diff --git a/docs/init-config-surface.md b/docs/init-config-surface.md
index 9dec258..7bb578d 100644
--- a/docs/init-config-surface.md
+++ b/docs/init-config-surface.md
@@ -68,7 +68,7 @@ intentionally unsupported.
 | config.profiles.<name>.git.identity_cache | Not shown as an editable init field. Preserve only. | Intentionally unsupported for init and config mutation. Runtime identity refresh owns it. | Existing cache is preserved. New profiles omit it. | Preserve unless a future explicit cache invalidation ticket owns behavior. Profile rename does not rewrite cache contents. | Preserve-only regression in #177/#180. |
 | config.profiles.<name>.reviewer_credentials | Optional reviewer credential section. Wizard supports skip, preserve, enable, edit, or clear reviewer config. | Existing `cr init --reviewer-credential-ref` and `--reviewer-auth-mode` own enable/edit. `cr init --disable-reviewer` owns scripted removal. | Omitted means posting uses Git credentials. Existing section is pre-populated. | Clear removes the whole section. Enable requires auth mode and credential ref. Ref must differ from Git and LLM refs. | #179 planner and #180 optional section tests. #181 secret ingress tests. |
 | config.profiles.<name>.reviewer_credentials.auth_mode | Reviewer wizard chooses PAT or GitHub App; `oauth_device` remains reserved. | Existing `cr init --reviewer-auth-mode`. | Current init defaults reviewer mode to `pat` when reviewer credentials are requested. Existing value is pre-populated. | Overwrite only to supported v1 modes. Switching modes re-plans key specs and preserves old secrets unless explicit overwrite/migration occurs. | #179 credential bundle tests for PAT and GitHub App. |
-| config.profiles.<name>.reviewer_credentials.credential_ref | Credential-ref planner chooses reviewer Git ref. | Existing `cr init --reviewer-credential-ref`; `cr set-credential` writes secrets. | New reviewer section defaults to `codereview/<profile>-reviewer`. Existing ref is pre-populated and preserved. | Flattened interactive init shows the effective reviewer storage label only when a separate reviewer entity is active. Leaving the field at its effective default means "follow the selected reviewer entity's default label" across later entity changes; entering a different value makes it a preserved custom override. Switching back to posting with the profile Git account clears the reviewer ref from config. | #179 planner tests collision handling. #181 secret ingress tests. |
+| config.profiles.<name>.reviewer_credentials.credential_ref | Credential-ref planner chooses reviewer Git ref. | Existing `cr init --reviewer-credential-ref`; `cr set-credential` writes secrets. | New reviewer section defaults to `codereview/<profile>-reviewer`, or `codereview/<label>-reviewer` when the user types a new reviewer entity label. Existing ref is pre-populated and preserved. | Flattened interactive init shows the effective reviewer storage label only when a separate reviewer entity is active. Label-derived defaults apply only while creating a new reviewer and before the user manually edits the storage label. Editing an existing reviewer label never migrates the credential ref. Switching back to posting with the profile Git account clears the reviewer ref from config. | #179 planner tests collision handling. #181 secret ingress tests. |
 | config.profiles.<name>.reviewer_credentials.display_name | Reviewer wizard lets the user set or clear a human-friendly label for a separate reviewer entity. | Interactive `cr init` only for now. No dedicated scripted owner yet. | Empty means chooser labels fall back to deterministic credential-ref/profile-derived text. Existing value is pre-populated. | Preserve on skip. Overwrite trims surrounding whitespace. Clear is valid and returns the entity to fallback labeling. Conflicting labels across profiles that share one reviewer identity do not create duplicate identities; the shared chooser entry falls back to deterministic identity text until one label wins. | #244 tests round-trip, validation, shared-identity conflict fallback, and chooser labeling. |
 | config.profiles.<name>.reviewer_credentials.identity_cache | Not shown as an editable init field. Preserve only. | Intentionally unsupported for init and config mutation. Runtime identity refresh owns it. | Existing cache is preserved. New reviewer sections omit it. | Preserve unless a future explicit cache invalidation ticket owns behavior. | Preserve-only regression in #177/#180. |
 | config.profiles.<name>.llm.provider | Core profile wizard chooses provider. | Existing `cr init --llm-provider`. | Current init defaults to `anthropic`. Existing value is pre-populated. | Overwrite validates provider and may require compatible auth/adapter/key specs. | #179 provider credential planning. #180 provider/auth/adapter compatibility tests. |
@@ -158,8 +158,8 @@ owns interactive secret ingress.
 | Purpose | Auth/provider | Ref default | Required keys | Optional keys | Keep/defer/overwrite semantics | Migration rule |
 |---------|---------------|-------------|---------------|---------------|--------------------------------|----------------|
 | User Git auth | `pat` | `codereview/<profile>` | `git_token` | None | Keep preserves existing ref and key. Defer stores ref and prints follow-up `cr set-credential`. Overwrite writes `git_token` through keyring only. | Profile rename preserves ref. Regenerate only with explicit key migration or overwrite. |
-| Reviewer Git auth | `pat` | `codereview/<profile>-reviewer` | `git_token` | None | Same as user Git, but ref must differ from user Git ref. Clearing the reviewer section removes the ref from config but does not delete secrets. | Profile rename preserves ref unless #181 migrates or overwrites. |
-| User or reviewer Git auth | `github_app` | Same purpose-specific defaults as PAT | `github_app_id`, `github_app_private_key` | `github_app_installation_id` | Keep preserves bundle. Defer stores ref and prints one follow-up command per key. Overwrite writes only keys the user provided, with required-key validation before saving. | Migration is bundle-wide: never leave config pointing at a partially moved bundle. |
+| Reviewer Git auth | `pat` | `codereview/<profile>-reviewer`, or label-derived for new interactive reviewer entities | `git_token` | None | Interactive reviewer setup collects `git_token` inline before staging a new or changed reviewer ref. Keep preserves an unchanged existing ref. Clearing the reviewer section removes the ref from config but does not delete secrets. | Profile rename and reviewer label edits preserve existing refs. No implicit ref migration. |
+| User or reviewer Git auth | `github_app` | Same purpose-specific defaults as PAT | `github_app_id`, `github_app_private_key` | `github_app_installation_id` | Keep preserves bundle. Interactive reviewer setup collects required GitHub App keys inline before staging a new or changed reviewer ref; optional installation ID may be left blank. Scripted/deferred flows print one follow-up command per required key. Overwrite writes only keys the user provided, with required-key validation before saving. | Migration is bundle-wide and explicit only: never leave config pointing at a partially moved bundle. |
 | Git auth | `oauth_device` | None | None | None | Unsupported in v1. The wizard must not offer it as a selectable mode. | Future OAuth work must amend this document. |
 | LLM API key | `anthropic` + `api_key` | `codereview/<profile>-llm` | `anthropic_api_key` | None | Keep preserves existing ref. Defer stores ref only if the key already exists or follow-up is clearly rendered. Overwrite writes provider key through keyring. | Preserve custom refs on rename. Regeneration requires explicit migration/overwrite. |
 | LLM API key | `openai` + `api_key` | `codereview/<profile>-llm` | `openai_api_key` | None | Same as Anthropic API-key auth. | Same as Anthropic API-key auth. |
@@ -202,7 +202,8 @@ Scripted installs should remain readable. The intended shape is:
 
 1. Run `cr init --non-interactive` for the profile's core non-secret config and
    any secrets intentionally supplied through stdin/env ingress.
-2. Use `cr set-credential` for deferred or multi-key credential bundles.
+2. Use `cr set-credential` for scripted, deferred, or post-init credential
+   bundles.
 3. Use `cr config default`, `cr config route`, `cr config agent-source`,
    `cr config llm models`, and `cr config retention` for narrow idempotent
    mutations.
diff --git a/docs/init-ux-contract.md b/docs/init-ux-contract.md
index a2c0267..d252337 100644
--- a/docs/init-ux-contract.md
+++ b/docs/init-ux-contract.md
@@ -144,18 +144,18 @@ Until the user chooses **Commit staged changes and exit**:
 
 Interactive `init` must offer both:
 
-- **Commit staged changes and exit**: validate the draft, collect or defer any
-  still-unhandled required secrets, then write config and keyring state in the
-  defined final commit order
+- **Commit staged changes and exit**: validate the draft, write any staged
+  secret values, then write config and keyring state in the defined final
+  commit order
 - **Discard staged changes and exit**: discard the draft and leave both config and
   keyring untouched
 
 Credential values may be collected inside the relevant subflow once the user has
-enough local context to understand why each secret is needed. For example,
-reviewer-entity setup may collect PAT or GitHub App reviewer secrets immediately
-after the reviewer settings are staged. Those values remain draft-local until
-commit; final commit still handles untouched or deferred Git, reviewer, and LLM
-credential refs.
+enough local context to understand why each secret is needed. Reviewer-entity
+setup collects the required PAT or GitHub App reviewer secrets inline on the
+reviewer details page before a new reviewer can be staged. Those values remain
+draft-local until commit; final commit still handles untouched or deferred Git
+and LLM credential refs.
 
 If the user cancels during credential collection, whether from a subflow or after
 choosing **Commit staged changes and exit**, any pending secret values remain
@@ -177,7 +177,9 @@ selected reviewer credential ref:
 - `staged` means a draft-local value will be written at final commit.
 - `skipped optional` means the user explicitly skipped an optional key in the
   current draft.
-- `deferred` means the user deferred a required key in the current draft.
+- `deferred` means the user deferred a required key in the current draft. New
+  interactive reviewer setup should not offer deferral for required reviewer
+  keys; they must be entered inline before staging.
 - `optional` means an optional key has no staged, skipped, or existing value.
 - `status unavailable` means the backend or key contract could not be inspected,
   so the UI must not claim a key is missing.
@@ -313,6 +315,10 @@ Primary-path users should not be asked for `credential_ref` values directly.
 Instead:
 
 - defaults should be generated automatically
+- new reviewer defaults may follow the typed entity label, for example
+  `rianjs-bot` becomes `codereview/rianjs-bot-reviewer`
+- changing an existing reviewer label must not migrate or rename the existing
+  credential-store ref
 - users who need an override may edit the relevant inline **storage label**
   fields for Git, reviewer, or LLM secrets
 - irrelevant reviewer/LLM storage-label fields should stay hidden when the
diff --git a/internal/cmd/credentialcmd/credentialcmd.go b/internal/cmd/credentialcmd/credentialcmd.go
index 75ed048..a3088e9 100644
--- a/internal/cmd/credentialcmd/credentialcmd.go
+++ b/internal/cmd/credentialcmd/credentialcmd.go
@@ -253,33 +253,38 @@ const (
 )
 
 type initDraft struct {
-	Action                initDraftAction
-	ActionTarget          string
-	OriginalProfileName   string
-	ProfileName           string
-	MakeDefault           bool
-	GitHost               string
-	GitAuth               string
-	GitCredentialRef      string
-	ReviewerEnabled       bool
-	ReviewerAuth          string
-	ReviewerCredentialRef string
-	ReviewerDisplayName   string
-	SecretsProfile        string
-	LLMProvider           string
-	LLMAuth               string
-	LLMAdapter            string
-	LLMReviewerModelTier  string
-	LLMCredentialRef      string
-	AdvancedStorageLabels bool
-	RoutesSet             bool
-	Routes                []configedit.RepositoryRouteSpec
-	ModelMapSet           bool
-	ModelMap              config.ModelMap
-	AgentSourcesSet       bool
-	AgentSources          []string
-	ReviewPolicySet       bool
-	ReviewPolicy          config.ReviewPolicy
+	Action                       initDraftAction
+	ActionTarget                 string
+	OriginalProfileName          string
+	ProfileName                  string
+	MakeDefault                  bool
+	GitHost                      string
+	GitAuth                      string
+	GitCredentialRef             string
+	ReviewerEnabled              bool
+	ReviewerAuth                 string
+	ReviewerCredentialRef        string
+	ReviewerDisplayName          string
+	ReviewerCredentialWriteRef   string
+	ReviewerCredentialWriteStore credentials.ResolvedSecretsProfile
+	ReviewerCredentialWrites     map[string]string
+	ReviewerCredentialOverwrite  bool
+	ReviewerCredentialSatisfied  bool
+	SecretsProfile               string
+	LLMProvider                  string
+	LLMAuth                      string
+	LLMAdapter                   string
+	LLMReviewerModelTier         string
+	LLMCredentialRef             string
+	AdvancedStorageLabels        bool
+	RoutesSet                    bool
+	Routes                       []configedit.RepositoryRouteSpec
+	ModelMapSet                  bool
+	ModelMap                     config.ModelMap
+	AgentSourcesSet              bool
+	AgentSources                 []string
+	ReviewPolicySet              bool
+	ReviewPolicy                 config.ReviewPolicy
 }
 
 type initModelMapPrompt struct {
@@ -487,6 +492,7 @@ type initSessionDraft struct {
 	workspace                    *initWorkspaceDraft
 	touchedProfiles              map[string]string
 	writes                       map[string]map[string]string
+	credentialWriteStores        map[string]credentials.ResolvedSecretsProfile
 	credentialDecisions          map[initCredentialDecisionKey]initCredentialDecisionKind
 	overwriteRefs                map[string]bool
 	satisfiedRefs                map[string]bool
@@ -567,6 +573,7 @@ type initStore interface {
 	Exists(profile, key string) (bool, error)
 	ListBundle(profile string) ([]string, error)
 	SetBundle(profile string, kv map[string]string, opts ...credstore.SetOpt) (credstore.Result, error)
+	Delete(profile, key string) error
 	Close() error
 }
 
@@ -1494,8 +1501,6 @@ func editInteractiveInitReviewerEntityStep(cmd *cobra.Command, opts *root.Option
 	case initDraftActionDeleteProfile, initDraftActionUndoDeleteProfile, initDraftActionDeleteLLMRuntime, initDraftActionUndoDeleteLLMRuntime:
 		return initSessionDraft{}, false, fmt.Errorf("unsupported reviewer-entity draft action %q", draft.Action)
 	}
-	previousProfileName := session.workspace.profileName
-	previousProfile := session.workspace.profile
 	previousCfg := cloneInitConfigFile(session.cfg)
 	previousEntity := initReviewerEntityDraft{}
 	if draft.ActionTarget != "" {
@@ -1515,6 +1520,7 @@ func editInteractiveInitReviewerEntityStep(cmd *cobra.Command, opts *root.Option
 	session.cfg = propagateSharedReviewerEntityChanges(previousCfg, session.cfg, workspace.profileName, previousEntity, nextEntity)
 	session = rebuildInteractiveInitWorkspace(session, workspace.profileName)
 	session.requestedProfileName = workspace.profileName
+	session = mergeReviewerCredentialDraftWrites(session, draft)
 	if session.workspace != nil {
 		credentialPlan, err := planInitCredentialsWithConfig(session.cfg, workspace.previousProfile, session.workspace.profile, projectInitPlannedWriteKeys(session.writes))
 		if err != nil {
@@ -1523,19 +1529,81 @@ func editInteractiveInitReviewerEntityStep(cmd *cobra.Command, opts *root.Option
 		session.workspace.previousProfile = workspace.previousProfile
 		session.workspace.credentialPlan = credentialPlan
 	}
-	if previousProfileName != workspace.profileName || !reflect.DeepEqual(previousProfile, session.workspace.profile) {
-		session = recordTouchedProfile(session, workspace.profileName, draft.OriginalProfileName)
-		if deps.menuPrompter != nil || deps.prompter == nil {
-			session, err = collectInteractiveInitSessionWorkspaceSecrets(opts, deps, session, []string{"reviewer_credentials"})
-			if errors.Is(err, errInitNavigateBack) {
-				return session, false, nil
-			}
-			if err != nil {
-				return initSessionDraft{}, false, err
-			}
+	session = recordTouchedProfile(session, workspace.profileName, draft.OriginalProfileName)
+	return session, false, nil
+}
+
+func mergeReviewerCredentialDraftWrites(session initSessionDraft, draft initDraft) initSessionDraft {
+	ref := strings.TrimSpace(draft.ReviewerCredentialWriteRef)
+	if ref == "" {
+		return session
+	}
+	if session.writes == nil {
+		session.writes = map[string]map[string]string{}
+	}
+	if session.overwriteRefs == nil {
+		session.overwriteRefs = map[string]bool{}
+	}
+	if session.satisfiedRefs == nil {
+		session.satisfiedRefs = map[string]bool{}
+	}
+	if session.credentialWriteStores == nil {
+		session.credentialWriteStores = map[string]credentials.ResolvedSecretsProfile{}
+	}
+	hadStagedWrites := len(session.writes[ref]) > 0
+	if session.writes[ref] != nil {
+		session.writes[ref] = filterInitCredentialWritesForDraftReviewerMode(session.writes[ref], draft)
+		if len(session.writes[ref]) == 0 {
+			delete(session.writes, ref)
 		}
 	}
-	return session, false, nil
+	hasNewWrites := len(draft.ReviewerCredentialWrites) > 0
+	if hasNewWrites {
+		for key, value := range draft.ReviewerCredentialWrites {
+			addWrite(session.writes, ref, key, value)
+		}
+	}
+	if draft.ReviewerCredentialOverwrite {
+		session.overwriteRefs[ref] = true
+	} else if hasNewWrites || !hadStagedWrites {
+		delete(session.overwriteRefs, ref)
+	}
+	if draft.ReviewerCredentialSatisfied {
+		session.satisfiedRefs[ref] = true
+	} else {
+		delete(session.satisfiedRefs, ref)
+	}
+	session.credentialWriteStores[ref] = draft.ReviewerCredentialWriteStore
+	return session
+}
+
+func filterInitCredentialWritesForDraftReviewerMode(writes map[string]string, draft initDraft) map[string]string {
+	if len(writes) == 0 {
+		return writes
+	}
+	ref := config.CredentialRef{
+		Purpose: "reviewer_credentials",
+		Ref:     strings.TrimSpace(draft.ReviewerCredentialWriteRef),
+		Mode:    strings.TrimSpace(draft.ReviewerAuth),
+	}
+	if ref.Mode == "" {
+		ref.Mode = string(config.GitAuthModePAT)
+	}
+	specs, err := credentials.KeySpecsForPurpose(ref)
+	if err != nil {
+		return writes
+	}
+	allowed := make(map[string]struct{}, len(specs))
+	for _, spec := range specs {
+		allowed[spec.Key] = struct{}{}
+	}
+	filtered := make(map[string]string, len(writes))
+	for key, value := range writes {
+		if _, ok := allowed[key]; ok {
+			filtered[key] = value
+		}
+	}
+	return filtered
 }
 
 func propagateSharedReviewerEntityChanges(priorCfg config.File, updatedCfg config.File, activeProfileName string, previousEntity initReviewerEntityDraft, nextEntity initReviewerEntityDraft) config.File {
@@ -1980,7 +2048,7 @@ func (p huhInitReviewerEntityPrompter) editReviewerEntityInventory(prompt initRe
 		applyReviewerEntityInventorySelection(&candidateDraft, selection, prompt.Context.ReviewerEntities)
 		entity, existingEntity := prompt.Context.ReviewerEntities[selection]
 		if existingEntity {
-			detailDraft, back, err := p.editExistingReviewerEntity(entity, candidateDraft)
+			detailDraft, back, err := p.editExistingReviewerEntity(prompt.Context, entity, candidateDraft)
 			if err != nil {
 				return initDraft{}, err
 			}
@@ -1990,7 +2058,7 @@ func (p huhInitReviewerEntityPrompter) editReviewerEntityInventory(prompt initRe
 			detailDraft.ActionTarget = selection
 			return detailDraft, nil
 		}
-		detailDraft, back, err := p.editNewReviewerEntity(initReviewerEntityKind(selection), candidateDraft)
+		detailDraft, back, err := p.editNewReviewerEntity(prompt.Context, initReviewerEntityKind(selection), candidateDraft)
 		if err != nil {
 			return initDraft{}, err
 		}
@@ -2001,16 +2069,16 @@ func (p huhInitReviewerEntityPrompter) editReviewerEntityInventory(prompt initRe
 	}
 }
 
-func (p huhInitReviewerEntityPrompter) editExistingReviewerEntity(entity initReviewerEntityDraft, seed initDraft) (initDraft, bool, error) {
-	return p.editReviewerEntityFields(entity, seed, true)
+func (p huhInitReviewerEntityPrompter) editExistingReviewerEntity(ctx initPromptContext, entity initReviewerEntityDraft, seed initDraft) (initDraft, bool, error) {
+	return p.editReviewerEntityFields(ctx, entity, seed, true)
 }
 
-func (p huhInitReviewerEntityPrompter) editNewReviewerEntity(kind initReviewerEntityKind, seed initDraft) (initDraft, bool, error) {
-	return p.editReviewerEntityFields(initReviewerEntityDraft{Kind: kind}, seed, false)
+func (p huhInitReviewerEntityPrompter) editNewReviewerEntity(ctx initPromptContext, kind initReviewerEntityKind, seed initDraft) (initDraft, bool, error) {
+	return p.editReviewerEntityFields(ctx, initReviewerEntityDraft{Kind: kind}, seed, false)
 }
 
-func (p huhInitReviewerEntityPrompter) editReviewerEntityFields(entity initReviewerEntityDraft, seed initDraft, preserveCurrentLocation bool) (initDraft, bool, error) {
-	return p.editReviewerEntityFieldsLinear(entity, seed, preserveCurrentLocation)
+func (p huhInitReviewerEntityPrompter) editReviewerEntityFields(ctx initPromptContext, entity initReviewerEntityDraft, seed initDraft, preserveCurrentLocation bool) (initDraft, bool, error) {
+	return p.editReviewerEntityFieldsLinear(ctx, entity, seed, preserveCurrentLocation)
 }
 
 func finalizeReviewerEntityEditorDraft(editDraft *initDraft, explicitDisplayName string, fallbackLabelSeed string, labelInput string, reviewerSecretLocation string, standardReviewerRef string, preserveCurrentLocation bool) {
@@ -4347,6 +4415,8 @@ func buildInteractiveInitSessionPlan(opts *root.Options, session initSessionDraf
 	writes := filterInitWritesByRefs(session.writes, activeRefs)
 	overwriteRefs := filterInitBoolMapByRefs(session.overwriteRefs, activeRefs)
 	satisfiedRefs := filterInitBoolMapByRefs(session.satisfiedRefs, activeRefs)
+	writeStores := filterInitCredentialWriteStoresByRefs(session.credentialWriteStores, activeRefs)
+	writes, overwriteRefs, satisfiedRefs = filterInteractiveInitStagedCredentialStateByStore(writes, overwriteRefs, satisfiedRefs, writeStores, entries)
 	entries = refreshInteractiveCredentialPlan(entries, projectInitPlannedWriteKeys(writes), satisfiedRefs)
 	credentialDecisions := filterInitCredentialDecisions(session.credentialDecisions, entries)
 	return initSessionPlan{
@@ -5641,6 +5711,11 @@ type initWriteGroup struct {
 	OverwriteRefs map[string]bool
 }
 
+type initReviewerCredentialCleanupGroup struct {
+	Resolved credentials.ResolvedSecretsProfile
+	Entries  map[string][]initCredentialPlanEntry
+}
+
 func groupInitWritesByStore(entries []initCredentialPlanEntry, writes map[string]map[string]string, overwriteRefs map[string]bool) ([]initWriteGroup, error) {
 	if len(entries) == 0 {
 		// An empty credential plan means init is using the legacy/default store
@@ -5683,6 +5758,125 @@ func groupInitWritesByStore(entries []initCredentialPlanEntry, writes map[string
 	return out, nil
 }
 
