+  })
+
+  it('does not hand back the array it was given', () => {
+    const people = [person({ id: 'a' })]
+    bulkConfirmation(people).people.push(person({ id: 'z' }))
+    expect(people).toHaveLength(1)
+  })
+})
+
+describe('the request body', () => {
+  it('sends the ids as strings, in the order they were ticked', () => {
+    expect(bulkRevokeBody(['200', '100'], null)).toEqual({ discord_user_ids: ['200', '100'] })
+  })
+
+  it('sends no instant field at all when none was chosen', () => {
+    // Pressing straight through sends the body it always would have, and
+    // the API stamps its own `now`.
+    expect('effective_at' in bulkRevokeBody(['1'], null)).toBe(false)
+  })
+
+  it('sends the instant when one was chosen', () => {
+    expect(bulkRevokeBody(['1'], '2026-03-01T12:00:00+01:00')).toEqual({
+      discord_user_ids: ['1'],
+      effective_at: '2026-03-01T12:00:00+01:00',
+    })
+  })
+
+  it('names each person once', () => {
+    // The API refuses a repeat because it answers one outcome per name and
+    // cannot say which of two identical names an outcome belongs to.
+    expect(bulkRevokeBody(['1', '2', '1'], null).discord_user_ids).toEqual(['1', '2'])
+  })
+})
+
+describe('what the API answered', () => {
+  const ANSWER = {
+    guild_id: '55',
+    requested: 3,
+    revoked: 1,
+    refused: 2,
+    outcomes: [
+      {
+        discord_user_id: '1',
+        revoked: true,
+        refusal: null,
+        effective_at: '2026-03-01T12:00:00+00:00',
+        recordings_from_effective_at: 2,
+      },
+      { discord_user_id: '2', revoked: false, refusal: 'already_revoked' },
+      { discord_user_id: '3', revoked: false, refusal: 'no_consent_on_record' },
+    ],
+  }
+
+  it('reads one outcome per person', () => {
+    const result = parseBulkRevoke(ANSWER)
+    expect(result.guild_id).toBe('55')
+    expect(result.requested).toBe(3)
+    expect(result.outcomes).toHaveLength(3)
+  })
+
+  it('counts the tallies from the outcomes rather than from the envelope', () => {
+    // A `revoked: 7` beside six successful outcomes would put a number on
+    // screen that the list below it contradicts.
+    const result = parseBulkRevoke({ ...ANSWER, revoked: 7, refused: 0 })
+    expect(result.revoked).toBe(1)
+    expect(result.refused).toBe(2)
+  })
+
+  it('treats anything but a literal true as not withdrawn', () => {
+    // The only person who finds out otherwise is the one still being
+    // recorded.
+    const result = parseBulkRevoke({ outcomes: [{ discord_user_id: '1', revoked: 'true' }] })
+    expect(result.outcomes[0]?.revoked).toBe(false)
+  })
+
+  it('drops an outcome naming nobody', () => {
+    const result = parseBulkRevoke({ outcomes: [{ revoked: true }, { discord_user_id: '1' }] })
+    expect(result.outcomes.map((held) => held.discord_user_id)).toEqual(['1'])
+  })
+
+  it('survives a body it cannot read', () => {
+    expect(parseBulkRevoke(null)).toEqual({
+      guild_id: null,
+      requested: 0,
+      revoked: 0,
+      refused: 0,
+      outcomes: [],
+    })
+  })
+})
+
+describe('the mixed answer, person by person', () => {
+  const KNOWN = {
+    1: person({ id: '1', label: 'Ada' }),
+    2: person({ id: '2', label: 'Grace' }),
+  }
+
+  it('gives each person their own sentence', () => {
+    // The reason the endpoint answers 200 for a mixed result. "Some were
+    // refused" is an administrator who has to withdraw all ten again one
+    // at a time to find out which.
+    const rows = bulkOutcomeRows(
+      parseBulkRevoke({
+        outcomes: [
+          { discord_user_id: '1', revoked: true, effective_at: null },
+          { discord_user_id: '2', revoked: false, refusal: 'already_revoked' },
+        ],
+      }),
+      KNOWN,
+    )
+    expect(rows.map((held) => [held.person.label, held.tone, held.sentence.key])).toEqual([
+      ['Ada', 'done', 'admin.consents.bulk.outcomeWithdrawn'],
+      ['Grace', 'refused', 'admin.consents.bulk.outcomeAlready'],
+    ])
+  })
+
+  it('matches outcomes to people by id rather than by position', () => {
+    // The API does answer index-for-index; relying on it means one dropped
+    // entry renames every outcome after it, and the wrong sentence against
+    // the wrong name still reads perfectly.
+    const rows = bulkOutcomeRows(
+      parseBulkRevoke({
+        outcomes: [
+          { discord_user_id: '2', revoked: true },
+          { discord_user_id: '1', revoked: false, refusal: 'no_consent_on_record' },
+        ],
+      }),
+      KNOWN,
+    )
+    expect(rows.map((held) => held.person.label)).toEqual(['Grace', 'Ada'])
+  })
+
+  it('reports what the API did with the instant, under the people it did it to', () => {
+    const rows = bulkOutcomeRows(
+      parseBulkRevoke({
+        outcomes: [
+          {
+            discord_user_id: '1',
+            revoked: true,
+            effective_at: '2026-03-01T12:00:00+00:00',
+            recordings_from_effective_at: 2,
+          },
+        ],
+      }),
+      KNOWN,
+    )
+    expect(rows[0]?.detail.map((line) => line.key)).toEqual([
+      'admin.consents.effective.tookEffect',
+      'admin.consents.effective.fromMany',
+    ])
+  })
+
+  it('says nothing about an instant under a refusal', () => {
+    // "It takes effect on Tuesday" beneath "nothing was withdrawn"
+    // describes a withdrawal that does not exist.
+    const rows = bulkOutcomeRows(
+      parseBulkRevoke({
+        outcomes: [
+          {
+            discord_user_id: '1',
+            revoked: false,
+            refusal: 'already_revoked',
+            effective_at: '2026-03-01T12:00:00+00:00',
+          },
+        ],
+      }),
+      KNOWN,
+    )
+    expect(rows[0]?.detail).toEqual([])
+  })
+
+  it('names somebody it has no record of rather than leaving the row blank', () => {
+    const rows = bulkOutcomeRows(
+      parseBulkRevoke({ outcomes: [{ discord_user_id: '404', revoked: true }] }),
+      KNOWN,
+    )
+    expect(rows[0]?.person).toMatchObject({ label: '404', source: 'unknown' })
+  })
+
+  it('has a sentence for every refusal the API can name, and one for the ones it cannot', () => {
+    expect(refusalKey('already_revoked')).toBe('admin.consents.bulk.outcomeAlready')
+    expect(refusalKey('no_consent_on_record')).toBe('admin.consents.bulk.outcomeNoRecord')
+    expect(refusalKey('effective_before_grant')).toBe('admin.consents.bulk.outcomeBeforeGrant')
+    expect(refusalKey(null)).toBe('admin.consents.bulk.outcomeRefused')
+    expect(refusalKey('something_new')).toBe('admin.consents.bulk.outcomeRefused')
+  })
+
+  it('heads the list with a tally and leaves the detail to the rows', () => {
+    const result = parseBulkRevoke({
+      requested: 10,
+      outcomes: [
+        { discord_user_id: '1', revoked: true },
+        { discord_user_id: '2', revoked: false, refusal: 'already_revoked' },
+      ],
+    })
+    expect(bulkTally(result)).toEqual({
+      key: 'admin.consents.bulk.tally',
+      params: { count: 1, requested: 10 },
+    })
+  })
+})
diff --git a/console/test/consents.spec.ts b/console/test/consents.spec.ts
index 43f2890..ad83e7e 100644
--- a/console/test/consents.spec.ts
+++ b/console/test/consents.spec.ts
@@ -23,7 +23,6 @@ import {
   describeConsentError,
   describeRefusal,
   grantedLine,
-  identityNote,
   isStaleRow,
   orderConsents,
   parseConsents,
@@ -167,20 +166,23 @@ describe('naming a person', () => {
     )
   })
 
