fix(mise): migrate from unix only asdf backend to a universal one

fix(evm): revoke dependent grants when wallet access is revoked
fix(vault): derive the recovery operator id from the authenticated peer
2026-09-08 16:11:42 +02:00 · 2026-09-08 16:11:42 +02:00 · 2026-09-08 16:11:42 +02:00 · 2026-09-08 16:11:42 +02:00 · 2026-09-08 16:11:42 +02:00 · 2026-09-08 16:11:42 +02:00
42 changed files with 7671 additions and 790 deletions
--- a/mise.lock
+++ b/mise.lock
@@ -7,6 +7,7 @@ backend = "aqua:ast-grep/ast-grep"
 [tools.ast-grep."platforms.linux-arm64"]
 checksum = "sha256:3ba383839044cf9817929435f5ce0027f91d06931e8efb32d942e58d73d92be5"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-aarch64-unknown-linux-gnu.zip"
+url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388772218"

 [tools.ast-grep."platforms.linux-arm64-musl"]
 checksum = "sha256:3ba383839044cf9817929435f5ce0027f91d06931e8efb32d942e58d73d92be5"
@@ -15,6 +16,7 @@ url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-aarch64
 [tools.ast-grep."platforms.linux-x64"]
 checksum = "sha256:5de8b87cba67fc8dc3e239d54b6484802ad745a7ae3de76be4fe89661dc52657"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-unknown-linux-gnu.zip"
+url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388771275"

 [tools.ast-grep."platforms.linux-x64-musl"]
 checksum = "sha256:5de8b87cba67fc8dc3e239d54b6484802ad745a7ae3de76be4fe89661dc52657"
@@ -23,14 +25,17 @@ url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-
 [tools.ast-grep."platforms.macos-arm64"]
 checksum = "sha256:c3961d8e8a4ee0ce2d0d98c7beeb168bb331cdc766b53630118a7b6c4fd39015"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-aarch64-apple-darwin.zip"
+url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388770234"

 [tools.ast-grep."platforms.macos-x64"]
 checksum = "sha256:a038965bfd7fe44257c771cdf8918dc3467dd8ec0eef673b8b14f639b144cdbd"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-apple-darwin.zip"
+url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388770498"

 [tools.ast-grep."platforms.windows-x64"]
 checksum = "sha256:fe34f631bb24c08ad146f92ca2a92971a53d179461b509fd8d32dc863bff9f83"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-pc-windows-msvc.zip"
+url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388771363"

 [[tools."cargo:cargo-audit"]]
 version = "0.22.1"
@@ -57,7 +62,7 @@ version = "0.9.133"
 backend = "cargo:cargo-nextest"

 [[tools."cargo:cargo-shear"]]
-version = "1.11.2"
+version = "1.13.4"
 backend = "cargo:cargo-shear"

 [[tools."cargo:cargo-vet"]]
@@ -78,7 +83,27 @@ backend = "cargo:flutter_rust_bridge_codegen"

 [[tools.flutter]]
 version = "3.41.7-stable"
-backend = "asdf:flutter"
+backend = "http:flutter"
+
+[tools.flutter."platforms.linux-x64"]
+checksum = "sha256:f344d5057db52abc2a63cd3a7c7370957b7685d1fca5e5fbe2ce4dfe74657a79"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.41.7-stable.tar.xz"
+
+[tools.flutter."platforms.linux-x64-musl"]
+checksum = "sha256:f344d5057db52abc2a63cd3a7c7370957b7685d1fca5e5fbe2ce4dfe74657a79"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.41.7-stable.tar.xz"
+
+[tools.flutter."platforms.macos-arm64"]
+checksum = "sha256:2e3e6af44d1adccf695deff52e5e4c8beb10e5625066b27ad082b38b83ef805e"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_arm64_3.41.7-stable.zip"
+
+[tools.flutter."platforms.macos-x64"]
+checksum = "sha256:a0b9af49e6e1a6800f31a408b98c1d7bd51e98650a8b9ebcd77168b48c916ff0"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_3.41.7-stable.zip"
+
+[tools.flutter."platforms.windows-x64"]
+checksum = "sha256:de17b513b740a931c5dbc3f96b5a659c1612dfe6b5e1f910c5ad954a8bac17ee"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/windows/flutter_windows_3.41.7-stable.zip"

 [[tools.protoc]]
 version = "29.6"
@@ -87,30 +112,37 @@ backend = "aqua:protocolbuffers/protobuf/protoc"
 [tools.protoc."platforms.linux-arm64"]
 checksum = "sha256:2594ff4fcae8cb57310d394d0961b236190ad9c5efbfdf1f597ea471d424fe79"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-aarch_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795076"

 [tools.protoc."platforms.linux-arm64-musl"]
 checksum = "sha256:2594ff4fcae8cb57310d394d0961b236190ad9c5efbfdf1f597ea471d424fe79"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-aarch_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795076"

 [tools.protoc."platforms.linux-x64"]
 checksum = "sha256:48785a926e73ffa3f68e2f22b14e7b849620c7a1d36809ac9249a5495e280323"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-x86_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795083"

 [tools.protoc."platforms.linux-x64-musl"]
 checksum = "sha256:48785a926e73ffa3f68e2f22b14e7b849620c7a1d36809ac9249a5495e280323"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-x86_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795083"

 [tools.protoc."platforms.macos-arm64"]
 checksum = "sha256:b9576b5fa1a1ef3fe13a8c91d9d8204b46545759bea5ae155cd6ba2ea4cdaeed"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-osx-aarch_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795082"

 [tools.protoc."platforms.macos-x64"]
 checksum = "sha256:312f04713946921cc0187ef34df80241ddca1bab6f564c636885fd2cc90d3f88"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-osx-x86_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795085"

 [tools.protoc."platforms.windows-x64"]
 checksum = "sha256:1ebd7c87baffb9f1c47169b640872bf5fb1e4408079c691af527be9561d8f6f7"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-win64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795088"

 [[tools.python]]
 version = "3.14.4"
@@ -122,8 +154,8 @@ url = "https://github.com/astral-sh/python-build-standalone/releases/download/20
 provenance = "github-attestations"

 [tools.python."platforms.linux-arm64-musl"]
-checksum = "sha256:b8b597fdb2f8dccdc502c11947b60a4b65eb6bce79cfa60c7ccf9b6e8352c60a"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
+checksum = "sha256:a10687b226e0941632569836bc1d8fa6353a8e3e8424316467ca9cdf220b983d"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-aarch64-unknown-linux-musl-install_only_stripped.tar.gz"
 provenance = "github-attestations"

 [tools.python."platforms.linux-x64"]
@@ -132,12 +164,12 @@ url = "https://github.com/astral-sh/python-build-standalone/releases/download/20
 provenance = "github-attestations"

 [tools.python."platforms.linux-x64-musl"]
-checksum = "sha256:fe9a9c32d13870af632cbac3dfc7528ae53597e94472aa4c7d6a42e8166136cd"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
+checksum = "sha256:d6005226cd24e780630626232c7a63243d4885fdf975dcf930a0758a0759ce14"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-x86_64-unknown-linux-musl-install_only_stripped.tar.gz"
 provenance = "github-attestations"

 [tools.python."platforms.macos-arm64"]
-checksum = "blake3:0314ec66e0f33ec04959583b5900bc8edae371a396aa96b8874e750d1fe936e6"
+checksum = "sha256:6f304f4ec30854611f23316578302235fb517cd970519ecdd11a8c4db87fd843"
 url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-aarch64-apple-darwin-install_only_stripped.tar.gz"
 provenance = "github-attestations"

@@ -154,3 +186,6 @@ provenance = "github-attestations"
 [[tools.rust]]
 version = "1.95.0"
 backend = "core:rust"
+
+[tools.rust.options]
+components = "clippy,rust-analyzer"
--- a/protobufs/operator/vault/bootstrap.proto
+++ b/protobufs/operator/vault/bootstrap.proto
@@ -18,8 +18,7 @@ message ContributePassphrase {
 }

 message ContributeRecoveryPassphrase {
-  int32 recovery_operator_id = 1;
-  bytes passphrase            = 2;
+  bytes passphrase = 1;
 }

 enum BootstrapResult {
--- a/protobufs/operator/vault/rekey.proto
+++ b/protobufs/operator/vault/rekey.proto
@@ -7,8 +7,7 @@ message ContributePassphrase {
 }

 message ContributeRecoveryPassphrase {
-  int32 recovery_operator_id = 1;
-  bytes passphrase           = 2;
+  bytes passphrase = 1;
 }

 enum RekeyResult {
--- a/protobufs/operator/vault/unseal.proto
+++ b/protobufs/operator/vault/unseal.proto
@@ -20,8 +20,7 @@ message ContributePassphrase {
 }

 message ContributeRecoveryPassphrase {
-  int32 recovery_operator_id = 1;
-  bytes passphrase            = 2;
+  bytes passphrase = 1;
 }

 enum UnsealResult {
--- a/server/Cargo.lock
+++ b/server/Cargo.lock
@@ -674,6 +674,12 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
 [[package]]
 name = "anyhow"
 version = "1.0.102"
@@ -767,6 +773,7 @@ dependencies = [
 "kameo",
 "kameo_actors",
 "ml-dsa",
+ "mockall",
 "mutants",
 "pem",
 "proptest",
@@ -782,6 +789,7 @@ dependencies = [
 "smlang",
 "strum 0.28.0",
 "subtle",
+ "tempfile",
 "test-log",
 "thiserror",
 "tokio",
@@ -1983,6 +1991,12 @@ dependencies = [
 "syn 2.0.117",
 ]

+[[package]]
+name = "downcast"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1435fa1053d8b2fbbe9be7e97eca7f33d37b28409959813daefc1446a14247f1"
+
 [[package]]
 name = "downcast-rs"
 version = "2.0.2"
@@ -2235,6 +2249,15 @@ dependencies = [
 "percent-encoding",
 ]

+[[package]]
+name = "fragile"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8878864ba14bb86e818a412bfd6f18f9eabd4ec0f008a28e8f7eb61db532fcf9"
+dependencies = [
+ "futures-core",
+]
+
 [[package]]
 name = "fs_extra"
 version = "1.3.0"
@@ -3352,6 +3375,32 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "mockall"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a6ceddfe3ce334925e96bf420fdb2dcee5bed6c632a168ece622676dadeaf8a"
+dependencies = [
+ "cfg-if",
+ "downcast",
+ "fragile",
+ "mockall_derive",
+ "predicates",
+ "predicates-tree",
+]
+
+[[package]]
+name = "mockall_derive"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cfe16fbe8a314aeec0b861ac24e60b1e123e97634bab045475b9d6a18416fd8"
+dependencies = [
+ "cfg-if",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "module-lattice"
 version = "0.2.2"
@@ -3785,6 +3834,32 @@ dependencies = [
 "zerocopy",
 ]

+[[package]]
+name = "predicates"
+version = "3.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ada8f2932f28a27ee7b70dd6c1c39ea0675c55a36879ab92f3a715eaa1e63cfe"
+dependencies = [
+ "anstyle",
+ "predicates-core",
+]
+
+[[package]]
+name = "predicates-core"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cad38746f3166b4031b1a0d39ad9f954dd291e7854fcc0eed52ee41a0b50d144"
+
+[[package]]
+name = "predicates-tree"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0de1b847b39c8131db0467e9df1ff60e6d0562ab8e9a16e568ad0fdb372e2f2"
+dependencies = [
+ "predicates-core",
+ "termtree",
+]
+
 [[package]]
 name = "prettyplease"
 version = "0.2.37"
@@ -5171,6 +5246,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "termtree"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
+
 [[package]]
 name = "test-log"
 version = "0.2.20"
--- a/server/crates/arbiter-server/Cargo.toml
+++ b/server/crates/arbiter-server/Cargo.toml
@@ -59,6 +59,8 @@ proptest = "1.11.0"
 rstest.workspace = true
 test-log = { version = "0.2", default-features = false, features = ["trace"] }
 ml-dsa.workspace = true
+mockall = "0.15.0"
+tempfile = "3.27.0"

 [lib]
 doctest = false
--- a/server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
+++ b/server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
@@ -37,7 +37,11 @@ create table if not exists tls_history (
 create table if not exists arbiter_settings (
    id INTEGER not null PRIMARY KEY CHECK (id = 1), -- singleton row, id must be 1
    root_key_id integer references root_key_history (id) on delete RESTRICT, -- if null, means wasn't bootstrapped yet
-    tls_id integer references tls_history (id) on delete RESTRICT
+    tls_id integer references tls_history (id) on delete RESTRICT,
+    -- Shamir threshold of the split that produced the stored shares. Null before bootstrap.
+    -- Recorded rather than recomputed: an aborted operator replacement leaves fewer share
+    -- rows than the split has shares, and a recomputed threshold would then be wrong.
+    shamir_threshold integer
 ) STRICT;

 insert into arbiter_settings (id) values (1) on conflict do nothing;
@@ -109,6 +113,7 @@ create table if not exists evm_wallet_access (
    id integer not null primary key,
    wallet_id integer not null references evm_wallet (id) on delete cascade,
    client_id integer not null references program_client (id) on delete cascade,
+    revoked_at integer, -- unix timestamp when revoked, null = still active
    created_at integer not null default(unixepoch ('now'))
 ) STRICT;

--- a/server/crates/arbiter-server/src/actors/bootstrap.rs
+++ b/server/crates/arbiter-server/src/actors/bootstrap.rs
@@ -4,28 +4,43 @@ use arbiter_proto::{BOOTSTRAP_PATH, home_path};
 use diesel::QueryDsl;
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, messages};
-use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng};
+use rand::{
+    distr::{Alphanumeric, SampleString as _},
+    make_rng,
+    rngs::StdRng,
+};
+use std::path::Path;
 use subtle::ConstantTimeEq as _;
 use thiserror::Error;

 const TOKEN_LENGTH: usize = 64;

-pub async fn generate_token() -> Result<String, std::io::Error> {
-    let rng: StdRng = make_rng();
+pub async fn generate_token(home: &Path) -> Result<String, std::io::Error> {
+    let mut rng: StdRng = make_rng();

-    let token = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
-        String::default(),
-        |mut accum, char| {
-            accum += char.to_string().as_str();
-            accum
-        },
-    );
+    // `Alphanumeric` samples raw `u8` ASCII codes, not `char`s -- `SampleString::sample_string`
+    // is `rand`'s own documented way to turn that into an actual TOKEN_LENGTH-character string
+    // (see the "Passwords" example on `Alphanumeric`'s docs). A prior version of this function
+    // called `.to_string()` on the sampled `u8` directly, which stringifies the numeric byte
+    // value (e.g. `65` instead of `'A'`) rather than the character it represents, silently
+    // producing a variable-length, all-decimal-digit string instead of a real token.
+    let token = Alphanumeric.sample_string(&mut rng, TOKEN_LENGTH);

-    tokio::fs::write(home_path()?.join(BOOTSTRAP_PATH), token.as_str()).await?;
+    tokio::fs::write(home.join(BOOTSTRAP_PATH), token.as_str()).await?;

    Ok(token)
 }

+/// A token file is only trustworthy if it looks like something `generate_token` could have
+/// produced. Anything else -- empty (a crash between the file's truncate and write), foreign
+/// content, or a trailing newline added by an editor -- must not be adopted as a live
+/// credential: an empty file would make every empty-string token verify, and mismatched
+/// content would silently lock out every operator holding the real, already-printed token.
+#[must_use]
+fn is_valid_token(candidate: &str) -> bool {
+    candidate.len() == TOKEN_LENGTH && candidate.chars().all(|c| c.is_ascii_alphanumeric())
+}
+
 #[derive(Error, Debug)]
 pub enum Error {
    #[error("Database error: {0}")]
@@ -44,31 +59,77 @@ pub struct Bootstrapper {
 }

 impl Bootstrapper {
+    /// Production constructor: resolves the real `~/.arbiter` directory and delegates.
    pub async fn new(db: &DatabasePool) -> Result<Self, Error> {
-        let row_count: i64 = {
-            let mut conn = db.get().await?;
-
-            schema::operator::table
-                .count()
-                .get_result(&mut conn)
-                .await?
-        };
-
-        let token = if row_count == 0 {
-            let token = generate_token().await?;
-            Some(token)
-        } else {
-            None
-        };
-
-        Ok(Self { token })
+        let home = home_path()?;
+        Self::new_in(db, &home).await
    }
-}

-#[messages]
-impl Bootstrapper {
-    #[message]
-    pub fn is_correct_token(&self, token: String) -> bool {
+    /// Carries all of `new`'s logic, parameterized on the directory the token file lives in.
+    /// `new` resolves the real home directory and calls this; tests call it directly with a
+    /// throwaway temp directory so they never touch the real `~/.arbiter/bootstrap_token`.
+    pub async fn new_in(db: &DatabasePool, home: &Path) -> Result<Self, Error> {
+        let mut conn = db.get().await?;
+
+        let bootstrapped: bool = schema::arbiter_settings::table
+            .select(schema::arbiter_settings::root_key_id)
+            .first::<Option<i32>>(&mut conn)
+            .await?
+            .is_some();
+
+        if bootstrapped {
+            return Ok(Self { token: None });
+        }
+
+        let any_operator_registered: bool = schema::operator_identity::table
+            .count()
+            .get_result::<i64>(&mut conn)
+            .await?
+            > 0;
+
+        if !any_operator_registered {
+            // Nobody has used the current token yet, so there is nothing to preserve across a
+            // restart: generate a fresh one, exactly as on a first run. Reusing an old file
+            // here would let a token survive a database reset, silently reviving trust in
+            // whoever still held it.
+            return Ok(Self {
+                token: Some(generate_token(home).await?),
+            });
+        }
+
+        // At least one operator has already registered with the current token: every other
+        // declared operator still needs that same token, including across a restart, so an
+        // existing file is reused rather than replaced -- but only if it still looks like a
+        // real token. A truncated, foreign, or corrupted file must not become a live
+        // credential (see `is_valid_token`).
+        let path = home.join(BOOTSTRAP_PATH);
+        let token = match tokio::fs::read_to_string(&path).await {
+            Ok(existing) if is_valid_token(&existing) => existing,
+            Ok(_) => {
+                // Replacing the file invalidates whatever token the already-registered
+                // operators were handed, so it must not happen quietly. The content itself is
+                // a credential and stays out of the log; the path is enough to act on.
+                tracing::warn!(
+                    ?path,
+                    "Bootstrap token file is not a well-formed token; replacing it"
+                );
+                generate_token(home).await?
+            }
+            Err(err) if err.kind() == std::io::ErrorKind::NotFound => generate_token(home).await?,
+            Err(err) => return Err(Error::Io(err)),
+        };
+
+        Ok(Self { token: Some(token) })
+    }
+
+    /// Drops the token from memory. Called once the vault is bootstrapped: from then on,
+    /// operators are added through governance rather than through the token.
+    pub(crate) fn forget_token(&mut self) {
+        self.token = None;
+    }
+
+    #[must_use]
+    fn is_correct_token(&self, token: &str) -> bool {
        self.token.as_ref().is_some_and(|expected| {
            let expected_bytes = expected.as_bytes();
            let token_bytes = token.as_bytes();
@@ -77,15 +138,28 @@ impl Bootstrapper {
            bool::from(choice)
        })
    }
+}

+#[messages]
+impl Bootstrapper {
+    /// Checks the token without retiring it: every operator in a declared committee
+    /// authenticates with the same token during bootstrap.
    #[message]
-    pub fn consume_token(&mut self, token: String) -> bool {
-        if self.is_correct_token(token) {
-            self.token = None;
-            true
-        } else {
-            false
-        }
+    #[must_use]
+    pub fn verify_token(&self, token: String) -> bool {
+        self.is_correct_token(&token)
+    }
+}
+
+impl kameo::prelude::Message<crate::actors::vault::events::Bootstrapped> for Bootstrapper {
+    type Reply = ();
+
+    async fn handle(
+        &mut self,
+        _msg: crate::actors::vault::events::Bootstrapped,
+        _ctx: &mut kameo::prelude::Context<Self, Self::Reply>,
+    ) -> Self::Reply {
+        self.forget_token();
    }
 }