+func groupStaleReviewerCredentialCleanupsByStore(cfg config.File, entries []initCredentialPlanEntry) ([]initReviewerCredentialCleanupGroup, error) {
+	activeByStoreRef, resolvedByStore, err := activeReviewerCredentialEntriesByStoreRef(cfg, entries)
+	if err != nil {
+		return nil, err
+	}
+	cleanupRefsByStore := map[string]map[string]struct{}{}
+	for _, entry := range entries {
+		if !initCredentialEntryUsesActiveReviewerRef(entry) {
+			continue
+		}
+		storeKey := initCredentialStoreKey(entry.SecretsProfile)
+		if initCredentialEntryChangesReviewerModeInPlace(entry) {
+			if cleanupRefsByStore[storeKey] == nil {
+				cleanupRefsByStore[storeKey] = map[string]struct{}{}
+			}
+			cleanupRefsByStore[storeKey][entry.Ref.Ref] = struct{}{}
+		}
+	}
+
+	storeKeys := make([]string, 0, len(cleanupRefsByStore))
+	for storeKey := range cleanupRefsByStore {
+		storeKeys = append(storeKeys, storeKey)
+	}
+	sort.Strings(storeKeys)
+	groups := make([]initReviewerCredentialCleanupGroup, 0, len(storeKeys))
+	for _, storeKey := range storeKeys {
+		group := initReviewerCredentialCleanupGroup{
+			Resolved: resolvedByStore[storeKey],
+			Entries:  map[string][]initCredentialPlanEntry{},
+		}
+		refs := make([]string, 0, len(cleanupRefsByStore[storeKey]))
+		for ref := range cleanupRefsByStore[storeKey] {
+			refs = append(refs, ref)
+		}
+		sort.Strings(refs)
+		for _, ref := range refs {
+			activeEntries := activeByStoreRef[storeKey][ref]
+			if len(activeEntries) == 0 {
+				continue
+			}
+			group.Entries[ref] = activeEntries
+		}
+		if len(group.Entries) > 0 {
+			groups = append(groups, group)
+		}
+	}
+	return groups, nil
+}
+
+func activeReviewerCredentialEntriesByStoreRef(cfg config.File, fallback []initCredentialPlanEntry) (map[string]map[string][]initCredentialPlanEntry, map[string]credentials.ResolvedSecretsProfile, error) {
+	activeByStoreRef := map[string]map[string][]initCredentialPlanEntry{}
+	resolvedByStore := map[string]credentials.ResolvedSecretsProfile{}
+	if len(cfg.Profiles) == 0 {
+		for _, entry := range fallback {
+			if !initCredentialEntryUsesActiveReviewerRef(entry) {
+				continue
+			}
+			addActiveReviewerCredentialEntry(activeByStoreRef, resolvedByStore, entry)
+		}
+		return activeByStoreRef, resolvedByStore, nil
+	}
+	profileNames := make([]string, 0, len(cfg.Profiles))
+	for profileName := range cfg.Profiles {
+		profileNames = append(profileNames, profileName)
+	}
+	sort.Strings(profileNames)
+	for _, profileName := range profileNames {
+		profile := cfg.Profiles[profileName]
+		resolved, err := credentials.ResolveSecretsProfileForProfile(cfg, profile)
+		if err != nil {
+			return nil, nil, err
+		}
+		refs, err := config.CredentialRefs(profile)
+		if err != nil {
+			return nil, nil, err
+		}
+		for _, ref := range refs {
+			if ref.Purpose != "reviewer_credentials" || strings.TrimSpace(ref.Ref) == "" {
+				continue
+			}
+			specs, err := credentials.KeySpecsForPurpose(ref)
+			if err != nil {
+				return nil, nil, err
+			}
+			addActiveReviewerCredentialEntry(activeByStoreRef, resolvedByStore, initCredentialPlanEntry{
+				Ref:            ref,
+				SecretsProfile: resolved,
+				KeySpecs:       append([]credentials.KeySpec(nil), specs...),
+				State:          initCredentialPlanStateKeepExisting,
+			})
+		}
+	}
+	return activeByStoreRef, resolvedByStore, nil
+}
+
+func addActiveReviewerCredentialEntry(activeByStoreRef map[string]map[string][]initCredentialPlanEntry, resolvedByStore map[string]credentials.ResolvedSecretsProfile, entry initCredentialPlanEntry) {
+	storeKey := initCredentialStoreKey(entry.SecretsProfile)
+	resolvedByStore[storeKey] = entry.SecretsProfile
+	if activeByStoreRef[storeKey] == nil {
+		activeByStoreRef[storeKey] = map[string][]initCredentialPlanEntry{}
+	}
+	activeByStoreRef[storeKey][entry.Ref.Ref] = append(activeByStoreRef[storeKey][entry.Ref.Ref], entry)
+}
+
+func initCredentialEntryUsesActiveReviewerRef(entry initCredentialPlanEntry) bool {
+	return entry.State != initCredentialPlanStateClearRef &&
+		entry.Ref.Purpose == "reviewer_credentials" &&
+		strings.TrimSpace(entry.Ref.Ref) != ""
+}
+
+func initCredentialEntryChangesReviewerModeInPlace(entry initCredentialPlanEntry) bool {
+	if !initCredentialEntryUsesActiveReviewerRef(entry) || entry.PreviousRef == nil {
+		return false
+	}
+	return entry.PreviousRef.Purpose == entry.Ref.Purpose &&
+		entry.PreviousRef.Ref == entry.Ref.Ref &&
+		entry.PreviousRef.Mode != entry.Ref.Mode
+}
+
 func openInitStoreForEntry(deps initDeps, opts *root.Options, flagSet bool, cfg config.File, entry initCredentialPlanEntry) (initStore, error) {
 	if entry.SecretsProfile.IsNamed() {
 		return deps.openResolvedStore(entry.SecretsProfile, opts.Backend, flagSet, cfg)
@@ -6147,6 +6341,66 @@ func filterInitWritesByRefs(writes map[string]map[string]string, activeRefs map[
 	return filtered
 }
 
+func filterInitCredentialWriteStoresByRefs(values map[string]credentials.ResolvedSecretsProfile, activeRefs map[string]bool) map[string]credentials.ResolvedSecretsProfile {
+	filtered := map[string]credentials.ResolvedSecretsProfile{}
+	for ref, resolved := range values {
+		if !activeRefs[ref] {
+			continue
+		}
+		filtered[ref] = resolved
+	}
+	return filtered
+}
+
+func filterInteractiveInitStagedCredentialStateByStore(
+	writes map[string]map[string]string,
+	overwriteRefs map[string]bool,
+	satisfiedRefs map[string]bool,
+	writeStores map[string]credentials.ResolvedSecretsProfile,
+	entries []initCredentialPlanEntry,
+) (map[string]map[string]string, map[string]bool, map[string]bool) {
+	currentStores := activeInitCredentialStoresByRef(entries)
+	for ref, stagedStore := range writeStores {
+		if initCredentialStoreBindingEmpty(stagedStore) {
+			continue
+		}
+		if initCredentialStoreListContains(currentStores[ref], stagedStore) {
+			continue
+		}
+		delete(writes, ref)
+		delete(overwriteRefs, ref)
+		delete(satisfiedRefs, ref)
+	}
+	return writes, overwriteRefs, satisfiedRefs
+}
+
+func initCredentialStoreBindingEmpty(resolved credentials.ResolvedSecretsProfile) bool {
+	return resolved.ID == "" && resolved.Source == "" && resolved.Backend == ""
+}
+
+func activeInitCredentialStoresByRef(entries []initCredentialPlanEntry) map[string][]credentials.ResolvedSecretsProfile {
+	stores := map[string][]credentials.ResolvedSecretsProfile{}
+	for _, entry := range entries {
+		if entry.State == initCredentialPlanStateClearRef || strings.TrimSpace(entry.Ref.Ref) == "" {
+			continue
+		}
+		if initCredentialStoreListContains(stores[entry.Ref.Ref], entry.SecretsProfile) {
+			continue
+		}
+		stores[entry.Ref.Ref] = append(stores[entry.Ref.Ref], entry.SecretsProfile)
+	}
+	return stores
+}
+
+func initCredentialStoreListContains(values []credentials.ResolvedSecretsProfile, target credentials.ResolvedSecretsProfile) bool {
+	for _, value := range values {
+		if sameInitCredentialStore(value, target) {
+			return true
+		}
+	}
+	return false
+}
+
 func filterInitCredentialDecisions(values map[initCredentialDecisionKey]initCredentialDecisionKind, entries []initCredentialPlanEntry) map[initCredentialDecisionKey]initCredentialDecisionKind {
 	if len(values) == 0 {
 		return map[initCredentialDecisionKey]initCredentialDecisionKind{}
@@ -6356,6 +6610,7 @@ func applyInteractiveInitSessionPlan(opts *root.Options, deps initDeps, plan ini
 		}
 		return err
 	}
+	touchedCredentialRefs := map[string]struct{}{}
 	if len(plan.writes) > 0 {
 		groups, err := groupInitWritesByStore(plan.credentialPlan, plan.writes, plan.overwriteRefs)
 		if err != nil {
@@ -6377,18 +6632,28 @@ func applyInteractiveInitSessionPlan(opts *root.Options, deps initDeps, plan ini
 				_ = store.Close()
 				return cmderr.Credential(err)
 			}
+			for ref := range group.Writes {
+				touchedCredentialRefs[ref] = struct{}{}
+			}
 			_ = store.Close()
 		}
 	}
+	cleanupGroups, err := groupStaleReviewerCredentialCleanupsByStore(plan.cfg, plan.credentialPlan)
+	if err != nil {
+		return cmderr.Config(err)
+	}
 	if err := deps.saveConfig(plan.path, plan.cfg); err != nil {
 		if errors.Is(err, config.ErrInvalid) || errors.Is(err, config.ErrProfileNotFound) {
 			return cmderr.Config(err)
 		}
-		if len(plan.writes) > 0 {
-			return fmt.Errorf("init wrote credentials but failed to save config; credential refs needing cleanup: %v: %w", sortedRefs(plan.writes), err)
+		if len(touchedCredentialRefs) > 0 {
+			return fmt.Errorf("init updated credentials but failed to save config; credential refs needing cleanup: %v: %w", sortedCredentialRefSet(touchedCredentialRefs), err)
 		}
 		return err
 	}
+	if err := applyStaleReviewerCredentialCleanups(opts, deps, plan.backendFlagSet, plan.cfg, cleanupGroups); err != nil {
+		return err
+	}
 	if err := writeInteractiveInitSessionSummary(opts.Stdout, plan); err != nil {
 		return err
 	}
@@ -6527,9 +6792,30 @@ func initSecretsProfileHintLabel(resolved credentials.ResolvedSecretsProfile) st
 	return initSecretsProfilePromptSuffix(resolved)
 }
 
+func applyStaleReviewerCredentialCleanups(opts *root.Options, deps initDeps, backendFlagSet bool, cfg config.File, groups []initReviewerCredentialCleanupGroup) error {
+	for _, group := range groups {
+		store, err := openInitStoreForEntry(deps, opts, backendFlagSet, cfg, initCredentialPlanEntry{SecretsProfile: group.Resolved})
+		if err != nil {
+			return cmderr.Credential(fmt.Errorf("init saved config before failing to open credential store for stale reviewer cleanup; stale credential refs needing manual cleanup: %v: %w", sortedCredentialEntryRefs(group.Entries), err))
+		}
+		cleanedRefs, err := deleteStaleReviewerCredentialKeysForRefs(store, group.Entries)
+		if err != nil {
+			_ = store.Close()
+			return cmderr.Credential(fmt.Errorf("init saved config before failing to delete stale reviewer keys on %s; stale credential refs needing manual cleanup: %v: %w", firstUncleanedReviewerCredentialRef(group.Entries, cleanedRefs), sortedCredentialEntryRefs(group.Entries), err))
+		}
+		_ = store.Close()
+	}
+	return nil
+}
+
 func applyInitPlan(opts *root.Options, flags initOptions, deps initDeps, plan initPlan) error {
 	var store initStore
 	var primaryResolved credentials.ResolvedSecretsProfile
+	cleanupGroups, err := groupStaleReviewerCredentialCleanupsByStore(plan.cfg, plan.credentialPlan)
+	if err != nil {
+		return cmderr.Config(err)
+	}
+	needsPrimaryStore := len(plan.writes) > 0 || (plan.profile.LLM.Auth == config.LLMAuthAPIKey && !plan.allowDeferredLLM)
 	openPrimaryStore := func() (initStore, credentials.ResolvedSecretsProfile, error) {
 		if store != nil {
 			return store, primaryResolved, nil
@@ -6552,7 +6838,7 @@ func applyInitPlan(opts *root.Options, flags initOptions, deps initDeps, plan in
 		primaryResolved = entry.SecretsProfile
 		return store, primaryResolved, nil
 	}
-	if len(plan.writes) > 0 || (plan.profile.LLM.Auth == config.LLMAuthAPIKey && !plan.allowDeferredLLM) {
+	if needsPrimaryStore {
 		var err error
 		store, primaryResolved, err = openPrimaryStore()
 		if err != nil {
@@ -6583,6 +6869,7 @@ func applyInitPlan(opts *root.Options, flags initOptions, deps initDeps, plan in
 			return exitcode.Usage(fmt.Errorf("api_key LLM auth requires --llm-api-key-stdin or --llm-api-key-from-env"))
 		}
 	}
+	touchedCredentialRefs := map[string]struct{}{}
 	if len(plan.writes) > 0 {
 		groups, err := groupInitWritesByStore(plan.credentialPlan, plan.writes, plan.overwriteRefs)
 		if err != nil {
@@ -6610,31 +6897,37 @@ func applyInitPlan(opts *root.Options, flags initOptions, deps initDeps, plan in
 			if _, err := writeBundles(groupStore, group.Writes, flags.overwrite, group.OverwriteRefs); err != nil {
 				return cmderr.Credential(err)
 			}
+			for ref := range group.Writes {
+				touchedCredentialRefs[ref] = struct{}{}
+			}
 		}
 	}
 	if err := deps.saveConfig(plan.path, plan.cfg); err != nil {
 		if errors.Is(err, config.ErrInvalid) || errors.Is(err, config.ErrProfileNotFound) {
 			return cmderr.Config(err)
 		}
-		if len(plan.writes) > 0 {
-			return fmt.Errorf("init wrote credentials but failed to save config for profile %q; credential refs needing cleanup: %v: %w", plan.profileName, sortedRefs(plan.writes), err)
+		if len(touchedCredentialRefs) > 0 {
+			return fmt.Errorf("init updated credentials but failed to save config for profile %q; credential refs needing cleanup: %v: %w", plan.profileName, sortedCredentialRefSet(touchedCredentialRefs), err)
 		}
 		return err
 	}
+	if err := applyStaleReviewerCredentialCleanups(opts, deps, plan.backendFlagSet, plan.cfg, cleanupGroups); err != nil {
+		return err
+	}
 	if _, err := fmt.Fprintf(opts.Stdout, "Initialized profile %s\n", plan.profileName); err != nil {
 		return err
 	}
-	var err error
+	var writeErr error
 	for _, entry := range plan.credentialPlan {
 		if !shouldWriteInitCredentialHint(entry, plan.writeLLMHint) {
 			continue
 		}
 		hintErr := writeInitCredentialPlanHints(opts.Stderr, plan.backendArg, entry)
-		if err == nil {
-			err = hintErr
+		if writeErr == nil {
+			writeErr = hintErr
 		}
 	}
-	return err
+	return writeErr
 }
 
 func writeInitCredentialPlanHints(w io.Writer, backendArg string, entry initCredentialPlanEntry) error {
@@ -6994,6 +7287,84 @@ func writeBundles(store initStore, writes map[string]map[string]string, overwrit
 	return writtenRefs, nil
 }
 
+func deleteStaleReviewerCredentialKeysForRefs(store initStore, entries map[string][]initCredentialPlanEntry) ([]string, error) {
+	var cleanedRefs []string
+	for _, ref := range sortedCredentialEntryRefs(entries) {
+		deleted, err := deleteStaleReviewerCredentialKeys(store, entries[ref])
+		if deleted {
+			cleanedRefs = append(cleanedRefs, ref)
+		}
+		if err != nil {
+			return cleanedRefs, err
+		}
+	}
+	return cleanedRefs, nil
+}
+
+func deleteStaleReviewerCredentialKeys(store initStore, entries []initCredentialPlanEntry) (bool, error) {
+	if len(entries) == 0 {
+		return false, nil
+	}
+	ref := entries[0].Ref
+	if ref.Purpose != "reviewer_credentials" || strings.TrimSpace(ref.Ref) == "" {
+		return false, nil
+	}
+	for _, entry := range entries[1:] {
+		if entry.Ref.Purpose != ref.Purpose || entry.Ref.Ref != ref.Ref {
+			return false, nil
+		}
+	}
+	staleKeys := staleReviewerCredentialKeys(entries)
+	if len(staleKeys) == 0 {
+		return false, nil
+	}
+	parsed, err := credentials.ParseRef(ref.Ref)
+	if err != nil {
+		return false, err
+	}
+	existingKeys, err := store.ListBundle(parsed.Profile)
+	if err != nil {
+		return false, err
+	}
+	existing := make(map[string]struct{}, len(existingKeys))
+	for _, key := range existingKeys {
+		existing[key] = struct{}{}
+	}
+	deleted := false
+	for _, key := range staleKeys {
+		if _, ok := existing[key]; !ok {
+			continue
+		}
+		if err := store.Delete(parsed.Profile, key); err != nil {
+			return deleted, err
+		}
+		deleted = true
+	}
+	return deleted, nil
+}
+
+func staleReviewerCredentialKeys(entries []initCredentialPlanEntry) []string {
+	current := map[string]struct{}{}
+	for _, entry := range entries {
+		for _, spec := range entry.KeySpecs {
+			current[spec.Key] = struct{}{}
+		}
+	}
+	candidates := []string{
+		credentials.GitTokenKey,
+		credentials.GitHubAppIDKey,
+		credentials.GitHubAppPrivateKeyKey,
+		credentials.GitHubAppInstallationIDKey,
+	}
+	var stale []string
+	for _, key := range candidates {
+		if _, ok := current[key]; !ok {
+			stale = append(stale, key)
+		}
+	}
+	return stale
+}
+
 func sortedRefs(writes map[string]map[string]string) []string {
 	refs := make([]string, 0, len(writes))
 	for ref := range writes {
@@ -7003,6 +7374,37 @@ func sortedRefs(writes map[string]map[string]string) []string {
 	return refs
 }
 
+func sortedCredentialEntryRefs(entries map[string][]initCredentialPlanEntry) []string {
+	refs := make([]string, 0, len(entries))
+	for ref := range entries {
+		refs = append(refs, ref)
+	}
+	sort.Strings(refs)
+	return refs
+}
+
+func sortedCredentialRefSet(refs map[string]struct{}) []string {
+	out := make([]string, 0, len(refs))
+	for ref := range refs {
+		out = append(out, ref)
+	}
+	sort.Strings(out)
+	return out
+}
+
+func firstUncleanedReviewerCredentialRef(entries map[string][]initCredentialPlanEntry, cleanedRefs []string) string {
+	cleaned := make(map[string]struct{}, len(cleanedRefs))
+	for _, ref := range cleanedRefs {
+		cleaned[ref] = struct{}{}
+	}
+	for _, ref := range sortedCredentialEntryRefs(entries) {
+		if _, ok := cleaned[ref]; !ok {
+			return ref
+		}
+	}
+	return ""
+}
+
 func sortedKeys(values map[string]string) []string {
 	keys := make([]string, 0, len(values))
 	for key := range values {
diff --git a/internal/cmd/credentialcmd/credentialcmd_test.go b/internal/cmd/credentialcmd/credentialcmd_test.go
index bf4e697..3b1c15c 100644
--- a/internal/cmd/credentialcmd/credentialcmd_test.go
+++ b/internal/cmd/credentialcmd/credentialcmd_test.go
@@ -5129,8 +5129,11 @@ func TestHuhInitReviewerEntityPrompterAccessibleConfiguredReviewerRoundTripsInMi
 	reviewerEntities, profileReviewerEntities := buildInitReviewerEntityInventory(cfg)
 	var stderr bytes.Buffer
 	prompter := huhInitReviewerEntityPrompter{
-		stderr:       &stderr,
-		editorRunner: stageReviewerEntityEditorRunner(t, nil, ""),
+		stderr: &stderr,
+		editorRunner: stageReviewerEntityEditorRunner(t, map[initLinearFieldID]string{
+			initReviewerEntityFieldGitHubAppID:         "12345",
+			initReviewerEntityFieldGitHubAppPrivateKey: testReviewerGitHubAppPrivateKey(),
+		}, ""),
 		inventoryRunner: func(_ initInventoryPrompt, _ io.Reader, out io.Writer) (initInventoryResult, error) {
 			_, _ = io.WriteString(out, "custom-work-reviewer (PAT reviewer)\n")
 			return initInventoryResult{
@@ -6122,8 +6125,10 @@ func TestHuhInitReviewerEntityPrompterAccessibleChoiceShowsDetails(t *testing.T)
 	existing := basicProfile("work")
 	var stderr bytes.Buffer
 	prompter := huhInitReviewerEntityPrompter{
-		stderr:       &stderr,
-		editorRunner: stageReviewerEntityEditorRunner(t, nil, ""),
+		stderr: &stderr,
+		editorRunner: stageReviewerEntityEditorRunner(t, map[initLinearFieldID]string{
+			initReviewerEntityFieldGitToken: "reviewer-pat",
+		}, ""),
 		inventoryRunner: func(_ initInventoryPrompt, _ io.Reader, out io.Writer) (initInventoryResult, error) {
 			_, _ = io.WriteString(out, "Configure new personal access token (PAT) reviewer\n")
 			return initInventoryResult{
@@ -6169,8 +6174,11 @@ func TestHuhInitReviewerEntityPrompterNewTemplateDoesNotInheritCustomSecretLocat
 	}
 	var stderr bytes.Buffer
 	prompter := huhInitReviewerEntityPrompter{
-		stderr:       &stderr,
-		editorRunner: stageReviewerEntityEditorRunner(t, nil, ""),
+		stderr: &stderr,
+		editorRunner: stageReviewerEntityEditorRunner(t, map[initLinearFieldID]string{
+			initReviewerEntityFieldGitHubAppID:         "12345",
+			initReviewerEntityFieldGitHubAppPrivateKey: testReviewerGitHubAppPrivateKey(),
+		}, ""),
 		inventoryRunner: func(_ initInventoryPrompt, _ io.Reader, out io.Writer) (initInventoryResult, error) {
 			_, _ = io.WriteString(out, "Configure new GitHub App reviewer\n")
 			return initInventoryResult{
@@ -6278,7 +6286,7 @@ func TestHuhInitReviewerEntityPrompterExistingReviewerCustomSecretLocationPersis
 		editorRunner: stageReviewerEntityEditorRunner(t, nil, ""),
 	}
 
-	nextDraft, back, err := prompter.editExistingReviewerEntity(initReviewerEntityDraftFromConfig(existing), draft)
+	nextDraft, back, err := prompter.editExistingReviewerEntity(initPromptContext{}, initReviewerEntityDraftFromConfig(existing), draft)
 	if err != nil {
 		t.Fatalf("editExistingReviewerEntity: %v", err)
 	}
@@ -6313,7 +6321,7 @@ func TestHuhInitReviewerEntityPrompterExistingReviewerFallbackSeedDoesNotPersist
 		editorRunner: stageReviewerEntityEditorRunner(t, nil, ""),
 	}
 
-	nextDraft, back, err := prompter.editExistingReviewerEntity(initReviewerEntityDraftFromConfig(existing), draft)
+	nextDraft, back, err := prompter.editExistingReviewerEntity(initPromptContext{}, initReviewerEntityDraftFromConfig(existing), draft)
 	if err != nil {
 		t.Fatalf("editExistingReviewerEntity: %v", err)
 	}
@@ -6344,7 +6352,7 @@ func TestHuhInitReviewerEntityPrompterAccessibleShowsSeededDisplayNamePrompt(t *
 		editorRunner: stageReviewerEntityEditorRunner(t, nil, ""),
 	}
 
-	nextDraft, back, err := prompter.editExistingReviewerEntity(initReviewerEntityDraftFromConfig(existing), draft)
+	nextDraft, back, err := prompter.editExistingReviewerEntity(initPromptContext{}, initReviewerEntityDraftFromConfig(existing), draft)
 	if err != nil {
 		t.Fatalf("editExistingReviewerEntity: %v", err)
 	}
@@ -6375,7 +6383,7 @@ func TestHuhInitReviewerEntityPrompterExistingReviewerCanEditLabel(t *testing.T)
 		}, ""),
 	}
 