-  it('says plainly that a nameless row is showing an id', () => {
-    const note = identityNote(row({ discord_user_id: '100' }))!
-    expect(note).toContain('Discord user id')
-  })
-
-  it('explains why there is no name rather than looking broken', () => {
-    // A bare snowflake where every other row has a name reads as a fault in
-    // the console. It is not: consent is given in a command, and a name is
-    // only learned in a recorded session.
-    expect(identityNote(row({ discord_user_id: '100' }))!).toContain('recorded session')
+  it('lets a caller supply a better name than it could derive', () => {
+    // The roster resolves the nameless against the guild directory. A
+    // confirmation reading "Withdraw Discord user 100's consent?" under a
+    // row headed "Ada Lovelace" is one the reader cannot match to the
+    // thing they clicked.
+    const nameless = row({ discord_user_id: '100', display_name: null })
+    expect(revokeConfirmation(nameless, 'Ada Lovelace').title).toContain('Ada Lovelace')
+    expect(recordingsKeptNote(nameless, 'Ada Lovelace')).toContain('Ada Lovelace')
+    expect(
+      revokeOutcome(nameless, { revoked: true, refusal: null, effective_at: null, recordings_from_effective_at: 0 }, 'Ada Lovelace').headline,
+    ).toContain('Ada Lovelace')
   })
 
-  it('says nothing at all when there is a name', () => {
-    expect(identityNote(row({ discord_user_id: '100', display_name: 'Anna' }))).toBeNull()
+  it('still derives one when the caller has nothing better', () => {
+    expect(revokeConfirmation(row({ discord_user_id: '100', display_name: null })).title).toContain(
+      'Discord user 100',
+    )
   })
 })
 
@@ -495,6 +497,16 @@ describe('when the API says no', () => {
     expect(said.toLowerCase()).toContain('same')
   })
 
+  it('explains a 400 as a request the console built, not a guild that refused', () => {
+    // Two requests on this page earn one: a page of the roster that does
+    // not exist, and a withdrawal naming a set of people the API will not
+    // take. The sentence has to be true of both, and it has to say that
+    // nothing changed — otherwise a stale bookmark reads as a failed write.
+    const said = describeConsentError(failure(400))
+    expect(said.toLowerCase()).toContain('does not exist')
+    expect(said).toContain('Nothing was changed')
+  })
+
   it('describes a 409 as the row being out of date', () => {
     expect(describeConsentError(failure(409))).toBe(describeRefusal(null))
   })