@@ -96,3 +170,150 @@ impl Bootstrapper {
        self.token.clone()
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use diesel::{ExpressionMethods as _, insert_into, update};
+
+    /// A multi-operator committee registers every member with the same token, so verifying it
+    /// must not consume it. Only a completed bootstrap retires the token.
+    #[tokio::test]
+    async fn token_verifies_repeatedly_until_bootstrap_completes() {
+        let mut bootstrapper = Bootstrapper {
+            token: Some("test-token".to_owned()),
+        };
+
+        assert!(bootstrapper.verify_token("test-token".to_owned()));
+        assert!(bootstrapper.verify_token("test-token".to_owned()));
+        assert!(!bootstrapper.verify_token("wrong-token".to_owned()));
+
+        bootstrapper.forget_token();
+
+        assert!(!bootstrapper.verify_token("test-token".to_owned()));
+        assert!(bootstrapper.get_token().is_none());
+    }
+
+    /// Once the vault is bootstrapped, `Bootstrapper::new_in` must return with no token -- and
+    /// it must do so from `arbiter_settings.root_key_id` alone, taking the early return before
+    /// `home` is ever consulted. Uses `new_in` with a throwaway temp directory (never the
+    /// production `new`, which unconditionally resolves the real home directory before this
+    /// method even runs) so this test cannot touch the real filesystem regardless of outcome.
+    #[tokio::test]
+    async fn new_returns_no_token_once_the_vault_is_bootstrapped() {
+        let db = db::create_test_pool().await;
+        let mut conn = db.get().await.unwrap();
+
+        let root_key_history_id: i32 = insert_into(schema::root_key_history::table)
+            .values(&db::models::NewRootKeyHistory {
+                ciphertext: vec![0u8; 32],
+                tag: vec![0u8; 16],
+                root_key_encryption_nonce: vec![0u8; 24],
+                data_encryption_nonce: vec![0u8; 24],
+                schema_version: 1,
+                salt: vec![0u8; 16],
+            })
+            .returning(schema::root_key_history::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+
+        update(schema::arbiter_settings::table)
+            .set(schema::arbiter_settings::root_key_id.eq(root_key_history_id))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        drop(conn);
+
+        let home = tempfile::tempdir().unwrap();
+        let bootstrapper = Bootstrapper::new_in(&db, home.path()).await.unwrap();
+
+        assert!(bootstrapper.get_token().is_none());
+    }
+
+    /// The file-reuse path (an operator has already registered, so bootstrap is unfinished)
+    /// must not adopt a corrupted token file as a live credential: it must reject it and
+    /// generate a fresh one instead. This is the Critical from the review, now reachable
+    /// safely because `new_in` takes a throwaway temp directory instead of the real home.
+    #[tokio::test]
+    async fn new_in_rejects_and_replaces_a_corrupted_token_file() {
+        let db = db::create_test_pool().await;
+        let mut conn = db.get().await.unwrap();
+
+        // At least one operator must have registered, or `new_in` would regenerate
+        // unconditionally regardless of the file (Important 2) and never exercise validation.
+        insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(vec![0u8; 32]))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        drop(conn);
+
+        let home = tempfile::tempdir().unwrap();
+        tokio::fs::write(home.path().join(BOOTSTRAP_PATH), "")
+            .await
+            .unwrap();
+
+        let bootstrapper = Bootstrapper::new_in(&db, home.path()).await.unwrap();
+
+        let token = bootstrapper
+            .get_token()
+            .expect("a fresh token must be generated");
+        assert!(is_valid_token(&token));
+
+        // The replacement must also have landed on disk, not just in memory, so a restart
+        // reads back the same (now valid) token rather than the corrupted one again.
+        let on_disk = tokio::fs::read_to_string(home.path().join(BOOTSTRAP_PATH))
+            .await
+            .unwrap();
+        assert_eq!(on_disk, token);
+    }
+
+    /// The second defect the task exists to fix: a restart between the first registration and
+    /// the completed bootstrap must not invalidate the token the other declared operators were
+    /// already given. With an operator registered and a well-formed file on disk, `new_in` has
+    /// to hand back exactly what it read instead of generating a replacement.
+    #[tokio::test]
+    async fn new_in_reuses_a_valid_token_file_across_a_restart() {
+        let db = db::create_test_pool().await;
+        let mut conn = db.get().await.unwrap();
+
+        // Without a registered operator, `new_in` regenerates unconditionally (Important 2 of
+        // the round-2 review) and never reaches the reuse path this test is about.
+        insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(vec![0u8; 32]))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        drop(conn);
+
+        let home = tempfile::tempdir().unwrap();
+        // Stands in for the token a previous run wrote and printed to the console.
+        let handed_out = "Zq7Z2rXaB90kLmNpQwErTyUiOpAsDfGhJkLzXcVbNmQwErTyUiOpAsDfGhJkLzXc";
+        assert!(is_valid_token(handed_out));
+        tokio::fs::write(home.path().join(BOOTSTRAP_PATH), handed_out)
+            .await
+            .unwrap();
+
+        let bootstrapper = Bootstrapper::new_in(&db, home.path()).await.unwrap();
+
+        assert_eq!(bootstrapper.get_token().as_deref(), Some(handed_out));
+    }
+
+    /// An empty file must not be adopted as a live credential: `is_correct_token`'s
+    /// `is_some_and` would enter its closure for `Some(String::new())`, and comparing two empty
+    /// byte slices is true, so an unauthenticated `Some("")` from the wire would otherwise
+    /// verify. Also pins the other corrupted-content shapes `is_valid_token` must reject.
+    #[test]
+    fn is_valid_token_rejects_anything_that_is_not_a_real_token() {
+        assert!(!is_valid_token(""));
+        assert!(!is_valid_token("too-short"));
+        assert!(!is_valid_token(&"a".repeat(TOKEN_LENGTH - 1)));
+        assert!(!is_valid_token(&"a".repeat(TOKEN_LENGTH + 1)));
+        // A trailing newline (e.g. from an editor) must not be silently accepted either.
+        assert!(!is_valid_token(&format!("{}\n", "a".repeat(TOKEN_LENGTH))));
+        assert!(!is_valid_token(&"!".repeat(TOKEN_LENGTH)));
+
+        assert!(is_valid_token(&"a".repeat(TOKEN_LENGTH)));
+    }
+}
--- a/server/crates/arbiter-server/src/actors/evm/mod.rs
+++ b/server/crates/arbiter-server/src/actors/evm/mod.rs
@@ -70,6 +70,52 @@ pub enum Error {

    #[error("Signing error: {0}")]
    Sign(#[from] SignTransactionError),
+
+    #[error(
+        "Grant timestamp {0} is outside the i32 range a grant boundary column can store \
+         (Unix seconds, so no later than 2038-01-19T03:14:07Z)"
+    )]
+    InvalidTimestamp(i64),
+
+    #[error("Wallet access {0} is revoked or does not exist")]
+    AccessNotActive(i32),
+}
+
+/// Converts a grant boundary from Unix seconds. `None` in means "unbounded"; a value the
+/// boundary column cannot store is an error, never a silently different window.
+///
+/// The range is `i32`, not `i64`, because that is what actually reaches the database:
+/// `SqliteTimestamp::to_sql` narrows to `i32` (`fixme! #84`), so `3_000_000_000` -- a
+/// `valid_from` in 2065 -- would wrap to 1902 and open the grant immediately instead of in
+/// forty years. Accepting only what round-trips keeps the grant that gets written the grant
+/// that was voted on.
+fn grant_timestamp(secs: Option<i64>) -> Result<Option<chrono::DateTime<chrono::Utc>>, Error> {
+    secs.map(|s| {
+        let storable = i32::try_from(s).map_err(|_| Error::InvalidTimestamp(s))?;
+        chrono::DateTime::from_timestamp(i64::from(storable), 0).ok_or(Error::InvalidTimestamp(s))
+    })
+    .transpose()
+}
+
+/// Refuses an access id that is revoked or absent, so nothing hangs a grant off it.
+async fn ensure_access_active(
+    conn: &mut crate::db::DatabaseConnection,
+    access_id: i32,
+) -> Result<(), Error> {
+    let active: bool = diesel::select(diesel::dsl::exists(
+        schema::evm_wallet_access::table
+            .filter(schema::evm_wallet_access::id.eq(access_id))
+            .filter(schema::evm_wallet_access::revoked_at.is_null()),
+    ))
+    .get_result(conn)
+    .await
+    .map_err(DatabaseError::from)?;
+
+    if active {
+        Ok(())
+    } else {
+        Err(Error::AccessNotActive(access_id))
+    }
 }

 #[derive(Actor)]
@@ -216,6 +262,7 @@ impl EvmActor {
            .select(models::EvmWalletAccess::as_select())
            .filter(schema::evm_wallet_access::wallet_id.eq(wallet.id))
            .filter(schema::evm_wallet_access::client_id.eq(client_id))
+            .filter(schema::evm_wallet_access::revoked_at.is_null())
            .first(&mut conn)
            .await
            .optional()
@@ -251,6 +298,7 @@ impl EvmActor {
            .select(models::EvmWalletAccess::as_select())
            .filter(schema::evm_wallet_access::wallet_id.eq(wallet.id))
            .filter(schema::evm_wallet_access::client_id.eq(client_id))
+            .filter(schema::evm_wallet_access::revoked_at.is_null())
            .first(&mut conn)
            .await
            .optional()
@@ -313,11 +361,22 @@ impl EvmActor {
    ) -> Result<(), Error> {
        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;

+        // Revives a previously revoked row instead of conflicting on it forever:
+        // `uniq_wallet_access` is a unique index on `(wallet_id, client_id)`. Visibility is
+        // all this restores -- revocation closes the grants that hung off the access, so a
+        // persistent grant needs its own vote again (§3.2). See
+        // `peers::operator::session::handlers::revoke_wallet_access`.
        insert_into(schema::evm_wallet_access::table)
            .values((
                schema::evm_wallet_access::wallet_id.eq(EvmWalletId::from_raw(settings.wallet_id)),
                schema::evm_wallet_access::client_id.eq(settings.client_id),
            ))
+            .on_conflict((
+                schema::evm_wallet_access::wallet_id,
+                schema::evm_wallet_access::client_id,
+            ))
+            .do_update()
+            .set(schema::evm_wallet_access::revoked_at.eq(None::<models::SqliteTimestamp>))
            .execute(&mut conn)
            .await
            .map_err(DatabaseError::from)?;
@@ -335,6 +394,14 @@ impl EvmActor {
        use alloy::primitives::U256;
        use chrono::Duration;

+        // A persistent grant is only as good as the visibility it hangs off (§3.2, two
+        // separate votes). The proposal names the access id when it is created and can be
+        // approved much later, so the access may have been revoked in between; a grant
+        // against a revoked access would sit dormant and go live the moment anyone re-grants.
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
+        ensure_access_active(&mut conn, grant.wallet_access_id).await?;
+        drop(conn);
+
        let volume = |limit: persistent_grant::VolumeLimit| VolumeRateLimit {
            max_volume: U256::from_be_bytes(limit.max_volume),
            window: Duration::seconds(limit.window_secs),
@@ -343,12 +410,8 @@ impl EvmActor {
        let basic = SharedGrantSettings {
            wallet_access_id: grant.wallet_access_id,
            chain: grant.chain_id,
-            valid_from: grant
-                .valid_from_secs
-                .and_then(|s| chrono::DateTime::from_timestamp(s, 0)),
-            valid_until: grant
-                .valid_until_secs
-                .and_then(|s| chrono::DateTime::from_timestamp(s, 0)),
+            valid_from: grant_timestamp(grant.valid_from_secs)?,
+            valid_until: grant_timestamp(grant.valid_until_secs)?,
            max_gas_fee_per_gas: grant.max_gas_fee_per_gas.map(U256::from_be_bytes),
            max_priority_fee_per_gas: grant.max_priority_fee_per_gas.map(U256::from_be_bytes),
            rate_limit: grant.rate_limit.map(|r| TransactionRateLimit {
@@ -414,3 +477,218 @@ impl EvmActor {
        Ok(())
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{Error, EvmActor, ensure_access_active, grant_timestamp};
+    use crate::db::{self, models, schema};
+
+    use diesel::{ExpressionMethods as _, QueryDsl as _, dsl::insert_into};
+    use diesel_async::RunQueryDsl;
+
+    #[test]
+    fn absent_timestamp_stays_absent() {
+        assert!(grant_timestamp(None).unwrap().is_none());
+    }
+
+    #[test]
+    fn in_range_timestamp_is_converted() {
+        let converted = grant_timestamp(Some(1_800_000_000)).unwrap();
+        assert_eq!(converted.unwrap().timestamp(), 1_800_000_000);
+    }
+
+    /// An unrepresentable expiry must not silently become "no expiry": that would widen the
+    /// grant beyond what was voted on.
+    #[test]
+    fn out_of_range_timestamp_is_an_error() {
+        let err = grant_timestamp(Some(i64::MAX)).unwrap_err();
+        assert!(matches!(err, Error::InvalidTimestamp(i64::MAX)));
+    }
+
+    /// A `valid_from` past 2038 is representable as a `DateTime` but not as the `i32` the
+    /// boundary column stores: `3_000_000_000` (2065) wraps to a negative, which reads back as
+    /// 1902 and makes the grant active immediately. Refusing it is the only way the grant
+    /// that lands can match the window that was voted on.
+    #[test]
+    fn a_timestamp_past_2038_is_an_error() {
+        let past_2038 = 3_000_000_000_i64;
+        assert!(
+            chrono::DateTime::from_timestamp(past_2038, 0).is_some(),
+            "the fixture must be a date chrono accepts, or it proves nothing about storage"
+        );
+
+        let err = grant_timestamp(Some(past_2038)).unwrap_err();
+        assert!(
+            matches!(err, Error::InvalidTimestamp(got) if got == past_2038),
+            "expected an out-of-range error, got {err:?}"
+        );
+    }
+
+    /// The last second the boundary column can hold must still be accepted: the range check
+    /// has to stop at what storage can take, not short of it.
+    #[test]
+    fn the_last_storable_timestamp_is_accepted() {
+        let converted = grant_timestamp(Some(i64::from(i32::MAX))).unwrap();
+        assert_eq!(converted.unwrap().timestamp(), i64::from(i32::MAX));
+    }
+
+    /// Seeds a wallet, a client and one access row between them, and returns the access id.
+    async fn seed_access(conn: &mut db::DatabaseConnection) -> i32 {
+        let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
+            .values(&models::NewRootKeyHistory {
+                ciphertext: vec![0u8; 32],
+                tag: vec![0u8; 16],
+                root_key_encryption_nonce: vec![0u8; 24],
+                data_encryption_nonce: vec![0u8; 24],
+                schema_version: 1,
+                salt: vec![0u8; 16],
+            })
+            .returning(schema::root_key_history::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let aead_id: i32 = insert_into(schema::aead_encrypted::table)
+            .values(&models::NewAeadEncrypted {
+                ciphertext: vec![0u8; 32],
+                tag: vec![0u8; 16],
+                current_nonce: vec![0u8; 24],
+                schema_version: 1,
+                associated_root_key_id: root_key_id,
+                created_at: chrono::Utc::now().into(),
+            })
+            .returning(schema::aead_encrypted::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let wallet_id: models::EvmWalletId = insert_into(schema::evm_wallet::table)
+            .values((
+                schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
+                schema::evm_wallet::aead_encrypted_id.eq(aead_id),
+            ))
+            .returning(schema::evm_wallet::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let metadata_id: i32 = insert_into(schema::client_metadata::table)
+            .values(schema::client_metadata::name.eq("test"))
+            .returning(schema::client_metadata::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let client_id: i32 = insert_into(schema::program_client::table)
+            .values((
+                schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
+                schema::program_client::metadata_id.eq(metadata_id),
+            ))
+            .returning(schema::program_client::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        insert_into(schema::evm_wallet_access::table)
+            .values((
+                schema::evm_wallet_access::wallet_id.eq(wallet_id),
+                schema::evm_wallet_access::client_id.eq(client_id),
+            ))
+            .returning(schema::evm_wallet_access::id)
+            .get_result(conn)
+            .await
+            .unwrap()
+    }
+
+    /// Both directions, so a guard that refused everything could not pass: a live access is
+    /// let through, a revoked one is not.
+    #[tokio::test]
+    async fn only_a_live_access_passes_the_grant_guard() {
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let access_id = seed_access(&mut conn).await;
+        ensure_access_active(&mut conn, access_id)
+            .await
+            .expect("a live access must pass");
+
+        diesel::update(schema::evm_wallet_access::table)
+            .filter(schema::evm_wallet_access::id.eq(access_id))
+            .set(schema::evm_wallet_access::revoked_at.eq(models::SqliteTimestamp::now()))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+
+        let err = ensure_access_active(&mut conn, access_id)
+            .await
+            .expect_err("a revoked access must be refused");
+        assert!(
+            matches!(err, Error::AccessNotActive(got) if got == access_id),
+            "expected AccessNotActive, got {err:?}"
+        );
+    }
+
+    /// The guard has to be wired into the executor, not just exist: an approved persistent
+    /// grant whose access was revoked between proposal and approval must not create a grant
+    /// that would go live again the moment anyone re-grants that access (§3.2).
+    #[tokio::test]
+    async fn an_approved_persistent_grant_refuses_a_revoked_access() {
+        use crate::actors::{GlobalActors, vault::Vault};
+        use crate::db::proposal::persistent_grant;
+        use kameo::actor::Spawn as _;
+
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let access_id = seed_access(&mut conn).await;
+        diesel::update(schema::evm_wallet_access::table)
+            .filter(schema::evm_wallet_access::id.eq(access_id))
+            .set(schema::evm_wallet_access::revoked_at.eq(models::SqliteTimestamp::now()))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        drop(conn);
+
+        let vault = Vault::spawn(
+            Vault::new(pool.clone(), GlobalActors::spawn_message_bus())
+                .await
+                .unwrap(),
+        );
+        let mut evm_actor = EvmActor::new(vault, pool.clone());
+
+        let err = evm_actor
+            .create_persistent_grant(persistent_grant::Settings {
+                wallet_access_id: access_id,
+                chain_id: 1,
+                valid_from_secs: None,
+                valid_until_secs: None,
+                max_gas_fee_per_gas: None,
+                max_priority_fee_per_gas: None,
+                rate_limit: None,
+                specific: persistent_grant::Specific::EtherTransfer {
+                    targets: vec![[0u8; 20]],
+                    limit: persistent_grant::VolumeLimit {
+                        max_volume: [0u8; 32],
+                        window_secs: 3600,
+                    },
+                },
+            })
+            .await
+            .expect_err("a grant against a revoked access must be refused");
+        assert!(
+            matches!(err, Error::AccessNotActive(got) if got == access_id),
+            "expected AccessNotActive, got {err:?}"
+        );
+
+        let grants: i64 = schema::evm_basic_grant::table
+            .filter(schema::evm_basic_grant::wallet_access_id.eq(access_id))
+            .count()
+            .get_result(&mut pool.get().await.unwrap())
+            .await
+            .unwrap();
+        assert_eq!(
+            grants, 0,
+            "no grant row may be written for a revoked access"
+        );
+    }
+}
--- a/server/crates/arbiter-server/src/actors/mod.rs
+++ b/server/crates/arbiter-server/src/actors/mod.rs
@@ -5,7 +5,7 @@ use crate::{
        flow_coordinator::FlowCoordinator,
        operator_registry::OperatorRegistry,
        proposal_manager::{ProposalManager, events::ProposalApproved},
-        vault::Vault,
+        vault::{Vault, events},
        vault_coordinator::VaultCoordinator,
    },
    db,
@@ -17,6 +17,7 @@ use kameo_actors::{
    message_bus::{MessageBus, Register},
 };
 use thiserror::Error;
+use tracing::error;

 pub mod bootstrap;
 pub mod evm;
@@ -54,6 +55,26 @@ impl GlobalActors {
    }

    pub async fn spawn(db: db::DatabasePool) -> Result<Self, SpawnError> {
+        let bootstrapper = Bootstrapper::new(&db).await?;
+        Self::spawn_with_bootstrapper(db, bootstrapper).await
+    }
+
+    /// Test-facing: threads an explicit directory through to `Bootstrapper` instead of letting
+    /// it resolve the real home directory, so a test spawning a full `GlobalActors` can never
+    /// reach (let alone write to) the real `~/.arbiter/bootstrap_token`. Mirrors `spawn`
+    /// exactly, aside from where the token file lives.
+    pub async fn spawn_in(
+        db: db::DatabasePool,
+        home: &std::path::Path,
+    ) -> Result<Self, SpawnError> {
+        let bootstrapper = Bootstrapper::new_in(&db, home).await?;
+        Self::spawn_with_bootstrapper(db, bootstrapper).await
+    }
+
+    async fn spawn_with_bootstrapper(
+        db: db::DatabasePool,
+        bootstrapper: Bootstrapper,
+    ) -> Result<Self, SpawnError> {
        let message_bus = Self::spawn_message_bus();
        let key_holder = Vault::spawn(Vault::new(db.clone(), message_bus.clone()).await?);
        let operator_registry = OperatorRegistry::spawn(OperatorRegistry::default());
@@ -62,6 +83,7 @@ impl GlobalActors {
            db.clone(),
            key_holder.clone(),
        ));
+        let bootstrapper = Bootstrapper::spawn(bootstrapper);
        // Approved proposals are executed by whoever owns the kind, not by ProposalManager.
        for recipient in [
            evm.clone().recipient::<ProposalApproved>(),
@@ -70,9 +92,23 @@ impl GlobalActors {
        ] {
            let _ = message_bus.tell(Register(recipient)).await;
        }
+        // The token guards bootstrap only: once the vault reports success, it must be retired.
+        // A dropped registration would leave the token valid forever with nothing else to
+        // notice, so a failure here is logged rather than silently discarded.
+        if let Err(err) = message_bus
+            .tell(Register(
+                bootstrapper.clone().recipient::<events::Bootstrapped>(),
+            ))
+            .await
+        {
+            error!(
+                ?err,
+                "Failed to register Bootstrapper for the Bootstrapped event"
+            );
+        }

        Ok(Self {
-            bootstrapper: Bootstrapper::spawn(Bootstrapper::new(&db).await?),
+            bootstrapper,
            proposal_manager: ProposalManager::spawn(ProposalManager::new(db, message_bus.clone())),
            vault: key_holder,
            vault_coordinator,
--- a/server/crates/arbiter-server/src/actors/proposal_manager.rs
+++ b/server/crates/arbiter-server/src/actors/proposal_manager.rs
@@ -1,31 +1,26 @@
 use crate::{
-    actors::proposal_manager::events::ProposalApproved,
+    actors::proposal_manager::{
+        events::ProposalApproved,
+        store::{DieselProposalStore, ProposalStore, Tally},
+    },
    crypto::governance,
    db::{
        self,
-        functions::unixepoch,
        models::{
-            NewProposal, NewProposalVote, NewRecoveryProposalVote, NewRecoveryWakeupRequest,
-            OperatorIdentityId, Proposal, ProposalId, ProposalStatus, RecoveryOperatorIdentityId,
-            SqliteTimestamp,
+            NewProposalVote, NewRecoveryProposalVote, OperatorIdentityId, Proposal, ProposalId,
+            ProposalStatus, RecoveryOperatorIdentityId, SqliteTimestamp,
        },
        proposal::{ProposalKind, ProposalKindTag},
-        schema,
    },
 };
 use chrono::Utc;
-use diesel::{
-    ExpressionMethods as _, QueryDsl,
-    dsl::{exists, select},
-};
-use diesel_async::{AsyncConnection as _, RunQueryDsl};
 use kameo::{Actor, actor::ActorRef, messages};
 use kameo_actors::message_bus::{MessageBus, Publish};
-use std::collections::HashMap;
-use strum::IntoDiscriminant as _;
+use std::sync::Arc;
 use tracing::warn;

 pub mod events;
+pub mod store;

 pub const DEFAULT_TTL_SECS: u32 = 7 * 24 * 60 * 60; // 7 days
 pub const MAX_TTL_SECS: u32 = DEFAULT_TTL_SECS;
@@ -81,13 +76,21 @@ pub struct ProposalSummary {

 #[derive(Actor)]
 pub struct ProposalManager {
-    pub(crate) db: db::DatabasePool,
+    pub(crate) store: Arc<dyn ProposalStore>,
    pub(crate) events: ActorRef<MessageBus>,
 }

 impl ProposalManager {
-    pub const fn new(db: db::DatabasePool, events: ActorRef<MessageBus>) -> Self {
-        Self { db, events }
+    pub fn new(db: db::DatabasePool, events: ActorRef<MessageBus>) -> Self {
+        Self::with_store(Arc::new(DieselProposalStore::new(db)), events)
+    }
+
+    /// Builds the actor over an arbitrary store, so tests can supply a mock.
+    pub(crate) const fn with_store(
+        store: Arc<dyn ProposalStore>,
+        events: ActorRef<MessageBus>,
+    ) -> Self {
+        Self { store, events }
    }
 }

@@ -107,98 +110,18 @@ impl ProposalManager {
        let expires_at =
            SqliteTimestamp::from(Utc::now() + chrono::Duration::seconds(i64::from(ttl)));

-        let id: ProposalId = self
-            .db
-            .get()
-            .await?
-            .transaction(async |conn| {
-                let id: ProposalId = diesel::insert_into(schema::proposal::table)
-                    .values(&NewProposal {
-                        kind: kind.discriminant(),
-                        initiator_id,
-                        expires_at,
-                    })
-                    .returning(schema::proposal::id)
-                    .get_result(conn)
-                    .await?;
-                db::proposal::insert_kind(conn, id, &kind).await?;
-                Ok::<_, diesel::result::Error>(id)
-            })
-            .await?;
-
-        Ok(id)
+        self.store.create(kind, initiator_id, expires_at).await
    }