-	nextDraft, back, err := prompter.editExistingReviewerEntity(initReviewerEntityDraftFromConfig(existing), draft)
+	nextDraft, back, err := prompter.editExistingReviewerEntity(initPromptContext{}, initReviewerEntityDraftFromConfig(existing), draft)
 	if err != nil {
 		t.Fatalf("editExistingReviewerEntity: %v", err)
 	}
@@ -6404,6 +6412,8 @@ func TestHuhInitReviewerEntityPrompterDefaultUsesLinearReviewerFlow(t *testing.T
 		editorRunner: func(editor initLinearEditor, _ io.Reader, out io.Writer) (initLinearEditorModel, error) {
 			model := newInitLinearEditorModel(editor, 160, 60)
 			model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldSelection, string(initReviewerEntityKindPAT))
+			model.setFieldValue(initReviewerEntityFieldGitToken, "reviewer-pat")
+			model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldGitToken))
 			model = focusInitLinearField(t, model, initReviewerEntityFieldAction)
 			model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldAction, initDetailActionEdit)
 			_, _ = io.WriteString(out, model.View())
@@ -6429,6 +6439,9 @@ func TestHuhInitReviewerEntityPrompterDefaultUsesLinearReviewerFlow(t *testing.T
 	if !draft.ReviewerEnabled || draft.ReviewerAuth != string(config.GitAuthModePAT) {
 		t.Fatalf("draft = %#v, want PAT reviewer", draft)
 	}
+	if got := draft.ReviewerCredentialWrites[credentials.GitTokenKey]; got != "reviewer-pat" {
+		t.Fatalf("staged reviewer PAT = %q, want inline token", got)
+	}
 	out := stderr.String()
 	for _, want := range []string{
 		"Reviewer entity",
@@ -6438,7 +6451,11 @@ func TestHuhInitReviewerEntityPrompterDefaultUsesLinearReviewerFlow(t *testing.T
 		"Entity label",
 		"Reviewer secret location",
 		"Reviewer credential status",
-		credentials.GitTokenKey + ": missing",
+		"This is a credential-store ref, not a PAT",
+		credentials.GitTokenKey,
+		"staged",
+		"Reviewer credential values",
+		"GitHub PAT",
 		"Reviewer action",
 		"Stage reviewer settings",
 	} {
@@ -6447,6 +6464,9 @@ func TestHuhInitReviewerEntityPrompterDefaultUsesLinearReviewerFlow(t *testing.T
 		}
 	}
 	assertContentOrder(t, out, "Reviewer entity", "Reviewer details", "Entity label", "Reviewer secret location", "Reviewer credential status", "Reviewer action")
+	if strings.Contains(out, "reviewer-pat") {
+		t.Fatalf("stderr leaked reviewer PAT value:\n%s", out)
+	}
 	if strings.Contains(out, "Back to main menu") {
 		t.Fatalf("stderr = %q, want action-local Back without staging instead of inventory Back", out)
 	}
@@ -6455,11 +6475,16 @@ func TestHuhInitReviewerEntityPrompterDefaultUsesLinearReviewerFlow(t *testing.T
 func TestHuhInitReviewerEntityPrompterGitHubAppLinearFlowShowsCredentialBundleCopy(t *testing.T) {
 	existing := basicProfile("work")
 	var stderr bytes.Buffer
+	privateKey := testReviewerGitHubAppPrivateKey()
 	prompter := huhInitReviewerEntityPrompter{
 		stderr: &stderr,
 		editorRunner: func(editor initLinearEditor, _ io.Reader, out io.Writer) (initLinearEditorModel, error) {
 			model := newInitLinearEditorModel(editor, 160, 60)
 			model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldSelection, string(initReviewerEntityKindGitHubApp))
+			model.setFieldValue(initReviewerEntityFieldGitHubAppID, "12345")
+			model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldGitHubAppID))
+			model.setFieldValue(initReviewerEntityFieldGitHubAppPrivateKey, privateKey)
+			model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldGitHubAppPrivateKey))
 			model = focusInitLinearField(t, model, initReviewerEntityFieldAction)
 			model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldAction, initDetailActionEdit)
 			_, _ = io.WriteString(out, model.View())
@@ -6485,26 +6510,450 @@ func TestHuhInitReviewerEntityPrompterGitHubAppLinearFlowShowsCredentialBundleCo
 	if !draft.ReviewerEnabled || draft.ReviewerAuth != string(config.GitAuthModeGitHubApp) {
 		t.Fatalf("draft = %#v, want GitHub App reviewer", draft)
 	}
+	if got := draft.ReviewerCredentialWrites[credentials.GitHubAppIDKey]; got != "12345" {
+		t.Fatalf("staged app id = %q, want inline app id", got)
+	}
+	if got := draft.ReviewerCredentialWrites[credentials.GitHubAppPrivateKeyKey]; got != privateKey {
+		t.Fatalf("staged private key = %q, want inline private key", got)
+	}
 	out := stderr.String()
 	for _, want := range []string{
 		"GitHub App reviewer. Required credential keys",
 		"Reviewer secret location",
-		"non-secret",
 		"credential-store ref",
+		"This is a credential-store ref, not a PAT",
 		"Reviewer credential status",
-		credentials.GitHubAppIDKey + ": missing",
-		credentials.GitHubAppPrivateKeyKey + ": missing",
-		credentials.GitHubAppInstallationIDKey + ":",
 		credentials.GitHubAppIDKey,
 		credentials.GitHubAppPrivateKeyKey,
+		credentials.GitHubAppInstallationIDKey,
+		"staged",
+		credentials.GitHubAppIDKey,
+		credentials.GitHubAppPrivateKeyKey,
+		"Reviewer credential values",
+		"GitHub App ID",
+		"GitHub App private key",
 		"Optional credential key: " + credentials.GitHubAppInstallationIDKey,
-		credentials.GitHubAppInstallationIDKey + " is optional",
+		"optional",
 	} {
 		if !strings.Contains(out, want) {
 			t.Fatalf("stderr missing %q:\n%s", want, out)
 		}
 	}
 	assertContentOrder(t, out, "Reviewer secret location", "Reviewer credential status", "Reviewer action")
+	for _, leaked := range []string{"12345", privateKey} {
+		if strings.Contains(out, leaked) {
+			t.Fatalf("stderr leaked GitHub App secret value %q:\n%s", leaked, out)
+		}
+	}
+}
+
+func TestReviewerEntityLinearEditorNewLabelDerivesDefaultSecretLocation(t *testing.T) {
+	existing := basicProfile("work")
+	ctx := initPromptContext{
+		RequestedProfileName: "work",
+		ExistingProfileName:  "work",
+		ExistingProfile:      &existing,
+		DefaultProfileName:   "work",
+		ExistingConfig:       config.File{Profiles: map[string]config.Profile{"work": existing}},
+	}
+	seed := seedInteractiveInitDraft("work", "work", "work", &existing)
+	model := newInitLinearEditorModel(initReviewerEntityLinearEditor(ctx, seed), 120, 40)
+	model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldSelection, string(initReviewerEntityKindGitHubApp))
+
+	model.setFieldValue(initReviewerEntityFieldLabel, "rianjs-bot")
+	labelIndex := model.document.fieldIndexByID(initReviewerEntityFieldLabel)
+	if labelIndex < 0 {
+		t.Fatal("label field missing")
+	}
+	model.afterFieldChange(labelIndex)
+
+	if got, want := model.document.fieldValue(initReviewerEntityFieldSecretLocation), "codereview/rianjs-bot-reviewer"; got != want {
+		t.Fatalf("secret location = %q, want label-derived %q", got, want)
+	}
+	status := model.document[model.document.fieldIndexByID(initReviewerEntityFieldCredentialStatus)].Description
+	if !strings.Contains(status, "Destination: codereview/rianjs-bot-reviewer") {
+		t.Fatalf("status = %q, want label-derived destination", status)
+	}
+	if !strings.Contains(status, credentials.GitHubAppIDKey) || !strings.Contains(status, string(initReviewerCredentialKeyMissing)) || strings.Contains(status, string(initReviewerCredentialKeyUnavailable)) {
+		t.Fatalf("status = %q, want label-derived ref to show missing required keys, not unavailable", status)
+	}
+}
+
+func TestReviewerEntityLinearEditorManualSecretLocationStopsLabelDerivedUpdates(t *testing.T) {
+	existing := basicProfile("work")
+	ctx := initPromptContext{
+		RequestedProfileName: "work",
+		ExistingProfileName:  "work",
+		ExistingProfile:      &existing,
+		DefaultProfileName:   "work",
+		ExistingConfig:       config.File{Profiles: map[string]config.Profile{"work": existing}},
+	}
+	seed := seedInteractiveInitDraft("work", "work", "work", &existing)
+	model := newInitLinearEditorModel(initReviewerEntityLinearEditor(ctx, seed), 120, 40)
+	model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldSelection, string(initReviewerEntityKindPAT))
+
+	model.setFieldValue(initReviewerEntityFieldSecretLocation, "codereview/custom-reviewer")
+	locationIndex := model.document.fieldIndexByID(initReviewerEntityFieldSecretLocation)
+	if locationIndex < 0 {
+		t.Fatal("secret location field missing")
+	}
+	model.afterFieldChange(locationIndex)
+
+	model.setFieldValue(initReviewerEntityFieldLabel, "rianjs-bot")
+	labelIndex := model.document.fieldIndexByID(initReviewerEntityFieldLabel)
+	if labelIndex < 0 {
+		t.Fatal("label field missing")
+	}
+	model.afterFieldChange(labelIndex)
+
+	if got, want := model.document.fieldValue(initReviewerEntityFieldSecretLocation), "codereview/custom-reviewer"; got != want {
+		t.Fatalf("secret location = %q, want manual override %q", got, want)
+	}
+}
+
+func TestReviewerEntityLinearEditorExistingReviewerLabelDoesNotMigrateRef(t *testing.T) {
+	profile := basicProfile("work")
+	profile.ReviewerCredentials = &config.ReviewerCredentials{
+		AuthMode:      config.GitAuthModeGitHubApp,
+		CredentialRef: "codereview/existing-reviewer",
+		DisplayName:   "Old label",
+	}
+	cfg := config.File{
+		DefaultProfile: "work",
+		Profiles:       map[string]config.Profile{"work": profile},
+	}
+	entities, profileEntities := buildInitReviewerEntityInventory(cfg)
+	profileCopy := profile
+	ctx := initPromptContext{
+		RequestedProfileName:    "work",
+		ExistingProfileName:     "work",
+		DefaultProfileName:      "work",
+		ExistingProfile:         &profileCopy,
+		ExistingConfig:          cfg,
+		ReviewerEntities:        entities,
+		ProfileReviewerEntities: profileEntities,
+	}
+	seed := seedInteractiveInitDraft("work", "work", "work", &profile)
+	model := newInitLinearEditorModel(initReviewerEntityLinearEditor(ctx, seed), 120, 40)
+
+	model.setFieldValue(initReviewerEntityFieldLabel, "rianjs-bot")
+	labelIndex := model.document.fieldIndexByID(initReviewerEntityFieldLabel)
+	if labelIndex < 0 {
+		t.Fatal("label field missing")
+	}
+	model.afterFieldChange(labelIndex)
+
+	if got, want := model.document.fieldValue(initReviewerEntityFieldSecretLocation), "codereview/existing-reviewer"; got != want {
+		t.Fatalf("secret location = %q, want existing ref %q", got, want)
+	}
+}
+
+func TestReviewerEntityExistingReviewerChangedRefRequiresInlineSecrets(t *testing.T) {
+	profile := basicProfile("work")
+	profile.ReviewerCredentials = &config.ReviewerCredentials{
+		AuthMode:      config.GitAuthModePAT,
+		CredentialRef: "codereview/existing-reviewer",
+		DisplayName:   "Existing reviewer",
+	}
+	seed := seedInteractiveInitDraft("work", "work", "work", &profile)
+	state, err := newReviewerEntityEditorState(initReviewerEntityDraft{
+		Kind:          initReviewerEntityKindPAT,
+		AuthMode:      config.GitAuthModePAT,
+		CredentialRef: "codereview/existing-reviewer",
+		DisplayName:   "Existing reviewer",
+	}, seed, true)
+	if err != nil {
+		t.Fatalf("newReviewerEntityEditorState: %v", err)
+	}
+	model := newInitLinearEditorModel(state.editor(initPromptContext{}), 120, 40)
+	model = focusInitLinearField(t, model, initReviewerEntityFieldAction)
+	model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldAction, initDetailActionEdit)
+
+	updated, _ := model.Update(tea.KeyMsg{Type: tea.KeyEnter})
+	unchanged, ok := updated.(initLinearEditorModel)
+	if !ok {
+		t.Fatalf("Update returned %T, want initLinearEditorModel", updated)
+	}
+	if unchanged.resultAction != initDetailActionEdit {
+		t.Fatalf("unchanged existing ref resultAction = %q, want staged without re-entering secrets", unchanged.resultAction)
+	}
+
+	model = newInitLinearEditorModel(state.editor(initPromptContext{}), 120, 40)
+	model.setFieldValue(initReviewerEntityFieldSecretLocation, "codereview/new-reviewer")
+	model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldSecretLocation))
+	model = focusInitLinearField(t, model, initReviewerEntityFieldAction)
+	model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldAction, initDetailActionEdit)
+
+	updated, _ = model.Update(tea.KeyMsg{Type: tea.KeyEnter})
+	changed, ok := updated.(initLinearEditorModel)
+	if !ok {
+		t.Fatalf("Update returned %T, want initLinearEditorModel", updated)
+	}
+	if changed.resultAction != "" {
+		t.Fatalf("changed ref resultAction = %q, want validation to block staging", changed.resultAction)
+	}
+	actionIndex := changed.document.fieldIndexByID(initReviewerEntityFieldAction)
+	if actionIndex < 0 {
+		t.Fatal("action field missing")
+	}
+	if got := changed.document[actionIndex].Error; !strings.Contains(got, credentials.GitTokenKey) {
+		t.Fatalf("changed ref action error = %q, want missing PAT credential", got)
+	}
+}
+
+func TestReviewerEntityExistingReviewerChangedRefRequiresInlineSecretsWhenStatusUnavailable(t *testing.T) {
+	profile := basicProfile("work")
+	profile.ReviewerCredentials = &config.ReviewerCredentials{
+		AuthMode:      config.GitAuthModePAT,
+		CredentialRef: "codereview/existing-reviewer",
+		DisplayName:   "Existing reviewer",
+	}
+	cfg := config.File{
+		DefaultProfile: "work",
+		Profiles:       map[string]config.Profile{"work": profile},
+	}
+	entities, profileEntities := buildInitReviewerEntityInventory(cfg)
+	profileCopy := profile
+	ctx := initPromptContext{
+		RequestedProfileName:    "work",
+		ExistingProfileName:     "work",
+		DefaultProfileName:      "work",
+		ExistingProfile:         &profileCopy,
+		ExistingConfig:          cfg,
+		ReviewerEntities:        entities,
+		ProfileReviewerEntities: profileEntities,
+		ReviewerCredentialStatuses: []initReviewerCredentialStatus{{
+			Ref: config.CredentialRef{
+				Purpose: "reviewer_credentials",
+				Ref:     "codereview/existing-reviewer",
+				Mode:    string(config.GitAuthModePAT),
+			},
+			Unavailable: "credential backend status unavailable",
+			Keys: []initReviewerCredentialKeyStatus{{
+				Key:      credentials.GitTokenKey,
+				Required: true,
+				State:    initReviewerCredentialKeyUnavailable,
+			}},
+		}},
+	}
+	seed := seedInteractiveInitDraft("work", "work", "work", &profile)
+	model := newInitLinearEditorModel(initReviewerEntityLinearEditor(ctx, seed), 120, 40)
+	model.setFieldValue(initReviewerEntityFieldSecretLocation, "codereview/new-reviewer")
+	model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldSecretLocation))
+	model = focusInitLinearField(t, model, initReviewerEntityFieldAction)
+	model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldAction, initDetailActionEdit)
+
+	updated, _ := model.Update(tea.KeyMsg{Type: tea.KeyEnter})
+	changed, ok := updated.(initLinearEditorModel)
+	if !ok {
+		t.Fatalf("Update returned %T, want initLinearEditorModel", updated)
+	}
+	if changed.resultAction != "" {
+		t.Fatalf("changed ref resultAction = %q, want validation to block staging", changed.resultAction)
+	}
+	actionIndex := changed.document.fieldIndexByID(initReviewerEntityFieldAction)
+	if actionIndex < 0 {
+		t.Fatal("action field missing")
+	}
+	if got := changed.document[actionIndex].Error; !strings.Contains(got, credentials.GitTokenKey) {
+		t.Fatalf("changed ref action error = %q, want missing PAT credential", got)
+	}
+}
+
+func TestReviewerEntityLinearEditorGitHubAppRequiresInlineSecretsBeforeStaging(t *testing.T) {
+	existing := basicProfile("work")
+	ctx := initPromptContext{
+		RequestedProfileName: "work",
+		ExistingProfileName:  "work",
+		ExistingProfile:      &existing,
+		DefaultProfileName:   "work",
+		ExistingConfig:       config.File{Profiles: map[string]config.Profile{"work": existing}},
+	}
+	seed := seedInteractiveInitDraft("work", "work", "work", &existing)
+	model := newInitLinearEditorModel(initReviewerEntityLinearEditor(ctx, seed), 120, 40)
+	model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldSelection, string(initReviewerEntityKindGitHubApp))
+	model.setFieldValue(initReviewerEntityFieldLabel, "rianjs-bot")
+	model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldLabel))
+	model = focusInitLinearField(t, model, initReviewerEntityFieldAction)
+	model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldAction, initDetailActionEdit)
+
+	updated, _ := model.Update(tea.KeyMsg{Type: tea.KeyEnter})
+	blocked, ok := updated.(initLinearEditorModel)
+	if !ok {
+		t.Fatalf("Update returned %T, want initLinearEditorModel", updated)
+	}
+	if blocked.resultAction != "" {
+		t.Fatalf("resultAction = %q, want validation to keep editor open", blocked.resultAction)
+	}
+	actionIndex := blocked.document.fieldIndexByID(initReviewerEntityFieldAction)
+	if actionIndex < 0 {
+		t.Fatal("action field missing")
+	}
+	if got := blocked.document[actionIndex].Error; !strings.Contains(got, credentials.GitHubAppIDKey) || !strings.Contains(got, credentials.GitHubAppPrivateKeyKey) {
+		t.Fatalf("action error = %q, want missing GitHub App required keys", got)
+	}
+
+	blocked.setFieldValue(initReviewerEntityFieldGitHubAppID, "12345")
+	blocked.afterFieldChange(blocked.document.fieldIndexByID(initReviewerEntityFieldGitHubAppID))
+	privateKey := strings.Join([]string{
+		"-----BEGIN PRIVATE KEY-----",
+		"abc123",
+		"-----END PRIVATE KEY-----",
+	}, "\n")
+	blocked.setFieldValue(initReviewerEntityFieldGitHubAppPrivateKey, privateKey)
+	blocked.afterFieldChange(blocked.document.fieldIndexByID(initReviewerEntityFieldGitHubAppPrivateKey))
+	blocked = focusInitLinearField(t, blocked, initReviewerEntityFieldAction)
+	blocked = selectInitLinearFieldValue(t, blocked, initReviewerEntityFieldAction, initDetailActionEdit)
+
+	updated, _ = blocked.Update(tea.KeyMsg{Type: tea.KeyEnter})
+	staged, ok := updated.(initLinearEditorModel)
+	if !ok {
+		t.Fatalf("Update returned %T, want initLinearEditorModel", updated)
+	}
+	if staged.resultAction != initDetailActionEdit {
+		t.Fatalf("resultAction = %q, want staged reviewer settings", staged.resultAction)
+	}
+	draft, err := initReviewerEntityDraftFromDocument(ctx, seed, staged.document)
+	if err != nil {
+		t.Fatalf("initReviewerEntityDraftFromDocument: %v", err)
+	}
+	if got, want := draft.ReviewerCredentialWriteRef, "codereview/rianjs-bot-reviewer"; got != want {
+		t.Fatalf("ReviewerCredentialWriteRef = %q, want %q", got, want)
+	}
+	if got := draft.ReviewerCredentialWrites[credentials.GitHubAppIDKey]; got != "12345" {
+		t.Fatalf("staged github_app_id = %q, want 12345", got)
+	}
+	if got := draft.ReviewerCredentialWrites[credentials.GitHubAppPrivateKeyKey]; got != privateKey {
+		t.Fatalf("staged private key = %q, want multiline key", got)
+	}
+	if _, ok := draft.ReviewerCredentialWrites[credentials.GitHubAppInstallationIDKey]; ok {
+		t.Fatalf("optional installation id staged unexpectedly: %#v", draft.ReviewerCredentialWrites)
+	}
+}
+
+func TestReviewerEntityLinearEditorLabelDerivedRefDoesNotMarkMissingStatusAsOverwrite(t *testing.T) {
+	existing := basicProfile("work")
+	ctx := initPromptContext{
+		RequestedProfileName: "work",
+		ExistingProfileName:  "work",
+		ExistingProfile:      &existing,
+		DefaultProfileName:   "work",
+		ExistingConfig:       config.File{Profiles: map[string]config.Profile{"work": existing}},
+		ReviewerCredentialStatuses: []initReviewerCredentialStatus{{
+			Ref: config.CredentialRef{
+				Purpose: "reviewer_credentials",
+				Ref:     "codereview/work-reviewer",
+				Mode:    string(config.GitAuthModeGitHubApp),
+			},
+			Keys: []initReviewerCredentialKeyStatus{
+				{Key: credentials.GitHubAppIDKey, Required: true, State: initReviewerCredentialKeyMissing},
+				{Key: credentials.GitHubAppPrivateKeyKey, Required: true, State: initReviewerCredentialKeyMissing},
+				{Key: credentials.GitHubAppInstallationIDKey, Required: false, State: initReviewerCredentialKeyOptional},
+			},
+		}},
+	}
+	seed := seedInteractiveInitDraft("work", "work", "work", &existing)
+	model := newInitLinearEditorModel(initReviewerEntityLinearEditor(ctx, seed), 120, 40)
+	model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldSelection, string(initReviewerEntityKindGitHubApp))
+	model.setFieldValue(initReviewerEntityFieldLabel, "rianjs-bot")
+	model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldLabel))
+	model.setFieldValue(initReviewerEntityFieldGitHubAppID, "12345")
+	model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldGitHubAppID))
+	model.setFieldValue(initReviewerEntityFieldGitHubAppPrivateKey, testReviewerGitHubAppPrivateKey())
+	model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldGitHubAppPrivateKey))
+
+	draft, err := initReviewerEntityDraftFromDocument(ctx, seed, model.document)
+	if err != nil {
+		t.Fatalf("initReviewerEntityDraftFromDocument: %v", err)
+	}
+	if got, want := draft.ReviewerCredentialWriteRef, "codereview/rianjs-bot-reviewer"; got != want {
+		t.Fatalf("ReviewerCredentialWriteRef = %q, want %q", got, want)
+	}
+	if draft.ReviewerCredentialOverwrite {
+		t.Fatalf("ReviewerCredentialOverwrite = true, want missing label-derived ref to preserve no-overwrite preflight")
+	}
+}
+
+func TestReviewerEntityLinearEditorManualRefDoesNotMarkUnavailableStatusAsOverwrite(t *testing.T) {
+	existing := basicProfile("work")
+	ctx := initPromptContext{
+		RequestedProfileName: "work",
+		ExistingProfileName:  "work",
+		ExistingProfile:      &existing,
+		DefaultProfileName:   "work",
+		ExistingConfig:       config.File{Profiles: map[string]config.Profile{"work": existing}},
+		ReviewerCredentialStatuses: []initReviewerCredentialStatus{{
+			Ref: config.CredentialRef{
+				Purpose: "reviewer_credentials",
+				Ref:     "codereview/work-reviewer",
+				Mode:    string(config.GitAuthModeGitHubApp),
+			},
+			Keys: []initReviewerCredentialKeyStatus{
+				{Key: credentials.GitHubAppIDKey, Required: true, State: initReviewerCredentialKeyMissing},
+				{Key: credentials.GitHubAppPrivateKeyKey, Required: true, State: initReviewerCredentialKeyMissing},
+				{Key: credentials.GitHubAppInstallationIDKey, Required: false, State: initReviewerCredentialKeyOptional},
+			},
+		}},
+	}
+	seed := seedInteractiveInitDraft("work", "work", "work", &existing)
+	model := newInitLinearEditorModel(initReviewerEntityLinearEditor(ctx, seed), 120, 40)
+	model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldSelection, string(initReviewerEntityKindGitHubApp))
+	model.setFieldValue(initReviewerEntityFieldSecretLocation, "codereview/manual-reviewer")
+	model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldSecretLocation))
+	model.setFieldValue(initReviewerEntityFieldGitHubAppID, "12345")
+	model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldGitHubAppID))
+	model.setFieldValue(initReviewerEntityFieldGitHubAppPrivateKey, testReviewerGitHubAppPrivateKey())
+	model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldGitHubAppPrivateKey))
+
+	draft, err := initReviewerEntityDraftFromDocument(ctx, seed, model.document)
+	if err != nil {
+		t.Fatalf("initReviewerEntityDraftFromDocument: %v", err)
+	}
+	if got, want := draft.ReviewerCredentialWriteRef, "codereview/manual-reviewer"; got != want {
+		t.Fatalf("ReviewerCredentialWriteRef = %q, want %q", got, want)
+	}
+	if draft.ReviewerCredentialOverwrite {
+		t.Fatalf("ReviewerCredentialOverwrite = true, want unavailable manual ref to preserve no-overwrite preflight")
+	}
+}
+
+func TestReviewerEntityLinearEditorLabelDerivedRefPreservesBackendUnavailableStatus(t *testing.T) {
+	existing := basicProfile("work")
+	ctx := initPromptContext{
+		RequestedProfileName: "work",
+		ExistingProfileName:  "work",
+		ExistingProfile:      &existing,
+		DefaultProfileName:   "work",
+		ExistingConfig:       config.File{Profiles: map[string]config.Profile{"work": existing}},
+		ReviewerCredentialStatuses: []initReviewerCredentialStatus{{
+			Ref: config.CredentialRef{
+				Purpose: "reviewer_credentials",
+				Ref:     "codereview/work-reviewer",
+				Mode:    string(config.GitAuthModeGitHubApp),
+			},
+			Unavailable: "credential backend status unavailable",
+			Keys: []initReviewerCredentialKeyStatus{
+				{Key: credentials.GitHubAppIDKey, Required: true, State: initReviewerCredentialKeyUnavailable},
+				{Key: credentials.GitHubAppPrivateKeyKey, Required: true, State: initReviewerCredentialKeyUnavailable},
+				{Key: credentials.GitHubAppInstallationIDKey, Required: false, State: initReviewerCredentialKeyUnavailable},
+			},
+		}},
+	}
+	seed := seedInteractiveInitDraft("work", "work", "work", &existing)
+	model := newInitLinearEditorModel(initReviewerEntityLinearEditor(ctx, seed), 120, 40)
+	model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldSelection, string(initReviewerEntityKindGitHubApp))
+	model.setFieldValue(initReviewerEntityFieldLabel, "rianjs-bot")
+	model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldLabel))
+
+	status := model.document[model.document.fieldIndexByID(initReviewerEntityFieldCredentialStatus)].Description
+	if !strings.Contains(status, "Destination: codereview/rianjs-bot-reviewer") ||
+		!strings.Contains(status, "credential backend status unavailable") ||
+		!strings.Contains(status, string(initReviewerCredentialKeyUnavailable)) {
+		t.Fatalf("status = %q, want label-derived ref to preserve backend-unavailable state", status)
+	}
+	if strings.Contains(status, string(initReviewerCredentialKeyMissing)) {
+		t.Fatalf("status = %q, want unavailable instead of missing when backend status pass failed", status)
+	}
 }
 
 func TestHuhInitReviewerEntityStatusUpdatesWhenSecretLocationChanges(t *testing.T) {
@@ -6547,7 +6996,7 @@ func TestHuhInitReviewerEntityStatusUpdatesWhenSecretLocationChanges(t *testing.
 		t.Fatal("reviewer credential status field missing")
 	}
 	initial := model.document[statusIndex].Description
-	if !strings.Contains(initial, "codereview/old-reviewer") || !strings.Contains(initial, credentials.GitTokenKey+": existing") {
+	if !strings.Contains(initial, "codereview/old-reviewer") || !strings.Contains(initial, credentials.GitTokenKey) || !strings.Contains(initial, string(initReviewerCredentialKeyExisting)) {
 		t.Fatalf("initial status = %q, want old reviewer existing token", initial)
 	}
 
@@ -6559,12 +7008,12 @@ func TestHuhInitReviewerEntityStatusUpdatesWhenSecretLocationChanges(t *testing.
 	model.afterFieldChange(locationIndex)
 
 	updated := model.document[statusIndex].Description
-	for _, want := range []string{"Destination: codereview/new-reviewer", "credential backend status unavailable", credentials.GitTokenKey + ": status unavailable"} {
+	for _, want := range []string{"Destination: codereview/new-reviewer", "credential backend status unavailable", credentials.GitTokenKey, string(initReviewerCredentialKeyUnavailable)} {
 		if !strings.Contains(updated, want) {
 			t.Fatalf("updated status = %q, want %q", updated, want)
 		}
 	}
-	if strings.Contains(updated, "codereview/old-reviewer") || strings.Contains(updated, credentials.GitTokenKey+": existing") {
+	if strings.Contains(updated, "codereview/old-reviewer") || strings.Contains(updated, string(initReviewerCredentialKeyExisting)) {
 		t.Fatalf("updated status = %q, want old ref existing state cleared", updated)
 	}
 }
@@ -6579,7 +7028,7 @@ func TestHuhInitReviewerEntityDetailsBackDoesNotMutateDraft(t *testing.T) {
 		editorRunner: stageReviewerEntityEditorRunner(t, nil, initDetailActionBack),
 	}
 