    #[message]
    pub async fn query_pending(&mut self, operator_id: OperatorIdentityId) -> Vec<ProposalSummary> {
-        #[expect(
-            clippy::cast_possible_truncation,
-            clippy::as_conversions,
-            reason = "fixme! #84; this will break in 2038"
-        )]
-        let now_ts = Utc::now().timestamp() as i32;
-
-        let Ok(mut conn) = self.db.get().await else {
-            warn!("query_pending: failed to acquire DB connection");
-            return vec![];
-        };
-
-        let voted_ids: Vec<ProposalId> = schema::proposal_vote::table
-            .filter(schema::proposal_vote::operator_id.eq(operator_id))
-            .select(schema::proposal_vote::proposal_id)
-            .load(&mut conn)
+        self.store
+            .pending_for(operator_id)
            .await
-            .unwrap_or_default();
-
-        let proposals: Vec<Proposal> = schema::proposal::table
-            .filter(schema::proposal::status.eq(ProposalStatus::Pending))
-            .filter(schema::proposal::expires_at.gt(now_ts))
-            .filter(diesel::dsl::not(schema::proposal::id.eq_any(&voted_ids)))
-            .load(&mut conn)
-            .await
-            .unwrap_or_default();
-
-        let ids: Vec<ProposalId> = proposals.iter().map(|p| p.id).collect();
-        let tallies: Vec<(ProposalId, bool, i64)> = schema::proposal_vote::table
-            .filter(schema::proposal_vote::proposal_id.eq_any(&ids))
-            .group_by((
-                schema::proposal_vote::proposal_id,
-                schema::proposal_vote::approve,
-            ))
-            .select((
-                schema::proposal_vote::proposal_id,
-                schema::proposal_vote::approve,
-                diesel::dsl::count_star(),
-            ))
-            .load(&mut conn)
-            .await
-            .unwrap_or_default();
-
-        let mut by_proposal: HashMap<ProposalId, (i64, i64)> = HashMap::new();
-        for (proposal_id, approve, count) in tallies {
-            let entry = by_proposal.entry(proposal_id).or_insert((0, 0));
-            if approve {
-                entry.0 += count;
-            } else {
-                entry.1 += count;
-            }
-        }
-
-        proposals
-            .into_iter()
-            .map(|p| {
-                let (approve_count, reject_count) =
-                    by_proposal.get(&p.id).copied().unwrap_or((0, 0));
-                ProposalSummary {
-                    id: p.id,
-                    kind: p.kind,
-                    initiator_id: p.initiator_id,
-                    expires_at: p.expires_at,
-                    approve_count,
-                    reject_count,
-                }
+            .unwrap_or_else(|e| {
+                warn!(?e, "query_pending failed");
+                vec![]
            })
-            .collect()
    }

    #[message]
@@ -209,141 +132,32 @@ impl ProposalManager {
        approve: bool,
        signature: Vec<u8>,
    ) -> Result<VoteOutcome, Error> {
-        let mut conn = self.db.get().await?;
+        let proposal = self.store.load(proposal_id).await?;

-        // Load proposal — must exist
-        let proposal: Proposal = schema::proposal::table
-            .find(proposal_id)
-            .first(&mut conn)
-            .await
-            .map_err(|e| match e {
-                diesel::result::Error::NotFound => Error::ProposalNotFound,
-                other => Error::DatabaseQuery(other),
-            })?;
-
-        // Check for duplicate vote before status check so AlreadyVoted takes priority
-        let already_voted: bool = select(exists(
-            schema::proposal_vote::table
-                .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
-                .filter(schema::proposal_vote::operator_id.eq(operator_id)),
-        ))
-        .get_result(&mut conn)
-        .await?;
-        if already_voted {
+        // Checked before the status check so AlreadyVoted takes priority.
+        if self.store.has_voted(proposal_id, operator_id).await? {
            return Err(Error::AlreadyVoted);
        }

-        if proposal.status != ProposalStatus::Pending {
-            return Err(Error::ProposalNotPending);
-        }
+        Self::check_votable(&proposal)?;

-        if proposal.expires_at.0 <= Utc::now() {
-            return Err(Error::ProposalExpired);
-        }
-
-        // Load operator public key from operator_identity
-        let pubkey_bytes: Vec<u8> = schema::operator_identity::table
-            .find(operator_id)
-            .select(schema::operator_identity::public_key)
-            .first(&mut conn)
-            .await
-            .map_err(|e| match e {
-                diesel::result::Error::NotFound => Error::OperatorNotFound,
-                other => Error::DatabaseQuery(other),
-            })?;
-
-        governance::verify_vote(&pubkey_bytes, proposal_id, approve, &signature)
+        let public_key = self.store.operator_public_key(operator_id).await?;
+        governance::verify_vote(&public_key, proposal_id, approve, &signature)
            .map_err(|_| Error::InvalidSignature)?;

-        // Insert vote
-        diesel::insert_into(schema::proposal_vote::table)
-            .values(&NewProposalVote {
+        self.store
+            .record_vote(NewProposalVote {
                proposal_id,
                operator_id,
                approve,
                signature,
            })
-            .execute(&mut conn)
            .await?;

-        // Quorum check
-        let total_operators: i64 = schema::operator_identity::table
-            .count()
-            .get_result(&mut conn)
-            .await?;
-        let recovery_active = Self::is_recovery_active_conn(&mut conn).await?;
-        let total_recovery: i64 = if recovery_active {
-            schema::recovery_operator_identity::table
-                .count()
-                .get_result(&mut conn)
-                .await?
-        } else {
-            0
-        };
-        #[expect(
-            clippy::cast_possible_truncation,
-            clippy::cast_sign_loss,
-            clippy::as_conversions,
-            reason = "operator count is always a small positive integer"
-        )]
-        let threshold = if proposal.kind.requires_full_quorum() {
-            // §3.3: key-rotation proposals require every eligible voter to approve
-            // §3.5: when recovery is active, recovery operators also vote on replace_operator
-            (total_operators + total_recovery) as usize
-        } else {
-            crate::crypto::shamir::shamir_threshold(total_operators as usize)
-        };
+        let mut tally = self.store.tally(proposal_id).await?;
+        self.narrow_electorate(&proposal, &mut tally).await?;

-        let ordinary_approve: i64 = schema::proposal_vote::table
-            .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
-            .filter(schema::proposal_vote::approve.eq(true))
-            .count()
-            .get_result(&mut conn)
-            .await?;
-        let recovery_approve: i64 = schema::recovery_proposal_vote::table
-            .filter(schema::recovery_proposal_vote::proposal_id.eq(proposal_id))
-            .filter(schema::recovery_proposal_vote::approve.eq(true))
-            .count()
-            .get_result(&mut conn)
-            .await?;
-        let approve_count = ordinary_approve + recovery_approve;
-
-        let ordinary_reject: i64 = schema::proposal_vote::table
-            .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
-            .filter(schema::proposal_vote::approve.eq(false))
-            .count()
-            .get_result(&mut conn)
-            .await?;
-        let recovery_reject: i64 = schema::recovery_proposal_vote::table
-            .filter(schema::recovery_proposal_vote::proposal_id.eq(proposal_id))
-            .filter(schema::recovery_proposal_vote::approve.eq(false))
-            .count()
-            .get_result(&mut conn)
-            .await?;
-        let reject_count = ordinary_reject + recovery_reject;
-
-        #[expect(
-            clippy::cast_possible_wrap,
-            clippy::as_conversions,
-            reason = "threshold is derived from operator count, always fits i64"
-        )]
-        let threshold_i64 = threshold as i64;
-
-        if approve_count >= threshold_i64 {
-            self.announce_approval(&mut conn, &proposal).await?;
-            return Ok(VoteOutcome::Approved);
-        }
-
-        let total_eligible = total_operators + total_recovery;
-        if reject_count > total_eligible - threshold_i64 {
-            diesel::update(schema::proposal::table.find(proposal_id))
-                .set(schema::proposal::status.eq(ProposalStatus::Rejected))
-                .execute(&mut conn)
-                .await?;
-            return Ok(VoteOutcome::Rejected);
-        }
-
-        Ok(VoteOutcome::Pending)
+        self.settle(&proposal, &tally).await
    }

    /// §3.6: Any ordinary operator may request recovery wake-up.
@@ -353,17 +167,10 @@ impl ProposalManager {
        &mut self,
        operator_id: OperatorIdentityId,
    ) -> Result<(), Error> {
-        let mut conn = self.db.get().await?;
-        if Self::has_uncancelled_wakeup(&mut conn).await? {
+        if self.store.has_uncancelled_wakeup().await? {
            return Err(Error::WakeupAlreadyPending);
        }
-        diesel::insert_into(schema::recovery_wakeup_request::table)
-            .values(&NewRecoveryWakeupRequest {
-                requested_by: operator_id,
-            })
-            .execute(&mut conn)
-            .await?;
-        Ok(())
+        self.store.request_wakeup(operator_id).await
    }

    /// §3.6: Any ordinary operator may cancel a pending wake-up request.
@@ -373,19 +180,11 @@ impl ProposalManager {
        &mut self,
        operator_id: OperatorIdentityId,
    ) -> Result<(), Error> {
-        let mut conn = self.db.get().await?;
-        let rows_updated = diesel::update(schema::recovery_wakeup_request::table)
-            .filter(schema::recovery_wakeup_request::cancelled_at.is_null())
-            .set((
-                schema::recovery_wakeup_request::cancelled_by.eq(Some(operator_id)),
-                schema::recovery_wakeup_request::cancelled_at.eq(Some(SqliteTimestamp::now())),
-            ))
-            .execute(&mut conn)
-            .await?;
-        if rows_updated == 0 {
-            return Err(Error::NoActiveWakeup);
+        if self.store.cancel_wakeup(operator_id).await? {
+            Ok(())
+        } else {
+            Err(Error::NoActiveWakeup)
        }
-        Ok(())
    }

    /// §3.5: Recovery operators may only vote on operator replacement proposals.
@@ -398,151 +197,135 @@ impl ProposalManager {
        approve: bool,
        signature: Vec<u8>,
    ) -> Result<VoteOutcome, Error> {
-        let mut conn = self.db.get().await?;
-
-        let proposal: Proposal = schema::proposal::table
-            .find(proposal_id)
-            .first(&mut conn)
-            .await
-            .map_err(|e| match e {
-                diesel::result::Error::NotFound => Error::ProposalNotFound,
-                other => Error::DatabaseQuery(other),
-            })?;
+        let proposal = self.store.load(proposal_id).await?;

        if proposal.kind != ProposalKindTag::ReplaceOperator {
            return Err(Error::NotAllowedForRecoveryOperator);
        }

-        if !Self::is_recovery_active_conn(&mut conn).await? {
+        if !self.store.is_recovery_active().await? {
            return Err(Error::RecoveryNotActive);
        }

-        let already_voted: bool = select(exists(
-            schema::recovery_proposal_vote::table
-                .filter(schema::recovery_proposal_vote::proposal_id.eq(proposal_id))
-                .filter(
-                    schema::recovery_proposal_vote::recovery_operator_id.eq(recovery_operator_id),
-                ),
-        ))
-        .get_result(&mut conn)
-        .await?;
-        if already_voted {
+        if self
+            .store
+            .has_recovery_voted(proposal_id, recovery_operator_id)
+            .await?
+        {
            return Err(Error::AlreadyVoted);
        }

-        if proposal.status != ProposalStatus::Pending {
-            return Err(Error::ProposalNotPending);
-        }
+        Self::check_votable(&proposal)?;

-        if proposal.expires_at.0 <= Utc::now() {
-            return Err(Error::ProposalExpired);
-        }
-
-        let pubkey_bytes: Vec<u8> = schema::recovery_operator_identity::table
-            .find(recovery_operator_id)
-            .select(schema::recovery_operator_identity::public_key)
-            .first(&mut conn)
-            .await
-            .map_err(|e| match e {
-                diesel::result::Error::NotFound => Error::OperatorNotFound,
-                other => Error::DatabaseQuery(other),
-            })?;
-
-        governance::verify_vote(&pubkey_bytes, proposal_id, approve, &signature)
+        let public_key = self
+            .store
+            .recovery_operator_public_key(recovery_operator_id)
+            .await?;
+        governance::verify_vote(&public_key, proposal_id, approve, &signature)
            .map_err(|_| Error::InvalidSignature)?;

-        diesel::insert_into(schema::recovery_proposal_vote::table)
-            .values(&NewRecoveryProposalVote {
+        self.store
+            .record_recovery_vote(NewRecoveryProposalVote {
                proposal_id,
                recovery_operator_id,
                approve,
                signature,
            })
-            .execute(&mut conn)
            .await?;

-        // Quorum: all ordinary + all recovery operators must approve (§3.3 + §3.5)
-        let total_ordinary: i64 = schema::operator_identity::table
-            .count()
-            .get_result(&mut conn)
-            .await?;
-        let total_recovery: i64 = schema::recovery_operator_identity::table
-            .count()
-            .get_result(&mut conn)
-            .await?;
-        let threshold_i64 = total_ordinary + total_recovery;
+        let mut tally = self.store.tally(proposal_id).await?;
+        self.narrow_electorate(&proposal, &mut tally).await?;

-        let ordinary_approve: i64 = schema::proposal_vote::table
-            .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
-            .filter(schema::proposal_vote::approve.eq(true))
-            .count()
-            .get_result(&mut conn)
-            .await?;
-        let recovery_approve: i64 = schema::recovery_proposal_vote::table
-            .filter(schema::recovery_proposal_vote::proposal_id.eq(proposal_id))
-            .filter(schema::recovery_proposal_vote::approve.eq(true))
-            .count()
-            .get_result(&mut conn)
-            .await?;
-        let approve_count = ordinary_approve + recovery_approve;
-
-        if approve_count >= threshold_i64 {
-            self.announce_approval(&mut conn, &proposal).await?;
-            return Ok(VoteOutcome::Approved);
-        }
-
-        let recovery_reject: i64 = schema::recovery_proposal_vote::table
-            .filter(schema::recovery_proposal_vote::proposal_id.eq(proposal_id))
-            .filter(schema::recovery_proposal_vote::approve.eq(false))
-            .count()
-            .get_result(&mut conn)
-            .await?;
-        let ordinary_reject: i64 = schema::proposal_vote::table
-            .filter(schema::proposal_vote::proposal_id.eq(proposal_id))
-            .filter(schema::proposal_vote::approve.eq(false))
-            .count()
-            .get_result(&mut conn)
-            .await?;
-        let reject_count = ordinary_reject + recovery_reject;
-
-        if reject_count > threshold_i64 - approve_count - reject_count {
-            diesel::update(schema::proposal::table.find(proposal_id))
-                .set(schema::proposal::status.eq(ProposalStatus::Rejected))
-                .execute(&mut conn)
-                .await?;
-            return Ok(VoteOutcome::Rejected);
-        }
-
-        Ok(VoteOutcome::Pending)
+        self.settle(&proposal, &tally).await
    }
 }

 impl ProposalManager {
-    const WAKEUP_DELAY_SECS: i32 = 14 * 24 * 60 * 60;
-
-    /// Returns true when an uncancelled wakeup request has passed the 14-day dispute window.
-    async fn is_recovery_active_conn(conn: &mut db::DatabaseConnection) -> Result<bool, Error> {
-        select(exists(
-            schema::recovery_wakeup_request::table
-                .filter(schema::recovery_wakeup_request::cancelled_at.is_null())
-                .filter(
-                    schema::recovery_wakeup_request::requested_at
-                        .le(unixepoch("now") - Self::WAKEUP_DELAY_SECS),
-                ),
-        ))
-        .get_result(conn)
-        .await
-        .map_err(Error::from)
+    /// A vote only counts while the proposal is still open.
+    fn check_votable(proposal: &Proposal) -> Result<(), Error> {
+        if proposal.status != ProposalStatus::Pending {
+            return Err(Error::ProposalNotPending);
+        }
+        if proposal.expires_at.0 <= Utc::now() {
+            return Err(Error::ProposalExpired);
+        }
+        Ok(())
    }

-    /// Returns true when there is any uncancelled wakeup request (pending or active).
-    async fn has_uncancelled_wakeup(conn: &mut db::DatabaseConnection) -> Result<bool, Error> {
-        select(exists(schema::recovery_wakeup_request::table.filter(
-            schema::recovery_wakeup_request::cancelled_at.is_null(),
-        )))
-        .get_result(conn)
-        .await
-        .map_err(Error::from)
+    /// §3.5/§3.6: recovery operators join the electorate only for the kinds they may vote on,
+    /// and only once the wake-up window has elapsed. Counting them anywhere else makes the
+    /// rejection threshold unreachable and, for full-quorum kinds, approval unreachable too.
+    ///
+    /// The votes go out with the voters. A wake-up can be cancelled after recovery operators
+    /// have already voted (`cancel_wakeup` cancels any uncancelled request, elapsed or not),
+    /// so a `ReplaceOperator` tally can hold recovery approvals at the moment the committee
+    /// stops being eligible. Keeping those while zeroing only the electorate size would let
+    /// them cover ordinary votes that were never cast.
+    async fn narrow_electorate(&self, proposal: &Proposal, tally: &mut Tally) -> Result<(), Error> {
+        if !proposal.kind.recovery_may_vote() || !self.store.is_recovery_active().await? {
+            tally.drop_recovery();
+        }
+        Ok(())
+    }
+
+    /// Pure quorum arithmetic — no I/O, so the rules can be tested directly (§3.3).
+    ///
+    /// A proposal is rejected once approval has become unreachable: even if every voter
+    /// who has not spoken yet approved, the threshold could not be met.
+    #[must_use]
+    pub(crate) const fn evaluate_quorum(tally: &Tally, requires_full_quorum: bool) -> VoteOutcome {
+        let total_eligible = tally.total_ordinary + tally.total_recovery;
+
+        // No electorate, nothing to settle. Guarded before the branch rather than inside it:
+        // the full-quorum arm would otherwise set `threshold` to 0 and read an empty tally as
+        // unanimous approval.
+        if total_eligible <= 0 {
+            return VoteOutcome::Pending;
+        }
+
+        #[expect(
+            clippy::cast_possible_truncation,
+            clippy::cast_sign_loss,
+            clippy::cast_possible_wrap,
+            clippy::as_conversions,
+            reason = "operator counts are always small positive integers"
+        )]
+        // §3.3: key-rotation proposals require every eligible voter to approve.
+        // §3.5: when recovery is active, recovery operators are eligible too.
+        let threshold: i64 = if requires_full_quorum {
+            total_eligible
+        } else {
+            match crate::crypto::shamir::shamir_threshold(tally.total_ordinary as usize) {
+                Some(threshold) => threshold as i64,
+                // No ordinary operators means no electorate: nothing can settle.
+                None => return VoteOutcome::Pending,
+            }
+        };
+
+        if tally.approve() >= threshold {
+            VoteOutcome::Approved
+        } else if tally.reject() > total_eligible - threshold {
+            VoteOutcome::Rejected
+        } else {
+            VoteOutcome::Pending
+        }
+    }
+
+    /// Applies the quorum rules to a fresh tally and records whatever they decide.
+    async fn settle(&self, proposal: &Proposal, tally: &Tally) -> Result<VoteOutcome, Error> {
+        let outcome = Self::evaluate_quorum(tally, proposal.kind.requires_full_quorum());
+
+        match outcome {
+            VoteOutcome::Approved => self.announce_approval(proposal).await?,
+            VoteOutcome::Rejected => {
+                self.store
+                    .set_status(proposal.id, ProposalStatus::Rejected)
+                    .await?;
+            }
+            VoteOutcome::Pending => {}
+        }
+
+        Ok(outcome)
    }

    /// Marks the proposal approved and hands the outcome to whoever owns that kind.
@@ -550,17 +333,12 @@ impl ProposalManager {
    /// The outcome is published, not executed: this actor coordinates voting and nothing
    /// else. Executors subscribe on the bus, so a vote is answered once the quorum is
    /// recorded rather than once the effect has landed.
-    async fn announce_approval(
-        &self,
-        conn: &mut db::DatabaseConnection,
-        proposal: &Proposal,
-    ) -> Result<(), Error> {
-        diesel::update(schema::proposal::table.find(proposal.id))
-            .set(schema::proposal::status.eq(ProposalStatus::Approved))
-            .execute(conn)
+    async fn announce_approval(&self, proposal: &Proposal) -> Result<(), Error> {
+        self.store
+            .set_status(proposal.id, ProposalStatus::Approved)
            .await?;