-	nextDraft, back, err := prompter.editNewReviewerEntity(initReviewerEntityKindUseGitIdentity, draft)
+	nextDraft, back, err := prompter.editNewReviewerEntity(initPromptContext{}, initReviewerEntityKindUseGitIdentity, draft)
 	if err != nil {
 		t.Fatalf("editNewReviewerEntity: %v", err)
 	}
@@ -6598,12 +7047,16 @@ func TestHuhInitReviewerEntityDetailsGitHubAppShowsCredentialBundleCopy(t *testi
 	t.Setenv("TERM", "dumb")
 	draft := seedInteractiveInitDraft("work", "work", "work", nil)
 	var stderr bytes.Buffer
+	privateKey := testReviewerGitHubAppPrivateKey()
 	prompter := huhInitReviewerEntityPrompter{
-		stderr:       &stderr,
-		editorRunner: stageReviewerEntityEditorRunner(t, nil, ""),
-	}
-
-	nextDraft, back, err := prompter.editNewReviewerEntity(initReviewerEntityKindGitHubApp, draft)
+		stderr: &stderr,
+		editorRunner: stageReviewerEntityEditorRunner(t, map[initLinearFieldID]string{
+			initReviewerEntityFieldGitHubAppID:         "12345",
+			initReviewerEntityFieldGitHubAppPrivateKey: privateKey,
+		}, ""),
+	}
+
+	nextDraft, back, err := prompter.editNewReviewerEntity(initPromptContext{}, initReviewerEntityKindGitHubApp, draft)
 	if err != nil {
 		t.Fatalf("editNewReviewerEntity: %v", err)
 	}
@@ -6613,21 +7066,80 @@ func TestHuhInitReviewerEntityDetailsGitHubAppShowsCredentialBundleCopy(t *testi
 	if !nextDraft.ReviewerEnabled || nextDraft.ReviewerAuth != string(config.GitAuthModeGitHubApp) {
 		t.Fatalf("draft = %#v, want GitHub App reviewer", nextDraft)
 	}
+	if got := nextDraft.ReviewerCredentialWrites[credentials.GitHubAppIDKey]; got != "12345" {
+		t.Fatalf("staged app id = %q, want inline app id", got)
+	}
+	if got := nextDraft.ReviewerCredentialWrites[credentials.GitHubAppPrivateKeyKey]; got != privateKey {
+		t.Fatalf("staged private key = %q, want inline private key", got)
+	}
 	out := stderr.String()
 	for _, want := range []string{
 		"GitHub App reviewer. Required credential keys",
 		"Reviewer secret location",
-		"non-secret",
 		"credential-store ref",
+		"This is a credential-store ref, not a PAT",
+		"Reviewer credential values",
+		"GitHub App ID",
+		"GitHub App private key",
 		credentials.GitHubAppIDKey,
 		credentials.GitHubAppPrivateKeyKey,
 		"Optional credential key: " + credentials.GitHubAppInstallationIDKey,
-		credentials.GitHubAppInstallationIDKey + " is optional",
+		"optional",
 	} {
 		if !strings.Contains(out, want) {
 			t.Fatalf("stderr missing %q:\n%s", want, out)
 		}
 	}
+	for _, leaked := range []string{"12345", privateKey} {
+		if strings.Contains(out, leaked) {
+			t.Fatalf("stderr leaked GitHub App secret value %q:\n%s", leaked, out)
+		}
+	}
+}
+
+func TestHuhInitReviewerEntityDetailsPreservesPromptContextCredentialStore(t *testing.T) {
+	t.Setenv("TERM", "dumb")
+	draft := seedInteractiveInitDraft("work", "work", "work", nil)
+	resolved := credentials.ResolvedSecretsProfile{
+		ID:      "work-file",
+		Label:   "Work file",
+		Source:  config.EffectiveSecretsProfileSourceConfigured,
+		Backend: string(credstore.BackendFile),
+	}
+	ctx := initPromptContext{
+		ReviewerCredentialStatuses: []initReviewerCredentialStatus{{
+			Ref: config.CredentialRef{
+				Purpose: "reviewer_credentials",
+				Ref:     "codereview/work-reviewer",
+				Mode:    string(config.GitAuthModeGitHubApp),
+			},
+			SecretsProfile: resolved,
+			Keys: []initReviewerCredentialKeyStatus{
+				{Key: credentials.GitHubAppIDKey, Required: true, State: initReviewerCredentialKeyMissing},
+				{Key: credentials.GitHubAppPrivateKeyKey, Required: true, State: initReviewerCredentialKeyMissing},
+				{Key: credentials.GitHubAppInstallationIDKey, Required: false, State: initReviewerCredentialKeyOptional},
+			},
+		}},
+	}
+	privateKey := testReviewerGitHubAppPrivateKey()
+	prompter := huhInitReviewerEntityPrompter{
+		stderr: &bytes.Buffer{},
+		editorRunner: stageReviewerEntityEditorRunner(t, map[initLinearFieldID]string{
+			initReviewerEntityFieldGitHubAppID:         "12345",
+			initReviewerEntityFieldGitHubAppPrivateKey: privateKey,
+		}, ""),
+	}
+
+	nextDraft, back, err := prompter.editNewReviewerEntity(ctx, initReviewerEntityKindGitHubApp, draft)
+	if err != nil {
+		t.Fatalf("editNewReviewerEntity: %v", err)
+	}
+	if back {
+		t.Fatal("back = true, want staged GitHub App reviewer details")
+	}
+	if !nextDraft.ReviewerCredentialWriteStore.Equal(resolved) {
+		t.Fatalf("ReviewerCredentialWriteStore = %#v, want %#v", nextDraft.ReviewerCredentialWriteStore, resolved)
+	}
 }
 
 func TestHuhInitReviewerEntityDetailsAccessibleHidesSecretLocationForGitIdentity(t *testing.T) {
@@ -6639,7 +7151,7 @@ func TestHuhInitReviewerEntityDetailsAccessibleHidesSecretLocationForGitIdentity
 		editorRunner: stageReviewerEntityEditorRunner(t, nil, ""),
 	}
 
-	nextDraft, back, err := prompter.editNewReviewerEntity(initReviewerEntityKindUseGitIdentity, draft)
+	nextDraft, back, err := prompter.editNewReviewerEntity(initPromptContext{}, initReviewerEntityKindUseGitIdentity, draft)
 	if err != nil {
 		t.Fatalf("editNewReviewerEntity: %v", err)
 	}
@@ -9965,7 +10477,7 @@ func TestInitLinearEditorArrowKeysDoNotScrollFocusedInput(t *testing.T) {
 		document.addSection(fmt.Sprintf("Section %02d", i), "Context line")
 	}
 	model := newInitLinearEditorModel(initLinearEditor{Document: document}, 120, 5)
-	model.viewport.SetYOffset(1)
+	model.setYOffset(1)
 
 	model = updateInitLinearEditorModel(t, model, tea.KeyMsg{Type: tea.KeyDown})
 	if got := model.viewport.YOffset; got != 1 {
@@ -11202,6 +11714,26 @@ func TestInitLinearEditorAlignsFieldDescriptionsWithFieldTitles(t *testing.T) {
 	}
 }
 
+func TestInitLinearEditorPreservesExplicitDescriptionNewlines(t *testing.T) {
+	var document initLinearDocument
+	document.addSection("Status", "first status line\nsecond_key  missing\nthird_key   optional")
+	model := newInitLinearEditorModel(initLinearEditor{Document: document}, 80, 12)
+
+	for _, want := range []string{
+		"first status line",
+		"second_key  missing",
+		"third_key   optional",
+	} {
+		if !strings.Contains(model.layout.Content, want) {
+			t.Fatalf("layout content missing %q:\n%s", want, model.layout.Content)
+		}
+	}
+	if strings.Contains(model.layout.Content, "first status line second_key") ||
+		strings.Contains(model.layout.Content, "second_key\nmissing") {
+		t.Fatalf("layout content collapsed or split explicit description lines:\n%s", model.layout.Content)
+	}
+}
+
 func TestInitSecretsManagementLinearEditorOnlyFocusedSelectChangesAndShowsCaret(t *testing.T) {
 	cfg := config.File{
 		Profiles:       map[string]config.Profile{"default": basicProfile("default")},
@@ -12920,6 +13452,12 @@ func stageReviewerEntityEditorRunner(t *testing.T, edits map[initLinearFieldID]s
 		if !ok {
 			t.Fatalf("Update returned %T, want initLinearEditorModel", updated)
 		}
+		if action == initDetailActionEdit && next.resultAction == "" {
+			actionIndex := next.document.fieldIndexByID(initReviewerEntityFieldAction)
+			if actionIndex >= 0 && strings.TrimSpace(next.document[actionIndex].Error) != "" {
+				t.Fatalf("reviewer editor validation blocked staging: %s", next.document[actionIndex].Error)
+			}
+		}
 		return next, nil
 	}
 }
@@ -14774,6 +15312,66 @@ func TestInitReviewerCredentialStatusShowsExistingPATAndSecretsProfileDestinatio
 	}
 }
 
+func TestInitReviewerCredentialStatusDropsStagedWritesWhenSecretsStoreChanges(t *testing.T) {
+	originalProfile := basicProfile("work")
+	originalProfile.ReviewerCredentials = &config.ReviewerCredentials{
+		AuthMode:      config.GitAuthModeGitHubApp,
+		CredentialRef: "codereview/work-reviewer",
+	}
+	originalCfg := config.File{DefaultProfile: "work", Profiles: map[string]config.Profile{"work": originalProfile}}
+	originalResolved, err := credentials.ResolveSecretsProfileForProfile(originalCfg, originalProfile)
+	if err != nil {
+		t.Fatalf("Resolve original secrets profile: %v", err)
+	}
+	profile := originalProfile
+	profile.SecretsProfile = "work-file"
+	cfg := config.File{
+		DefaultProfile: "work",
+		Secrets: config.SecretsConfig{
+			DefaultProfile: "work-file",
+			Profiles: map[string]config.SecretsProfile{
+				"work-file": {
+					Backend: config.SecretsProfileBackend{Kind: config.SecretsBackendKind(credstore.BackendFile)},
+				},
+			},
+		},
+		Profiles: map[string]config.Profile{"work": profile},
+	}
+	session := initSessionDraft{
+		cfg: cfg,
+		workspace: &initWorkspaceDraft{
+			profileName:     "work",
+			profile:         profile,
+			previousProfile: &originalProfile,
+		},
+		writes: map[string]map[string]string{
+			"codereview/work-reviewer": {
+				credentials.GitHubAppIDKey:         "12345",
+				credentials.GitHubAppPrivateKeyKey: "private-key",
+			},
+		},
+		credentialWriteStores: map[string]credentials.ResolvedSecretsProfile{
+			"codereview/work-reviewer": originalResolved,
+		},
+		credentialDecisions: map[initCredentialDecisionKey]initCredentialDecisionKind{},
+		satisfiedRefs:       map[string]bool{"codereview/work-reviewer": true},
+	}
+	deps := initDeps{
+		openStore: func(string, bool, config.File) (initStore, error) {
+			t.Fatal("legacy openStore called after profile moved to named secrets profile")
+			return nil, nil
+		},
+		openResolvedStore: func(credentials.ResolvedSecretsProfile, string, bool, config.File) (initStore, error) {
+			return newFakeInitStore(nil), nil
+		},
+	}
+
+	statuses := buildInteractiveInitReviewerCredentialStatuses(&root.Options{}, deps, session)
+	status := findReviewerCredentialStatusForTest(t, statuses, "codereview/work-reviewer", string(config.GitAuthModeGitHubApp))
+	assertReviewerCredentialKeyState(t, status, credentials.GitHubAppIDKey, initReviewerCredentialKeyMissing)
+	assertReviewerCredentialKeyState(t, status, credentials.GitHubAppPrivateKeyKey, initReviewerCredentialKeyMissing)
+}
+
 func TestInitReviewerCredentialStatusIncludesSelectableReviewerEntities(t *testing.T) {
 	work := basicProfile("work")
 	bot := basicProfile("bot")
@@ -14871,7 +15469,124 @@ func assertReviewerCredentialKeyAbsent(t *testing.T, status initReviewerCredenti
 	}
 }
 
-func TestInitInteractiveMenuFocusedGitHubAppReviewerDeferEmitsReadinessAndHints(t *testing.T) {
+func testReviewerGitHubAppPrivateKey() string {
+	return strings.Join([]string{
+		"-----BEGIN PRIVATE KEY-----",
+		"abc123",
+		"-----END PRIVATE KEY-----",
+	}, "\n")
+}
+
+func stageDraftInlineGitHubAppReviewerCredentials(draft *initDraft, ref string, appID string, privateKey string) {
+	draft.ReviewerCredentialWriteRef = ref
+	draft.ReviewerCredentialWrites = map[string]string{
+		credentials.GitHubAppIDKey:         appID,
+		credentials.GitHubAppPrivateKeyKey: privateKey,
+	}
+	draft.ReviewerCredentialSatisfied = true
+}
+
+func stageDraftInlinePATReviewerCredential(draft *initDraft, ref string, token string) {
+	draft.ReviewerCredentialWriteRef = ref
+	draft.ReviewerCredentialWrites = map[string]string{
+		credentials.GitTokenKey: token,
+	}
+	draft.ReviewerCredentialSatisfied = true
+}
+
+func TestMergeReviewerCredentialDraftWritesDropsStaleKeysWhenAuthModeChanges(t *testing.T) {
+	ref := "codereview/shared-reviewer"
+	privateKey := testReviewerGitHubAppPrivateKey()
+
+	t.Run("PAT to GitHub App", func(t *testing.T) {
+		session := initSessionDraft{}
+		patDraft := initDraft{ReviewerAuth: string(config.GitAuthModePAT)}
+		stageDraftInlinePATReviewerCredential(&patDraft, ref, "old-token")
+		patDraft.ReviewerCredentialOverwrite = true
+		session = mergeReviewerCredentialDraftWrites(session, patDraft)
+
+		appDraft := initDraft{ReviewerAuth: string(config.GitAuthModeGitHubApp)}
+		stageDraftInlineGitHubAppReviewerCredentials(&appDraft, ref, "12345", privateKey)
+		session = mergeReviewerCredentialDraftWrites(session, appDraft)
+
+		if _, ok := session.writes[ref][credentials.GitTokenKey]; ok {
+			t.Fatalf("writes[%q] kept stale PAT key: %#v", ref, session.writes[ref])
+		}
+		if got := session.writes[ref][credentials.GitHubAppIDKey]; got != "12345" {
+			t.Fatalf("github_app_id = %q, want current GitHub App staged value", got)
+		}
+		if got := session.writes[ref][credentials.GitHubAppPrivateKeyKey]; got != privateKey {
+			t.Fatalf("github_app_private_key = %q, want current GitHub App staged value", got)
+		}
+		if session.overwriteRefs[ref] {
+			t.Fatalf("overwriteRefs[%q] = true, want stale overwrite flag cleared", ref)
+		}
+
+		profile := basicProfile("work")
+		profile.ReviewerCredentials = &config.ReviewerCredentials{
+			AuthMode:      config.GitAuthModeGitHubApp,
+			CredentialRef: ref,
+		}
+		if _, err := planInitCredentialsWithConfig(config.File{Profiles: map[string]config.Profile{"work": profile}}, nil, profile, projectInitPlannedWriteKeys(session.writes)); err != nil {
+			t.Fatalf("planInitCredentialsWithConfig: %v", err)
+		}
+	})
+
+	t.Run("GitHub App to PAT", func(t *testing.T) {
+		session := initSessionDraft{}
+		appDraft := initDraft{ReviewerAuth: string(config.GitAuthModeGitHubApp)}
+		stageDraftInlineGitHubAppReviewerCredentials(&appDraft, ref, "12345", privateKey)
+		session = mergeReviewerCredentialDraftWrites(session, appDraft)
+
+		patDraft := initDraft{ReviewerAuth: string(config.GitAuthModePAT)}
+		stageDraftInlinePATReviewerCredential(&patDraft, ref, "new-token")
+		session = mergeReviewerCredentialDraftWrites(session, patDraft)
+
+		if _, ok := session.writes[ref][credentials.GitHubAppIDKey]; ok {
+			t.Fatalf("writes[%q] kept stale GitHub App key: %#v", ref, session.writes[ref])
+		}
+		if _, ok := session.writes[ref][credentials.GitHubAppPrivateKeyKey]; ok {
+			t.Fatalf("writes[%q] kept stale GitHub App private key: %#v", ref, session.writes[ref])
+		}
+		if got := session.writes[ref][credentials.GitTokenKey]; got != "new-token" {
+			t.Fatalf("git_token = %q, want current PAT staged value", got)
+		}
+
+		profile := basicProfile("work")
+		profile.ReviewerCredentials = &config.ReviewerCredentials{
+			AuthMode:      config.GitAuthModePAT,
+			CredentialRef: ref,
+		}
+		if _, err := planInitCredentialsWithConfig(config.File{Profiles: map[string]config.Profile{"work": profile}}, nil, profile, projectInitPlannedWriteKeys(session.writes)); err != nil {
+			t.Fatalf("planInitCredentialsWithConfig: %v", err)
+		}
+	})
+}
+
+func TestMergeReviewerCredentialDraftWritesPreservesOverwriteFlagOnNoSecretReentry(t *testing.T) {
+	ref := "codereview/work-reviewer"
+	session := initSessionDraft{}
+	firstDraft := initDraft{ReviewerAuth: string(config.GitAuthModePAT)}
+	stageDraftInlinePATReviewerCredential(&firstDraft, ref, "replacement-token")
+	firstDraft.ReviewerCredentialOverwrite = true
+	session = mergeReviewerCredentialDraftWrites(session, firstDraft)
+
+	secondDraft := initDraft{
+		ReviewerAuth:                string(config.GitAuthModePAT),
+		ReviewerCredentialWriteRef:  ref,
+		ReviewerCredentialSatisfied: true,
+	}
+	session = mergeReviewerCredentialDraftWrites(session, secondDraft)
+
+	if got := session.writes[ref][credentials.GitTokenKey]; got != "replacement-token" {
+		t.Fatalf("staged git_token = %q, want replacement retained", got)
+	}
+	if !session.overwriteRefs[ref] {
+		t.Fatalf("overwriteRefs[%q] = false, want retained for existing staged replacement", ref)
+	}
+}
+
+func TestInitInteractiveMenuFocusedGitHubAppReviewerInlineWritesReadyWithoutHints(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "config.yml")
 	cfg := config.File{
 		DefaultProfile: "work",
@@ -14893,6 +15608,7 @@ func TestInitInteractiveMenuFocusedGitHubAppReviewerDeferEmitsReadinessAndHints(
 	saveCredentialTestConfig(t, path, cfg)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
+	privateKey := testReviewerGitHubAppPrivateKey()
 	opts := &root.Options{
 		Stdin:      strings.NewReader(""),
 		Stdout:     &stdout,
@@ -14900,6 +15616,12 @@ func TestInitInteractiveMenuFocusedGitHubAppReviewerDeferEmitsReadinessAndHints(
 		ConfigPath: path,
 	}
 	reviewerPrompterCalls := 0
+	secretPrompter := &fakeInitSecretPrompter{}
+	store := newFakeInitStore(map[string]map[string]string{
+		"work": {
+			credentials.GitTokenKey: "existing-token",
+		},
+	})
 	deps := initDeps{
 		menuPrompter: &fakeInitMenuPrompter{
 			actions: []initMenuAction{
@@ -14920,17 +15642,12 @@ func TestInitInteractiveMenuFocusedGitHubAppReviewerDeferEmitsReadinessAndHints(
 			draft.ReviewerAuth = string(config.GitAuthModeGitHubApp)
 			draft.ReviewerCredentialRef = "codereview/rianjs-bot"
 			draft.ReviewerDisplayName = "rianjs-bot"
+			stageDraftInlineGitHubAppReviewerCredentials(&draft, draft.ReviewerCredentialRef, "12345", privateKey)
 			return draft, nil
 		}),
-		secretPrompter: &fakeInitSecretPrompter{
-			actions: []initCredentialSecretAction{initCredentialSecretActionDefer},
-		},
+		secretPrompter: secretPrompter,
 		openStore: func(string, bool, config.File) (initStore, error) {
-			return newFakeInitStore(map[string]map[string]string{
-				"work": {
-					credentials.GitTokenKey: "existing-token",
-				},
-			}), nil
+			return store, nil
 		},
 		configPath: func(*root.Options) (string, error) { return path, nil },
 		loadConfig: loadConfigForInit,
@@ -14953,33 +15670,27 @@ func TestInitInteractiveMenuFocusedGitHubAppReviewerDeferEmitsReadinessAndHints(
 		profile.ReviewerCredentials.DisplayName != "rianjs-bot" {
 		t.Fatalf("reviewer credentials = %#v, want rianjs-bot GitHub App reviewer", profile.ReviewerCredentials)
 	}
-	out := stdout.String()
-	for _, want := range []string{
-		"Saved staged init changes",
-		"- work: needs follow-up",
-		"reviewer deferred",
-		"required: " + credentials.GitHubAppIDKey + ", " + credentials.GitHubAppPrivateKeyKey,
-		"optional: " + credentials.GitHubAppInstallationIDKey,
-	} {
-		if !strings.Contains(out, want) {
-			t.Fatalf("stdout = %q, want %q", out, want)
-		}
+	if len(secretPrompter.actionPrompts) != 0 || len(secretPrompter.sourcePrompts) != 0 {
+		t.Fatalf("secret prompts = actions:%d sources:%d, want inline reviewer credential collection only", len(secretPrompter.actionPrompts), len(secretPrompter.sourcePrompts))
 	}
-	errOut := stderr.String()
-	for _, want := range []string{
-		"Next: cr set-credential --ref codereview/rianjs-bot --key " + credentials.GitHubAppIDKey + " --stdin",
-		"Next: cr set-credential --ref codereview/rianjs-bot --key " + credentials.GitHubAppPrivateKeyKey + " --stdin",
-	} {
-		if !strings.Contains(errOut, want) {
-			t.Fatalf("stderr = %q, want %q", errOut, want)
-		}
+	if got := store.bundles["rianjs-bot"][credentials.GitHubAppIDKey]; got != "12345" {
+		t.Fatalf("stored app id = %q, want staged inline value", got)
+	}
+	if got := store.bundles["rianjs-bot"][credentials.GitHubAppPrivateKeyKey]; got != privateKey {
+		t.Fatalf("stored private key = %q, want staged inline private key", got)
+	}
+	if _, ok := store.bundles["rianjs-bot"][credentials.GitHubAppInstallationIDKey]; ok {
+		t.Fatalf("installation id stored unexpectedly: %#v", store.bundles["rianjs-bot"])
 	}
-	if strings.Contains(errOut, " --key "+credentials.GitHubAppInstallationIDKey+" ") {
-		t.Fatalf("stderr = %q, want optional installation id omitted from required follow-up commands", errOut)
+	if !strings.Contains(stdout.String(), "- work: ready") {
+		t.Fatalf("stdout = %q, want ready profile after inline reviewer credentials", stdout.String())
+	}
+	if strings.Contains(stdout.String(), "reviewer deferred") || strings.Contains(stderr.String(), "set-credential --ref codereview/rianjs-bot") {
+		t.Fatalf("stdout/stderr kept follow-up hint:\nstdout=%s\nstderr=%s", stdout.String(), stderr.String())
 	}
 }
 
-func TestInitInteractiveMenuFocusedGitHubAppReviewerSetNowPromptsBeforeCommitAndDoesNotRepeat(t *testing.T) {
+func TestInitInteractiveMenuFocusedGitHubAppReviewerInlineWritesBeforeCommitAndDoesNotRepeat(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "config.yml")
 	cfg := config.File{
 		DefaultProfile: "work",
@@ -15002,24 +15713,8 @@ func TestInitInteractiveMenuFocusedGitHubAppReviewerSetNowPromptsBeforeCommitAnd
 			initMenuActionSave,
 		},
 	}
-	privateKey := strings.Join([]string{
-		"-----BEGIN PRIVATE KEY-----",
-		"abc123",
-		"-----END PRIVATE KEY-----",
-	}, "\n")
-	var actionMenuPromptCounts []int
-	secretPrompter := &fakeInitSecretPrompter{
-		actions: []initCredentialSecretAction{initCredentialSecretActionSetNow},
-		sources: []initSecretSource{
-			initSecretSourcePaste,
-			initSecretSourcePaste,
-			initSecretSourceSkip,
-		},
-		pastes: []string{"12345", privateKey},
-		onAction: func(initCredentialSecretPrompt) {
-			actionMenuPromptCounts = append(actionMenuPromptCounts, len(menu.prompts))
-		},
-	}
+	privateKey := testReviewerGitHubAppPrivateKey()
+	secretPrompter := &fakeInitSecretPrompter{}
 	store := newFakeInitStore(map[string]map[string]string{
 		"work": {credentials.GitTokenKey: "existing-token"},
 	})
@@ -15039,6 +15734,7 @@ func TestInitInteractiveMenuFocusedGitHubAppReviewerSetNowPromptsBeforeCommitAnd
 			draft.ReviewerAuth = string(config.GitAuthModeGitHubApp)
 			draft.ReviewerCredentialRef = "codereview/rianjs-bot"
 			draft.ReviewerDisplayName = "rianjs-bot"
+			stageDraftInlineGitHubAppReviewerCredentials(&draft, draft.ReviewerCredentialRef, "12345", privateKey)
 			return draft, nil
 		}),
 		secretPrompter: secretPrompter,
@@ -15053,23 +15749,11 @@ func TestInitInteractiveMenuFocusedGitHubAppReviewerSetNowPromptsBeforeCommitAnd
 	if err := runInitWithDeps(&cobra.Command{}, opts, initOptions{}, deps); err != nil {
 		t.Fatalf("runInitWithDeps: %v", err)
 	}
-	if !reflect.DeepEqual(actionMenuPromptCounts, []int{1}) {
-		t.Fatalf("action prompt menu counts = %#v, want prompt after reviewer menu action and before commit", actionMenuPromptCounts)
-	}
-	if len(secretPrompter.actionPrompts) != 1 {
-		t.Fatalf("action prompts = %d, want reviewer credential prompt once", len(secretPrompter.actionPrompts))
-	}
-	actionPrompt := secretPrompter.actionPrompts[0]
-	if actionPrompt.Entry.Ref.Purpose != "reviewer_credentials" || actionPrompt.Entry.Ref.Mode != string(config.GitAuthModeGitHubApp) {
-		t.Fatalf("action prompt ref = %#v, want GitHub App reviewer credentials", actionPrompt.Entry.Ref)
-	}
-	gotKeys := make([]string, 0, len(secretPrompter.sourcePrompts))
-	for _, prompt := range secretPrompter.sourcePrompts {
-		gotKeys = append(gotKeys, prompt.Key)
+	if len(menu.prompts) != 2 {
+		t.Fatalf("menu prompts = %d, want reviewer menu then save", len(menu.prompts))
 	}
-	wantKeys := []string{credentials.GitHubAppIDKey, credentials.GitHubAppPrivateKeyKey, credentials.GitHubAppInstallationIDKey}
-	if !reflect.DeepEqual(gotKeys, wantKeys) {
-		t.Fatalf("source prompt keys = %#v, want %#v", gotKeys, wantKeys)
+	if len(secretPrompter.actionPrompts) != 0 || len(secretPrompter.sourcePrompts) != 0 {
+		t.Fatalf("secret prompts = actions:%d sources:%d, want no separate reviewer credential prompt", len(secretPrompter.actionPrompts), len(secretPrompter.sourcePrompts))
 	}
 	if got := store.bundles["rianjs-bot"][credentials.GitHubAppIDKey]; got != "12345" {
 		t.Fatalf("stored app id = %q, want staged value written at commit", got)
@@ -15088,12 +15772,15 @@ func TestInitInteractiveMenuFocusedGitHubAppReviewerSetNowPromptsBeforeCommitAnd
 	}
 }
 