-        let kind = db::proposal::load_kind(conn, proposal.id, proposal.kind).await?;
+        let kind = self.store.load_kind(proposal.id, proposal.kind).await?;
        let _ = self
            .events
            .tell(Publish(ProposalApproved {
@@ -572,3 +350,6 @@ impl ProposalManager {
        Ok(())
    }
 }
+
+#[cfg(test)]
+mod tests;
--- a/server/crates/arbiter-server/src/actors/proposal_manager/store.rs
+++ b/server/crates/arbiter-server/src/actors/proposal_manager/store.rs
@@ -0,0 +1,431 @@
+//! Database access for [`super::ProposalManager`], behind a trait.
+//!
+//! The actor holds a `dyn ProposalStore` rather than a connection pool, so the quorum
+//! rules can be exercised against a mock instead of a live SQLite file.
+
+use super::{Error, ProposalSummary};
+use crate::db::{
+    self,
+    models::{
+        NewProposal, NewProposalVote, NewRecoveryProposalVote, NewRecoveryWakeupRequest,
+        OperatorIdentityId, Proposal, ProposalId, ProposalStatus, RecoveryOperatorIdentityId,
+        SqliteTimestamp,
+    },
+    proposal::{ProposalKind, ProposalKindTag},
+    schema,
+};
+
+use async_trait::async_trait;
+use chrono::Utc;
+use diesel::{
+    ExpressionMethods as _, QueryDsl,
+    dsl::{exists, select},
+};
+use diesel_async::{AsyncConnection as _, RunQueryDsl};
+use std::collections::HashMap;
+use strum::IntoDiscriminant as _;
+
+/// Everything the quorum rules need to know about one proposal's votes.
+///
+/// Votes are kept per electorate rather than pre-summed: an electorate can stop counting
+/// between the vote and the tally (§3.6 -- recovery goes back to sleep the moment a wake-up
+/// is cancelled), and the votes it already cast have to leave with it. A single `approve`
+/// field would carry them past [`Tally::drop_recovery`] into a threshold computed for the
+/// ordinary committee alone.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Tally {
+    pub ordinary_approve: i64,
+    pub ordinary_reject: i64,
+    pub recovery_approve: i64,
+    pub recovery_reject: i64,
+    pub total_ordinary: i64,
+    pub total_recovery: i64,
+}
+
+impl Tally {
+    /// Approvals from every electorate that still counts.
+    pub const fn approve(&self) -> i64 {
+        self.ordinary_approve + self.recovery_approve
+    }
+
+    /// Rejections from every electorate that still counts.
+    pub const fn reject(&self) -> i64 {
+        self.ordinary_reject + self.recovery_reject
+    }
+
+    /// Takes the recovery committee out of the electorate, votes and all. The three numbers
+    /// go together: leaving the votes behind counts them against a threshold derived from an
+    /// electorate they are no longer part of.
+    pub const fn drop_recovery(&mut self) {
+        self.recovery_approve = 0;
+        self.recovery_reject = 0;
+        self.total_recovery = 0;
+    }
+}
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait]
+pub trait ProposalStore: Send + Sync + 'static {
+    /// Writes the proposal and its kind-specific rows in one transaction.
+    async fn create(
+        &self,
+        kind: ProposalKind,
+        initiator_id: OperatorIdentityId,
+        expires_at: SqliteTimestamp,
+    ) -> Result<ProposalId, Error>;
+
+    async fn load(&self, id: ProposalId) -> Result<Proposal, Error>;
+
+    async fn load_kind(&self, id: ProposalId, tag: ProposalKindTag) -> Result<ProposalKind, Error>;
+
+    async fn has_voted(
+        &self,
+        id: ProposalId,
+        operator_id: OperatorIdentityId,
+    ) -> Result<bool, Error>;
+
+    async fn has_recovery_voted(
+        &self,
+        id: ProposalId,
+        recovery_operator_id: RecoveryOperatorIdentityId,
+    ) -> Result<bool, Error>;
+
+    async fn operator_public_key(&self, id: OperatorIdentityId) -> Result<Vec<u8>, Error>;
+
+    async fn recovery_operator_public_key(
+        &self,
+        id: RecoveryOperatorIdentityId,
+    ) -> Result<Vec<u8>, Error>;
+
+    async fn record_vote(&self, vote: NewProposalVote) -> Result<(), Error>;
+
+    async fn record_recovery_vote(&self, vote: NewRecoveryProposalVote) -> Result<(), Error>;
+
+    /// Vote counts for one proposal, alongside the size of each electorate.
+    async fn tally(&self, id: ProposalId) -> Result<Tally, Error>;
+
+    async fn set_status(&self, id: ProposalId, status: ProposalStatus) -> Result<(), Error>;
+
+    /// Pending, unexpired proposals this operator has not voted on yet.
+    async fn pending_for(
+        &self,
+        operator_id: OperatorIdentityId,
+    ) -> Result<Vec<ProposalSummary>, Error>;
+
+    /// True once an uncancelled wake-up request has outlived the dispute window.
+    async fn is_recovery_active(&self) -> Result<bool, Error>;
+
+    /// True while any wake-up request stands, whether or not the window has elapsed.
+    async fn has_uncancelled_wakeup(&self) -> Result<bool, Error>;
+
+    async fn request_wakeup(&self, operator_id: OperatorIdentityId) -> Result<(), Error>;
+
+    /// Returns false when there was no uncancelled request to cancel.
+    async fn cancel_wakeup(&self, operator_id: OperatorIdentityId) -> Result<bool, Error>;
+}
+
+pub struct DieselProposalStore {
+    db: db::DatabasePool,
+}
+
+impl DieselProposalStore {
+    pub const fn new(db: db::DatabasePool) -> Self {
+        Self { db }
+    }
+}
+
+/// `NotFound` means the row is absent, which every caller reports as its own error.
+fn missing(absent: Error) -> impl FnOnce(diesel::result::Error) -> Error {
+    move |e| match e {
+        diesel::result::Error::NotFound => absent,
+        other => Error::DatabaseQuery(other),
+    }
+}
+
+#[async_trait]
+impl ProposalStore for DieselProposalStore {
+    async fn create(
+        &self,
+        kind: ProposalKind,
+        initiator_id: OperatorIdentityId,
+        expires_at: SqliteTimestamp,
+    ) -> Result<ProposalId, Error> {
+        let id = self
+            .db
+            .get()
+            .await?
+            .transaction(async |conn| {
+                let id: ProposalId = diesel::insert_into(schema::proposal::table)
+                    .values(&NewProposal {
+                        kind: kind.discriminant(),
+                        initiator_id,
+                        expires_at,
+                    })
+                    .returning(schema::proposal::id)
+                    .get_result(conn)
+                    .await?;
+                db::proposal::insert_kind(conn, id, &kind).await?;
+                Ok::<_, diesel::result::Error>(id)
+            })
+            .await?;
+
+        Ok(id)
+    }
+
+    async fn load(&self, id: ProposalId) -> Result<Proposal, Error> {
+        let mut conn = self.db.get().await?;
+        schema::proposal::table
+            .find(id)
+            .first(&mut conn)
+            .await
+            .map_err(missing(Error::ProposalNotFound))
+    }
+
+    async fn load_kind(&self, id: ProposalId, tag: ProposalKindTag) -> Result<ProposalKind, Error> {
+        let mut conn = self.db.get().await?;
+        db::proposal::load_kind(&mut conn, id, tag)
+            .await
+            .map_err(Error::from)
+    }
+
+    async fn has_voted(
+        &self,
+        id: ProposalId,
+        operator_id: OperatorIdentityId,
+    ) -> Result<bool, Error> {
+        let mut conn = self.db.get().await?;
+        select(exists(
+            schema::proposal_vote::table
+                .filter(schema::proposal_vote::proposal_id.eq(id))
+                .filter(schema::proposal_vote::operator_id.eq(operator_id)),
+        ))
+        .get_result(&mut conn)
+        .await
+        .map_err(Error::from)
+    }
+
+    async fn has_recovery_voted(
+        &self,
+        id: ProposalId,
+        recovery_operator_id: RecoveryOperatorIdentityId,
+    ) -> Result<bool, Error> {
+        let mut conn = self.db.get().await?;
+        select(exists(
+            schema::recovery_proposal_vote::table
+                .filter(schema::recovery_proposal_vote::proposal_id.eq(id))
+                .filter(
+                    schema::recovery_proposal_vote::recovery_operator_id.eq(recovery_operator_id),
+                ),
+        ))
+        .get_result(&mut conn)
+        .await
+        .map_err(Error::from)
+    }
+
+    async fn operator_public_key(&self, id: OperatorIdentityId) -> Result<Vec<u8>, Error> {
+        let mut conn = self.db.get().await?;
+        schema::operator_identity::table
+            .find(id)
+            .select(schema::operator_identity::public_key)
+            .first(&mut conn)
+            .await
+            .map_err(missing(Error::OperatorNotFound))
+    }
+
+    async fn recovery_operator_public_key(
+        &self,
+        id: RecoveryOperatorIdentityId,
+    ) -> Result<Vec<u8>, Error> {
+        let mut conn = self.db.get().await?;
+        schema::recovery_operator_identity::table
+            .find(id)
+            .select(schema::recovery_operator_identity::public_key)
+            .first(&mut conn)
+            .await
+            .map_err(missing(Error::OperatorNotFound))
+    }
+
+    async fn record_vote(&self, vote: NewProposalVote) -> Result<(), Error> {
+        let mut conn = self.db.get().await?;
+        diesel::insert_into(schema::proposal_vote::table)
+            .values(&vote)
+            .execute(&mut conn)
+            .await?;
+        Ok(())
+    }
+
+    async fn record_recovery_vote(&self, vote: NewRecoveryProposalVote) -> Result<(), Error> {
+        let mut conn = self.db.get().await?;
+        diesel::insert_into(schema::recovery_proposal_vote::table)
+            .values(&vote)
+            .execute(&mut conn)
+            .await?;
+        Ok(())
+    }
+
+    async fn tally(&self, id: ProposalId) -> Result<Tally, Error> {
+        let mut conn = self.db.get().await?;
+
+        let ordinary_approve: i64 = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq(id))
+            .filter(schema::proposal_vote::approve.eq(true))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let recovery_approve: i64 = schema::recovery_proposal_vote::table
+            .filter(schema::recovery_proposal_vote::proposal_id.eq(id))
+            .filter(schema::recovery_proposal_vote::approve.eq(true))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+
+        let ordinary_reject: i64 = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq(id))
+            .filter(schema::proposal_vote::approve.eq(false))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let recovery_reject: i64 = schema::recovery_proposal_vote::table
+            .filter(schema::recovery_proposal_vote::proposal_id.eq(id))
+            .filter(schema::recovery_proposal_vote::approve.eq(false))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+
+        let total_ordinary: i64 = schema::operator_identity::table
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let total_recovery: i64 = schema::recovery_operator_identity::table
+            .count()
+            .get_result(&mut conn)
+            .await?;
+
+        Ok(Tally {
+            ordinary_approve,
+            ordinary_reject,
+            recovery_approve,
+            recovery_reject,
+            total_ordinary,
+            total_recovery,
+        })
+    }
+
+    async fn set_status(&self, id: ProposalId, status: ProposalStatus) -> Result<(), Error> {
+        let mut conn = self.db.get().await?;
+        diesel::update(schema::proposal::table.find(id))
+            .set(schema::proposal::status.eq(status))
+            .execute(&mut conn)
+            .await?;
+        Ok(())
+    }
+
+    async fn pending_for(
+        &self,
+        operator_id: OperatorIdentityId,
+    ) -> Result<Vec<ProposalSummary>, Error> {
+        #[expect(
+            clippy::cast_possible_truncation,
+            clippy::as_conversions,
+            reason = "fixme! #84; this will break in 2038"
+        )]
+        let now_ts = Utc::now().timestamp() as i32;
+
+        let mut conn = self.db.get().await?;
+
+        let voted_ids: Vec<ProposalId> = schema::proposal_vote::table
+            .filter(schema::proposal_vote::operator_id.eq(operator_id))
+            .select(schema::proposal_vote::proposal_id)
+            .load(&mut conn)
+            .await?;
+
+        let proposals: Vec<Proposal> = schema::proposal::table
+            .filter(schema::proposal::status.eq(ProposalStatus::Pending))
+            .filter(schema::proposal::expires_at.gt(now_ts))
+            .filter(diesel::dsl::not(schema::proposal::id.eq_any(&voted_ids)))
+            .load(&mut conn)
+            .await?;
+
+        let ids: Vec<ProposalId> = proposals.iter().map(|p| p.id).collect();
+        let tallies: Vec<(ProposalId, bool, i64)> = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq_any(&ids))
+            .group_by((
+                schema::proposal_vote::proposal_id,
+                schema::proposal_vote::approve,
+            ))
+            .select((
+                schema::proposal_vote::proposal_id,
+                schema::proposal_vote::approve,
+                diesel::dsl::count_star(),
+            ))
+            .load(&mut conn)
+            .await?;
+
+        let mut by_proposal: HashMap<ProposalId, (i64, i64)> = HashMap::new();
+        for (proposal_id, approve, count) in tallies {
+            let entry = by_proposal.entry(proposal_id).or_insert((0, 0));
+            if approve {
+                entry.0 += count;
+            } else {
+                entry.1 += count;
+            }
+        }
+
+        Ok(proposals
+            .into_iter()
+            .map(|p| {
+                let (approve_count, reject_count) =
+                    by_proposal.get(&p.id).copied().unwrap_or((0, 0));
+                ProposalSummary {
+                    id: p.id,
+                    kind: p.kind,
+                    initiator_id: p.initiator_id,
+                    expires_at: p.expires_at,
+                    approve_count,
+                    reject_count,
+                }
+            })
+            .collect())
+    }
+
+    async fn is_recovery_active(&self) -> Result<bool, Error> {
+        let mut conn = self.db.get().await?;
+        db::recovery::is_active(&mut conn)
+            .await
+            .map_err(Error::from)
+    }
+
+    async fn has_uncancelled_wakeup(&self) -> Result<bool, Error> {
+        let mut conn = self.db.get().await?;
+        select(exists(schema::recovery_wakeup_request::table.filter(
+            schema::recovery_wakeup_request::cancelled_at.is_null(),
+        )))
+        .get_result(&mut conn)
+        .await
+        .map_err(Error::from)
+    }
+
+    async fn request_wakeup(&self, operator_id: OperatorIdentityId) -> Result<(), Error> {
+        let mut conn = self.db.get().await?;
+        diesel::insert_into(schema::recovery_wakeup_request::table)
+            .values(&NewRecoveryWakeupRequest {
+                requested_by: operator_id,
+            })
+            .execute(&mut conn)
+            .await?;
+        Ok(())
+    }
+
+    async fn cancel_wakeup(&self, operator_id: OperatorIdentityId) -> Result<bool, Error> {
+        let mut conn = self.db.get().await?;
+        let rows = diesel::update(schema::recovery_wakeup_request::table)
+            .filter(schema::recovery_wakeup_request::cancelled_at.is_null())
+            .set((
+                schema::recovery_wakeup_request::cancelled_by.eq(Some(operator_id)),
+                schema::recovery_wakeup_request::cancelled_at.eq(Some(SqliteTimestamp::now())),
+            ))
+            .execute(&mut conn)
+            .await?;
+        Ok(rows > 0)
+    }
+}
--- a/server/crates/arbiter-server/src/actors/proposal_manager/tests.rs
+++ b/server/crates/arbiter-server/src/actors/proposal_manager/tests.rs
@@ -0,0 +1,395 @@
+//! The quorum rules, exercised without a database.
+//!
+//! These assertions are the point of [`super::store::ProposalStore`]: until the actor took
+//! its data through a trait, checking that two of three operators carry an ordinary
+//! proposal meant opening SQLite and registering operators first.
+
+use super::{
+    ProposalManager, VoteOutcome,
+    store::{MockProposalStore, Tally},
+};
+use crate::{
+    actors::GlobalActors,
+    crypto::governance::vote_message,
+    db::{
+        models::{OperatorIdentityId, Proposal, ProposalId, ProposalStatus, SqliteTimestamp},
+        proposal::ProposalKindTag,
+    },
+};
+use arbiter_crypto::authn::{SigningContext, SigningKey};
+use chrono::{Duration, Utc};
+use std::sync::Arc;
+
+/// A tally where every vote came from the ordinary committee.
+const fn tally(approve: i64, reject: i64, ordinary: i64, recovery: i64) -> Tally {
+    Tally {
+        ordinary_approve: approve,
+        ordinary_reject: reject,
+        recovery_approve: 0,
+        recovery_reject: 0,
+        total_ordinary: ordinary,
+        total_recovery: recovery,
+    }
+}
+
+/// A tally with votes from both committees, in the order approve/reject per committee.
+const fn mixed_tally(
+    ordinary_approve: i64,
+    ordinary_reject: i64,
+    recovery_approve: i64,
+    recovery_reject: i64,
+    total_ordinary: i64,
+    total_recovery: i64,
+) -> Tally {
+    Tally {
+        ordinary_approve,
+        ordinary_reject,
+        recovery_approve,
+        recovery_reject,
+        total_ordinary,
+        total_recovery,
+    }
+}
+
+#[test]
+fn simple_majority_approves_at_two_of_three() {
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(2, 0, 3, 0), false),
+        VoteOutcome::Approved
+    );
+}
+
+#[test]
+fn one_of_three_is_not_yet_a_majority() {
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(1, 0, 3, 0), false),
+        VoteOutcome::Pending
+    );
+}
+
+#[test]
+fn full_quorum_kind_needs_every_voter() {
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(2, 0, 3, 0), true),
+        VoteOutcome::Pending,
+        "two of three must not carry a key-rotation proposal"
+    );
+}
+
+#[test]
+fn recovery_voters_count_towards_full_quorum() {
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&mixed_tally(2, 0, 1, 0, 2, 1), true),
+        VoteOutcome::Approved
+    );
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&mixed_tally(2, 0, 0, 0, 2, 1), true),
+        VoteOutcome::Pending,
+        "the sleeping recovery operator still owes a vote"
+    );
+}
+
+/// An empty committee cannot approve anything. Both arms have to say so: the full-quorum arm
+/// derives its threshold from the electorate, so with nobody eligible it would compare 0
+/// approvals against a threshold of 0 and call that unanimous.
+#[test]
+fn an_empty_electorate_settles_nothing() {
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(0, 0, 0, 0), true),
+        VoteOutcome::Pending,
+        "a full-quorum proposal must not pass with no eligible voters"
+    );
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(0, 0, 0, 0), false),
+        VoteOutcome::Pending
+    );
+}
+
+#[test]
+fn rejection_is_decided_once_approval_is_unreachable() {
+    // Threshold is 2 of 3, so two rejections leave at most one approval available.
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(0, 2, 3, 0), false),
+        VoteOutcome::Rejected
+    );
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(0, 1, 3, 0), false),
+        VoteOutcome::Pending,
+        "one rejection still leaves two approvals reachable"
+    );
+}
+
+#[test]
+fn a_single_rejection_sinks_a_full_quorum_proposal() {
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(2, 1, 3, 0), true),
+        VoteOutcome::Rejected
+    );
+}
+
+fn pending_proposal(id: ProposalId, kind: ProposalKindTag) -> Proposal {
+    let now = Utc::now();
+    Proposal {
+        id,
+        kind,
+        initiator_id: OperatorIdentityId::from_raw(1),
+        created_at: SqliteTimestamp::from(now),
+        expires_at: SqliteTimestamp::from(now + Duration::days(1)),
+        status: ProposalStatus::Pending,
+    }
+}
+
+/// The mock earns its keep here: reaching quorum must flip the stored status to
+/// `Approved` exactly once. Signature verification stays real -- only the database is
+/// stubbed out.
+#[tokio::test]
+async fn reaching_quorum_marks_the_proposal_approved() {
+    let id = ProposalId::from_raw(1);
+    let voter = OperatorIdentityId::from_raw(1);
+    let key = SigningKey::generate();
+    let signature = key
+        .sign_message(&vote_message(id, true), SigningContext::GovernanceVote)
+        .expect("signing a vote must succeed");
+    let public_key = key.public_key().to_bytes();
+
+    let mut store = MockProposalStore::new();
+    store
+        .expect_load()
+        .returning(move |id| Ok(pending_proposal(id, ProposalKindTag::TriggerRekey)));
+    store.expect_has_voted().returning(|_, _| Ok(false));
+    store
+        .expect_operator_public_key()
+        .returning(move |_| Ok(public_key.clone()));
+    store.expect_record_vote().returning(|_| Ok(()));
+    store.expect_is_recovery_active().returning(|| Ok(false));
+    store.expect_tally().returning(|_| Ok(tally(1, 0, 1, 0)));
+    store
+        .expect_set_status()
+        .withf(move |got, status| *got == id && *status == ProposalStatus::Approved)
+        .times(1)
+        .returning(|_, _| Ok(()));
+    store
+        .expect_load_kind()
+        .returning(|_, _| Ok(crate::db::proposal::ProposalKind::TriggerRekey));
+
+    let mut manager =
+        ProposalManager::with_store(Arc::new(store), GlobalActors::spawn_message_bus());
+
+    let outcome = manager
+        .cast_vote(id, voter, true, signature.to_bytes())
+        .await
+        .expect("a valid vote must be accepted");
+
+    assert_eq!(outcome, VoteOutcome::Approved);
+}
+
+/// A vote that does not reach the threshold must leave the stored status alone.
+#[tokio::test]
+async fn a_vote_short_of_quorum_does_not_touch_the_status() {
+    let id = ProposalId::from_raw(7);
+    let voter = OperatorIdentityId::from_raw(2);
+    let key = SigningKey::generate();
+    let signature = key
+        .sign_message(&vote_message(id, true), SigningContext::GovernanceVote)
+        .expect("signing a vote must succeed");
+    let public_key = key.public_key().to_bytes();
+
+    let mut store = MockProposalStore::new();
+    store
+        .expect_load()
+        .returning(move |id| Ok(pending_proposal(id, ProposalKindTag::ApproveSdkClient)));
+    store.expect_has_voted().returning(|_, _| Ok(false));
+    store
+        .expect_operator_public_key()
+        .returning(move |_| Ok(public_key.clone()));
+    store.expect_record_vote().returning(|_| Ok(()));
+    store.expect_is_recovery_active().returning(|| Ok(false));
+    store.expect_tally().returning(|_| Ok(tally(1, 0, 3, 0)));
+    store.expect_set_status().never();
+
+    let mut manager =
+        ProposalManager::with_store(Arc::new(store), GlobalActors::spawn_message_bus());
+
+    let outcome = manager
+        .cast_vote(id, voter, true, signature.to_bytes())
+        .await
+        .expect("a valid vote must be accepted");
+
+    assert_eq!(outcome, VoteOutcome::Pending);
+}
+
+/// Drives one `cast_vote` on a proposal of the given `kind` through a mocked store and
+/// returns the outcome. `recovery_active` decides what `is_recovery_active` reports;
+/// `expected_status` is the status a settled outcome must be persisted under, or `None` for
+/// a caller that expects the vote to leave the proposal pending.
+///
+/// `set_status` carries an argument matcher but no `.times()`, and `None` relaxes even the
+/// matcher: the caller's own `assert_eq!` on the outcome is what pins the behaviour, so a
+/// regression fails on a readable diff rather than on a mockall cardinality panic that hides
+/// what the actor actually computed.
+async fn settle_vote_with(
+    kind: ProposalKindTag,
+    tally: Tally,
+    recovery_active: bool,
+    expected_status: Option<ProposalStatus>,
+) -> VoteOutcome {
+    let id = ProposalId::from_raw(11);
+    let voter = OperatorIdentityId::from_raw(1);
+    let key = SigningKey::generate();
+    let signature = key
+        .sign_message(&vote_message(id, true), SigningContext::GovernanceVote)
+        .expect("signing a vote must succeed");
+    let public_key = key.public_key().to_bytes();
+
+    let mut store = MockProposalStore::new();
+    store
+        .expect_load()
+        .returning(move |id| Ok(pending_proposal(id, kind)));
+    store.expect_has_voted().returning(|_, _| Ok(false));
+    store
+        .expect_operator_public_key()
+        .returning(move |_| Ok(public_key.clone()));
+    store.expect_record_vote().returning(|_| Ok(()));
+    store
+        .expect_is_recovery_active()
+        .returning(move || Ok(recovery_active));
+    store.expect_tally().returning(move |_| Ok(tally));
+    store
+        .expect_set_status()
+        .withf(move |_, status| {
+            expected_status
+                .as_ref()
+                .is_none_or(|expected| status == expected)
+        })
+        .returning(|_, _| Ok(()));
+    store.expect_load_kind().returning(move |_, _| {
+        Ok(match kind {
+            ProposalKindTag::TriggerRekey => crate::db::proposal::ProposalKind::TriggerRekey,
+            ProposalKindTag::ApproveSdkClient => {
+                crate::db::proposal::ProposalKind::ApproveSdkClient(
+                    crate::db::proposal::approve_sdk_client::Settings { client_id: 1 },
+                )
+            }
+            ProposalKindTag::ReplaceOperator => crate::db::proposal::ProposalKind::ReplaceOperator(
+                crate::db::proposal::replace_operator::Settings {
+                    old_operator_id: OperatorIdentityId::from_raw(1),
+                    new_pubkey: vec![0u8; 32],
+                },
+            ),
+            other => unreachable!("settle_vote_with has no load_kind fixture for {other:?}"),
+        })
+    });
+
+    let mut manager =
+        ProposalManager::with_store(Arc::new(store), GlobalActors::spawn_message_bus());
+
+    manager
+        .cast_vote(id, voter, true, signature.to_bytes())
+        .await
+        .expect("a valid vote must be accepted")
+}
+
+/// The full-quorum rejection path is insensitive to electorate size by construction:
+/// `threshold == total_eligible` there, so `total_eligible - threshold` is always 0 and any
+/// single rejection settles the proposal, whether or not recovery operators are (wrongly)
+/// counted. This does not exercise the electorate-narrowing fix -- see
+/// `unanimous_ordinary_rejection_rejects_a_non_full_quorum_proposal_while_recovery_is_awake`
+/// below for the test that does -- it just pins that `cast_vote` still writes `Rejected`
+/// through `settle` for a full-quorum kind.
+#[tokio::test]
+async fn unanimous_rejection_settles_a_full_quorum_rekey_via_cast_vote() {
+    let outcome = settle_vote_with(
+        ProposalKindTag::TriggerRekey,
+        tally(0, 3, 3, 2),
+        /* recovery_active */ true,
+        Some(ProposalStatus::Rejected),
+    )
+    .await;
+
+    assert_eq!(outcome, VoteOutcome::Rejected);
+}
+
+/// §3.3 full quorum for a rekey means every *ordinary* operator, not every identity on file.
+#[tokio::test]
+async fn unanimous_ordinary_approval_approves_a_rekey_while_recovery_is_awake() {
+    let outcome = settle_vote_with(
+        ProposalKindTag::TriggerRekey,
+        tally(3, 0, 3, 2),
+        /* recovery_active */ true,
+        Some(ProposalStatus::Approved),
+    )
+    .await;
+
+    assert_eq!(outcome, VoteOutcome::Approved);
+}
+
+/// §3.5: recovery operators do not vote on `ApproveSdkClient`, so they must not inflate its
+/// electorate. Before the fix, `total_eligible` counted them anyway (5, not 3), so the
+/// rejection test `reject > total_eligible - threshold` became `3 > 5 - 2 = 3`, which is
+/// false -- three unanimous rejections left the proposal `Pending` forever, since a fourth
+/// vote could never arrive. After the fix, `total_eligible` is 3 and the same test becomes
+/// `3 > 3 - 2 = 1`, which settles it.
+#[tokio::test]
+async fn unanimous_ordinary_rejection_rejects_a_non_full_quorum_proposal_while_recovery_is_awake() {
+    let outcome = settle_vote_with(
+        ProposalKindTag::ApproveSdkClient,
+        tally(0, 3, 3, 2),
+        /* recovery_active */ true,
+        Some(ProposalStatus::Rejected),
+    )
+    .await;
+
+    assert_eq!(outcome, VoteOutcome::Rejected);
+}
+
+/// §3.5/§3.6: `ReplaceOperator` is the one kind recovery may vote on, so it is the only kind
+/// where whether recovery is awake is observable at all -- for every other kind
+/// `narrow_electorate` zeroes `total_recovery` regardless of `is_recovery_active`, short-
+/// circuiting before that call. A sleeping recovery electorate must not raise the bar here:
+/// with 1 ordinary operator and 2 (asleep) recovery operators, the lone ordinary approval
+/// must already reach full quorum.
+#[tokio::test]
+async fn sleeping_recovery_operators_do_not_count_towards_quorum() {
+    let outcome = settle_vote_with(
+        ProposalKindTag::ReplaceOperator,
+        tally(1, 0, 1, 2),
+        /* recovery_active */ false,
+        Some(ProposalStatus::Approved),
+    )
+    .await;
+
+    assert_eq!(outcome, VoteOutcome::Approved);
+}
+
+/// The sequence the whole-branch review worked through, on a `ReplaceOperator` with 3
+/// ordinary and 2 recovery operators (§3.3: full quorum). Both recovery operators approve
+/// while awake; one ordinary operator approves; another ordinary operator then cancels the
+/// wake-up -- `cancel_wakeup` cancels an uncancelled request whether or not its window has
+/// elapsed, so the committee goes straight back to sleep with its votes on the record; a
+/// second ordinary operator approves.
+///
+/// The store now reports 4 approvals, 2 of them from a committee that is no longer eligible.
+/// Narrowing the electorate has to drop those votes along with the voters: what is left is 2
+/// of 3 ordinary approvals, and a full quorum needs all three. Counting the electorate down
+/// to 3 while keeping all 4 votes would replace an operator on two ordinary approvals.
+#[tokio::test]
+async fn recovery_votes_leave_with_the_committee_that_cast_them() {
+    let outcome = settle_vote_with(
+        ProposalKindTag::ReplaceOperator,
+        mixed_tally(
+            /* ordinary_approve */ 2, /* ordinary_reject */ 0,
+            /* recovery_approve */ 2, /* recovery_reject */ 0,
+            /* total_ordinary */ 3, /* total_recovery */ 2,
+        ),
+        /* recovery_active */ false,
+        None,
+    )
+    .await;
+
+    assert_eq!(
+        outcome,
+        VoteOutcome::Pending,
+        "two of three ordinary approvals must not carry a full-quorum proposal, whatever a \
+         sleeping recovery committee voted earlier"
+    );
+}
--- a/server/crates/arbiter-server/src/actors/vault/mod.rs
+++ b/server/crates/arbiter-server/src/actors/vault/mod.rs
@@ -222,7 +222,9 @@ impl Vault {
        });

        info!("Vault bootstrapped successfully");
-        let _ = self.events.tell(Publish(events::Bootstrapped)).await;
+        if let Err(err) = self.events.tell(Publish(events::Bootstrapped)).await {
+            error!(?err, "Failed to publish Bootstrapped event");
+        }

        Ok(())
    }
@@ -277,8 +279,10 @@ impl Vault {
        Ok(())
    }

-    /// Re-encrypts the root key with `new_seal_key` and records a new root_key_history row.
-    /// Called after a Shamir re-key so the old seal key is no longer sufficient to unseal.
+    /// Re-encrypts the root key with `new_seal_key`, updating its `root_key_history` row in
+    /// place. Called after a Shamir re-key, so the old seal key is no longer sufficient to
+    /// unseal. The root key itself does not change, so its row identity (and the nonce counter
+    /// and integrity envelopes bound to it) must not change either.
    #[message]
    pub async fn rekey_root_key(&mut self, mut new_seal_key: KeyCell) -> Result<(), Error> {
        let Unsealed {
@@ -298,34 +302,31 @@ impl Vault {
                })
        })?;

-        let data_encryption_nonce = Nonce::default();
-
        let mut conn = self.db.get().await?;
-        let new_root_key_history_id: i32 = conn
-            .transaction(async |conn| {
-                let new_id = insert_into(schema::root_key_history::table)
-                    .values(&models::NewRootKeyHistory {
-                        ciphertext: new_ciphertext,
-                        tag: v1::ROOT_KEY_TAG.to_vec(),
-                        root_key_encryption_nonce: new_nonce.to_vec(),
-                        data_encryption_nonce: data_encryption_nonce.to_vec(),
-                        schema_version: 1,
-                        salt: new_salt.to_vec(),
-                    })
-                    .returning(schema::root_key_history::id)
-                    .get_result::<i32>(&mut *conn)
-                    .await?;

-                update(schema::arbiter_settings::table)
-                    .set(schema::arbiter_settings::root_key_id.eq(new_id))
-                    .execute(&mut *conn)
-                    .await?;
-
-                Result::<_, diesel::result::Error>::Ok(new_id)
-            })
+        // The root key is unchanged, so its row keeps its identity: `data_encryption_nonce`
+        // keeps counting up, and every integrity envelope stays bound to the same key version.
+        // Only the seal-key material is replaced, retiring the previous one. `tag` and
+        // `schema_version` are deliberately left untouched: the seal-key encryption scheme
+        // itself is unchanged by a re-key, so there is nothing new for them to describe.
+        let rows_updated = update(schema::root_key_history::table)
+            .filter(schema::root_key_history::id.eq(*root_key_history_id))
+            .set((
+                schema::root_key_history::ciphertext.eq(new_ciphertext),
+                schema::root_key_history::root_key_encryption_nonce.eq(new_nonce.to_vec()),
+                schema::root_key_history::salt.eq(new_salt.to_vec()),
+            ))
+            .execute(&mut conn)
            .await?;

-        *root_key_history_id = RootKeyHistoryId::from_raw(new_root_key_history_id);
+        if rows_updated == 0 {
+            error!(
+                "Broken database: rekey matched no root_key_history row id={:#?}",
+                root_key_history_id
+            );
+            return Err(Error::BrokenDatabase);
+        }
+
        info!("Vault root key rekeyed successfully");
        Ok(())
    }
@@ -522,7 +523,6 @@ impl Vault {
 #[cfg(test)]
 mod tests {
    use crate::actors::GlobalActors;
-    use arbiter_crypto::safecell::SafeCellHandle as _;

    use super::*;

@@ -578,4 +578,96 @@ mod tests {
            "next write must advance nonce"
        );
    }
+
+    #[tokio::test]
+    #[test_log::test]
+    async fn rekey_does_not_restart_the_data_nonce_counter() {
+        let db = db::create_test_pool().await;
+        let mut actor = bootstrapped_actor(&db).await;
+
+        let before = actor
+            .create_new(SafeCell::new(b"before-rekey".to_vec()))
+            .await
+            .unwrap();
+
+        actor.rekey_root_key(KeyCell::from([7u8; 32])).await.unwrap();
+
+        let after = actor
+            .create_new(SafeCell::new(b"after-rekey".to_vec()))
+            .await
+            .unwrap();
+
+        let mut conn = db.get().await.unwrap();
+
+        // One root key, one row: the root key never changed, so its history did not fork.
+        let rows: i64 = schema::root_key_history::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(rows, 1, "a seal-key re-key must not append a root key row");
+
+        // Fetch each nonce by its own id, rather than `eq_any` (whose row order is
+        // unspecified), and assert the counter strictly advanced. A weaker `assert_ne!` would
+        // still pass if the counter reset, as long as the two nonces happened to differ.
+        let before_nonce: Vec<u8> = schema::aead_encrypted::table
+            .find(before)
+            .select(schema::aead_encrypted::current_nonce)
+            .first(&mut conn)
+            .await
+            .unwrap();
+        let after_nonce: Vec<u8> = schema::aead_encrypted::table
+            .find(after)
+            .select(schema::aead_encrypted::current_nonce)
+            .first(&mut conn)
+            .await
+            .unwrap();
+        assert!(
+            after_nonce > before_nonce,
+            "nonce counter must keep advancing across a rekey, not reset"
+        );
+    }
+
+    #[tokio::test]
+    #[test_log::test]
+    async fn rekey_invalidates_the_old_seal_key() {
+        let db = db::create_test_pool().await;
+        let mut actor = bootstrapped_actor(&db).await;
+
+        actor.rekey_root_key(KeyCell::from([7u8; 32])).await.unwrap();
+        actor.seal().await.unwrap();
+
+        // A no-op rekey would leave the old seal key working; it must not.
+        let err = actor
+            .try_unseal(KeyCell::from([0u8; 32]))
+            .await
+            .unwrap_err();
+        assert!(
+            matches!(err, Error::InvalidKey),
+            "old seal key must no longer unseal after a rekey, got {err:?}"
+        );
+
+        // A failed unseal must leave the sealed state intact: the new seal key must still be
+        // able to unseal on the next attempt.
+        actor.try_unseal(KeyCell::from([7u8; 32])).await.unwrap();
+    }
+
+    #[tokio::test]
+    #[test_log::test]
+    async fn integrity_envelopes_survive_a_rekey() {
+        let db = db::create_test_pool().await;
+        let mut actor = bootstrapped_actor(&db).await;
+
+        let mac_input = b"operator_credentials/1".to_vec();
+        let (key_version, mac) = actor.sign_integrity(mac_input.clone()).unwrap();
+
+        actor.rekey_root_key(KeyCell::from([9u8; 32])).await.unwrap();
+
+        assert!(
+            actor
+                .verify_integrity(mac_input, mac, key_version)
+                .unwrap(),
+            "a seal-key re-key must not invalidate existing attestations"
+        );
+    }
 }
--- a/server/crates/arbiter-server/src/actors/vault_coordinator/mod.rs
+++ b/server/crates/arbiter-server/src/actors/vault_coordinator/mod.rs
@@ -52,6 +52,10 @@ pub enum Error {
    TwoOperatorsRequireRecovery,
    #[error("Broken database")]
    BrokenDatabase,
+    #[error("A committee must have at least one ordinary operator")]
+    EmptyCommittee,
+    #[error("Recovery operators are sleeping")]
+    RecoveryNotActive,
 }

 // Passphrases stored as plain Vec<u8> (not SafeCell) so CoordinatorState is Sync.
@@ -140,6 +144,36 @@ fn decrypt_share(
    Ok(share_buffer.read().clone())
 }

+/// Records the threshold of the split that produced the stored shares.
+async fn store_threshold(conn: &mut db::DatabaseConnection, threshold: usize) -> Result<(), Error> {
+    // A threshold that doesn't fit in the column is a bug, not a real empty-committee refusal.
+    let threshold = i32::try_from(threshold).map_err(|_| Error::BrokenDatabase)?;
+    let rows_updated = diesel::update(schema::arbiter_settings::table)
+        .set(schema::arbiter_settings::shamir_threshold.eq(Some(threshold)))
+        .execute(conn)
+        .await?;
+    // The singleton row always exists (up.sql seeds it), so anything else means the update did
+    // not land -- bootstrap would then report success while the threshold stays NULL forever.
+    if rows_updated != 1 {
+        return Err(Error::BrokenDatabase);
+    }
+    Ok(())
+}
+
+/// Reads back the threshold recorded at bootstrap or re-key time.
+async fn load_threshold(conn: &mut db::DatabaseConnection) -> Result<usize, Error> {
+    let stored: Option<i32> = schema::arbiter_settings::table
+        .select(schema::arbiter_settings::shamir_threshold)
+        .first(conn)
+        .await?;
+
+    // A missing or out-of-range value here means the recorded threshold is corrupt, not that the
+    // committee is genuinely empty -- `EmptyCommittee` is reserved for the real domain refusal.
+    stored
+        .and_then(|threshold| usize::try_from(threshold).ok())
+        .ok_or(Error::BrokenDatabase)
+}
+
 /// §3.4: Split the seal key across ordinary + recovery operators.
 /// Threshold = `shamir_threshold(ordinary_count)`; total shares = ordinary + recovery.
 /// When `ordinary_count` == 1 (threshold = 1), vsss-rs does not support a proper split,
@@ -153,7 +187,7 @@ async fn finalize_bootstrap(
    let ordinary_count = ordinary_passphrases.len();
    let recovery_count = recovery_passphrases.len();
    let total = ordinary_count + recovery_count;
-    let threshold = shamir_threshold(ordinary_count);
+    let threshold = shamir_threshold(ordinary_count).ok_or(Error::EmptyCommittee)?;

    let mut seal_key_bytes = [0u8; 32];
    OsRng.fill_bytes(&mut seal_key_bytes);
@@ -210,6 +244,8 @@ async fn finalize_bootstrap(
            .await?;
    }

+    store_threshold(&mut conn, threshold).await?;
+
    vault.ask(Bootstrap { seal_key }).await.map_err(|err| {
        error!(?err, "Vault bootstrap failed");
        Error::VaultError
@@ -228,11 +264,7 @@ async fn finalize_unseal(
    let mut conn = db.get().await?;

    // Determine whether shares were stored as raw keys (threshold=1) or vsss-rs splits (threshold>=2).
-    let ordinary_operator_count: i64 = schema::operator::table
-        .count()
-        .get_result(&mut conn)
-        .await?;
-    let threshold = shamir_threshold(ordinary_operator_count as usize);
+    let threshold = load_threshold(&mut conn).await?;

    let mut shares: Vec<Vec<u8>> = Vec::new();

@@ -314,7 +346,7 @@ async fn finalize_rekey(
    let ordinary_count = ordinary_passphrases.len();
    let recovery_count = recovery_passphrases.len();
    let total = ordinary_count + recovery_count;
-    let threshold = shamir_threshold(ordinary_count);
+    let threshold = shamir_threshold(ordinary_count).ok_or(Error::EmptyCommittee)?;

    let mut new_seal_key_bytes = [0u8; 32];
    OsRng.fill_bytes(&mut new_seal_key_bytes);
@@ -369,6 +401,8 @@ async fn finalize_rekey(
            .await?;
    }

+    store_threshold(&mut conn, threshold).await?;
+
    drop(conn);

    let new_seal_key = KeyCell::from(new_seal_key_bytes);
@@ -398,6 +432,9 @@ impl VaultCoordinator {
        if !matches!(self.state, CoordinatorState::Idle) {
            return Err(Error::AlreadyBootstrapping);
        }
+        if declared_count == 0 {
+            return Err(Error::EmptyCommittee);
+        }
        if declared_count == 2 && recovery_count == 0 {
            return Err(Error::TwoOperatorsRequireRecovery);
        }
@@ -548,6 +585,13 @@ impl VaultCoordinator {
        recovery_operator_id: i32,
        mut passphrase: SafeCell<Vec<u8>>,
    ) -> Result<bool, Error> {
+        {
+            let mut conn = self.db.get().await?;
+            if !db::recovery::is_active(&mut conn).await? {
+                return Err(Error::RecoveryNotActive);
+            }
+        }
+
        self.ensure_unsealing_state().await?;

        let CoordinatorState::Unsealing {
@@ -576,15 +620,12 @@ impl VaultCoordinator {

 impl VaultCoordinator {
    /// Initializes `CoordinatorState::Unsealing` on first call if still `Idle`.
-    /// Threshold is based on ordinary operator count only (§3.4).
+    /// Threshold comes from the recorded split parameters (§3.4), not from a live row count.
    async fn ensure_unsealing_state(&mut self) -> Result<(), Error> {
        if matches!(self.state, CoordinatorState::Idle) {
            let mut conn = self.db.get().await?;
-            let ordinary_count: i64 = schema::operator::table
-                .count()
-                .get_result(&mut conn)
-                .await?;
-            let threshold = shamir_threshold(usize::try_from(ordinary_count).unwrap_or_default());
+            let threshold = load_threshold(&mut conn).await?;
+            drop(conn);
            self.state = CoordinatorState::Unsealing {
                threshold,
                ordinary_passphrases: HashMap::new(),
@@ -643,9 +684,7 @@ impl VaultCoordinator {
    /// then transitions to Rekeying state awaiting contributions from all of them.
    #[message]
    pub async fn start_rekey(&mut self) -> Result<(), Error> {
-        if !matches!(self.state, CoordinatorState::Idle) {
-            return Err(Error::AlreadyBootstrapping);
-        }
+        self.ensure_idle()?;
        let mut conn = self.db.get().await?;
        let ordinary_count: i64 = schema::operator_identity::table
            .count()
@@ -753,12 +792,28 @@ impl Message<ProposalApproved> for VaultCoordinator {
 }

 impl VaultCoordinator {
+    /// The coordinator runs one ceremony at a time; anything that starts a new one has to say
+    /// so before it changes any state the ceremony depends on.
+    const fn ensure_idle(&self) -> Result<(), Error> {
+        if matches!(self.state, CoordinatorState::Idle) {
+            Ok(())
+        } else {
+            Err(Error::AlreadyBootstrapping)
+        }
+    }
+
    /// Replaces the operator's public key in place, keeping their id and history, drops the
    /// share that key no longer matches, then begins a coordinated re-key (§3.3).
    async fn replace_operator(
        &mut self,
        settings: &replace_operator::Settings,
    ) -> Result<(), Error> {
+        // Checked before anything is written. The re-key is what gives the replaced operator
+        // a share they can use; if the coordinator is mid-ceremony, `start_rekey` refuses, and
+        // swapping the key and destroying the share first would leave that operator locked
+        // out with no re-key running and nothing to undo it -- the caller only logs the error.
+        self.ensure_idle()?;
+
        let mut conn = self.db.get().await?;

        diesel::update(schema::operator_identity::table)
@@ -778,3 +833,91 @@ impl VaultCoordinator {
        self.start_rekey().await
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{CoordinatorState, Error, VaultCoordinator};
+    use crate::{
+        actors::{GlobalActors, vault::Vault},
+        db::{self, models::OperatorIdentityId, proposal::replace_operator, schema},
+    };
+
+    use diesel::{ExpressionMethods as _, QueryDsl as _, dsl::insert_into};
+    use diesel_async::RunQueryDsl;
+    use kameo::actor::Spawn as _;
+    use std::collections::HashMap;
+
+    /// An approved `ReplaceOperator` that arrives while another ceremony is running must
+    /// change nothing. Swapping the public key and deleting the share are only safe because a
+    /// re-key follows and hands the operator a share for the new key; when `start_rekey`
+    /// refuses, the operator would otherwise be left holding a key with no share, and the
+    /// caller does nothing with the error but log it.
+    #[tokio::test]
+    async fn a_refused_rekey_leaves_the_operator_untouched() {
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let old_key = rand::random::<[u8; 32]>().to_vec();
+        let operator_id: OperatorIdentityId = insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(&old_key))
+            .returning(schema::operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        insert_into(schema::operator::table)
+            .values((
+                schema::operator::id.eq(Some(operator_id)),
+                schema::operator::share.eq(vec![1u8; 32]),
+                schema::operator::share_nonce.eq(vec![2u8; 24]),
+                schema::operator::share_salt.eq(vec![3u8; 32]),
+            ))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        drop(conn);
+
+        let vault = Vault::spawn(
+            Vault::new(pool.clone(), GlobalActors::spawn_message_bus())
+                .await
+                .unwrap(),
+        );
+        let mut coordinator = VaultCoordinator::new(pool.clone(), vault);
+        coordinator.state = CoordinatorState::Rekeying {
+            ordinary_count: 2,
+            recovery_count: 0,
+            passphrases: HashMap::new(),
+            recovery_passphrases: HashMap::new(),
+        };
+
+        let result = coordinator
+            .replace_operator(&replace_operator::Settings {
+                old_operator_id: operator_id,
+                new_pubkey: vec![9u8; 32],
+            })
+            .await;
+        assert!(
+            matches!(result, Err(Error::AlreadyBootstrapping)),
+            "a busy coordinator must refuse the replacement, got {result:?}"
+        );
+
+        let mut conn = pool.get().await.unwrap();
+        let stored_key: Vec<u8> = schema::operator_identity::table
+            .find(operator_id)
+            .select(schema::operator_identity::public_key)
+            .first(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(
+            stored_key, old_key,
+            "the public key must not be swapped when no re-key can follow"
+        );
+
+        let shares: i64 = schema::operator::table
+            .filter(schema::operator::id.eq(Some(operator_id)))
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(shares, 1, "the operator's share must not be destroyed");
+    }
+}
--- a/server/crates/arbiter-server/src/crypto/shamir.rs
+++ b/server/crates/arbiter-server/src/crypto/shamir.rs
@@ -21,14 +21,14 @@ pub fn split_key(
 }

 /// Returns the minimum number of shares required to reconstruct the secret
-/// for a committee of `n` operators.
+/// for a committee of `n` operators, or `None` for an empty committee.
 #[must_use]
-pub const fn shamir_threshold(n: usize) -> usize {
+pub const fn shamir_threshold(n: usize) -> Option<usize> {
    match n {
-        0 => panic!("No operators"),
-        1 => 1,
-        2 => 2,
-        n => n / 2 + 1,
+        0 => None,
+        1 => Some(1),
+        2 => Some(2),
+        n => Some(n / 2 + 1),
    }
 }

@@ -39,3 +39,22 @@ pub fn combine_shares(shares: &[Vec<u8>]) -> Result<[u8; 32], ShamirError> {
    <[u8; 32]>::try_from(bytes.as_slice())
        .map_err(|_| ShamirError::Combine("unexpected reconstructed key length".to_owned()))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::shamir_threshold;
+
+    #[test]
+    fn empty_committee_has_no_threshold() {
+        assert_eq!(shamir_threshold(0), None);
+    }
+
+    #[test]
+    fn threshold_follows_the_ordinary_quorum() {
+        // ARCHITECTURE.md §3.1/§3.4: 1 decides alone, 2 need consensus, N needs N/2 + 1.
+        assert_eq!(shamir_threshold(1), Some(1));
+        assert_eq!(shamir_threshold(2), Some(2));
+        assert_eq!(shamir_threshold(3), Some(2));
+        assert_eq!(shamir_threshold(4), Some(3));
+    }
+}
--- a/server/crates/arbiter-server/src/db/functions.rs
+++ b/server/crates/arbiter-server/src/db/functions.rs
@@ -1,6 +1,6 @@
 //! Typed bindings for the SQLite scalar functions used in Diesel expressions.