-func TestInitInteractiveMenuFocusedPATReviewerPromptsForGitTokenOnly(t *testing.T) {
+func TestInitInteractiveMenuLabelDerivedReviewerRefDoesNotOverwriteUnconfiguredExistingBundle(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "config.yml")
-	saveCredentialTestConfig(t, path, config.File{
+	cfg := config.File{
 		DefaultProfile: "work",
-		Profiles:       map[string]config.Profile{"work": basicProfile("work")},
-	})
+		Profiles: map[string]config.Profile{
+			"work": basicProfile("work"),
+		},
+	}
+	saveCredentialTestConfig(t, path, cfg)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	opts := &root.Options{
@@ -15102,14 +15789,14 @@ func TestInitInteractiveMenuFocusedPATReviewerPromptsForGitTokenOnly(t *testing.
 		Stderr:     &stderr,
 		ConfigPath: path,
 	}
-	secretPrompter := &fakeInitSecretPrompter{
-		actions: []initCredentialSecretAction{initCredentialSecretActionSetNow},
-		sources: []initSecretSource{initSecretSourcePaste},
-		pastes:  []string{"reviewer-pat"},
-	}
 	store := newFakeInitStore(map[string]map[string]string{
 		"work": {credentials.GitTokenKey: "existing-token"},
+		"rianjs-bot-reviewer": {
+			credentials.GitHubAppIDKey:         "existing-app-id",
+			credentials.GitHubAppPrivateKeyKey: "existing-private-key",
+		},
 	})
+	privateKey := testReviewerGitHubAppPrivateKey()
 	deps := initDeps{
 		menuPrompter: &fakeInitMenuPrompter{
 			actions: []initMenuAction{
@@ -15121,59 +15808,209 @@ func TestInitInteractiveMenuFocusedPATReviewerPromptsForGitTokenOnly(t *testing.
 			return initFinalizeActionSave, nil
 		}),
 		reviewerPrompter: initReviewerEntityPrompterFunc(func(prompt initReviewerEntityPrompt) (initDraft, error) {
-			draft := seedInteractiveInitDraft(prompt.Context.RequestedProfileName, prompt.Context.ExistingProfileName, prompt.Context.DefaultProfileName, prompt.Context.ExistingProfile)
-			draft.ReviewerEnabled = true
-			draft.ReviewerAuth = string(config.GitAuthModePAT)
-			draft.ReviewerCredentialRef = "codereview/work-reviewer"
-			return draft, nil
+			seed := seedInteractiveInitDraft(prompt.Context.RequestedProfileName, prompt.Context.ExistingProfileName, prompt.Context.DefaultProfileName, prompt.Context.ExistingProfile)
+			model := newInitLinearEditorModel(initReviewerEntityLinearEditor(prompt.Context, seed), 160, 60)
+			model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldSelection, string(initReviewerEntityKindGitHubApp))
+			model.setFieldValue(initReviewerEntityFieldLabel, "rianjs-bot")
+			model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldLabel))
+			model.setFieldValue(initReviewerEntityFieldGitHubAppID, "12345")
+			model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldGitHubAppID))
+			model.setFieldValue(initReviewerEntityFieldGitHubAppPrivateKey, privateKey)
+			model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldGitHubAppPrivateKey))
+			model = focusInitLinearField(t, model, initReviewerEntityFieldAction)
+			model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldAction, initDetailActionEdit)
+
+			updated, _ := model.Update(tea.KeyMsg{Type: tea.KeyEnter})
+			next, ok := updated.(initLinearEditorModel)
+			if !ok {
+				t.Fatalf("Update returned %T, want initLinearEditorModel", updated)
+			}
+			if next.resultAction != initDetailActionEdit {
+				t.Fatalf("resultAction = %q, want staged reviewer settings; action error = %q", next.resultAction, next.document[next.document.fieldIndexByID(initReviewerEntityFieldAction)].Error)
+			}
+			return initReviewerEntityDraftFromDocument(prompt.Context, seed, next.document)
 		}),
-		secretPrompter: secretPrompter,
+		secretPrompter: &fakeInitSecretPrompter{},
 		openStore: func(string, bool, config.File) (initStore, error) {
 			return store, nil
 		},
 		configPath: func(*root.Options) (string, error) { return path, nil },
 		loadConfig: loadConfigForInit,
-		saveConfig: config.Save,
+		saveConfig: func(string, config.File) error {
+			t.Fatal("saveConfig called despite existing label-derived reviewer bundle conflict")
+			return nil
+		},
 	}
 
-	if err := runInitWithDeps(&cobra.Command{}, opts, initOptions{}, deps); err != nil {
-		t.Fatalf("runInitWithDeps: %v", err)
-	}
-	if len(secretPrompter.actionPrompts) != 1 {
-		t.Fatalf("action prompts = %d, want one PAT reviewer prompt", len(secretPrompter.actionPrompts))
-	}
-	prompt := secretPrompter.actionPrompts[0]
-	if prompt.Entry.Ref.Purpose != "reviewer_credentials" || prompt.Entry.Ref.Mode != string(config.GitAuthModePAT) {
-		t.Fatalf("prompt ref = %#v, want PAT reviewer", prompt.Entry.Ref)
-	}
-	if len(secretPrompter.sourcePrompts) != 1 {
-		t.Fatalf("source prompts = %d, want exactly one reviewer PAT key prompt", len(secretPrompter.sourcePrompts))
-	}
-	sourcePrompt := secretPrompter.sourcePrompts[0]
-	if sourcePrompt.Key != credentials.GitTokenKey || sourcePrompt.Optional {
-		t.Fatalf("source prompt = %#v, want required reviewer git_token", sourcePrompt)
+	err := runInitWithDeps(&cobra.Command{}, opts, initOptions{}, deps)
+	if err == nil || !strings.Contains(err.Error(), credstore.ErrExists.Error()) {
+		t.Fatalf("runInitWithDeps error = %v, want no-overwrite conflict", err)
 	}
-	if got := initSecretSourcePromptTitle(sourcePrompt); got != "How should init get git_token?" {
-		t.Fatalf("source prompt title = %q, want reviewer git_token prompt", got)
+	if got := store.bundles["rianjs-bot-reviewer"][credentials.GitHubAppIDKey]; got != "existing-app-id" {
+		t.Fatalf("stored github_app_id = %q, want existing value preserved after conflict", got)
 	}
-	if got := store.bundles["work-reviewer"][credentials.GitTokenKey]; got != "reviewer-pat" {
-		t.Fatalf("stored reviewer PAT = %q, want staged value written at commit", got)
+	if got := store.bundles["rianjs-bot-reviewer"][credentials.GitHubAppPrivateKeyKey]; got != "existing-private-key" {
+		t.Fatalf("stored private key = %q, want existing value preserved after conflict", got)
 	}
-	if strings.Contains(stderr.String(), credentials.GitHubAppIDKey) || strings.Contains(stderr.String(), credentials.GitHubAppPrivateKeyKey) {
-		t.Fatalf("stderr = %q, want PAT reviewer flow not GitHub App keys", stderr.String())
+	if strings.Contains(stdout.String(), "Saved staged init changes") {
+		t.Fatalf("stdout = %q, want save blocked by no-overwrite conflict", stdout.String())
 	}
 }
 
-func TestInitInteractiveMenuFocusedUseGitReviewerSkipsReviewerCredentialPrompt(t *testing.T) {
+func TestInitInteractiveMenuManualReviewerRefDoesNotOverwriteUnconfiguredExistingBundle(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "config.yml")
-	saveCredentialTestConfig(t, path, config.File{
+	cfg := config.File{
 		DefaultProfile: "work",
-		Profiles:       map[string]config.Profile{"work": basicProfile("work")},
-	})
+		Profiles: map[string]config.Profile{
+			"work": basicProfile("work"),
+		},
+	}
+	saveCredentialTestConfig(t, path, cfg)
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
 	opts := &root.Options{
 		Stdin:      strings.NewReader(""),
-		Stdout:     &bytes.Buffer{},
-		Stderr:     &bytes.Buffer{},
+		Stdout:     &stdout,
+		Stderr:     &stderr,
+		ConfigPath: path,
+	}
+	store := newFakeInitStore(map[string]map[string]string{
+		"work": {credentials.GitTokenKey: "existing-token"},
+		"manual-reviewer": {
+			credentials.GitHubAppIDKey:         "existing-app-id",
+			credentials.GitHubAppPrivateKeyKey: "existing-private-key",
+		},
+	})
+	privateKey := testReviewerGitHubAppPrivateKey()
+	deps := initDeps{
+		menuPrompter: &fakeInitMenuPrompter{
+			actions: []initMenuAction{
+				initMenuActionReviewerEntities,
+				initMenuActionSave,
+			},
+		},
+		finalizePrompter: initFinalizePrompterFunc(func(initFinalizePrompt) (initFinalizeAction, error) {
+			return initFinalizeActionSave, nil
+		}),
+		reviewerPrompter: initReviewerEntityPrompterFunc(func(prompt initReviewerEntityPrompt) (initDraft, error) {
+			seed := seedInteractiveInitDraft(prompt.Context.RequestedProfileName, prompt.Context.ExistingProfileName, prompt.Context.DefaultProfileName, prompt.Context.ExistingProfile)
+			model := newInitLinearEditorModel(initReviewerEntityLinearEditor(prompt.Context, seed), 160, 60)
+			model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldSelection, string(initReviewerEntityKindGitHubApp))
+			model.setFieldValue(initReviewerEntityFieldSecretLocation, "codereview/manual-reviewer")
+			model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldSecretLocation))
+			model.setFieldValue(initReviewerEntityFieldGitHubAppID, "12345")
+			model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldGitHubAppID))
+			model.setFieldValue(initReviewerEntityFieldGitHubAppPrivateKey, privateKey)
+			model.afterFieldChange(model.document.fieldIndexByID(initReviewerEntityFieldGitHubAppPrivateKey))
+			model = focusInitLinearField(t, model, initReviewerEntityFieldAction)
+			model = selectInitLinearFieldValue(t, model, initReviewerEntityFieldAction, initDetailActionEdit)
+
+			updated, _ := model.Update(tea.KeyMsg{Type: tea.KeyEnter})
+			next, ok := updated.(initLinearEditorModel)
+			if !ok {
+				t.Fatalf("Update returned %T, want initLinearEditorModel", updated)
+			}
+			if next.resultAction != initDetailActionEdit {
+				t.Fatalf("resultAction = %q, want staged reviewer settings; action error = %q", next.resultAction, next.document[next.document.fieldIndexByID(initReviewerEntityFieldAction)].Error)
+			}
+			return initReviewerEntityDraftFromDocument(prompt.Context, seed, next.document)
+		}),
+		secretPrompter: &fakeInitSecretPrompter{},
+		openStore: func(string, bool, config.File) (initStore, error) {
+			return store, nil
+		},
+		configPath: func(*root.Options) (string, error) { return path, nil },
+		loadConfig: loadConfigForInit,
+		saveConfig: func(string, config.File) error {
+			t.Fatal("saveConfig called despite existing manual reviewer bundle conflict")
+			return nil
+		},
+	}
+
+	err := runInitWithDeps(&cobra.Command{}, opts, initOptions{}, deps)
+	if err == nil || !strings.Contains(err.Error(), credstore.ErrExists.Error()) {
+		t.Fatalf("runInitWithDeps error = %v, want no-overwrite conflict", err)
+	}
+	if got := store.bundles["manual-reviewer"][credentials.GitHubAppIDKey]; got != "existing-app-id" {
+		t.Fatalf("stored github_app_id = %q, want existing value preserved after conflict", got)
+	}
+	if got := store.bundles["manual-reviewer"][credentials.GitHubAppPrivateKeyKey]; got != "existing-private-key" {
+		t.Fatalf("stored private key = %q, want existing value preserved after conflict", got)
+	}
+	if strings.Contains(stdout.String(), "Saved staged init changes") {
+		t.Fatalf("stdout = %q, want save blocked by no-overwrite conflict", stdout.String())
+	}
+}
+
+func TestInitInteractiveMenuFocusedPATReviewerPromptsForGitTokenOnly(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.yml")
+	saveCredentialTestConfig(t, path, config.File{
+		DefaultProfile: "work",
+		Profiles:       map[string]config.Profile{"work": basicProfile("work")},
+	})
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	opts := &root.Options{
+		Stdin:      strings.NewReader(""),
+		Stdout:     &stdout,
+		Stderr:     &stderr,
+		ConfigPath: path,
+	}
+	secretPrompter := &fakeInitSecretPrompter{}
+	store := newFakeInitStore(map[string]map[string]string{
+		"work": {credentials.GitTokenKey: "existing-token"},
+	})
+	deps := initDeps{
+		menuPrompter: &fakeInitMenuPrompter{
+			actions: []initMenuAction{
+				initMenuActionReviewerEntities,
+				initMenuActionSave,
+			},
+		},
+		finalizePrompter: initFinalizePrompterFunc(func(initFinalizePrompt) (initFinalizeAction, error) {
+			return initFinalizeActionSave, nil
+		}),
+		reviewerPrompter: initReviewerEntityPrompterFunc(func(prompt initReviewerEntityPrompt) (initDraft, error) {
+			draft := seedInteractiveInitDraft(prompt.Context.RequestedProfileName, prompt.Context.ExistingProfileName, prompt.Context.DefaultProfileName, prompt.Context.ExistingProfile)
+			draft.ReviewerEnabled = true
+			draft.ReviewerAuth = string(config.GitAuthModePAT)
+			draft.ReviewerCredentialRef = "codereview/work-reviewer"
+			stageDraftInlinePATReviewerCredential(&draft, draft.ReviewerCredentialRef, "reviewer-pat")
+			return draft, nil
+		}),
+		secretPrompter: secretPrompter,
+		openStore: func(string, bool, config.File) (initStore, error) {
+			return store, nil
+		},
+		configPath: func(*root.Options) (string, error) { return path, nil },
+		loadConfig: loadConfigForInit,
+		saveConfig: config.Save,
+	}
+
+	if err := runInitWithDeps(&cobra.Command{}, opts, initOptions{}, deps); err != nil {
+		t.Fatalf("runInitWithDeps: %v", err)
+	}
+	if len(secretPrompter.actionPrompts) != 0 || len(secretPrompter.sourcePrompts) != 0 {
+		t.Fatalf("secret prompts = actions:%d sources:%d, want no separate reviewer PAT prompt", len(secretPrompter.actionPrompts), len(secretPrompter.sourcePrompts))
+	}
+	if got := store.bundles["work-reviewer"][credentials.GitTokenKey]; got != "reviewer-pat" {
+		t.Fatalf("stored reviewer PAT = %q, want staged value written at commit", got)
+	}
+	if strings.Contains(stderr.String(), credentials.GitHubAppIDKey) || strings.Contains(stderr.String(), credentials.GitHubAppPrivateKeyKey) {
+		t.Fatalf("stderr = %q, want PAT reviewer flow not GitHub App keys", stderr.String())
+	}
+}
+
+func TestInitInteractiveMenuFocusedUseGitReviewerSkipsReviewerCredentialPrompt(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.yml")
+	saveCredentialTestConfig(t, path, config.File{
+		DefaultProfile: "work",
+		Profiles:       map[string]config.Profile{"work": basicProfile("work")},
+	})
+	opts := &root.Options{
+		Stdin:      strings.NewReader(""),
+		Stdout:     &bytes.Buffer{},
+		Stderr:     &bytes.Buffer{},
 		ConfigPath: path,
 	}
 	deps := initDeps{
@@ -15222,8 +16059,15 @@ func TestInitInteractiveMenuReviewerCredentialDecisionDropsAfterReviewerCleared(
 		ConfigPath: path,
 	}
 	reviewerPrompterCalls := 0
-	secretPrompter := &fakeInitSecretPrompter{
-		actions: []initCredentialSecretAction{initCredentialSecretActionDefer},
+	secretPrompter := &fakeInitSecretPrompter{}
+	store := newFakeInitStore(map[string]map[string]string{
+		"work": {credentials.GitTokenKey: "existing-token"},
+	})
+	store.setBundleFunc = func(profile string, kv map[string]string, _ ...credstore.SetOpt) (credstore.Result, error) {
+		if profile == "rianjs-bot" {
+			t.Fatalf("SetBundle called for stale reviewer ref with %#v", kv)
+		}
+		return credstore.Result{}, nil
 	}
 	deps := initDeps{
 		menuPrompter: &fakeInitMenuPrompter{
@@ -15244,6 +16088,7 @@ func TestInitInteractiveMenuReviewerCredentialDecisionDropsAfterReviewerCleared(
 				draft.ReviewerEnabled = true
 				draft.ReviewerAuth = string(config.GitAuthModeGitHubApp)
 				draft.ReviewerCredentialRef = "codereview/rianjs-bot"
+				stageDraftInlineGitHubAppReviewerCredentials(&draft, draft.ReviewerCredentialRef, "12345", testReviewerGitHubAppPrivateKey())
 			case 2:
 				draft.ReviewerEnabled = false
 			default:
@@ -15253,9 +16098,7 @@ func TestInitInteractiveMenuReviewerCredentialDecisionDropsAfterReviewerCleared(
 		}),
 		secretPrompter: secretPrompter,
 		openStore: func(string, bool, config.File) (initStore, error) {
-			return newFakeInitStore(map[string]map[string]string{
-				"work": {credentials.GitTokenKey: "existing-token"},
-			}), nil
+			return store, nil
 		},
 		configPath: func(*root.Options) (string, error) { return path, nil },
 		loadConfig: loadConfigForInit,
@@ -15265,8 +16108,8 @@ func TestInitInteractiveMenuReviewerCredentialDecisionDropsAfterReviewerCleared(
 	if err := runInitWithDeps(&cobra.Command{}, opts, initOptions{}, deps); err != nil {
 		t.Fatalf("runInitWithDeps: %v", err)
 	}
-	if len(secretPrompter.actionPrompts) != 1 {
-		t.Fatalf("action prompts = %d, want only initial deferred reviewer prompt", len(secretPrompter.actionPrompts))
+	if len(secretPrompter.actionPrompts) != 0 || len(secretPrompter.sourcePrompts) != 0 {
+		t.Fatalf("secret prompts = actions:%d sources:%d, want no separate reviewer credential prompt", len(secretPrompter.actionPrompts), len(secretPrompter.sourcePrompts))
 	}
 	if strings.Contains(stdout.String(), "reviewer deferred") || strings.Contains(stderr.String(), "rianjs-bot") {
 		t.Fatalf("stdout/stderr kept stale reviewer decision:\nstdout=%s\nstderr=%s", stdout.String(), stderr.String())
@@ -15295,12 +16138,10 @@ func TestInitInteractiveMenuReviewerCredentialDecisionDropsAfterReviewerRefChang
 		ConfigPath: path,
 	}
 	reviewerPrompterCalls := 0
-	secretPrompter := &fakeInitSecretPrompter{
-		actions: []initCredentialSecretAction{
-			initCredentialSecretActionDefer,
-			initCredentialSecretActionDefer,
-		},
-	}
+	secretPrompter := &fakeInitSecretPrompter{}
+	store := newFakeInitStore(map[string]map[string]string{
+		"work": {credentials.GitTokenKey: "existing-token"},
+	})
 	deps := initDeps{
 		menuPrompter: &fakeInitMenuPrompter{
 			actions: []initMenuAction{
@@ -15320,8 +16161,10 @@ func TestInitInteractiveMenuReviewerCredentialDecisionDropsAfterReviewerRefChang
 			switch reviewerPrompterCalls {
 			case 1:
 				draft.ReviewerCredentialRef = "codereview/old-reviewer"
+				stageDraftInlineGitHubAppReviewerCredentials(&draft, draft.ReviewerCredentialRef, "old-app-id", testReviewerGitHubAppPrivateKey())
 			case 2:
 				draft.ReviewerCredentialRef = "codereview/new-reviewer"
+				stageDraftInlineGitHubAppReviewerCredentials(&draft, draft.ReviewerCredentialRef, "new-app-id", testReviewerGitHubAppPrivateKey())
 			default:
 				return initDraft{}, errInitNavigateBack
 			}
@@ -15329,9 +16172,7 @@ func TestInitInteractiveMenuReviewerCredentialDecisionDropsAfterReviewerRefChang
 		}),
 		secretPrompter: secretPrompter,
 		openStore: func(string, bool, config.File) (initStore, error) {
-			return newFakeInitStore(map[string]map[string]string{
-				"work": {credentials.GitTokenKey: "existing-token"},
-			}), nil
+			return store, nil
 		},
 		configPath: func(*root.Options) (string, error) { return path, nil },
 		loadConfig: loadConfigForInit,
@@ -15341,15 +16182,21 @@ func TestInitInteractiveMenuReviewerCredentialDecisionDropsAfterReviewerRefChang
 	if err := runInitWithDeps(&cobra.Command{}, opts, initOptions{}, deps); err != nil {
 		t.Fatalf("runInitWithDeps: %v", err)
 	}
-	if len(secretPrompter.actionPrompts) != 2 {
-		t.Fatalf("action prompts = %d, want old and new reviewer prompts", len(secretPrompter.actionPrompts))
+	if len(secretPrompter.actionPrompts) != 0 || len(secretPrompter.sourcePrompts) != 0 {
+		t.Fatalf("secret prompts = actions:%d sources:%d, want no separate reviewer credential prompt", len(secretPrompter.actionPrompts), len(secretPrompter.sourcePrompts))
 	}
 	out := stdout.String() + "\n" + stderr.String()
 	if strings.Contains(out, "old-reviewer") {
 		t.Fatalf("output kept stale reviewer ref:\n%s", out)
 	}
-	if !strings.Contains(out, "codereview/new-reviewer") {
-		t.Fatalf("output = %q, want follow-up hint for new reviewer ref", out)
+	if strings.Contains(out, "set-credential --ref codereview/new-reviewer") {
+		t.Fatalf("output kept follow-up hint for inline reviewer ref:\n%s", out)
+	}
+	if _, ok := store.bundles["old-reviewer"]; ok {
+		t.Fatalf("old reviewer bundle = %#v, want stale inline write filtered", store.bundles["old-reviewer"])
+	}
+	if got := store.bundles["new-reviewer"][credentials.GitHubAppIDKey]; got != "new-app-id" {
+		t.Fatalf("new reviewer app id = %q, want active inline write", got)
 	}
 	got, err := config.Load(path)
 	if err != nil {
@@ -15392,17 +16239,10 @@ func TestInitInteractiveMenuReviewerSetNowDiscardDoesNotWriteConfigOrCredentials
 			draft.ReviewerEnabled = true
 			draft.ReviewerAuth = string(config.GitAuthModeGitHubApp)
 			draft.ReviewerCredentialRef = "codereview/rianjs-bot"
+			stageDraftInlineGitHubAppReviewerCredentials(&draft, draft.ReviewerCredentialRef, "sentinel-app-id", "sentinel-private-key")
 			return draft, nil
 		}),
-		secretPrompter: &fakeInitSecretPrompter{
-			actions: []initCredentialSecretAction{initCredentialSecretActionSetNow},
-			sources: []initSecretSource{
-				initSecretSourcePaste,
-				initSecretSourcePaste,
-				initSecretSourceSkip,
-			},
-			pastes: []string{"sentinel-app-id", "sentinel-private-key"},
-		},
+		secretPrompter: &fakeInitSecretPrompter{},
 		openStore: func(string, bool, config.File) (initStore, error) {
 			return store, nil
 		},
@@ -15437,17 +16277,16 @@ func TestInitInteractiveMenuReviewerSetNowDiscardDoesNotWriteConfigOrCredentials
 	}
 }
 