-use diesel::sql_types::{Integer, Text};
+use diesel::sql_types::Text;

 diesel::define_sql_function! {
    /// SQLite `unixepoch(modifier)` -- seconds since the Unix epoch.
--- a/server/crates/arbiter-server/src/db/mod.rs
+++ b/server/crates/arbiter-server/src/db/mod.rs
@@ -11,6 +11,7 @@ use tracing::info;
 pub mod functions;
 pub mod models;
 pub mod proposal;
+pub mod recovery;
 pub mod schema;

 pub type DatabaseConnection = SyncConnectionWrapper<SqliteConnection>;
@@ -58,25 +59,39 @@ fn database_path() -> Result<std::path::PathBuf, DatabaseSetupError> {
    Ok(db_path)
 }

+/// The pragmas `SQLite` scopes to one connection. They are defined once and run on every
+/// connection that reaches the database -- the migration connection below and each pooled
+/// connection in `create_pool` -- because a value set on one connection is invisible to the
+/// next, and every real write happens on a pooled one.
+const CONNECTION_PRAGMAS: &str = "
+    -- sleep if the database is busy; this corresponds to up to 9 seconds sleeping time.
+    -- see https://fractaledmind.github.io/2023/09/07/enhancing-rails-sqlite-fine-tuning/
+    PRAGMA busy_timeout = 9000;
+    -- fsync only in critical moments
+    PRAGMA synchronous = NORMAL;
+    -- write WAL changes back every 1000 pages, for an in average 1MB WAL file.
+    -- May affect readers if number is increased
+    PRAGMA wal_autocheckpoint = 1000;
+    -- sqlite foreign keys are disabled by default, enable them for safety
+    PRAGMA foreign_keys = ON;
+    -- overwrite freed pages instead of leaving encrypted shares, nonces and salts
+    -- readable in the file
+    PRAGMA secure_delete = ON;
+";
+
 #[tracing::instrument(level = "info", skip(conn))]
 fn db_config(conn: &mut SqliteConnection) -> Result<(), diesel::result::Error> {
-    // fsync only in critical moments
-    conn.batch_execute("PRAGMA synchronous = NORMAL;")?;
-    // write WAL changes back every 1000 pages, for an in average 1MB WAL file.
-    // May affect readers if number is increased
-    conn.batch_execute("PRAGMA wal_autocheckpoint = 1000;")?;
+    conn.batch_execute(CONNECTION_PRAGMAS)?;
+
+    // The rest belong to the database file rather than the connection, so the one-shot
+    // migration connection is the right and only place for them.
+
    // free some space by truncating possibly massive WAL files from the last run
    conn.batch_execute("PRAGMA wal_checkpoint(TRUNCATE);")?;

-    // sqlite foreign keys are disabled by default, enable them for safety
-    conn.batch_execute("PRAGMA foreign_keys = ON;")?;
-
    // better space reclamation
    conn.batch_execute("PRAGMA auto_vacuum = FULL;")?;

-    // secure delete, overwrite deleted content with zeros to prevent recovery
-    conn.batch_execute("PRAGMA secure_delete = ON;")?;
-
    Ok(())
 }

@@ -100,12 +115,17 @@ fn initialize_database(url: &str) -> Result<(), DatabaseSetupError> {
 /// # Panics
 /// Panics if the database path is not valid UTF-8.
 pub async fn create_pool(url: Option<&str>) -> Result<DatabasePool, DatabaseSetupError> {
-    let database_url = url.map(String::from).unwrap_or(
-        database_path()?
+    // Matched rather than `unwrap_or`, whose argument is evaluated even when `url` is `Some`:
+    // `database_path` resolves the real home directory and creates `~/.arbiter` as a side
+    // effect, so an eager call reaches the developer's home from every test that passes an
+    // explicit temp path, and fails outright wherever no home directory is writable.
+    let database_url = match url {
+        Some(url) => url.to_owned(),
+        None => database_path()?
            .to_str()
            .expect("database path is not valid UTF-8")
            .to_owned(),
-    );
+    };

    initialize_database(&database_url)?;

@@ -114,13 +134,13 @@ pub async fn create_pool(url: Option<&str>) -> Result<DatabasePool, DatabaseSetu
        Box::pin(async move {
            let mut conn = DatabaseConnection::establish(url).await?;

-            // see https://fractaledmind.github.io/2023/09/07/enhancing-rails-sqlite-fine-tuning/
-            // sleep if the database is busy, this corresponds to up to 9 seconds sleeping time.
-            conn.batch_execute("PRAGMA busy_timeout = 9000;")
+            // better write-concurrency; a property of the file, but harmless to reassert
+            conn.batch_execute("PRAGMA journal_mode = WAL;")
                .await
                .map_err(diesel::ConnectionError::CouldntSetupConfiguration)?;
-            // better write-concurrency
-            conn.batch_execute("PRAGMA journal_mode = WAL;")
+            // The migration connection setting these is not enough: SQLite scopes them to
+            // one connection, and every real query runs on a pooled one.
+            conn.batch_execute(CONNECTION_PRAGMAS)
                .await
                .map_err(diesel::ConnectionError::CouldntSetupConfiguration)?;

@@ -156,3 +176,83 @@ pub async fn create_test_pool() -> DatabasePool {
        .await
        .expect("Failed to create test database pool")
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use diesel::{
+        ExpressionMethods as _,
+        dsl::insert_into,
+        result::{DatabaseErrorKind, Error as DieselError},
+    };
+    use diesel_async::RunQueryDsl;
+
+    /// `operator.id` references `operator_identity(id)`. Without `PRAGMA foreign_keys = ON`
+    /// on the pooled connection, SQLite accepts a share row for an operator that does not exist.
+    #[tokio::test]
+    async fn pooled_connections_enforce_foreign_keys() {
+        let pool = create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let result = insert_into(schema::operator::table)
+            .values((
+                schema::operator::id.eq(4242),
+                schema::operator::share.eq(vec![0u8; 32]),
+                schema::operator::share_nonce.eq(vec![0u8; 24]),
+                schema::operator::share_salt.eq(vec![0u8; 32]),
+            ))
+            .execute(&mut conn)
+            .await;
+
+        // Specifically a foreign-key violation, not any error: a `NOT NULL` failure or a
+        // renamed column would also make `result.is_err()` true without proving the pragma
+        // is what rejected the insert.
+        assert!(
+            matches!(
+                result,
+                Err(DieselError::DatabaseError(
+                    DatabaseErrorKind::ForeignKeyViolation,
+                    _
+                ))
+            ),
+            "expected a foreign-key violation for a dangling operator_identity reference, got {result:?}"
+        );
+    }
+
+    #[derive(diesel::QueryableByName)]
+    struct PragmaValue {
+        #[diesel(sql_type = diesel::sql_types::Integer)]
+        value: i32,
+    }
+
+    async fn pragma(conn: &mut DatabaseConnection, name: &str) -> i32 {
+        diesel::sql_query(format!("select {name} as value from pragma_{name}()"))
+            .get_result::<PragmaValue>(conn)
+            .await
+            .unwrap()
+            .value
+    }
+
+    /// `foreign_keys` had to be repeated on the pooled connection because `SQLite` scopes it
+    /// there; its siblings in `CONNECTION_PRAGMAS` are scoped the same way and were being
+    /// left behind on the migration connection. `secure_delete` is the one that matters in a
+    /// key-custody database: off by default, it leaves freed pages holding encrypted shares,
+    /// nonces and salts readable in the file.
+    #[tokio::test]
+    async fn pooled_connections_carry_the_shared_pragmas() {
+        let pool = create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        assert_eq!(
+            pragma(&mut conn, "secure_delete").await,
+            1,
+            "freed pages must be overwritten on the connection that does the writing"
+        );
+        assert_eq!(
+            pragma(&mut conn, "synchronous").await,
+            1,
+            "synchronous must be NORMAL (1), not the default FULL (2)"
+        );
+        assert_eq!(pragma(&mut conn, "foreign_keys").await, 1);
+    }
+}
--- a/server/crates/arbiter-server/src/db/models.rs
+++ b/server/crates/arbiter-server/src/db/models.rs
@@ -263,19 +263,22 @@ pub struct EvmWallet {
 #[view(
    NewEvmWalletAccess,
    derive(Insertable),
-    omit(id, created_at),
+    omit(id, created_at, revoked_at),
    attributes_with = "deriveless"
 )]
 #[view(
    CoreEvmWalletAccess,
    derive(Insertable),
-    omit(created_at),
+    omit(created_at, revoked_at),
    attributes_with = "deriveless"
 )]
 pub struct EvmWalletAccess {
    pub id: i32,
    pub wallet_id: EvmWalletId,
    pub client_id: i32,
+    // Grants, transaction logs, and persistent-grant proposals reference this row
+    // `on delete restrict`, so revocation cannot delete it -- it marks it revoked instead.
+    pub revoked_at: Option<SqliteTimestamp>,
    pub created_at: SqliteTimestamp,
 }

--- a/server/crates/arbiter-server/src/db/proposal/mod.rs
+++ b/server/crates/arbiter-server/src/db/proposal/mod.rs
@@ -82,6 +82,12 @@ impl ProposalKindTag {
    pub const fn requires_full_quorum(self) -> bool {
        matches!(self, Self::ReplaceOperator | Self::TriggerRekey)
    }
+
+    /// §3.5: recovery operators weigh in on operator replacement and nothing else.
+    #[must_use]
+    pub const fn recovery_may_vote(self) -> bool {
+        matches!(self, Self::ReplaceOperator)
+    }
 }

 /// Pins every implementation to the variant it is dispatched from. Without this a
--- a/server/crates/arbiter-server/src/db/recovery.rs
+++ b/server/crates/arbiter-server/src/db/recovery.rs
@@ -0,0 +1,102 @@
+//! Whether the recovery committee is awake.
+//!
+//! §3.6: a wake-up request opens a dispute window; recovery powers only become active once
+//! that window has elapsed without cancellation. Both the proposal manager (for voting) and
+//! the vault coordinator (for unsealing) gate on this, so the rule lives in one place.
+
+use crate::db::{functions::unixepoch, schema};
+
+use diesel::{
+    ExpressionMethods as _, QueryDsl as _,
+    dsl::{exists, select},
+};
+use diesel_async::RunQueryDsl;
+
+/// Recovery operators stay asleep for this long after a wake-up is requested, so the other
+/// operators have time to dispute it (§3.6).
+pub const WAKEUP_DELAY_SECS: i32 = 14 * 24 * 60 * 60;
+
+/// True when an uncancelled wake-up request is older than the dispute window.
+pub async fn is_active(
+    conn: &mut crate::db::DatabaseConnection,
+) -> Result<bool, diesel::result::Error> {
+    select(exists(
+        schema::recovery_wakeup_request::table
+            .filter(schema::recovery_wakeup_request::cancelled_at.is_null())
+            .filter(
+                schema::recovery_wakeup_request::requested_at
+                    .le(unixepoch("now") - WAKEUP_DELAY_SECS),
+            ),
+    ))
+    .get_result(conn)
+    .await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{WAKEUP_DELAY_SECS, is_active};
+    use crate::db::{self, schema};
+
+    use diesel::{ExpressionMethods as _, insert_into};
+    use diesel_async::RunQueryDsl;
+
+    /// `recovery_wakeup_request.requested_by` references `operator_identity(id)`, and pooled
+    /// connections enforce foreign keys, so every wake-up row needs a real identity behind it.
+    async fn insert_operator(pool: &db::DatabasePool) -> i32 {
+        let mut conn = pool.get().await.unwrap();
+        insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(vec![7u8; 32]))
+            .returning(schema::operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    }
+
+    /// Pins `.filter(requested_at.le(...))`: a wake-up requested moments ago must not be
+    /// active yet, even though nothing has cancelled it. Deleting that filter turns this
+    /// assertion false without touching any other test in the suite.
+    #[tokio::test]
+    async fn a_recent_wakeup_is_not_yet_active() {
+        let pool = db::create_test_pool().await;
+        let operator_id = insert_operator(&pool).await;
+        let mut conn = pool.get().await.unwrap();
+
+        diesel::sql_query(format!(
+            "INSERT INTO recovery_wakeup_request (requested_by, requested_at) \
+             VALUES ({operator_id}, unixepoch('now'))"
+        ))
+        .execute(&mut conn)
+        .await
+        .unwrap();
+
+        assert!(
+            !is_active(&mut conn).await.unwrap(),
+            "a wake-up requested moments ago must still be asleep"
+        );
+    }
+
+    /// Pins `.filter(cancelled_at.is_null())`: a cancelled wake-up must not count towards
+    /// activity even once its original request has outlived the dispute window. Deleting
+    /// that filter turns this assertion false without touching any other test in the suite.
+    #[tokio::test]
+    async fn a_cancelled_wakeup_is_not_active_even_past_the_window() {
+        let pool = db::create_test_pool().await;
+        let operator_id = insert_operator(&pool).await;
+        let mut conn = pool.get().await.unwrap();
+
+        diesel::sql_query(format!(
+            "INSERT INTO recovery_wakeup_request \
+             (requested_by, requested_at, cancelled_by, cancelled_at) \
+             VALUES ({operator_id}, unixepoch('now') - {WAKEUP_DELAY_SECS} - 1, \
+             {operator_id}, unixepoch('now'))"
+        ))
+        .execute(&mut conn)
+        .await
+        .unwrap();
+
+        assert!(
+            !is_active(&mut conn).await.unwrap(),
+            "a cancelled wake-up must not activate recovery even past the window"
+        );
+    }
+}
--- a/server/crates/arbiter-server/src/db/schema.rs
+++ b/server/crates/arbiter-server/src/db/schema.rs
@@ -17,6 +17,7 @@ diesel::table! {
        id -> Integer,
        root_key_id -> Nullable<Integer>,
        tls_id -> Nullable<Integer>,
+        shamir_threshold -> Nullable<Integer>,
    }
 }

@@ -135,6 +136,7 @@ diesel::table! {
        id -> Integer,
        wallet_id -> Integer,
        client_id -> Integer,
+        revoked_at -> Nullable<Integer>,
        created_at -> Integer,
    }
 }
--- a/server/crates/arbiter-server/src/evm/mod.rs
+++ b/server/crates/arbiter-server/src/evm/mod.rs
@@ -352,16 +352,17 @@ impl Engine {
 mod tests {
    use alloy::primitives::{Address, Bytes, U256, address};
    use chrono::{Duration, Utc};
-    use diesel::{SelectableHelper, insert_into};
+    use diesel::{ExpressionMethods as _, SelectableHelper, insert_into};
    use diesel_async::RunQueryDsl;
    use rstest::rstest;

    use crate::db::{
-        self, DatabaseConnection,
+        self, DatabaseConnection, models,
        models::{
            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
            SqliteTimestamp,
        },
+        schema,
        schema::{evm_basic_grant, evm_transaction_log},
    };
    use crate::evm::policies::{
@@ -380,6 +381,7 @@ mod tests {
                id: WALLET_ACCESS_ID,
                wallet_id: EvmWalletId::from_raw(5),
                client_id: 20,
+                revoked_at: None,
                created_at: SqliteTimestamp(Utc::now()),
            },
            chain: CHAIN_ID,
@@ -403,10 +405,85 @@ mod tests {
        }
    }

+    /// Creates the parent chain a fresh `evm_wallet_access` row needs under foreign-key
+    /// enforcement (a root key, an aead-encrypted secret, a wallet, and a client) and
+    /// returns the new access row's id.
+    async fn seed_wallet_access(conn: &mut DatabaseConnection) -> i32 {
+        let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
+            .values(&models::NewRootKeyHistory {
+                ciphertext: vec![0u8; 32],
+                tag: vec![0u8; 16],
+                root_key_encryption_nonce: vec![0u8; 24],
+                data_encryption_nonce: vec![0u8; 24],
+                schema_version: 1,
+                salt: vec![0u8; 16],
+            })
+            .returning(schema::root_key_history::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let aead_id: i32 = insert_into(schema::aead_encrypted::table)
+            .values(&models::NewAeadEncrypted {
+                ciphertext: vec![0u8; 32],
+                tag: vec![0u8; 16],
+                current_nonce: vec![0u8; 24],
+                schema_version: 1,
+                associated_root_key_id: root_key_id,
+                created_at: Utc::now().into(),
+            })
+            .returning(schema::aead_encrypted::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let wallet_id: EvmWalletId = insert_into(schema::evm_wallet::table)
+            .values((
+                schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
+                schema::evm_wallet::aead_encrypted_id.eq(aead_id),
+            ))
+            .returning(schema::evm_wallet::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let metadata_id: i32 = insert_into(schema::client_metadata::table)
+            .values(schema::client_metadata::name.eq("test"))
+            .returning(schema::client_metadata::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let client_id: i32 = insert_into(schema::program_client::table)
+            .values((
+                schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
+                schema::program_client::metadata_id.eq(metadata_id),
+            ))
+            .returning(schema::program_client::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        insert_into(schema::evm_wallet_access::table)
+            .values((
+                schema::evm_wallet_access::wallet_id.eq(wallet_id),
+                schema::evm_wallet_access::client_id.eq(client_id),
+            ))
+            .returning(schema::evm_wallet_access::id)
+            .get_result(conn)
+            .await
+            .unwrap()
+    }
+
    async fn insert_basic_grant(
        conn: &mut DatabaseConnection,
        shared: &SharedGrantSettings,
    ) -> EvmBasicGrant {
+        // The seeded id deliberately wins over `shared.wallet_access_id`: every other field
+        // below is read from `shared`, but a caller-supplied access id would almost never
+        // reference a row that actually exists under foreign-key enforcement.
+        let wallet_access_id = seed_wallet_access(conn).await;
+
        #[expect(
            clippy::cast_possible_truncation,
            clippy::cast_possible_wrap,
@@ -415,7 +492,7 @@ mod tests {
        )]
        insert_into(evm_basic_grant::table)
            .values(NewEvmBasicGrant {
-                wallet_access_id: shared.wallet_access_id,
+                wallet_access_id,
                chain_id: shared.chain.into(),
                valid_from: shared.valid_from.map(SqliteTimestamp),
                valid_until: shared.valid_until.map(SqliteTimestamp),
@@ -579,7 +656,7 @@ mod tests {
        insert_into(evm_transaction_log::table)
            .values(NewEvmTransactionLog {
                grant_id: basic_grant.id,
-                wallet_access_id: WALLET_ACCESS_ID,
+                wallet_access_id: basic_grant.wallet_access_id,
                chain_id: CHAIN_ID.into(),
                eth_value: super::utils::u256_to_bytes(U256::ZERO).to_vec(),
                signed_at: SqliteTimestamp(Utc::now()),
--- a/server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
+++ b/server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
@@ -1,11 +1,12 @@
 use super::{EtherTransfer, Settings};
 use crate::{
    db::{
-        self, DatabaseConnection,
+        self, DatabaseConnection, models,
        models::{
            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
            SqliteTimestamp,
        },
+        schema,
        schema::{evm_basic_grant, evm_transaction_log},
    },
    evm::{
@@ -19,7 +20,7 @@ use crate::{

 use alloy::primitives::{Address, Bytes, U256, address};
 use chrono::{Duration, Utc};
-use diesel::{SelectableHelper, insert_into};
+use diesel::{ExpressionMethods as _, SelectableHelper, insert_into};
 use diesel_async::RunQueryDsl;

 const WALLET_ACCESS_ID: i32 = 1;
@@ -34,6 +35,7 @@ fn ctx(to: Address, value: U256) -> EvalContext {
            id: WALLET_ACCESS_ID,
            wallet_id: EvmWalletId::from_raw(10),
            client_id: 20,
+            revoked_at: None,
            created_at: SqliteTimestamp(Utc::now()),
        },
        chain: CHAIN_ID,
@@ -45,10 +47,82 @@ fn ctx(to: Address, value: U256) -> EvalContext {
    }
 }

+/// Creates the parent chain a fresh `evm_wallet_access` row needs under foreign-key
+/// enforcement (a root key, an aead-encrypted secret, a wallet, and a client) and returns
+/// the new access row's id.
+async fn seed_wallet_access(conn: &mut DatabaseConnection) -> i32 {
+    let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
+        .values(&models::NewRootKeyHistory {
+            ciphertext: vec![0u8; 32],
+            tag: vec![0u8; 16],
+            root_key_encryption_nonce: vec![0u8; 24],
+            data_encryption_nonce: vec![0u8; 24],
+            schema_version: 1,
+            salt: vec![0u8; 16],
+        })
+        .returning(schema::root_key_history::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let aead_id: i32 = insert_into(schema::aead_encrypted::table)
+        .values(&models::NewAeadEncrypted {
+            ciphertext: vec![0u8; 32],
+            tag: vec![0u8; 16],
+            current_nonce: vec![0u8; 24],
+            schema_version: 1,
+            associated_root_key_id: root_key_id,
+            created_at: Utc::now().into(),
+        })
+        .returning(schema::aead_encrypted::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let wallet_id: EvmWalletId = insert_into(schema::evm_wallet::table)
+        .values((
+            schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
+            schema::evm_wallet::aead_encrypted_id.eq(aead_id),
+        ))
+        .returning(schema::evm_wallet::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let metadata_id: i32 = insert_into(schema::client_metadata::table)
+        .values(schema::client_metadata::name.eq("test"))
+        .returning(schema::client_metadata::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let client_id: i32 = insert_into(schema::program_client::table)
+        .values((
+            schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
+            schema::program_client::metadata_id.eq(metadata_id),
+        ))
+        .returning(schema::program_client::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    insert_into(schema::evm_wallet_access::table)
+        .values((
+            schema::evm_wallet_access::wallet_id.eq(wallet_id),
+            schema::evm_wallet_access::client_id.eq(client_id),
+        ))
+        .returning(schema::evm_wallet_access::id)
+        .get_result(conn)
+        .await
+        .unwrap()
+}
+
 async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicGrant {
+    let wallet_access_id = seed_wallet_access(conn).await;
+
    insert_into(evm_basic_grant::table)
        .values(NewEvmBasicGrant {
-            wallet_access_id: WALLET_ACCESS_ID,
+            wallet_access_id,
            chain_id: CHAIN_ID.into(),
            valid_from: None,
            valid_until: None,
@@ -161,7 +235,7 @@ async fn evaluate_passes_when_volume_within_limit() {
    insert_into(evm_transaction_log::table)
        .values(NewEvmTransactionLog {
            grant_id,
-            wallet_access_id: WALLET_ACCESS_ID,
+            wallet_access_id: basic.wallet_access_id,
            chain_id: CHAIN_ID.into(),
            eth_value: utils::u256_to_bytes(U256::from(500u64)).to_vec(),
            signed_at: SqliteTimestamp(Utc::now()),
@@ -203,7 +277,7 @@ async fn evaluate_rejects_volume_over_limit() {
    insert_into(evm_transaction_log::table)
        .values(NewEvmTransactionLog {
            grant_id,
-            wallet_access_id: WALLET_ACCESS_ID,
+            wallet_access_id: basic.wallet_access_id,
            chain_id: CHAIN_ID.into(),
            eth_value: utils::u256_to_bytes(U256::from(1_000u64)).to_vec(),
            signed_at: SqliteTimestamp(Utc::now()),
@@ -246,7 +320,7 @@ async fn evaluate_passes_at_exactly_volume_limit() {
    insert_into(evm_transaction_log::table)
        .values(NewEvmTransactionLog {
            grant_id,
-            wallet_access_id: WALLET_ACCESS_ID,
+            wallet_access_id: basic.wallet_access_id,
            chain_id: CHAIN_ID.into(),
            eth_value: utils::u256_to_bytes(U256::from(900u64)).to_vec(),
            signed_at: SqliteTimestamp(Utc::now()),
--- a/server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
+++ b/server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
@@ -1,8 +1,9 @@
 use super::{Settings, TokenTransfer};
 use crate::{
    db::{
-        self, DatabaseConnection,
+        self, DatabaseConnection, models,
        models::{EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, SqliteTimestamp},
+        schema,
        schema::evm_basic_grant,
    },
    evm::{
@@ -20,7 +21,7 @@ use alloy::{
    sol_types::SolCall,
 };
 use chrono::{Duration, Utc};
-use diesel::{SelectableHelper, insert_into};
+use diesel::{ExpressionMethods as _, SelectableHelper, insert_into};
 use diesel_async::RunQueryDsl;

 // DAI on Ethereum mainnet — present in the static token registry
@@ -47,6 +48,7 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
            id: WALLET_ACCESS_ID,
            wallet_id: EvmWalletId::from_raw(10),
            client_id: 20,
+            revoked_at: None,
            created_at: SqliteTimestamp(Utc::now()),
        },
        chain: CHAIN_ID,
@@ -58,10 +60,82 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
    }
 }

+/// Creates the parent chain a fresh `evm_wallet_access` row needs under foreign-key
+/// enforcement (a root key, an aead-encrypted secret, a wallet, and a client) and returns
+/// the new access row's id.
+async fn seed_wallet_access(conn: &mut DatabaseConnection) -> i32 {
+    let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
+        .values(&models::NewRootKeyHistory {
+            ciphertext: vec![0u8; 32],
+            tag: vec![0u8; 16],
+            root_key_encryption_nonce: vec![0u8; 24],
+            data_encryption_nonce: vec![0u8; 24],
+            schema_version: 1,
+            salt: vec![0u8; 16],
+        })
+        .returning(schema::root_key_history::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let aead_id: i32 = insert_into(schema::aead_encrypted::table)
+        .values(&models::NewAeadEncrypted {
+            ciphertext: vec![0u8; 32],
+            tag: vec![0u8; 16],
+            current_nonce: vec![0u8; 24],
+            schema_version: 1,
+            associated_root_key_id: root_key_id,
+            created_at: Utc::now().into(),
+        })
+        .returning(schema::aead_encrypted::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let wallet_id: EvmWalletId = insert_into(schema::evm_wallet::table)
+        .values((
+            schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
+            schema::evm_wallet::aead_encrypted_id.eq(aead_id),
+        ))
+        .returning(schema::evm_wallet::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let metadata_id: i32 = insert_into(schema::client_metadata::table)
+        .values(schema::client_metadata::name.eq("test"))
+        .returning(schema::client_metadata::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let client_id: i32 = insert_into(schema::program_client::table)
+        .values((
+            schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
+            schema::program_client::metadata_id.eq(metadata_id),
+        ))
+        .returning(schema::program_client::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    insert_into(schema::evm_wallet_access::table)
+        .values((
+            schema::evm_wallet_access::wallet_id.eq(wallet_id),
+            schema::evm_wallet_access::client_id.eq(client_id),
+        ))
+        .returning(schema::evm_wallet_access::id)
+        .get_result(conn)
+        .await
+        .unwrap()
+}
+
 async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicGrant {
+    let wallet_access_id = seed_wallet_access(conn).await;
+
    insert_into(evm_basic_grant::table)
        .values(NewEvmBasicGrant {
-            wallet_access_id: WALLET_ACCESS_ID,
+            wallet_access_id,
            chain_id: CHAIN_ID.into(),
            valid_from: None,
            valid_until: None,
@@ -77,6 +151,27 @@ async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicG
        .unwrap()
 }

+/// `evm_token_transfer_log.log_id` references the shared `evm_transaction_log` table, so
+/// tests recording a token transfer need a real row there to point at.
+async fn insert_transaction_log(
+    conn: &mut DatabaseConnection,
+    basic: &EvmBasicGrant,
+    eth_value: U256,
+) -> i32 {
+    insert_into(schema::evm_transaction_log::table)
+        .values(models::NewEvmTransactionLog {
+            grant_id: basic.id,
+            wallet_access_id: basic.wallet_access_id,
+            chain_id: CHAIN_ID.into(),
+            eth_value: utils::u256_to_bytes(eth_value).to_vec(),
+            signed_at: SqliteTimestamp(Utc::now()),
+        })
+        .returning(schema::evm_transaction_log::id)
+        .get_result(conn)
+        .await
+        .unwrap()
+}
+
 fn make_settings(target: Option<Address>, max_volume: Option<u64>) -> Settings {
    Settings {
        token_contract: DAI,
@@ -241,10 +336,11 @@ async fn evaluate_passes_volume_at_exact_limit() {
        .unwrap();

    // Record a past transfer of 900, with current transfer 100 => exactly 1000 limit
-    insert_into(db::schema::evm_token_transfer_log::table)
-        .values(db::models::NewEvmTokenTransferLog {
+    let log_id = insert_transaction_log(&mut conn, &basic, U256::from(900u64)).await;
+    insert_into(schema::evm_token_transfer_log::table)
+        .values(models::NewEvmTokenTransferLog {
            grant_id,
-            log_id: 0,
+            log_id,
            chain_id: CHAIN_ID.into(),
            token_contract: DAI.to_vec(),
            recipient_address: RECIPIENT.to_vec(),
@@ -285,10 +381,11 @@ async fn evaluate_rejects_volume_over_limit() {
        .await
        .unwrap();

-    insert_into(db::schema::evm_token_transfer_log::table)
-        .values(db::models::NewEvmTokenTransferLog {
+    let log_id = insert_transaction_log(&mut conn, &basic, U256::from(1_000u64)).await;
+    insert_into(schema::evm_token_transfer_log::table)
+        .values(models::NewEvmTokenTransferLog {
            grant_id,
-            log_id: 0,
+            log_id,
            chain_id: CHAIN_ID.into(),
            token_contract: DAI.to_vec(),
            recipient_address: RECIPIENT.to_vec(),
--- a/server/crates/arbiter-server/src/grpc/operator.rs
+++ b/server/crates/arbiter-server/src/grpc/operator.rs
@@ -129,14 +129,23 @@ pub async fn start(
    let (oob_sender, oob_receiver) = mpsc::channel(16);
    let oob_adapter = OutOfBandAdapter(oob_sender);

-    let actor = {
+    let started = {
        let transport = auth::AuthTransportAdapter::new(&mut bi, &mut request_tracker);
-        match crate::peers::operator::start(&mut conn, transport, Box::new(oob_adapter)).await {
-            Ok(actor) => actor,
-            Err(e) => {
-                warn!(error = ?e, "Operator connection failed");
-                return;
-            }
+        crate::peers::operator::start(&mut conn, transport, Box::new(oob_adapter)).await
+    };
+
+    let actor = match started {
+        Ok(actor) => actor,
+        // §3.5: a recovery operator is turned away from the session rather than failing. Say so
+        // on the stream, so it does not look like the server dropped the connection.
+        Err(e @ crate::peers::operator::Error::RecoveryOperatorHasNoSession) => {
+            info!("Recovery operator connection closed after the vault gate");
+            let _ = bi.send(Err(Status::permission_denied(e.to_string()))).await;
+            return;
+        }
+        Err(e) => {
+            warn!(error = ?e, "Operator connection failed");
+            return;
        }
    };

--- a/server/crates/arbiter-server/src/grpc/operator/vault.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault.rs
@@ -2,9 +2,12 @@ use crate::{
    actors::vault::VaultState,
    peers::operator::{
        OperatorSession,
-        session::handlers::{
-            HandleContributeRecoveryRekeyPassphrase, HandleContributeRekeyPassphrase,
-            HandleQueryVaultState,
+        session::{
+            Error as SessionError,
+            handlers::{
+                HandleContributeRecoveryRekeyPassphrase, HandleContributeRekeyPassphrase,
+                HandleQueryVaultState,
+            },
        },
    },
 };
@@ -21,7 +24,7 @@ use arbiter_proto::{
    proto::shared::VaultState as ProtoVaultState,
 };

-use kameo::actor::ActorRef;
+use kameo::{actor::ActorRef, error::SendError};
 use tonic::Status;
 use tracing::warn;

@@ -50,6 +53,20 @@ pub(super) async fn dispatch(
    }
 }

+/// A re-key share belongs to exactly one role (§3.3), so a contribution from the wrong one is a
+/// policy answer and must not reach the peer as an opaque `internal`.
+fn rekey_status<M>(err: SendError<M, SessionError>, context: &'static str) -> Status {
+    match err {
+        SendError::HandlerError(err @ SessionError::RoleNotPermitted) => {
+            Status::permission_denied(err.to_string())
+        }
+        err => {
+            warn!(?err, "{context}");
+            Status::internal(context)
+        }
+    }
+}
+
 async fn handle_rekey(
    actor: &ActorRef<OperatorSession>,
    req: proto_rekey::Request,
@@ -66,20 +83,13 @@ async fn handle_rekey(
                passphrase: cp.passphrase,
            })
            .await
-            .map_err(|e| {
-                warn!(?e, "rekey passphrase contribution failed");
-                Status::internal("Rekey contribution failed")
-            })?,
+            .map_err(|e| rekey_status(e, "Rekey contribution failed"))?,
        RekeyPayload::ContributeRecoveryPassphrase(crp) => actor
            .ask(HandleContributeRecoveryRekeyPassphrase {
-                recovery_operator_id: crp.recovery_operator_id,
                passphrase: crp.passphrase,
            })
            .await
-            .map_err(|e| {
-                warn!(?e, "rekey recovery passphrase contribution failed");
-                Status::internal("Rekey recovery contribution failed")
-            })?,
+            .map_err(|e| rekey_status(e, "Rekey recovery contribution failed"))?,
    };

    let proto_result = if done {
--- a/server/crates/arbiter-server/src/grpc/operator/vault_gate/inbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault_gate/inbound.rs
@@ -89,7 +89,6 @@ impl TryConvert for UnsealRequestPayload {
            Self::ContributeRecoveryPassphrase(crp) => Ok(
                vault_gate::Inbound::HandleContributeRecoveryUnsealPassphrase(
                    HandleContributeRecoveryUnsealPassphrase {
-                        recovery_operator_id: crp.recovery_operator_id,
                        passphrase: crp.passphrase,
                    },
                ),
@@ -157,7 +156,6 @@ impl TryConvert for BootstrapRequestPayload {
            Self::ContributeRecoveryPassphrase(crp) => Ok(
                vault_gate::Inbound::HandleContributeRecoveryBootstrapPassphrase(
                    HandleContributeRecoveryBootstrapPassphrase {
-                        recovery_operator_id: crp.recovery_operator_id,
                        passphrase: crp.passphrase,
                    },
                ),
--- a/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
@@ -103,6 +103,9 @@ impl TryConvert for vault_gate::Outbound {
                    Err(vault_gate::Error::AlreadyBootstrapped) => {
                        ProtoBootstrapResult::AlreadyBootstrapped
                    }
+                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
+                        return Err(Status::permission_denied(err.to_string()));
+                    }
                    Err(err) => {
                        warn!(?err, "bootstrap failed");
                        return Err(Status::internal("Failed to bootstrap vault"));
@@ -113,6 +116,11 @@ impl TryConvert for vault_gate::Outbound {
            Self::HandleDeclareCommittee(result) => {
                let proto_result = match result {
                    Ok(()) => ProtoBootstrapResult::Success,
+                    // A role refusal is a policy answer, not a server fault, so it leaves the
+                    // gate as `PERMISSION_DENIED` rather than as an opaque `internal`.
+                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
+                        return Err(Status::permission_denied(err.to_string()));
+                    }
                    Err(err) => {
                        warn!(?err, "declare committee failed");
                        return Err(Status::internal("Failed to declare committee"));
@@ -124,6 +132,9 @@ impl TryConvert for vault_gate::Outbound {
                let proto_result = match result {
                    Ok(true) => ProtoBootstrapResult::Success,
                    Ok(false) => ProtoBootstrapResult::AwaitingContributions,
+                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
+                        return Err(Status::permission_denied(err.to_string()));
+                    }
                    Err(err) => {
                        warn!(?err, "contribute bootstrap passphrase failed");
                        return Err(Status::internal("Failed to contribute bootstrap passphrase"));
@@ -135,6 +146,9 @@ impl TryConvert for vault_gate::Outbound {
                let proto_result = match result {
                    Ok(true) => ProtoBootstrapResult::Success,
                    Ok(false) => ProtoBootstrapResult::AwaitingContributions,
+                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
+                        return Err(Status::permission_denied(err.to_string()));
+                    }
                    Err(err) => {
                        warn!(?err, "contribute recovery bootstrap passphrase failed");
                        return Err(Status::internal(
@@ -148,6 +162,9 @@ impl TryConvert for vault_gate::Outbound {
                let proto_result = match result {
                    Ok(true) => ProtoUnsealResult::Success,
                    Ok(false) => ProtoUnsealResult::AwaitingContributions,
+                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
+                        return Err(Status::permission_denied(err.to_string()));
+                    }
                    Err(err) => {
                        warn!(?err, "contribute unseal passphrase failed");
                        return Err(Status::internal("Failed to contribute unseal passphrase"));
@@ -161,6 +178,9 @@ impl TryConvert for vault_gate::Outbound {
                let proto_result = match result {
                    Ok(true) => ProtoUnsealResult::Success,
                    Ok(false) => ProtoUnsealResult::AwaitingContributions,
+                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
+                        return Err(Status::permission_denied(err.to_string()));
+                    }
                    Err(err) => {
                        warn!(?err, "contribute recovery unseal passphrase failed");
                        return Err(Status::internal(
--- a/server/crates/arbiter-server/src/peers/operator/auth/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/mod.rs
@@ -1,4 +1,4 @@
-use super::{Credentials, OperatorConnection};
+use super::{AuthenticatedOperator, OperatorConnection};
 use arbiter_crypto::authn::{self, AuthChallenge};
 use arbiter_proto::transport::Bi;

@@ -71,7 +71,7 @@ fn parse_auth_event(payload: Inbound) -> AuthEvents {
 pub async fn authenticate<T>(
    props: &mut OperatorConnection,
    transport: &mut T,
-) -> Result<Credentials, Error>
+) -> Result<AuthenticatedOperator, Error>
 where
    T: Bi<Inbound, Result<Outbound, Error>> + Send + ?Sized,
 {
--- a/server/crates/arbiter-server/src/peers/operator/auth/state.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/state.rs
@@ -1,17 +1,20 @@
 use super::{
-    super::{Credentials, OperatorConnection},
+    super::{AuthenticatedOperator, Credentials, OperatorConnection, RecoveryCredentials},
    Error,
 };
 use crate::{
-    actors::bootstrap::ConsumeToken,
-    db::{DatabasePool, schema::operator_identity},
+    actors::bootstrap::VerifyToken,
+    db::{
+        DatabasePool,
+        schema::{arbiter_settings, operator_identity, recovery_operator_identity},
+    },
    peers::operator::auth::Outbound,
 };
 use arbiter_crypto::authn::{self, AuthChallenge, SigningContext};
 use arbiter_proto::transport::Bi;

 use diesel::{ExpressionMethods as _, OptionalExtension as _, QueryDsl};
-use diesel_async::RunQueryDsl;
+use diesel_async::{AsyncConnection as _, RunQueryDsl};
 use tracing::error;

 pub(crate) struct ChallengeRequest {
@@ -34,7 +37,7 @@ smlang::statemachine!(
    custom_error: true,
    transitions: {
        *Init + AuthRequest(ChallengeRequest) / async prepare_challenge = SentChallenge(ChallengeContext),
-        SentChallenge(ChallengeContext) + ReceivedSolution(ChallengeSolution) / async verify_solution = AuthOk(Credentials),
+        SentChallenge(ChallengeContext) + ReceivedSolution(ChallengeSolution) / async verify_solution = AuthOk(AuthenticatedOperator),
    }
 );

@@ -56,6 +59,27 @@ async fn get_client_id(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<O
        })
 }

+async fn get_recovery_operator_id(
+    db: &DatabasePool,
+    pubkey: &authn::PublicKey,
+) -> Result<Option<i32>, Error> {
+    let mut conn = db.get().await.map_err(|e| {
+        error!(error = ?e, "Database pool error");
+        Error::internal("Database unavailable")
+    })?;
+
+    recovery_operator_identity::table
+        .filter(recovery_operator_identity::public_key.eq(pubkey.to_bytes()))
+        .select(recovery_operator_identity::id)
+        .first::<i32>(&mut conn)
+        .await
+        .optional()
+        .map_err(|e| {
+            error!(error = ?e, "Database error");
+            Error::internal("Database operation failed")
+        })
+}
+
 async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i32, Error> {
    let pubkey_bytes = pubkey.to_bytes();
    let mut conn = db.get().await.map_err(|e| {
@@ -63,17 +87,32 @@ async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i3
        Error::internal("Database unavailable")
    })?;

-    let id: i32 = diesel::insert_into(operator_identity::table)
-        .values((operator_identity::public_key.eq(pubkey_bytes),))
-        .returning(operator_identity::id)
-        .get_result(&mut conn)
-        .await
-        .map_err(|e| {
-            error!(error = ?e, "Database error");
-            Error::internal("Database operation failed")
-        })?;
+    conn.transaction(async move |conn| {
+        // The database is authoritative on whether bootstrap has completed: `Vault::bootstrap`
+        // commits `root_key_id` before it publishes `events::Bootstrapped`, and `Bootstrapper`
+        // only learns of that two mailbox hops later. Re-checking it here, in the same
+        // transaction as the insert, closes that window deterministically instead of trusting
+        // a token that verified against `Bootstrapper`'s possibly-stale in-memory state.
+        let already_bootstrapped: bool = arbiter_settings::table
+            .select(arbiter_settings::root_key_id)
+            .first::<Option<i32>>(&mut *conn)
+            .await?
+            .is_some();

-    Ok(id)
+        if already_bootstrapped {
+            error!("Bootstrap token used to register after the vault was already bootstrapped");
+            return Err(Error::InvalidBootstrapToken);
+        }
+
+        let id: i32 = diesel::insert_into(operator_identity::table)
+            .values((operator_identity::public_key.eq(pubkey_bytes),))
+            .returning(operator_identity::id)
+            .get_result(&mut *conn)
+            .await?;
+
+        Ok(id)
+    })
+    .await
 }

 pub(super) struct AuthContext<'a, T: ?Sized> {
@@ -100,12 +139,14 @@ where
            bootstrap_token,
        }: ChallengeRequest,
    ) -> Result<ChallengeContext, Self::Error> {
-        // Verify pubkey is registered (unless bootstrapping)
-        if bootstrap_token.is_none() {
-            let id = get_client_id(&self.conn.db, &pubkey).await?;
-            if id.is_none() {
-                return Err(Error::UnregisteredPublicKey);
-            }
+        // Verify pubkey is registered in either identity table (unless bootstrapping)
+        if bootstrap_token.is_none()
+            && get_client_id(&self.conn.db, &pubkey).await?.is_none()
+            && get_recovery_operator_id(&self.conn.db, &pubkey)
+                .await?
+                .is_none()
+        {
+            return Err(Error::UnregisteredPublicKey);
        }

        let challenge = AuthChallenge::generate(&mut rand::rng());
@@ -135,7 +176,7 @@ where
            bootstrap_token,
        }: &ChallengeContext,
        ChallengeSolution { solution }: ChallengeSolution,
-    ) -> Result<Credentials, Self::Error> {
+    ) -> Result<AuthenticatedOperator, Self::Error> {
        let signature = authn::Signature::try_from(solution.as_slice()).map_err(|()| {
            error!("Failed to decode signature in challenge solution");
            Error::InvalidChallengeSolution
@@ -151,20 +192,21 @@ where
            return Err(Error::InvalidChallengeSolution);
        }