-func TestInitInteractiveMenuReviewerSetNowBackDuringSecretStepDiscardsPartialSecretWrites(t *testing.T) {
+func TestInitInteractiveMenuReviewerBackWithoutStagingDiscardsInlineSecretWrites(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "config.yml")
 	cfg := config.File{
 		DefaultProfile: "work",
 		Profiles:       map[string]config.Profile{"work": basicProfile("work")},
 	}
 	saveCredentialTestConfig(t, path, cfg)
-	var stdout bytes.Buffer
 	opts := &root.Options{
 		Stdin:      strings.NewReader(""),
-		Stdout:     &stdout,
+		Stdout:     &bytes.Buffer{},
 		Stderr:     &bytes.Buffer{},
 		ConfigPath: path,
 	}
@@ -15462,32 +16301,13 @@ func TestInitInteractiveMenuReviewerSetNowBackDuringSecretStepDiscardsPartialSec
 		menuPrompter: &fakeInitMenuPrompter{
 			actions: []initMenuAction{
 				initMenuActionReviewerEntities,
-				initMenuActionSave,
+				initMenuActionExit,
 			},
 		},
-		finalizePrompter: initFinalizePrompterFunc(func(initFinalizePrompt) (initFinalizeAction, error) {
-			return initFinalizeActionSave, nil
-		}),
-		reviewerPrompter: initReviewerEntityPrompterFunc(func(prompt initReviewerEntityPrompt) (initDraft, error) {
-			draft := seedInteractiveInitDraft(prompt.Context.RequestedProfileName, prompt.Context.ExistingProfileName, prompt.Context.DefaultProfileName, prompt.Context.ExistingProfile)
-			draft.ReviewerEnabled = true
-			draft.ReviewerAuth = string(config.GitAuthModeGitHubApp)
-			draft.ReviewerCredentialRef = "codereview/rianjs-bot"
-			return draft, nil
+		reviewerPrompter: initReviewerEntityPrompterFunc(func(_ initReviewerEntityPrompt) (initDraft, error) {
+			return initDraft{}, errInitNavigateBack
 		}),
-		secretPrompter: &fakeInitSecretPrompter{
-			actions: []initCredentialSecretAction{
-				initCredentialSecretActionSetNow,
-				initCredentialSecretActionBack,
-				initCredentialSecretActionDefer,
-			},
-			sources: []initSecretSource{
-				initSecretSourcePaste,
-				initSecretSourcePaste,
-				initSecretSourceBack,
-			},
-			pastes: []string{"sentinel-app-id", "sentinel-private-key"},
-		},
+		secretPrompter: &fakeInitSecretPrompter{},
 		openStore: func(string, bool, config.File) (initStore, error) {
 			return store, nil
 		},
@@ -15503,9 +16323,8 @@ func TestInitInteractiveMenuReviewerSetNowBackDuringSecretStepDiscardsPartialSec
 	if err != nil {
 		t.Fatalf("Load config: %v", err)
 	}
-	reviewer := got.Profiles["work"].ReviewerCredentials
-	if reviewer == nil || reviewer.CredentialRef != "codereview/rianjs-bot" {
-		t.Fatalf("reviewer credentials after secret-step back = %#v, want staged reviewer saved after final defer", reviewer)
+	if got.Profiles["work"].ReviewerCredentials != nil {
+		t.Fatalf("reviewer credentials after back = %#v, want original nil reviewer", got.Profiles["work"].ReviewerCredentials)
 	}
 	// #nosec G304 -- path is a test-controlled temporary config file.
 	raw, err := os.ReadFile(path)
@@ -15516,10 +16335,7 @@ func TestInitInteractiveMenuReviewerSetNowBackDuringSecretStepDiscardsPartialSec
 		t.Fatalf("config after secret-step back contains partial secret values:\n%s", string(raw))
 	}
 	if _, ok := store.bundles["rianjs-bot"]; ok {
-		t.Fatalf("reviewer bundle = %#v, want no credential write after secret-step back", store.bundles["rianjs-bot"])
-	}
-	if !strings.Contains(stdout.String(), "reviewer deferred") {
-		t.Fatalf("stdout = %q, want final defer hint after backing out of focused secret step", stdout.String())
+		t.Fatalf("reviewer bundle = %#v, want no credential write after back without staging", store.bundles["rianjs-bot"])
 	}
 }
 
@@ -15559,6 +16375,7 @@ func TestInitInteractiveMenuReviewerCredentialStatusShowsStagedOnReentry(t *test
 				draft.ReviewerEnabled = true
 				draft.ReviewerAuth = string(config.GitAuthModeGitHubApp)
 				draft.ReviewerCredentialRef = "codereview/rianjs-bot"
+				stageDraftInlineGitHubAppReviewerCredentials(&draft, draft.ReviewerCredentialRef, "sentinel-app-id", "sentinel-private-key")
 				return draft, nil
 			case 2:
 				if len(prompt.Context.ReviewerCredentialStatuses) == 0 {
@@ -15567,7 +16384,7 @@ func TestInitInteractiveMenuReviewerCredentialStatusShowsStagedOnReentry(t *test
 				status := findReviewerCredentialStatusForTest(t, prompt.Context.ReviewerCredentialStatuses, "codereview/rianjs-bot", string(config.GitAuthModeGitHubApp))
 				assertReviewerCredentialKeyState(t, status, credentials.GitHubAppIDKey, initReviewerCredentialKeyStaged)
 				assertReviewerCredentialKeyState(t, status, credentials.GitHubAppPrivateKeyKey, initReviewerCredentialKeyStaged)
-				assertReviewerCredentialKeyState(t, status, credentials.GitHubAppInstallationIDKey, initReviewerCredentialKeySkippedOptional)
+				assertReviewerCredentialKeyState(t, status, credentials.GitHubAppInstallationIDKey, initReviewerCredentialKeyOptional)
 				description := initReviewerCredentialStatusDescription(status)
 				if strings.Contains(description, "sentinel") {
 					t.Fatalf("status leaked secret value: %s", description)
@@ -15577,15 +16394,7 @@ func TestInitInteractiveMenuReviewerCredentialStatusShowsStagedOnReentry(t *test
 				return initDraft{}, errInitNavigateBack
 			}
 		}),
-		secretPrompter: &fakeInitSecretPrompter{
-			actions: []initCredentialSecretAction{initCredentialSecretActionSetNow},
-			sources: []initSecretSource{
-				initSecretSourcePaste,
-				initSecretSourcePaste,
-				initSecretSourceSkip,
-			},
-			pastes: []string{"sentinel-app-id", "sentinel-private-key"},
-		},
+		secretPrompter: &fakeInitSecretPrompter{},
 		openStore: func(string, bool, config.File) (initStore, error) {
 			return store, nil
 		},
@@ -17642,6 +18451,80 @@ func TestApplyInteractiveInitSessionPlanWritesSeparateSecretsProfilesIndependent
 	}
 }
 
+func TestApplyInteractiveInitSessionPlanWritesReviewerSecretsToResolvedStore(t *testing.T) {
+	workStore := newFakeInitStore(nil)
+	profile := basicProfile("work")
+	profile.SecretsProfile = "work-file"
+	profile.ReviewerCredentials = &config.ReviewerCredentials{
+		AuthMode:      config.GitAuthModeGitHubApp,
+		CredentialRef: "codereview/work-reviewer",
+	}
+	cfg := config.File{
+		DefaultProfile: "work",
+		Secrets: config.SecretsConfig{
+			DefaultProfile: "work-file",
+			Profiles: map[string]config.SecretsProfile{
+				"work-file": {
+					Backend: config.SecretsProfileBackend{Kind: config.SecretsBackendKind(credstore.BackendFile)},
+				},
+			},
+		},
+		Profiles: map[string]config.Profile{"work": profile},
+	}
+	resolved, err := credentials.ResolveSecretsProfileForProfile(cfg, profile)
+	if err != nil {
+		t.Fatalf("Resolve work secrets profile: %v", err)
+	}
+	plan := initSessionPlan{
+		path:         filepath.Join(t.TempDir(), "config.yml"),
+		cfg:          cfg,
+		profileNames: []string{"work"},
+		writes: map[string]map[string]string{
+			"codereview/work-reviewer": {
+				credentials.GitHubAppIDKey:         "12345",
+				credentials.GitHubAppPrivateKeyKey: "private-key",
+			},
+		},
+		credentialPlan: []initCredentialPlanEntry{{
+			Ref: config.CredentialRef{
+				Purpose: "reviewer_credentials",
+				Ref:     "codereview/work-reviewer",
+				Mode:    string(config.GitAuthModeGitHubApp),
+			},
+			SecretsProfile: resolved,
+			KeySpecs: []credentials.KeySpec{
+				{Key: credentials.GitHubAppIDKey, Required: true},
+				{Key: credentials.GitHubAppPrivateKeyKey, Required: true},
+				{Key: credentials.GitHubAppInstallationIDKey, Required: false},
+			},
+			State: initCredentialPlanStateWrite,
+		}},
+	}
+
+	err = applyInteractiveInitSessionPlan(&root.Options{Stdout: &bytes.Buffer{}, Stderr: &bytes.Buffer{}}, initDeps{
+		openStore: func(string, bool, config.File) (initStore, error) {
+			t.Fatal("legacy openStore called for named reviewer secrets")
+			return nil, nil
+		},
+		openResolvedStore: func(resolved credentials.ResolvedSecretsProfile, _ string, _ bool, _ config.File) (initStore, error) {
+			if resolved.ID != "work-file" {
+				t.Fatalf("opened secrets profile %q, want work-file", resolved.ID)
+			}
+			return workStore, nil
+		},
+		saveConfig: func(string, config.File) error { return nil },
+	}, plan)
+	if err != nil {
+		t.Fatalf("applyInteractiveInitSessionPlan: %v", err)
+	}
+	if got := workStore.bundles["work-reviewer"][credentials.GitHubAppIDKey]; got != "12345" {
+		t.Fatalf("stored reviewer app id = %q, want named-store value", got)
+	}
+	if got := workStore.bundles["work-reviewer"][credentials.GitHubAppPrivateKeyKey]; got != "private-key" {
+		t.Fatalf("stored reviewer private key = %q, want named-store value", got)
+	}
+}
+
 func TestApplyInteractiveInitSessionPlanNamedSecretsProfileWriteFailureStopsConfigSave(t *testing.T) {
 	store := newFakeInitStore(nil)
 	store.setBundleFunc = func(string, map[string]string, ...credstore.SetOpt) (credstore.Result, error) {
@@ -19037,26 +19920,477 @@ func TestWriteBundlesReportsPreviouslyWrittenRefsForCleanup(t *testing.T) {
 	}
 }
 
-type fakeInitSecretPrompter struct {
-	actions       []initCredentialSecretAction
-	sources       []initSecretSource
-	pastes        []string
-	pasteErrors   []error
-	onAction      func(initCredentialSecretPrompt)
-	actionPrompts []initCredentialSecretPrompt
-	sourcePrompts []initSecretValuePrompt
-	pastePrompts  []initSecretValuePrompt
-}
-
-func (f *fakeInitSecretPrompter) ChooseCredentialAction(prompt initCredentialSecretPrompt) (initCredentialSecretAction, error) {
-	f.actionPrompts = append(f.actionPrompts, prompt)
-	if f.onAction != nil {
-		f.onAction(prompt)
-	}
-	if len(f.actions) == 0 {
-		return "", errors.New("unexpected credential action prompt")
-	}
-	action := f.actions[0]
+func TestWriteBundlesLeavesStaleReviewerKeysForPostSaveCleanup(t *testing.T) {
+	store, err := credstore.Open(credentials.ServiceName, &credstore.Options{
+		AllowedKeys: credentials.AllowedKeys(),
+		Backend:     credstore.BackendMemory,
+	})
+	if err != nil {
+		t.Fatalf("Open memory store: %v", err)
+	}
+	defer store.Close()
+	if _, err := store.SetBundle("work-reviewer", map[string]string{credentials.GitTokenKey: "old-reviewer-pat"}); err != nil {
+		t.Fatalf("seed reviewer PAT bundle: %v", err)
+	}
+	written, err := writeBundles(store, map[string]map[string]string{
+		"codereview/work-reviewer": {
+			credentials.GitHubAppIDKey:         "12345",
+			credentials.GitHubAppPrivateKeyKey: "private-key",
+		},
+	}, false, nil)
+	if err != nil {
+		t.Fatalf("writeBundles: %v", err)
+	}
+	if !reflect.DeepEqual(written, []string{"codereview/work-reviewer"}) {
+		t.Fatalf("written refs = %#v, want work reviewer", written)
+	}
+	if ok, err := store.Exists("work-reviewer", credentials.GitTokenKey); err != nil || !ok {
+		t.Fatalf("stale git_token exists = %t, err = %v; want retained until config save succeeds", ok, err)
+	}
+	if ok, err := store.Exists("work-reviewer", credentials.GitHubAppIDKey); err != nil || !ok {
+		t.Fatalf("github_app_id exists = %t, err = %v; want written", ok, err)
+	}
+}
+
+func TestWriteBundlesKeepsStaleReviewerKeysRequiredByAnotherActiveMode(t *testing.T) {
+	store, err := credstore.Open(credentials.ServiceName, &credstore.Options{
+		AllowedKeys: credentials.AllowedKeys(),
+		Backend:     credstore.BackendMemory,
+	})
+	if err != nil {
+		t.Fatalf("Open memory store: %v", err)
+	}
+	defer store.Close()
+	if _, err := store.SetBundle("shared-reviewer", map[string]string{credentials.GitTokenKey: "existing-pat"}); err != nil {
+		t.Fatalf("seed shared reviewer PAT bundle: %v", err)
+	}
+	if _, err := writeBundles(store, map[string]map[string]string{
+		"codereview/shared-reviewer": {
+			credentials.GitHubAppIDKey:         "12345",
+			credentials.GitHubAppPrivateKeyKey: "private-key",
+		},
+	}, false, nil); err != nil {
+		t.Fatalf("writeBundles: %v", err)
+	}
+	if ok, err := store.Exists("shared-reviewer", credentials.GitTokenKey); err != nil || !ok {
+		t.Fatalf("git_token exists = %t, err = %v; want retained for active PAT entry", ok, err)
+	}
+}
+
+func TestApplyInteractiveInitSessionPlanDeletesStaleReviewerKeyWithoutWrites(t *testing.T) {
+	store := newFakeInitStore(map[string]map[string]string{
+		"work-reviewer": {
+			credentials.GitTokenKey:                "old-reviewer-pat",
+			credentials.GitHubAppIDKey:             "12345",
+			credentials.GitHubAppPrivateKeyKey:     "private-key",
+			credentials.GitHubAppInstallationIDKey: "67890",
+		},
+	})
+	profile := basicProfile("work")
+	profile.ReviewerCredentials = &config.ReviewerCredentials{
+		AuthMode:      config.GitAuthModeGitHubApp,
+		CredentialRef: "codereview/work-reviewer",
+		DisplayName:   "work bot",
+	}
+	cfg := config.File{
+		DefaultProfile: "work",
+		Profiles:       map[string]config.Profile{"work": profile},
+	}
+	resolved, err := credentials.ResolveSecretsProfileForProfile(cfg, profile)
+	if err != nil {
+		t.Fatalf("ResolveSecretsProfileForProfile: %v", err)
+	}
+	refs, err := config.CredentialRefs(profile)
+	if err != nil {
+		t.Fatalf("CredentialRefs: %v", err)
+	}
+	plan := initSessionPlan{
+		path:         filepath.Join(t.TempDir(), "config.yml"),
+		cfg:          cfg,
+		profileNames: []string{"work"},
+		profileRefs:  map[string][]config.CredentialRef{"work": refs},
+		credentialPlan: []initCredentialPlanEntry{{
+			Ref: config.CredentialRef{
+				Purpose: "reviewer_credentials",
+				Ref:     "codereview/work-reviewer",
+				Mode:    string(config.GitAuthModeGitHubApp),
+			},
+			PreviousRef: &config.CredentialRef{
+				Purpose: "reviewer_credentials",
+				Ref:     "codereview/work-reviewer",
+				Mode:    string(config.GitAuthModePAT),
+			},
+			SecretsProfile: resolved,
+			KeySpecs: []credentials.KeySpec{
+				{Key: credentials.GitHubAppIDKey, Required: true},
+				{Key: credentials.GitHubAppPrivateKeyKey, Required: true},
+				{Key: credentials.GitHubAppInstallationIDKey, Required: false},
+			},
+			State: initCredentialPlanStateKeepExisting,
+		}},
+	}
+	var saved bool
+	err = applyInteractiveInitSessionPlan(&root.Options{Stdout: &bytes.Buffer{}, Stderr: &bytes.Buffer{}}, initDeps{
+		openStore: func(string, bool, config.File) (initStore, error) { return store, nil },
+		saveConfig: func(string, config.File) error {
+			saved = true
+			return nil
+		},
+	}, plan)
+	if err != nil {
+		t.Fatalf("applyInteractiveInitSessionPlan: %v", err)
+	}
+	if !saved {
+		t.Fatal("saveConfig was not called")
+	}
+	if ok, err := store.Exists("work-reviewer", credentials.GitTokenKey); err != nil || ok {
+		t.Fatalf("stale git_token exists = %t, err = %v; want deleted", ok, err)
+	}
+	if ok, err := store.Exists("work-reviewer", credentials.GitHubAppIDKey); err != nil || !ok {
+		t.Fatalf("github_app_id exists = %t, err = %v; want retained", ok, err)
+	}
+	if ok, err := store.Exists("work-reviewer", credentials.GitHubAppPrivateKeyKey); err != nil || !ok {
+		t.Fatalf("github_app_private_key exists = %t, err = %v; want retained", ok, err)
+	}
+	if ok, err := store.Exists("work-reviewer", credentials.GitHubAppInstallationIDKey); err != nil || !ok {
+		t.Fatalf("github_app_installation_id exists = %t, err = %v; want retained", ok, err)
+	}
+}
+
+func TestApplyInteractiveInitSessionPlanSaveFailureDoesNotDeleteStaleReviewerKey(t *testing.T) {
+	store := newFakeInitStore(map[string]map[string]string{
+		"work-reviewer": {
+			credentials.GitTokenKey:            "old-reviewer-pat",
+			credentials.GitHubAppIDKey:         "12345",
+			credentials.GitHubAppPrivateKeyKey: "private-key",
+		},
+	})
+	profile := basicProfile("work")
+	profile.ReviewerCredentials = &config.ReviewerCredentials{
+		AuthMode:      config.GitAuthModeGitHubApp,
+		CredentialRef: "codereview/work-reviewer",
+	}
+	cfg := config.File{DefaultProfile: "work", Profiles: map[string]config.Profile{"work": profile}}
+	resolved, err := credentials.ResolveSecretsProfileForProfile(cfg, profile)
+	if err != nil {
+		t.Fatalf("ResolveSecretsProfileForProfile: %v", err)
+	}
+	plan := initSessionPlan{
+		path:         filepath.Join(t.TempDir(), "config.yml"),
+		cfg:          cfg,
+		profileNames: []string{"work"},
+		credentialPlan: []initCredentialPlanEntry{{
+			Ref: config.CredentialRef{
+				Purpose: "reviewer_credentials",
+				Ref:     "codereview/work-reviewer",
+				Mode:    string(config.GitAuthModeGitHubApp),
+			},
+			PreviousRef: &config.CredentialRef{
+				Purpose: "reviewer_credentials",
+				Ref:     "codereview/work-reviewer",
+				Mode:    string(config.GitAuthModePAT),
+			},
+			SecretsProfile: resolved,
+			KeySpecs: []credentials.KeySpec{
+				{Key: credentials.GitHubAppIDKey, Required: true},
+				{Key: credentials.GitHubAppPrivateKeyKey, Required: true},
+				{Key: credentials.GitHubAppInstallationIDKey, Required: false},
+			},
+			State: initCredentialPlanStateKeepExisting,
+		}},
+	}
+
+	err = applyInteractiveInitSessionPlan(&root.Options{Stdout: &bytes.Buffer{}, Stderr: &bytes.Buffer{}}, initDeps{
+		openStore:  func(string, bool, config.File) (initStore, error) { return store, nil },
+		saveConfig: func(string, config.File) error { return errors.New("disk full") },
+	}, plan)
+	if err == nil || !strings.Contains(err.Error(), "disk full") {
+		t.Fatalf("applyInteractiveInitSessionPlan error = %v, want save failure", err)
+	}
+	if ok, err := store.Exists("work-reviewer", credentials.GitTokenKey); err != nil || !ok {
+		t.Fatalf("git_token exists = %t, err = %v; want retained because config save failed", ok, err)
+	}
+}
+
+func TestApplyInteractiveInitSessionPlanKeepsSharedRefPATKeyAfterStagedAuthSwitchWrites(t *testing.T) {
+	store := newFakeInitStore(map[string]map[string]string{
+		"shared-reviewer": {credentials.GitTokenKey: "existing-pat"},
+	})
+	appProfile := basicProfile("app")
+	appProfile.ReviewerCredentials = &config.ReviewerCredentials{
+		AuthMode:      config.GitAuthModeGitHubApp,
+		CredentialRef: "codereview/shared-reviewer",
+	}
+	patProfile := basicProfile("pat")
+	patProfile.ReviewerCredentials = &config.ReviewerCredentials{
+		AuthMode:      config.GitAuthModePAT,
+		CredentialRef: "codereview/shared-reviewer",
+	}
+	cfg := config.File{
+		DefaultProfile: "app",
+		Profiles: map[string]config.Profile{
+			"app": appProfile,
+			"pat": patProfile,
+		},
+	}
+	resolved, err := credentials.ResolveSecretsProfileForProfile(cfg, appProfile)
+	if err != nil {
+		t.Fatalf("ResolveSecretsProfileForProfile: %v", err)
+	}
+	plan := initSessionPlan{
+		path:         filepath.Join(t.TempDir(), "config.yml"),
+		cfg:          cfg,
+		profileNames: []string{"app"},
+		writes: map[string]map[string]string{
+			"codereview/shared-reviewer": {
+				credentials.GitHubAppIDKey:         "12345",
+				credentials.GitHubAppPrivateKeyKey: "private-key",
+			},
+		},
+		credentialPlan: []initCredentialPlanEntry{{
+			Ref: config.CredentialRef{
+				Purpose: "reviewer_credentials",
+				Ref:     "codereview/shared-reviewer",
+				Mode:    string(config.GitAuthModeGitHubApp),
+			},
+			PreviousRef: &config.CredentialRef{
+				Purpose: "reviewer_credentials",
+				Ref:     "codereview/shared-reviewer",
+				Mode:    string(config.GitAuthModePAT),
+			},
+			SecretsProfile: resolved,
+			KeySpecs: []credentials.KeySpec{
+				{Key: credentials.GitHubAppIDKey, Required: true},
+				{Key: credentials.GitHubAppPrivateKeyKey, Required: true},
+				{Key: credentials.GitHubAppInstallationIDKey, Required: false},
+			},
+			State: initCredentialPlanStateWrite,
+		}},
+	}
+
+	err = applyInteractiveInitSessionPlan(&root.Options{Stdout: &bytes.Buffer{}, Stderr: &bytes.Buffer{}}, initDeps{
+		openStore:  func(string, bool, config.File) (initStore, error) { return store, nil },
+		saveConfig: func(string, config.File) error { return nil },
+	}, plan)
+	if err != nil {
+		t.Fatalf("applyInteractiveInitSessionPlan: %v", err)
+	}
+	if ok, err := store.Exists("shared-reviewer", credentials.GitTokenKey); err != nil || !ok {
+		t.Fatalf("git_token exists = %t, err = %v; want retained for untouched PAT profile", ok, err)
+	}
+	if ok, err := store.Exists("shared-reviewer", credentials.GitHubAppIDKey); err != nil || !ok {
+		t.Fatalf("github_app_id exists = %t, err = %v; want staged app key written", ok, err)
+	}
+}
+
+func TestApplyInitPlanDeletesStaleReviewerKeyWithoutWrites(t *testing.T) {
+	store := newFakeInitStore(map[string]map[string]string{
+		"work-reviewer": {
+			credentials.GitTokenKey:            "old-reviewer-pat",
+			credentials.GitHubAppIDKey:         "12345",
+			credentials.GitHubAppPrivateKeyKey: "private-key",
+		},
+	})
+	profile := basicProfile("work")
+	profile.ReviewerCredentials = &config.ReviewerCredentials{
+		AuthMode:      config.GitAuthModeGitHubApp,
+		CredentialRef: "codereview/work-reviewer",
+		DisplayName:   "work bot",
+	}
+	cfg := config.File{DefaultProfile: "work", Profiles: map[string]config.Profile{"work": profile}}
+	resolved, err := credentials.ResolveSecretsProfileForProfile(cfg, profile)
+	if err != nil {
+		t.Fatalf("ResolveSecretsProfileForProfile: %v", err)
+	}
+	plan := initPlan{
+		path:        filepath.Join(t.TempDir(), "config.yml"),
+		cfg:         cfg,
+		profileName: "work",
+		profile:     profile,
+		credentialPlan: []initCredentialPlanEntry{{
+			Ref: config.CredentialRef{
+				Purpose: "reviewer_credentials",
+				Ref:     "codereview/work-reviewer",
+				Mode:    string(config.GitAuthModeGitHubApp),
+			},
+			PreviousRef: &config.CredentialRef{
+				Purpose: "reviewer_credentials",
+				Ref:     "codereview/work-reviewer",
+				Mode:    string(config.GitAuthModePAT),
+			},
+			SecretsProfile: resolved,
+			KeySpecs: []credentials.KeySpec{
+				{Key: credentials.GitHubAppIDKey, Required: true},
+				{Key: credentials.GitHubAppPrivateKeyKey, Required: true},
+				{Key: credentials.GitHubAppInstallationIDKey, Required: false},
+			},
+			State: initCredentialPlanStateKeepExisting,
+		}},
+	}
+
+	err = applyInitPlan(&root.Options{Stdout: &bytes.Buffer{}, Stderr: &bytes.Buffer{}}, initOptions{}, initDeps{
+		openStore: func(string, bool, config.File) (initStore, error) { return store, nil },
+		saveConfig: func(string, config.File) error {
+			return nil
+		},
+	}, plan)
+	if err != nil {
+		t.Fatalf("applyInitPlan: %v", err)
+	}
+	if ok, err := store.Exists("work-reviewer", credentials.GitTokenKey); err != nil || ok {
+		t.Fatalf("stale git_token exists = %t, err = %v; want deleted", ok, err)
+	}
+	if ok, err := store.Exists("work-reviewer", credentials.GitHubAppIDKey); err != nil || !ok {
+		t.Fatalf("github_app_id exists = %t, err = %v; want retained", ok, err)
+	}
+}
+
+func TestStaleReviewerCleanupKeepsKeysRequiredByAnotherActiveModeWithoutWrites(t *testing.T) {
+	store := newFakeInitStore(map[string]map[string]string{
+		"shared-reviewer": {
+			credentials.GitTokenKey:            "existing-pat",
+			credentials.GitHubAppIDKey:         "12345",
+			credentials.GitHubAppPrivateKeyKey: "private-key",
+		},
+	})
+	appEntry := initCredentialPlanEntry{
+		Ref: config.CredentialRef{
+			Purpose: "reviewer_credentials",
+			Ref:     "codereview/shared-reviewer",
+			Mode:    string(config.GitAuthModeGitHubApp),
+		},
+		PreviousRef: &config.CredentialRef{
+			Purpose: "reviewer_credentials",
+			Ref:     "codereview/shared-reviewer",
+			Mode:    string(config.GitAuthModePAT),
+		},
+		KeySpecs: []credentials.KeySpec{
+			{Key: credentials.GitHubAppIDKey, Required: true},
+			{Key: credentials.GitHubAppPrivateKeyKey, Required: true},
+			{Key: credentials.GitHubAppInstallationIDKey, Required: false},
+		},
+		State: initCredentialPlanStateKeepExisting,
+	}
+	appProfile := basicProfile("app")
+	appProfile.ReviewerCredentials = &config.ReviewerCredentials{
+		AuthMode:      config.GitAuthModeGitHubApp,
+		CredentialRef: "codereview/shared-reviewer",
+	}
+	patProfile := basicProfile("pat")
+	patProfile.ReviewerCredentials = &config.ReviewerCredentials{
+		AuthMode:      config.GitAuthModePAT,
+		CredentialRef: "codereview/shared-reviewer",
+	}
+	cfg := config.File{
+		DefaultProfile: "app",
+		Profiles: map[string]config.Profile{
+			"app": appProfile,
+			"pat": patProfile,
+		},
+	}
+	resolved, err := credentials.ResolveSecretsProfileForProfile(cfg, appProfile)
+	if err != nil {
+		t.Fatalf("ResolveSecretsProfileForProfile: %v", err)
+	}
+	appEntry.SecretsProfile = resolved
+	groups, err := groupStaleReviewerCredentialCleanupsByStore(cfg, []initCredentialPlanEntry{appEntry})
+	if err != nil {
+		t.Fatalf("groupStaleReviewerCredentialCleanupsByStore: %v", err)
+	}
+	if len(groups) != 1 {
+		t.Fatalf("cleanup groups = %#v, want one group", groups)
+	}
+	cleanedRefs, err := deleteStaleReviewerCredentialKeysForRefs(store, groups[0].Entries)
+	if err != nil {
+		t.Fatalf("deleteStaleReviewerCredentialKeysForRefs: %v", err)
+	}
+	if len(cleanedRefs) != 0 {
+		t.Fatalf("cleaned refs = %#v, want none because both modes are active", cleanedRefs)
+	}
+	if ok, err := store.Exists("shared-reviewer", credentials.GitTokenKey); err != nil || !ok {
+		t.Fatalf("git_token exists = %t, err = %v; want retained for active PAT entry", ok, err)
+	}
+}
+
+func TestBuildInteractiveInitSessionPlanDropsReviewerWritesWhenSecretsStoreChanges(t *testing.T) {
+	originalProfile := basicProfile("work")
+	originalProfile.ReviewerCredentials = &config.ReviewerCredentials{
+		AuthMode:      config.GitAuthModeGitHubApp,
+		CredentialRef: "codereview/work-reviewer",
+	}
+	originalCfg := config.File{DefaultProfile: "work", Profiles: map[string]config.Profile{
+		"work": originalProfile,
+	}}
+	originalResolved, err := credentials.ResolveSecretsProfileForProfile(originalCfg, originalProfile)
+	if err != nil {
+		t.Fatalf("Resolve original secrets profile: %v", err)
+	}
+	nextProfile := originalProfile
+	nextCfg := config.File{
+		DefaultProfile: "work",
+		Secrets: config.SecretsConfig{
+			DefaultProfile: "vault",
+			Profiles: map[string]config.SecretsProfile{
+				"vault": {
+					Backend: config.SecretsProfileBackend{Kind: config.SecretsBackendKind(credstore.BackendFile)},
+				},
+			},
+		},
+		Profiles: map[string]config.Profile{"work": nextProfile},
+	}
+	session := initSessionDraft{
+		path:            filepath.Join(t.TempDir(), "config.yml"),
+		originalCfg:     originalCfg,
+		cfg:             nextCfg,
+		touchedProfiles: map[string]string{"work": "work"},
+		writes: map[string]map[string]string{
+			"codereview/work-reviewer": {
+				credentials.GitHubAppIDKey:         "12345",
+				credentials.GitHubAppPrivateKeyKey: "private-key",
+			},
+		},
+		credentialWriteStores: map[string]credentials.ResolvedSecretsProfile{
+			"codereview/work-reviewer": originalResolved,
+		},
+		overwriteRefs: map[string]bool{"codereview/work-reviewer": true},
+		satisfiedRefs: map[string]bool{"codereview/work-reviewer": true},
+	}
+
+	plan, err := buildInteractiveInitSessionPlan(&root.Options{}, session)
+	if err != nil {
+		t.Fatalf("buildInteractiveInitSessionPlan: %v", err)
+	}
+	if _, ok := plan.writes["codereview/work-reviewer"]; ok {
+		t.Fatalf("reviewer writes = %#v, want dropped after secrets store changed", plan.writes)
+	}
+	if plan.overwriteRefs["codereview/work-reviewer"] {
+		t.Fatalf("overwrite ref retained after secrets store changed")
+	}
+	if plan.satisfiedRefs["codereview/work-reviewer"] {
+		t.Fatalf("satisfied ref retained after secrets store changed")
+	}
+}
+
+type fakeInitSecretPrompter struct {
+	actions       []initCredentialSecretAction
+	sources       []initSecretSource
+	pastes        []string
+	pasteErrors   []error
+	onAction      func(initCredentialSecretPrompt)
+	actionPrompts []initCredentialSecretPrompt
+	sourcePrompts []initSecretValuePrompt
+	pastePrompts  []initSecretValuePrompt
+}
+
+func (f *fakeInitSecretPrompter) ChooseCredentialAction(prompt initCredentialSecretPrompt) (initCredentialSecretAction, error) {
+	f.actionPrompts = append(f.actionPrompts, prompt)
+	if f.onAction != nil {
+		f.onAction(prompt)
+	}
+	if len(f.actions) == 0 {
+		return "", errors.New("unexpected credential action prompt")
+	}
+	action := f.actions[0]
 	f.actions = f.actions[1:]
 	return action, nil
 }
@@ -19142,6 +20476,14 @@ func (s *fakeInitStore) SetBundle(profile string, kv map[string]string, opts ...
 	return credstore.Result{Written: written}, nil
 }
 
+func (s *fakeInitStore) Delete(profile, key string) error {
+	if _, ok := s.bundles[profile][key]; !ok {
+		return credstore.ErrNotFound
+	}
+	delete(s.bundles[profile], key)
+	return nil
+}
+
 func (s *fakeInitStore) Close() error { return nil }
 
 func newTestCommand(path string, stdin io.Reader) (*cobra.Command, *bytes.Buffer, *bytes.Buffer) {
diff --git a/internal/cmd/credentialcmd/init_linear_editor.go b/internal/cmd/credentialcmd/init_linear_editor.go
index 1862819..d06d3e9 100644
--- a/internal/cmd/credentialcmd/init_linear_editor.go
+++ b/internal/cmd/credentialcmd/init_linear_editor.go
@@ -3,6 +3,7 @@ package credentialcmd
 import (
 	"fmt"
 	"strings"
+	"unicode"
 
 	"github.com/charmbracelet/bubbles/viewport"
 	tea "github.com/charmbracelet/bubbletea"
@@ -81,12 +82,15 @@ type initLinearField struct {
 	Focusable   bool
 	Editable    bool
 	Hidden      bool
+	Secret      bool
+	AutoManaged bool
 	Error       string
 	Validate    func(string) error
 }
 
 type initLinearFieldOptions struct {
 	Hidden bool
+	Secret bool
 }
 
 type initLinearOption struct {
@@ -190,10 +194,10 @@ func (m initLinearEditorModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			m.ensureFocusedVisible()
 			return m, nil
 		case "pgup", "b":
-			m.viewport.HalfPageUp()
+			m.setYOffset(m.viewport.YOffset - max(m.viewport.Height/2, 1))
 			return m, nil
 		case "pgdown", "f", " ":
-			m.viewport.HalfPageDown()
+			m.setYOffset(m.viewport.YOffset + max(m.viewport.Height/2, 1))
 			return m, nil
 		case "up", "down", "j", "k":
 			// Up/Down only changes the focused select. Inputs should not leak
@@ -211,9 +215,7 @@ func (m initLinearEditorModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			return m, nil
 		}
 	}
-	var cmd tea.Cmd
-	m.viewport, cmd = m.viewport.Update(msg)
-	return m, cmd
+	return m, nil
 }
 
 func (m initLinearEditorModel) View() string {
@@ -264,10 +266,20 @@ func (d *initLinearDocument) addEditableInput(id initLinearFieldID, title, descr
 	d.addInputField(initLinearFieldInput, id, title, description, value, true, validate, mergedInitLinearFieldOptions(options))
 }
 
+func (d *initLinearDocument) addEditableSecretInput(id initLinearFieldID, title, description, value string, validate func(string) error, options ...initLinearFieldOptions) {
+	merged := mergedInitLinearFieldOptions(options)
+	merged.Secret = true
+	d.addInputField(initLinearFieldInput, id, title, description, value, true, validate, merged)
+}
+
 func (d *initLinearDocument) addEditableTextarea(id initLinearFieldID, title, description, value string) {
 	d.addInputField(initLinearFieldTextarea, id, title, description, value, true, nil, initLinearFieldOptions{})
 }
 
+func (d *initLinearDocument) addEditableSecretTextarea(id initLinearFieldID, title, description, value string) {
+	d.addInputField(initLinearFieldTextarea, id, title, description, value, true, nil, initLinearFieldOptions{Secret: true})
+}
+
 func (d *initLinearDocument) addInputField(kind initLinearFieldKind, id initLinearFieldID, title, description, value string, editable bool, validate func(string) error, options initLinearFieldOptions) {
 	*d = append(*d, initLinearField{
 		Kind:        kind,
@@ -279,6 +291,7 @@ func (d *initLinearDocument) addInputField(kind initLinearFieldKind, id initLine
 		Focusable:   true,
 		Editable:    editable,
 		Hidden:      options.Hidden,
+		Secret:      options.Secret,
 		Validate:    validate,
 	})
 }
@@ -289,6 +302,9 @@ func mergedInitLinearFieldOptions(options []initLinearFieldOptions) initLinearFi
 		if option.Hidden {
 			merged.Hidden = true
 		}
+		if option.Secret {
+			merged.Secret = true
+		}
 	}
 	return merged
 }
@@ -587,7 +603,15 @@ func (m *initLinearEditorModel) setFieldHidden(id initLinearFieldID, hidden bool
 
 func (m *initLinearEditorModel) relayout() {
 	m.layout = initLinearLayoutDocument(m.document, m.viewport.Width, m.focused)
-	m.viewport.SetContent(m.layout.Content)
+	m.setYOffset(m.viewport.YOffset)
+}
+
+func (m *initLinearEditorModel) setYOffset(offset int) {
+	m.viewport.YOffset = min(max(offset, 0), m.maxYOffset())
+}
+
+func (m initLinearEditorModel) maxYOffset() int {
+	return max(m.layout.Lines-max(m.viewport.Height, 1), 0)
 }
 
 func (m *initLinearEditorModel) ensureFocusedVisible() {
@@ -600,15 +624,15 @@ func (m *initLinearEditorModel) ensureFocusedVisible() {
 	bottom := top + height
 	switch {
 	case bounds.Start < top:
-		m.viewport.SetYOffset(bounds.Start)
+		m.setYOffset(bounds.Start)
 	case bounds.Start >= bottom:
-		m.viewport.SetYOffset(bounds.Start)
+		m.setYOffset(bounds.Start)
 	case bounds.End > bottom:
 		if bounds.End-bounds.Start >= height {
-			m.viewport.SetYOffset(bounds.Start)
+			m.setYOffset(bounds.Start)
 			return
 		}
-		m.viewport.SetYOffset(max(bounds.End-height, 0))
+		m.setYOffset(max(bounds.End-height, 0))
 	}
 }
 
@@ -651,6 +675,9 @@ func initLinearAppendFieldLines(lines *[]string, selectedLines map[int]bool, fie
 		if focused && field.Editable {
 			value = initLinearValueWithCursor(value, field.Cursor)
 		}
+		if field.Secret {
+			value = initLinearMaskedSecretValue(field.Value, field.Cursor, focused && field.Editable)
+		}
 		valueLines := strings.Split(value, "\n")
 		if len(valueLines) == 0 {
 			valueLines = []string{""}
@@ -670,6 +697,37 @@ func initLinearAppendFieldLines(lines *[]string, selectedLines map[int]bool, fie
 	}
 }
 
+func initLinearMaskedSecretValue(value string, cursor int, focused bool) string {
+	lines := strings.Split(value, "\n")
+	if len(lines) == 0 {
+		lines = []string{""}
+	}
+	cursorLine := 0
+	cursorColumn := cursor
+	seen := 0
+	if focused {
+		for index, line := range lines {
+			lineLen := len([]rune(line))
+			if cursor <= seen+lineLen {
+				cursorLine = index
+				cursorColumn = max(cursor-seen, 0)
+				break
+			}
+			seen += lineLen + 1
+			cursorLine = index
+			cursorColumn = lineLen
+		}
+	}
+	for index, line := range lines {
+		masked := strings.Repeat("*", len([]rune(line)))
+		if focused && index == cursorLine {
+			masked = initLinearValueWithCursor(masked, min(cursorColumn, len([]rune(masked))))
+		}
+		lines[index] = masked
+	}
+	return strings.Join(lines, "\n")
+}
+
 func initSelectOptionPrefix(focused bool, selected bool) string {
 	focusMarker := "  "
 	if focused && selected {
@@ -688,28 +746,54 @@ func initLinearAppendWrappedWithPrefix(lines *[]string, prefix string, text stri
 
 func initLinearAppendWrappedWithPrefixMarked(lines *[]string, selectedLines map[int]bool, prefix string, text string, width int, selected bool) {
 	start := len(*lines)
-	available := max(width-len([]rune(prefix)), 1)
-	remaining := []rune(strings.TrimSpace(text))
+	for _, rawLine := range strings.Split(text, "\n") {
+		initLinearAppendWrappedLineWithPrefix(lines, prefix, rawLine, width)
+	}
+	markInitLinearSelectedLines(selectedLines, selected, start, len(*lines))
+}
+
+func initLinearAppendWrappedLineWithPrefix(lines *[]string, prefix string, text string, width int) {
+	remaining := trimInitLinearSpaceRunes([]rune(text))
 	if len(remaining) == 0 {
 		*lines = append(*lines, prefix)
-		markInitLinearSelectedLines(selectedLines, selected, start, len(*lines))
 		return
 	}
-	for len(remaining) > available {
-		cut := available
-		for cut > 0 && remaining[cut] != ' ' {
-			cut--
+	linePrefix := prefix
+	for len(remaining) > 0 {
+		available := max(width-len([]rune(linePrefix)), 1)
+		cut := len(remaining)
+		if cut > available {
+			cut = available
+			for index := cut - 1; index > 0; index-- {
+				if remaining[index] == ' ' {
+					cut = index
+					break
+				}
+			}
 		}
 		if cut <= 0 {
-			cut = available
+			cut = min(available, len(remaining))
 		}
-		*lines = append(*lines, prefix+strings.TrimSpace(string(remaining[:cut])))
-		remaining = []rune(strings.TrimSpace(string(remaining[cut:])))
-		prefix = strings.Repeat(" ", len([]rune(prefix)))
-		available = max(width-len([]rune(prefix)), 1)
+		segmentRunes := trimInitLinearSpaceRunes(remaining[:cut])
+		if len(segmentRunes) == 0 {
+			segmentRunes = remaining[:cut]
+		}
+		*lines = append(*lines, linePrefix+string(segmentRunes))
+		remaining = trimInitLinearSpaceRunes(remaining[cut:])
+		linePrefix = strings.Repeat(" ", len([]rune(prefix)))
 	}
-	*lines = append(*lines, prefix+string(remaining))
-	markInitLinearSelectedLines(selectedLines, selected, start, len(*lines))
+}
+
+func trimInitLinearSpaceRunes(value []rune) []rune {
+	start := 0
+	for start < len(value) && unicode.IsSpace(value[start]) {
+		start++
+	}
+	end := len(value)
+	for end > start && unicode.IsSpace(value[end-1]) {
+		end--
+	}
+	return value[start:end]
 }
 
 func markInitLinearSelectedLines(selectedLines map[int]bool, selected bool, start int, end int) {
@@ -722,7 +806,7 @@ func markInitLinearSelectedLines(selectedLines map[int]bool, selected bool, star
 }
 
 func (m initLinearEditorModel) styleVisibleViewport() string {
-	lines := strings.Split(m.viewport.View(), "\n")
+	lines := m.visibleViewportLines()
 	activeStart := -1
 	activeEnd := -1
 	if m.focused >= 0 && m.focused < len(m.layout.Bounds) {
@@ -738,6 +822,16 @@ func (m initLinearEditorModel) styleVisibleViewport() string {
 	return strings.Join(lines, "\n")
 }
 
+func (m initLinearEditorModel) visibleViewportLines() []string {
+	if m.layout.Content == "" {
+		return []string{""}
+	}
+	lines := strings.Split(m.layout.Content, "\n")
+	top := min(max(m.viewport.YOffset, 0), len(lines))
+	bottom := min(top+max(m.viewport.Height, 1), len(lines))
+	return append([]string(nil), lines[top:bottom]...)
+}
+
 func (m initLinearEditorModel) styleViewportLine(line string, active bool, selected bool) string {
 	trimmed := strings.TrimSpace(line)
 	switch {
diff --git a/internal/cmd/credentialcmd/init_reviewer_credential_status.go b/internal/cmd/credentialcmd/init_reviewer_credential_status.go
index 85b4ad2..7153fc7 100644
--- a/internal/cmd/credentialcmd/init_reviewer_credential_status.go
+++ b/internal/cmd/credentialcmd/init_reviewer_credential_status.go
@@ -51,6 +51,15 @@ func buildInteractiveInitReviewerCredentialStatuses(opts *root.Options, deps ini
 	}
 	plannedWriteKeys := projectInitPlannedWriteKeys(session.writes)
 	entries := interactiveInitReviewerCredentialPlanEntries(session, plannedWriteKeys)
+	writes, _, satisfiedRefs := filterInteractiveInitStagedCredentialStateByStore(
+		cloneInitWrites(session.writes),
+		map[string]bool{},
+		cloneInitBoolMap(session.satisfiedRefs),
+		session.credentialWriteStores,
+		entries,
+	)
+	plannedWriteKeys = projectInitPlannedWriteKeys(writes)
+	entries = refreshInteractiveCredentialPlan(entries, plannedWriteKeys, satisfiedRefs)
 	statuses := make([]initReviewerCredentialStatus, 0, len(entries))
 	stores := map[string]initStore{}
 	defer func() {
@@ -89,7 +98,7 @@ func buildInteractiveInitReviewerCredentialStatuses(opts *root.Options, deps ini
 				existing = keys
 			}
 		}
-		status := initReviewerCredentialStatusFromEntry(entry, session.writes[entry.Ref.Ref], session.credentialDecisions, existing, unavailable)
+		status := initReviewerCredentialStatusFromEntry(entry, writes[entry.Ref.Ref], session.credentialDecisions, existing, unavailable)
 		backendArg := ""
 		if opts != nil {
 			backendArg = opts.Backend
@@ -331,12 +340,23 @@ func initReviewerCredentialStatusDescription(status initReviewerCredentialStatus
 	if destination == "" {
 		destination = "Destination: " + initReviewerCredentialDestinationDescription(status)
 	}
-	lines = append(lines, strings.Split(destination, "\n")...)
+	for _, line := range strings.Split(destination, "\n") {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" || strings.HasPrefix(trimmed, "Change destination by ") {
+			continue
+		}
+		lines = append(lines, trimmed)
+	}
+	lines = append(lines, "This is a credential-store ref, not a PAT, GitHub App ID, private key, or installation ID.")
 	if strings.TrimSpace(status.Unavailable) != "" {
 		lines = append(lines, strings.TrimSpace(status.Unavailable)+".")
 	}
+	keyWidth := 0
+	for _, key := range status.Keys {
+		keyWidth = max(keyWidth, len(key.Key))
+	}
 	for _, key := range status.Keys {
-		lines = append(lines, fmt.Sprintf("- %s: %s", key.Key, key.State))
+		lines = append(lines, fmt.Sprintf("%-*s  %s", keyWidth, key.Key, key.State))
 	}
 	return strings.Join(lines, "\n")
 }
diff --git a/internal/cmd/credentialcmd/init_reviewer_entity_editor.go b/internal/cmd/credentialcmd/init_reviewer_entity_editor.go
index 2163d5f..19e2857 100644
--- a/internal/cmd/credentialcmd/init_reviewer_entity_editor.go
+++ b/internal/cmd/credentialcmd/init_reviewer_entity_editor.go
@@ -8,6 +8,7 @@ import (
 
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/huh"
+	"github.com/open-cli-collective/cli-common/credstore"
 
 	"github.com/open-cli-collective/codereview-cli/internal/config"
 	"github.com/open-cli-collective/codereview-cli/internal/credentials"
@@ -16,11 +17,16 @@ import (
 type initReviewerEntityEditorRunner func(initLinearEditor, io.Reader, io.Writer) (initLinearEditorModel, error)
 
 const (
-	initReviewerEntityFieldSelection        initLinearFieldID = "reviewer_entity_selection"
-	initReviewerEntityFieldLabel            initLinearFieldID = "reviewer_entity_label"
-	initReviewerEntityFieldSecretLocation   initLinearFieldID = "reviewer_entity_secret_location"
-	initReviewerEntityFieldCredentialStatus initLinearFieldID = "reviewer_entity_credential_status"
-	initReviewerEntityFieldAction           initLinearFieldID = "reviewer_entity_action"
+	initReviewerEntityFieldSelection               initLinearFieldID = "reviewer_entity_selection"
+	initReviewerEntityFieldLabel                   initLinearFieldID = "reviewer_entity_label"
+	initReviewerEntityFieldSecretLocation          initLinearFieldID = "reviewer_entity_secret_location"
+	initReviewerEntityFieldCredentialStatus        initLinearFieldID = "reviewer_entity_credential_status"
+	initReviewerEntityFieldCredentialValues        initLinearFieldID = "reviewer_entity_credential_values"
+	initReviewerEntityFieldGitToken                initLinearFieldID = "reviewer_entity_git_token"
+	initReviewerEntityFieldGitHubAppID             initLinearFieldID = "reviewer_entity_github_app_id"
+	initReviewerEntityFieldGitHubAppPrivateKey     initLinearFieldID = "reviewer_entity_github_app_private_key"
+	initReviewerEntityFieldGitHubAppInstallationID initLinearFieldID = "reviewer_entity_github_app_installation_id"
+	initReviewerEntityFieldAction                  initLinearFieldID = "reviewer_entity_action"
 )
 
 const (
@@ -64,18 +70,18 @@ func (p huhInitReviewerEntityPrompter) editReviewerEntityLinear(prompt initRevie
 	}
 }
 
-func (p huhInitReviewerEntityPrompter) editReviewerEntityFieldsLinear(entity initReviewerEntityDraft, seed initDraft, preserveCurrentLocation bool) (initDraft, bool, error) {
+func (p huhInitReviewerEntityPrompter) editReviewerEntityFieldsLinear(ctx initPromptContext, entity initReviewerEntityDraft, seed initDraft, preserveCurrentLocation bool) (initDraft, bool, error) {
 	editorState, err := newReviewerEntityEditorState(entity, seed, preserveCurrentLocation)
 	if err != nil {
 		return initDraft{}, false, err
 	}
-	model, err := p.runReviewerEntityEditor(editorState.editor())
+	model, err := p.runReviewerEntityEditor(editorState.editor(ctx))
 	if err != nil {
 		return initDraft{}, false, err
 	}
 	switch model.resultAction {
 	case initDetailActionEdit:
-		draft, err := editorState.draftFromDocument(model.document)
+		draft, err := editorState.draftFromDocument(ctx, model.document)
 		if err != nil {
 			return initDraft{}, false, err
 		}
@@ -133,7 +139,7 @@ func newReviewerEntityEditorState(entity initReviewerEntityDraft, seed initDraft
 	}, nil
 }
 
-func (s reviewerEntityEditorState) editor() initLinearEditor {
+func (s reviewerEntityEditorState) editor(ctx initPromptContext) initLinearEditor {
 	var document initLinearDocument
 	document.addSection("Reviewer entity", reviewerEntitySelectionDescription())
 	document.addSection("Reviewer entity type", reviewerEntityKindDetailDescription(s.kind))
@@ -149,12 +155,10 @@ func (s reviewerEntityEditorState) editor() initLinearEditor {
 		if !s.preserveCurrentLocation {
 			labelInput = ""
 		}
-		reviewerSecretLocation := ""
+		reviewerSecretLocation := s.standardReviewerRef
 		if s.preserveCurrentLocation {
 			if currentRef := strings.TrimSpace(s.seed.ReviewerCredentialRef); currentRef != "" {
 				reviewerSecretLocation = currentRef
-			} else {
-				reviewerSecretLocation = s.standardReviewerRef
 			}
 		}
 		document.addEditableInput(
@@ -171,7 +175,10 @@ func (s reviewerEntityEditorState) editor() initLinearEditor {
 			reviewerSecretLocation,
 			validateOptionalCredentialRef,
 		)
-		status := synthesizeReviewerCredentialStatus(initPromptContext{}, config.CredentialRef{
+		if locationIndex := document.fieldIndexByID(initReviewerEntityFieldSecretLocation); locationIndex >= 0 {
+			document[locationIndex].AutoManaged = !s.preserveCurrentLocation
+		}
+		status := synthesizeReviewerCredentialStatus(ctx, config.CredentialRef{
 			Purpose: "reviewer_credentials",
 			Ref:     firstNonEmpty(reviewerSecretLocation, s.standardReviewerRef),
 			Mode:    string(reviewerCredentialAuthModeForKind(s.kind)),
@@ -181,6 +188,7 @@ func (s reviewerEntityEditorState) editor() initLinearEditor {
 			"Reviewer credential status",
 			initReviewerCredentialStatusDescription(status),
 		)
+		addReviewerEntityCredentialValueFields(&document, s.kind, false)
 	}
 	document.addEditableSelect(initReviewerEntityFieldAction, "Reviewer detail action", "", []huh.Option[string]{
 		huh.NewOption("Stage reviewer settings", initDetailActionEdit),
@@ -201,7 +209,7 @@ func (s reviewerEntityEditorState) editor() initLinearEditor {
 				model.resultAction = initDetailActionBack
 				return true, tea.Quit
 			case initDetailActionEdit:
-				if _, err := s.draftFromDocument(model.document); err != nil {
+				if _, err := s.draftFromDocument(ctx, model.document); err != nil {
 					model.document[model.focused].Error = err.Error()
 					model.relayout()
 					model.ensureFocusedVisible()
@@ -213,10 +221,27 @@ func (s reviewerEntityEditorState) editor() initLinearEditor {
 				return true, nil
 			}
 		},
+		OnFieldChange: func(model *initLinearEditorModel, index int) {
+			if index < 0 || index >= len(model.document) || s.kind == initReviewerEntityKindUseGitIdentity {
+				return
+			}
+			id := model.document[index].ID
+			if id == initReviewerEntityFieldSecretLocation {
+				model.document[index].AutoManaged = false
+			}
+			if id == initReviewerEntityFieldLabel {
+				initReviewerEntityMaybeUpdateAutoSecretLocation(model, s)
+			}
+			if id == initReviewerEntityFieldLabel ||
+				id == initReviewerEntityFieldSecretLocation ||
+				initReviewerEntityCredentialFieldKey(id) != "" {
+				initReviewerEntityRefreshCredentialStatus(model, ctx, s.seed, s)
+			}
+		},
 	}
 }
 
-func (s reviewerEntityEditorState) draftFromDocument(document initLinearDocument) (initDraft, error) {
+func (s reviewerEntityEditorState) draftFromDocument(ctx initPromptContext, document initLinearDocument) (initDraft, error) {
 	editDraft := s.seed
 	applyReviewerEntitySelection(&editDraft, string(s.kind))
 	if s.kind == initReviewerEntityKindUseGitIdentity {
@@ -230,7 +255,11 @@ func (s reviewerEntityEditorState) draftFromDocument(document initLinearDocument
 	if err := validateOptionalCredentialRef(reviewerSecretLocation); err != nil {
 		return initDraft{}, err
 	}
+	if err := validateReviewerEntityInlineCredentials(ctx, s.seed, s, document); err != nil {
+		return initDraft{}, err
+	}
 	finalizeReviewerEntityEditorDraft(&editDraft, s.explicitDisplayName, s.fallbackLabelSeed, labelInput, reviewerSecretLocation, s.standardReviewerRef, s.preserveCurrentLocation)
+	applyReviewerEntityCredentialDraftFromDocument(&editDraft, ctx, s.seed, s, document)
 	return editDraft, nil
 }
 
@@ -270,6 +299,7 @@ func initReviewerEntityLinearEditor(ctx initPromptContext, seed initDraft) initL
 		validateOptionalCredentialRef,
 	)
 	document.addSectionField(initReviewerEntityFieldCredentialStatus, "Reviewer credential status", "", initLinearFieldOptions{Hidden: true})
+	addReviewerEntityCredentialValueFields(&document, state.kind, true)
 	document.addEditableSelect(initReviewerEntityFieldAction, "Reviewer action", "", initReviewerEntityActionOptions(ctx, selection), initDetailActionEdit)
 	editor := initLinearEditor{
 		Document: document,
@@ -282,7 +312,13 @@ func initReviewerEntityLinearEditor(ctx initPromptContext, seed initDraft) initL
 				initReviewerEntitySyncLinearFields(model, ctx, seed, true)
 				return
 			}
-			if id == initReviewerEntityFieldAction || id == initReviewerEntityFieldSecretLocation {
+			if id == initReviewerEntityFieldSecretLocation {
+				model.document[index].AutoManaged = false
+			}
+			if id == initReviewerEntityFieldAction ||
+				id == initReviewerEntityFieldLabel ||
+				id == initReviewerEntityFieldSecretLocation ||
+				initReviewerEntityCredentialFieldKey(id) != "" {
 				initReviewerEntitySyncLinearFields(model, ctx, seed, false)
 			}
 		},
@@ -371,6 +407,320 @@ func initReviewerEntityActionOptions(_ initPromptContext, selection string) []hu
 	return options
 }
 
+func addReviewerEntityCredentialValueFields(document *initLinearDocument, kind initReviewerEntityKind, hidden bool) {
+	document.addSectionField(
+		initReviewerEntityFieldCredentialValues,
+		"Reviewer credential values",
+		"Enter required reviewer secrets here. Values are hidden, staged in memory, and written only when you Commit staged changes and exit.",
+		initLinearFieldOptions{Hidden: hidden},
+	)
+	document.addEditableSecretInput(
+		initReviewerEntityFieldGitToken,
+		"GitHub PAT",
+		"Required for PAT reviewers. Leave blank only when the status above already shows git_token as existing or staged.",
+		"",
+		nil,
+		initLinearFieldOptions{Hidden: hidden || kind != initReviewerEntityKindPAT},
+	)
+	document.addEditableSecretInput(
+		initReviewerEntityFieldGitHubAppID,
+		"GitHub App ID",
+		"Required for GitHub App reviewers. This is stored as github_app_id at the destination above.",
+		"",
+		nil,
+		initLinearFieldOptions{Hidden: hidden || kind != initReviewerEntityKindGitHubApp},
+	)
+	document.addEditableSecretTextarea(
+		initReviewerEntityFieldGitHubAppPrivateKey,
+		"GitHub App private key",
+		"Required for GitHub App reviewers. Paste the PEM private key; ctrl+j or alt+enter inserts a newline.",
+		"",
+	)
+	if index := document.fieldIndexByID(initReviewerEntityFieldGitHubAppPrivateKey); index >= 0 {
+		(*document)[index].Hidden = hidden || kind != initReviewerEntityKindGitHubApp
+	}
+	document.addEditableSecretInput(
+		initReviewerEntityFieldGitHubAppInstallationID,
+		"GitHub App installation ID",
+		"Optional. Leave blank unless this reviewer must pin a specific installation.",
+		"",
+		nil,
+		initLinearFieldOptions{Hidden: hidden || kind != initReviewerEntityKindGitHubApp},
+	)
+}
+
+func initReviewerEntitySetCredentialFieldsHidden(model *initLinearEditorModel, kind initReviewerEntityKind, hideDetails bool) {
+	hidePAT := hideDetails || kind != initReviewerEntityKindPAT
+	hideGitHubApp := hideDetails || kind != initReviewerEntityKindGitHubApp
+	model.setFieldHidden(initReviewerEntityFieldCredentialValues, hideDetails)
+	model.setFieldHidden(initReviewerEntityFieldGitToken, hidePAT)
+	model.setFieldHidden(initReviewerEntityFieldGitHubAppID, hideGitHubApp)
+	model.setFieldHidden(initReviewerEntityFieldGitHubAppPrivateKey, hideGitHubApp)
+	model.setFieldHidden(initReviewerEntityFieldGitHubAppInstallationID, hideGitHubApp)
+}
+
+func initReviewerEntityClearCredentialFieldValues(model *initLinearEditorModel) {
+	for _, id := range []initLinearFieldID{
+		initReviewerEntityFieldGitToken,
+		initReviewerEntityFieldGitHubAppID,
+		initReviewerEntityFieldGitHubAppPrivateKey,
+		initReviewerEntityFieldGitHubAppInstallationID,
+	} {
+		model.setFieldValue(id, "")
+	}
+}
+
+func initReviewerEntityMaybeUpdateAutoSecretLocation(model *initLinearEditorModel, state reviewerEntityEditorState) {
+	locationIndex := model.document.fieldIndexByID(initReviewerEntityFieldSecretLocation)
+	if locationIndex < 0 || !model.document[locationIndex].AutoManaged {
+		return
+	}
+	model.setFieldValue(initReviewerEntityFieldSecretLocation, initReviewerEntityDefaultSecretLocation(state, model.document.fieldValue(initReviewerEntityFieldLabel)))
+	if locationIndex = model.document.fieldIndexByID(initReviewerEntityFieldSecretLocation); locationIndex >= 0 {
+		model.document[locationIndex].AutoManaged = true
+	}
+}
+
+func initReviewerEntityDefaultSecretLocation(state reviewerEntityEditorState, labelInput string) string {
+	if state.preserveCurrentLocation {
+		if currentRef := strings.TrimSpace(state.seed.ReviewerCredentialRef); currentRef != "" {
+			return currentRef
+		}
+		return state.standardReviewerRef
+	}
+	if ref, ok := reviewerCredentialRefFromLabel(labelInput); ok {
+		return ref
+	}
+	return state.standardReviewerRef
+}
+
+func reviewerCredentialRefFromLabel(label string) (string, bool) {
+	segment := credstore.EscapeRefSegment(strings.TrimSpace(label))
+	if segment == "" {
+		return "", false
+	}
+	ref, err := credentials.FormatRef(segment + "-reviewer")
+	if err != nil {
+		return "", false
+	}
+	return ref, true
+}
+
+func initReviewerEntityCredentialFieldKey(id initLinearFieldID) string {
+	// This mapper intentionally accepts every linear-editor field ID but only reviewer
+	// credential value fields produce credential-store keys.
+	//nolint:exhaustive
+	switch id {
+	case initReviewerEntityFieldGitToken:
+		return credentials.GitTokenKey
+	case initReviewerEntityFieldGitHubAppID:
+		return credentials.GitHubAppIDKey
+	case initReviewerEntityFieldGitHubAppPrivateKey:
+		return credentials.GitHubAppPrivateKeyKey
+	case initReviewerEntityFieldGitHubAppInstallationID:
+		return credentials.GitHubAppInstallationIDKey
+	default:
+		return ""
+	}
+}
+
+func initReviewerEntityCredentialFieldID(key string) initLinearFieldID {
+	switch key {
+	case credentials.GitTokenKey:
+		return initReviewerEntityFieldGitToken
+	case credentials.GitHubAppIDKey:
+		return initReviewerEntityFieldGitHubAppID
+	case credentials.GitHubAppPrivateKeyKey:
+		return initReviewerEntityFieldGitHubAppPrivateKey
+	case credentials.GitHubAppInstallationIDKey:
+		return initReviewerEntityFieldGitHubAppInstallationID
+	default:
+		return ""
+	}
+}
+
+func initReviewerCredentialStatusWithDocumentWrites(status initReviewerCredentialStatus, document initLinearDocument) initReviewerCredentialStatus {
+	status.Keys = append([]initReviewerCredentialKeyStatus(nil), status.Keys...)
+	for index, key := range status.Keys {
+		fieldID := initReviewerEntityCredentialFieldID(key.Key)
+		if fieldID == "" || document.fieldHidden(fieldID) {
+			continue
+		}
+		if strings.TrimSpace(credentials.TrimSecretIngress(document.fieldValue(fieldID))) == "" {
+			continue
+		}
+		status.Keys[index].State = initReviewerCredentialKeyStaged
+	}
+	return status
+}
+
+func validateReviewerEntityInlineCredentials(ctx initPromptContext, seed initDraft, state reviewerEntityEditorState, document initLinearDocument) error {
+	if state.kind == initReviewerEntityKindUseGitIdentity {
+		return nil
+	}
+	ref := strings.TrimSpace(document.fieldValue(initReviewerEntityFieldSecretLocation))
+	if ref == "" {
+		return fmt.Errorf("reviewer secret location is required")
+	}
+	status, ok := reviewerCredentialStatusForDocument(ctx, seed, state, document)
+	if !ok {
+		return fmt.Errorf("reviewer credential status unavailable")
+	}
+	if reviewerEntityPreservesExistingCredentialRefWithoutWrites(state, document) {
+		return nil
+	}
+	missing := missingReviewerEntityInlineCredentialKeys(state, status, document)
+	if len(missing) > 0 {
+		return fmt.Errorf("set reviewer credentials before staging: %s", strings.Join(missing, ", "))
+	}
+	return nil
+}
+
+func reviewerEntityPreservesExistingCredentialRefWithoutWrites(state reviewerEntityEditorState, document initLinearDocument) bool {
+	if !state.preserveCurrentLocation {
+		return false
+	}
+	if strings.TrimSpace(document.fieldValue(initReviewerEntityFieldSecretLocation)) != strings.TrimSpace(state.seed.ReviewerCredentialRef) {
+		return false
+	}
+	writes, _ := reviewerEntityCredentialWritesFromDocument(synthesizeReviewerCredentialStatus(initPromptContext{}, config.CredentialRef{
+		Purpose: "reviewer_credentials",
+		Ref:     strings.TrimSpace(state.seed.ReviewerCredentialRef),
+		Mode:    string(reviewerCredentialAuthModeForKind(state.kind)),
+	}), document)
+	return len(writes) == 0
+}
+
+func reviewerCredentialStatusForDocument(ctx initPromptContext, seed initDraft, state reviewerEntityEditorState, document initLinearDocument) (initReviewerCredentialStatus, bool) {
+	status, ok := baseReviewerCredentialStatusForDocument(ctx, seed, state, document)
+	if !ok {
+		return initReviewerCredentialStatus{}, false
+	}
+	return initReviewerCredentialStatusWithDocumentWrites(status, document), true
+}
+
+func baseReviewerCredentialStatusForDocument(ctx initPromptContext, seed initDraft, state reviewerEntityEditorState, document initLinearDocument) (initReviewerCredentialStatus, bool) {
+	status, ok := initReviewerCredentialStatusForSelectionRef(ctx, seed, string(state.kind), document.fieldValue(initReviewerEntityFieldSecretLocation))
+	if !ok {
+		return initReviewerCredentialStatus{}, false
+	}
+	if initReviewerEntityUsesAutoDefaultSecretLocation(state, document) && !initReviewerCredentialStatusListContains(ctx.ReviewerCredentialStatuses, status.Ref) {
+		if initReviewerCredentialStatusListContainsUnavailable(ctx.ReviewerCredentialStatuses) {
+			status = synthesizeUnavailableReviewerCredentialStatus(ctx, status.Ref)
+		} else {
+			status = synthesizeReviewerCredentialStatus(ctx, status.Ref)
+		}
+	}
+	return status, true
+}
+
+func initReviewerEntityUsesAutoDefaultSecretLocation(state reviewerEntityEditorState, document initLinearDocument) bool {
+	if state.preserveCurrentLocation {
+		return false
+	}
+	locationIndex := document.fieldIndexByID(initReviewerEntityFieldSecretLocation)
+	if locationIndex < 0 || !document[locationIndex].AutoManaged {
+		return false
+	}
+	return strings.TrimSpace(document.fieldValue(initReviewerEntityFieldSecretLocation)) == strings.TrimSpace(initReviewerEntityDefaultSecretLocation(state, document.fieldValue(initReviewerEntityFieldLabel)))
+}
+
+func initReviewerCredentialStatusListContains(statuses []initReviewerCredentialStatus, ref config.CredentialRef) bool {
+	for _, status := range statuses {
+		if status.Ref.Purpose == ref.Purpose && status.Ref.Ref == ref.Ref && status.Ref.Mode == ref.Mode && status.Ref.Provider == ref.Provider {
+			return true
+		}
+	}
+	return false
+}
+
+func initReviewerCredentialStatusListContainsUnavailable(statuses []initReviewerCredentialStatus) bool {
+	for _, status := range statuses {
+		if strings.TrimSpace(status.Unavailable) != "" {
+			return true
+		}
+		for _, key := range status.Keys {
+			if key.State == initReviewerCredentialKeyUnavailable {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func missingReviewerEntityInlineCredentialKeys(state reviewerEntityEditorState, status initReviewerCredentialStatus, document initLinearDocument) []string {
+	var missing []string
+	keepsCurrentRef := reviewerEntityKeepsCurrentCredentialRef(state, document)
+	for _, key := range status.Keys {
+		if !key.Required {
+			continue
+		}
+		switch key.State {
+		case initReviewerCredentialKeyExisting, initReviewerCredentialKeyStaged:
+			continue
+		case initReviewerCredentialKeyUnavailable:
+			if keepsCurrentRef {
+				continue
+			}
+		case initReviewerCredentialKeyMissing, initReviewerCredentialKeyDeferred, initReviewerCredentialKeySkippedOptional, initReviewerCredentialKeyOptional:
+		}
+		missing = append(missing, key.Key)
+	}
+	return missing
+}
+
+func reviewerEntityKeepsCurrentCredentialRef(state reviewerEntityEditorState, document initLinearDocument) bool {
+	return state.preserveCurrentLocation &&
+		strings.TrimSpace(document.fieldValue(initReviewerEntityFieldSecretLocation)) == strings.TrimSpace(state.seed.ReviewerCredentialRef)
+}
+
+func applyReviewerEntityCredentialDraftFromDocument(editDraft *initDraft, ctx initPromptContext, seed initDraft, state reviewerEntityEditorState, document initLinearDocument) {
+	originalStatus, ok := baseReviewerCredentialStatusForDocument(ctx, seed, state, document)
+	if !ok {
+		return
+	}
+	status := initReviewerCredentialStatusWithDocumentWrites(originalStatus, document)
+	ref := strings.TrimSpace(status.Ref.Ref)
+	if ref == "" {
+		ref = strings.TrimSpace(document.fieldValue(initReviewerEntityFieldSecretLocation))
+	}
+	if ref == "" {
+		return
+	}
+	writes, overwrite := reviewerEntityCredentialWritesFromDocument(originalStatus, document)
+	editDraft.ReviewerCredentialWriteRef = ref
+	editDraft.ReviewerCredentialWriteStore = status.SecretsProfile
+	editDraft.ReviewerCredentialWrites = writes
+	editDraft.ReviewerCredentialOverwrite = overwrite
+	editDraft.ReviewerCredentialSatisfied = reviewerEntityPreservesExistingCredentialRefWithoutWrites(state, document) || len(missingReviewerEntityInlineCredentialKeys(state, status, document)) == 0
+}
+
+func reviewerEntityCredentialWritesFromDocument(status initReviewerCredentialStatus, document initLinearDocument) (map[string]string, bool) {
+	writes := map[string]string{}
+	keyStates := make(map[string]initReviewerCredentialKeyState, len(status.Keys))
+	for _, key := range status.Keys {
+		keyStates[key.Key] = key.State
+	}
+	overwrite := false
+	for _, key := range status.Keys {
+		fieldID := initReviewerEntityCredentialFieldID(key.Key)
+		if fieldID == "" || document.fieldHidden(fieldID) {
+			continue
+		}
+		value := credentials.TrimSecretIngress(document.fieldValue(fieldID))
+		if strings.TrimSpace(value) == "" {
+			continue
+		}
+		writes[key.Key] = value
+		switch keyStates[key.Key] {
+		case initReviewerCredentialKeyExisting:
+			overwrite = true
+		case initReviewerCredentialKeyMissing, initReviewerCredentialKeyStaged, initReviewerCredentialKeyDeferred, initReviewerCredentialKeySkippedOptional, initReviewerCredentialKeyOptional, initReviewerCredentialKeyUnavailable:
+		}
+	}
+	return writes, overwrite
+}
+
 func initReviewerEntitySyncLinearFields(model *initLinearEditorModel, ctx initPromptContext, seed initDraft, resetDetails bool) {
 	selection := model.document.selectedValue(initReviewerEntityFieldSelection)
 	initReviewerEntitySetSelectionOptions(model, ctx, selection)
@@ -400,6 +750,7 @@ func initReviewerEntitySyncLinearFields(model *initLinearEditorModel, ctx initPr
 	model.setFieldHidden(initReviewerEntityFieldLabel, hideDetails)
 	model.setFieldHidden(initReviewerEntityFieldSecretLocation, hideDetails)
 	model.setFieldHidden(initReviewerEntityFieldCredentialStatus, hideDetails)
+	initReviewerEntitySetCredentialFieldsHidden(model, state.kind, hideDetails)
 	if !hideDetails {
 		model.setFieldDescription(initReviewerEntityFieldSecretLocation, reviewerEntitySecretLocationDescription(state.kind))
 	}
@@ -415,22 +766,32 @@ func initReviewerEntitySyncLinearFields(model *initLinearEditorModel, ctx initPr
 		if !state.preserveCurrentLocation {
 			labelInput = ""
 		}
-		reviewerSecretLocation := ""
+		reviewerSecretLocation := state.standardReviewerRef
 		if state.preserveCurrentLocation {
 			if currentRef := strings.TrimSpace(state.seed.ReviewerCredentialRef); currentRef != "" {
 				reviewerSecretLocation = currentRef
-			} else {
-				reviewerSecretLocation = state.standardReviewerRef
 			}
+		} else {
+			reviewerSecretLocation = initReviewerEntityDefaultSecretLocation(state, labelInput)
 		}
 		model.setFieldValue(initReviewerEntityFieldLabel, labelInput)
 		model.setFieldValue(initReviewerEntityFieldSecretLocation, reviewerSecretLocation)
+		if locationIndex := model.document.fieldIndexByID(initReviewerEntityFieldSecretLocation); locationIndex >= 0 {
+			model.document[locationIndex].AutoManaged = !state.preserveCurrentLocation
+		}
+		initReviewerEntityClearCredentialFieldValues(model)
+	}
+	if !hideDetails && !resetDetails {
+		initReviewerEntityMaybeUpdateAutoSecretLocation(model, state)
 	}
 	if !hideDetails {
-		reviewerSecretLocation := model.document.fieldValue(initReviewerEntityFieldSecretLocation)
-		if status, ok := initReviewerCredentialStatusForSelectionRef(ctx, seed, selection, reviewerSecretLocation); ok {
-			model.setFieldDescription(initReviewerEntityFieldCredentialStatus, initReviewerCredentialStatusDescription(status))
-		}
+		initReviewerEntityRefreshCredentialStatus(model, ctx, seed, state)
+	}
+}
+
+func initReviewerEntityRefreshCredentialStatus(model *initLinearEditorModel, ctx initPromptContext, seed initDraft, state reviewerEntityEditorState) {
+	if status, ok := reviewerCredentialStatusForDocument(ctx, seed, state, model.document); ok {
+		model.setFieldDescription(initReviewerEntityFieldCredentialStatus, initReviewerCredentialStatusDescription(status))
 	}
 }
 
@@ -475,11 +836,14 @@ func reviewerEntityKindDetailDescription(kind initReviewerEntityKind) string {
 }
 
 func reviewerEntitySecretLocationDescription(kind initReviewerEntityKind) string {
-	base := "Leave blank to use the standard reviewer secret location for this profile. Replace the value only if you need a custom location."
-	if kind != initReviewerEntityKindGitHubApp {
-		return base
+	base := "Credential-store ref for this reviewer. This is where cr stores secret values; it is not a PAT, GitHub App ID, private key, or installation ID. Change it only if you need a custom credential-store location."
+	if kind == initReviewerEntityKindPAT {
+		return base + " Store required secret " + credentials.GitTokenKey + " at this ref."
 	}
-	return base + " This is a non-secret credential-store ref such as codereview/work-reviewer, not the GitHub App ID or private key. Store required secrets " + credentials.GitHubAppIDKey + " and " + credentials.GitHubAppPrivateKeyKey + " at this ref; " + credentials.GitHubAppInstallationIDKey + " is optional."
+	if kind == initReviewerEntityKindGitHubApp {
+		return base + " Store required secrets " + credentials.GitHubAppIDKey + " and " + credentials.GitHubAppPrivateKeyKey + " at this ref; " + credentials.GitHubAppInstallationIDKey + " is optional."
+	}
+	return base
 }
 
 func initReviewerEntityDraftFromDocument(ctx initPromptContext, seed initDraft, document initLinearDocument) (initDraft, error) {
@@ -488,5 +852,23 @@ func initReviewerEntityDraftFromDocument(ctx initPromptContext, seed initDraft,
 	if err != nil {
 		return initDraft{}, err
 	}
-	return state.draftFromDocument(document)
+	editDraft := state.seed
+	applyReviewerEntitySelection(&editDraft, string(state.kind))
+	if state.kind == initReviewerEntityKindUseGitIdentity {
+		return editDraft, nil
+	}
+	labelInput := document.fieldValue(initReviewerEntityFieldLabel)
+	if err := validateOptionalDisplayName(labelInput); err != nil {
+		return initDraft{}, err
+	}
+	reviewerSecretLocation := document.fieldValue(initReviewerEntityFieldSecretLocation)
+	if err := validateOptionalCredentialRef(reviewerSecretLocation); err != nil {
+		return initDraft{}, err
+	}
+	if err := validateReviewerEntityInlineCredentials(ctx, seed, state, document); err != nil {
+		return initDraft{}, err
+	}
+	finalizeReviewerEntityEditorDraft(&editDraft, state.explicitDisplayName, state.fallbackLabelSeed, labelInput, reviewerSecretLocation, state.standardReviewerRef, state.preserveCurrentLocation)
+	applyReviewerEntityCredentialDraftFromDocument(&editDraft, ctx, seed, state, document)
+	return editDraft, nil
 }