-        // Resolve client id: bootstrap (consume token + register) or lookup
-        let id = match bootstrap_token {
+        // Resolve the peer's role: bootstrap (verify token, then register as an ordinary
+        // operator) or look the key up in whichever identity table holds it.
+        let authenticated = match bootstrap_token {
            Some(token) => {
                let token_ok: bool = self
                    .conn
                    .actors
                    .bootstrapper
-                    .ask(ConsumeToken {
+                    .ask(VerifyToken {
                        token: token.clone(),
                    })
                    .await
                    .map_err(|e| {
-                        error!(?e, "Failed to consume bootstrap token");
-                        Error::internal("Failed to consume bootstrap token")
+                        error!(?e, "Failed to verify bootstrap token");
+                        Error::internal("Failed to verify bootstrap token")
                    })?;

                if !token_ok {
@@ -176,11 +218,59 @@ where
                    return Err(Error::InvalidBootstrapToken);
                }

-                register_key(&self.conn.db, pubkey).await?
+                let id = match register_key(&self.conn.db, pubkey).await {
+                    Ok(id) => id,
+                    // `register_key` refuses a token that verified here but lost the race
+                    // against bootstrap. Reported to the peer exactly like the refusal above,
+                    // so that operator sees a protocol error rather than a handshake that
+                    // stops with nothing on the wire.
+                    Err(Error::InvalidBootstrapToken) => {
+                        self.transport
+                            .send(Err(Error::InvalidBootstrapToken))
+                            .await
+                            .map_err(|_| Error::Transport)?;
+                        return Err(Error::InvalidBootstrapToken);
+                    }
+                    Err(err) => return Err(err),
+                };
+
+                AuthenticatedOperator::Ordinary(Credentials {
+                    id,
+                    pubkey: pubkey.clone(),
+                })
+            }
+            None => {
+                // The tables are searched in this order, so a key registered in both resolves
+                // as `Ordinary` and could never submit its recovery share. Nothing enforces
+                // that the two sets are disjoint: `unique` is per table, and the only writer
+                // today is `register_key` above -- `recovery_operator_identity` has no
+                // registration path yet. Whoever builds one must refuse a key that
+                // `operator_identity` already holds, and vice versa, or §3.5's "separate peer
+                // type" holds only by convention.
+                if let Some(id) = get_client_id(&self.conn.db, pubkey).await? {
+                    AuthenticatedOperator::Ordinary(Credentials {
+                        id,
+                        pubkey: pubkey.clone(),
+                    })
+                } else {
+                    // `prepare_challenge` already found the key in one of the tables, so
+                    // arriving here means it was removed mid-handshake. Reported to the peer
+                    // for the same reason `InvalidBootstrapToken` is above: an operator that
+                    // has sent its solution sees a protocol error rather than a handshake that
+                    // stops with nothing on the wire.
+                    let Some(id) = get_recovery_operator_id(&self.conn.db, pubkey).await? else {
+                        self.transport
+                            .send(Err(Error::UnregisteredPublicKey))
+                            .await
+                            .map_err(|_| Error::Transport)?;
+                        return Err(Error::UnregisteredPublicKey);
+                    };
+                    AuthenticatedOperator::Recovery(RecoveryCredentials {
+                        id,
+                        pubkey: pubkey.clone(),
+                    })
+                }
            }
-            None => get_client_id(&self.conn.db, pubkey)
-                .await?
-                .ok_or(Error::UnregisteredPublicKey)?,
        };

        self.transport
@@ -188,9 +278,6 @@ where
            .await
            .map_err(|_| Error::Transport)?;

-        Ok(Credentials {
-            id,
-            pubkey: pubkey.clone(),
-        })
+        Ok(authenticated)
    }
 }
--- a/server/crates/arbiter-server/src/peers/operator/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/mod.rs
@@ -33,6 +33,26 @@ impl Integrable for Credentials {
    const KIND: &'static str = "operator_credentials";
 }

+/// §3.5: recovery operators are a separate peer type with their own identity table. Their
+/// attestation kind differs from an ordinary operator's so the two id spaces cannot collide.
+#[derive(Debug, Clone, Hashable)]
+pub struct RecoveryCredentials {
+    pub id: i32,
+    pub pubkey: authn::PublicKey,
+}
+
+impl Integrable for RecoveryCredentials {
+    const KIND: &'static str = "recovery_operator_credentials";
+}
+
+/// The outcome of an operator handshake. The variant, not a field, decides what the peer may
+/// do — so no call site can pass an unauthenticated recovery id.
+#[derive(Debug, Clone)]
+pub enum AuthenticatedOperator {
+    Ordinary(Credentials),
+    Recovery(RecoveryCredentials),
+}
+
 // Messages, sent by operator to connection client without having a request
 #[derive(Debug)]
 pub enum OutOfBand {
@@ -62,6 +82,12 @@ pub enum Error {
    Transport,
    #[error("database error: {0}")]
    Database(DatabaseError),
+    /// §3.5: a recovery operator's authority stops at the vault gate. It has no operator
+    /// session, because a session is the whole ordinary-governance surface -- wallets, grants,
+    /// SDK clients, proposals -- which §3.5 puts out of a recovery operator's reach. Named
+    /// rather than folded into `Internal`, so a policy refusal is not logged as a fault.
+    #[error("recovery operators do not have an operator session")]
+    RecoveryOperatorHasNoSession,
    #[error("internal: {0}")]
    Internal(String),
 }
@@ -108,7 +134,7 @@ async fn should_run_gate(vault: &ActorRef<Vault>) -> Result<bool, Error> {
 async fn run_vault_gate<T>(
    props: &OperatorConnection,
    transport: &mut T,
-    auth_creds: Credentials,
+    auth_creds: AuthenticatedOperator,
 ) -> Result<(), Error>
 where
    T: Bi<vault_gate::Inbound, Result<vault_gate::Outbound, vault_gate::Error>> + Send + ?Sized,
@@ -168,19 +194,27 @@ where
    T: Bi<auth::Inbound, Result<auth::Outbound, auth::Error>> + Send,
    T: Bi<vault_gate::Inbound, Result<vault_gate::Outbound, vault_gate::Error>> + Send,
 {
-    let creds = authenticate(props, &mut transport).await?;
+    let authenticated = authenticate(props, &mut transport).await?;

    // should run vault gate only if sealed / unbootstrapped
    if should_run_gate(&props.actors.vault).await? {
-        run_vault_gate(props, &mut transport, creds.clone()).await?;
+        // §3.5 lets a recovery operator take part in unsealing, and the gate is where that
+        // happens, so both roles run it. The gate decides per message which role may send it.
+        run_vault_gate(props, &mut transport, authenticated.clone()).await?;
    }

+    // Past the gate the connection turns into an ordinary operator session, which a recovery
+    // operator may not have.
+    let AuthenticatedOperator::Ordinary(creds) = &authenticated else {
+        return Err(Error::RecoveryOperatorHasNoSession);
+    };
+
    // checking the integrity
-    verify_integrity(&props.db, &props.actors.vault, &creds).await?;
+    verify_integrity(&props.db, &props.actors.vault, creds).await?;

    Ok(OperatorSession::spawn(OperatorSession::new(
        props.clone(),
-        creds.clone(),
+        authenticated.clone(),
        oob_sender,
    )))
 }
--- a/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
@@ -177,41 +177,27 @@ impl OperatorSession {
        entries: Vec<NewEvmWalletAccess>,
    ) -> Result<(), Error> {
        let mut conn = self.props.db.get().await?;
-        conn.transaction(async |conn| {
-            use crate::db::schema::evm_wallet_access;
-
-            for entry in entries {
-                diesel::insert_into(evm_wallet_access::table)
-                    .values(&entry)
-                    .on_conflict_do_nothing()
-                    .execute(&mut *conn)
-                    .await?;
-            }
-
-            Result::<_, Error>::Ok(())
-        })
-        .await?;
+        grant_wallet_access(&mut conn, entries).await?;
        Ok(())
    }

+    /// A revoke that matched fewer rows than it named did not do what the operator asked:
+    /// the id was never granted, or someone revoked it first. Answering `Ok` there tells the
+    /// operator access is cut off when nothing changed. The rows that did match stay revoked
+    /// -- rolling them back to report the shortfall would leave live access behind.
    #[message]
    pub(crate) async fn handle_revoke_evm_wallet_access(
        &mut self,
        entries: Vec<i32>,
    ) -> Result<(), Error> {
        let mut conn = self.props.db.get().await?;
-        conn.transaction(async |conn| {
-            use crate::db::schema::evm_wallet_access;
-            for entry in entries {
-                diesel::delete(evm_wallet_access::table)
-                    .filter(evm_wallet_access::wallet_id.eq(entry))
-                    .execute(&mut *conn)
-                    .await?;
-            }
-
-            Result::<_, Error>::Ok(())
-        })
-        .await?;
+        let revoked = revoke_wallet_access(&mut conn, &entries).await?;
+        if revoked != entries.len() {
+            return Err(Error::PartialRevoke {
+                requested: entries.len(),
+                revoked,
+            });
+        }
        Ok(())
    }

@@ -222,6 +208,7 @@ impl OperatorSession {
        use crate::db::schema::evm_wallet_access;
        let mut conn = self.props.db.get().await?;
        let access_entries = evm_wallet_access::table
+            .filter(evm_wallet_access::revoked_at.is_null())
            .select(EvmWalletAccess::as_select())
            .load::<_>(&mut conn)
            .await?;
@@ -229,6 +216,81 @@ impl OperatorSession {
    }
 }

+/// Grants access, reviving a previously revoked row rather than leaving it shadowed:
+/// `uniq_wallet_access` is a unique index on `(wallet_id, client_id)`, so a plain insert
+/// would conflict forever on a row that was revoked but never deleted.
+///
+/// Reviving restores visibility and nothing else: [`revoke_wallet_access`] closes the grants
+/// that hung off the access, so a persistent grant takes its own vote again (§3.2).
+pub(crate) async fn grant_wallet_access(
+    conn: &mut crate::db::DatabaseConnection,
+    entries: Vec<NewEvmWalletAccess>,
+) -> Result<(), diesel::result::Error> {
+    use crate::db::{models::SqliteTimestamp, schema::evm_wallet_access};
+
+    conn.transaction(async |conn| {
+        for entry in entries {
+            diesel::insert_into(evm_wallet_access::table)
+                .values(&entry)
+                .on_conflict((evm_wallet_access::wallet_id, evm_wallet_access::client_id))
+                .do_update()
+                .set(evm_wallet_access::revoked_at.eq(None::<SqliteTimestamp>))
+                .execute(&mut *conn)
+                .await?;
+        }
+
+        Ok(())
+    })
+    .await
+}
+
+/// Marks access rows revoked by their own id rather than deleting them, and revokes every
+/// grant that hangs off them. Returns how many access rows this call revoked.
+///
+/// The wire carries `WalletAccessEntry.id` values, so filtering by `wallet_id` here would
+/// revoke every client's access to that wallet. Deleting is not an option: `evm_basic_grant`,
+/// `evm_transaction_log`, and `proposal_persistent_grant` all reference this row
+/// `on delete restrict`, so an access that was ever granted, signed with, or proposed
+/// against can never be deleted -- only marked revoked.
+///
+/// The dependent grants have to go with it. `grant_wallet_access` revives a revoked row by
+/// its id, and grant lookup keys on `wallet_access_id` alone, so leaving the grants live
+/// would make a later re-grant restore every persistent grant the access ever held, with its
+/// original volume and rate limits. §3.2 votes visibility and a persistent grant separately;
+/// a committee that approves visibility must not silently hand back signing authority it did
+/// not vote on. The filter names every requested id, not just the rows this call flipped, so
+/// an access revoked before this fix has its orphaned grants closed too.
+pub(crate) async fn revoke_wallet_access(
+    conn: &mut crate::db::DatabaseConnection,
+    ids: &[i32],
+) -> Result<usize, diesel::result::Error> {
+    use crate::db::{
+        models::SqliteTimestamp,
+        schema::{evm_basic_grant, evm_wallet_access},
+    };
+
+    conn.transaction(async |conn| {
+        let now = SqliteTimestamp::now();
+
+        let revoked = diesel::update(evm_wallet_access::table)
+            .filter(evm_wallet_access::id.eq_any(ids))
+            .filter(evm_wallet_access::revoked_at.is_null())
+            .set(evm_wallet_access::revoked_at.eq(now.clone()))
+            .execute(&mut *conn)
+            .await?;
+
+        diesel::update(evm_basic_grant::table)
+            .filter(evm_basic_grant::wallet_access_id.eq_any(ids))
+            .filter(evm_basic_grant::revoked_at.is_null())
+            .set(evm_basic_grant::revoked_at.eq(now))
+            .execute(&mut *conn)
+            .await?;
+
+        Ok(revoked)
+    })
+    .await
+}
+
 #[messages]
 impl OperatorSession {
    #[message(ctx)]
@@ -290,7 +352,7 @@ impl OperatorSession {
        ttl_secs: Option<u32>,
    ) -> Result<ProposalId, Error> {
        use crate::actors::proposal_manager::CreateProposal;
-        let initiator_id = OperatorIdentityId::from_raw(self.credentials.id);
+        let initiator_id = OperatorIdentityId::from_raw(self.ordinary_id()?);
        self.props
            .actors
            .proposal_manager
@@ -310,7 +372,10 @@ impl OperatorSession {
        signature: Vec<u8>,
    ) -> Result<crate::actors::proposal_manager::VoteOutcome, crate::actors::proposal_manager::Error> {
        use crate::actors::proposal_manager::CastVote;
-        let operator_id = OperatorIdentityId::from_raw(self.credentials.id);
+        let operator_id = OperatorIdentityId::from_raw(
+            self.ordinary_id()
+                .map_err(|_| crate::actors::proposal_manager::Error::NotAllowedForRecoveryOperator)?,
+        );
        self.props
            .actors
            .proposal_manager
@@ -327,7 +392,11 @@ impl OperatorSession {
        &mut self,
    ) -> Vec<crate::actors::proposal_manager::ProposalSummary> {
        use crate::actors::proposal_manager::QueryPending;
-        let operator_id = OperatorIdentityId::from_raw(self.credentials.id);
+        let Ok(id) = self.ordinary_id() else {
+            // The pending list is per ordinary operator; a recovery operator has no view of it.
+            return Vec::new();
+        };
+        let operator_id = OperatorIdentityId::from_raw(id);
        self.props
            .actors
            .proposal_manager
@@ -347,7 +416,7 @@ impl OperatorSession {
        use crate::actors::vault_coordinator::ContributeRekey;
        use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};

-        let operator_id = self.credentials.id;
+        let operator_id = self.ordinary_id()?;
        self.props
            .actors
            .vault_coordinator
@@ -359,15 +428,23 @@ impl OperatorSession {
            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
    }

+    /// §3.3: a re-key refreshes every share, recovery shares included, so a recovery operator
+    /// has one to contribute here.
+    ///
+    /// It cannot reach this handler yet: `peers::operator::start` refuses a recovery peer an
+    /// operator session, because a session carries the whole ordinary-governance surface that
+    /// §3.5 keeps out of a recovery operator's hands. Until a recovery-scoped session exists,
+    /// this refuses every caller -- which is the safe direction, and the id it would use comes
+    /// from the handshake either way.
    #[message]
    pub(crate) async fn handle_contribute_recovery_rekey_passphrase(
        &mut self,
-        recovery_operator_id: i32,
        passphrase: Vec<u8>,
    ) -> Result<bool, Error> {
        use crate::actors::vault_coordinator::ContributeRecoveryRekey;
        use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};

+        let recovery_operator_id = self.recovery_id()?;
        self.props
            .actors
            .vault_coordinator
@@ -379,3 +456,476 @@ impl OperatorSession {
            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{grant_wallet_access, revoke_wallet_access};
+    use crate::db::{self, models, schema};
+
+    use diesel::{ExpressionMethods as _, QueryDsl as _, dsl::insert_into};
+    use diesel_async::RunQueryDsl;
+
+    /// Inserts a fresh root key, an aead-encrypted wallet secret, and the wallet itself.
+    /// Returns the wallet's id and its 20-byte address.
+    async fn seed_wallet(conn: &mut db::DatabaseConnection) -> (models::EvmWalletId, Vec<u8>) {
+        let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
+            .values(&models::NewRootKeyHistory {
+                ciphertext: vec![0u8; 32],
+                tag: vec![0u8; 16],
+                root_key_encryption_nonce: vec![0u8; 24],
+                data_encryption_nonce: vec![0u8; 24],
+                schema_version: 1,
+                salt: vec![0u8; 16],
+            })
+            .returning(schema::root_key_history::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let aead_id: i32 = insert_into(schema::aead_encrypted::table)
+            .values(&models::NewAeadEncrypted {
+                ciphertext: vec![0u8; 32],
+                tag: vec![0u8; 16],
+                current_nonce: vec![0u8; 24],
+                schema_version: 1,
+                associated_root_key_id: root_key_id,
+                created_at: chrono::Utc::now().into(),
+            })
+            .returning(schema::aead_encrypted::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let address = rand::random::<[u8; 20]>().to_vec();
+        let wallet_id: models::EvmWalletId = insert_into(schema::evm_wallet::table)
+            .values((
+                schema::evm_wallet::address.eq(address.clone()),
+                schema::evm_wallet::aead_encrypted_id.eq(aead_id),
+            ))
+            .returning(schema::evm_wallet::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        (wallet_id, address)
+    }
+
+    async fn seed_client_metadata(conn: &mut db::DatabaseConnection) -> i32 {
+        insert_into(schema::client_metadata::table)
+            .values(schema::client_metadata::name.eq("test"))
+            .returning(schema::client_metadata::id)
+            .get_result(conn)
+            .await
+            .unwrap()
+    }
+
+    /// Inserts a `program_client` row under the given `client_metadata` row, keyed by its
+    /// own random public key.
+    async fn seed_client(conn: &mut db::DatabaseConnection, metadata_id: i32) -> i32 {
+        insert_into(schema::program_client::table)
+            .values((
+                schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
+                schema::program_client::metadata_id.eq(metadata_id),
+            ))
+            .returning(schema::program_client::id)
+            .get_result(conn)
+            .await
+            .unwrap()
+    }
+
+    /// Inserts an access row directly, for fixtures that need one to already exist.
+    /// Production code grants access through [`grant_wallet_access`].
+    async fn insert_wallet_access(
+        conn: &mut db::DatabaseConnection,
+        wallet_id: models::EvmWalletId,
+        client_id: i32,
+    ) -> i32 {
+        insert_into(schema::evm_wallet_access::table)
+            .values((
+                schema::evm_wallet_access::wallet_id.eq(wallet_id),
+                schema::evm_wallet_access::client_id.eq(client_id),
+            ))
+            .returning(schema::evm_wallet_access::id)
+            .get_result(conn)
+            .await
+            .unwrap()
+    }
+
+    /// The grants that grant lookup would treat as live for this access: the exact filter
+    /// `EtherTransfer::try_find_grant` and `TokenTransfer::try_find_grant` apply.
+    async fn live_grants_for(conn: &mut db::DatabaseConnection, access_id: i32) -> Vec<i32> {
+        schema::evm_basic_grant::table
+            .filter(schema::evm_basic_grant::wallet_access_id.eq(access_id))
+            .filter(schema::evm_basic_grant::revoked_at.is_null())
+            .select(schema::evm_basic_grant::id)
+            .load(conn)
+            .await
+            .unwrap()
+    }
+
+    /// Two clients share one wallet. Revoking one access row must leave the other alone,
+    /// and must mark the row revoked rather than deleting it.
+    #[tokio::test]
+    async fn revoking_one_access_leaves_the_other_client_alone() {
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let (wallet_id, _address) = seed_wallet(&mut conn).await;
+        let metadata_id = seed_client_metadata(&mut conn).await;
+        let first_client = seed_client(&mut conn, metadata_id).await;
+        let second_client = seed_client(&mut conn, metadata_id).await;
+
+        let first_access = insert_wallet_access(&mut conn, wallet_id, first_client).await;
+        let _second_access = insert_wallet_access(&mut conn, wallet_id, second_client).await;
+
+        let removed = revoke_wallet_access(&mut conn, &[first_access])
+            .await
+            .unwrap();
+        assert_eq!(removed, 1);
+
+        let active: Vec<i32> = schema::evm_wallet_access::table
+            .filter(schema::evm_wallet_access::revoked_at.is_null())
+            .select(schema::evm_wallet_access::client_id)
+            .load(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(
+            active,
+            vec![second_client],
+            "revoking one access row removed another client's access"
+        );
+
+        let total: i64 = schema::evm_wallet_access::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(
+            total, 2,
+            "revoking an access row must mark it revoked, not delete it"
+        );
+
+        // The count `handle_revoke_evm_wallet_access` answers on: a second revoke of the same
+        // id, like a revoke of an id that never existed, changes nothing and must say so.
+        let again = revoke_wallet_access(&mut conn, &[first_access])
+            .await
+            .unwrap();
+        assert_eq!(again, 0, "an already revoked access must report no rows");
+    }
+
+    /// The bug this round fixes: once an access has been used for a grant, a signed
+    /// transaction, or a proposed persistent grant, three tables reference
+    /// `evm_wallet_access` `on delete restrict`, so deleting the row is no longer possible
+    /// once foreign keys are enforced. Revoking must still succeed by marking it revoked.
+    #[tokio::test]
+    async fn revoking_an_access_with_grant_log_and_proposal_succeeds() {
+        use crate::db::proposal::{Proposal as _, persistent_grant, persistent_grant::PersistentGrant};
+
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let (wallet_id, _address) = seed_wallet(&mut conn).await;
+        let metadata_id = seed_client_metadata(&mut conn).await;
+        let client_id = seed_client(&mut conn, metadata_id).await;
+        let access_id = insert_wallet_access(&mut conn, wallet_id, client_id).await;
+
+        // A grant against this access...
+        let grant_id: i32 = insert_into(schema::evm_basic_grant::table)
+            .values(models::NewEvmBasicGrant {
+                wallet_access_id: access_id,
+                chain_id: 1u64.into(),
+                valid_from: None,
+                valid_until: None,
+                max_gas_fee_per_gas: None,
+                max_priority_fee_per_gas: None,
+                rate_limit_count: None,
+                rate_limit_window_secs: None,
+                revoked_at: None,
+            })
+            .returning(schema::evm_basic_grant::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+
+        // ...a signed transaction against that grant...
+        insert_into(schema::evm_transaction_log::table)
+            .values(models::NewEvmTransactionLog {
+                grant_id,
+                wallet_access_id: access_id,
+                chain_id: 1u64.into(),
+                eth_value: vec![0u8; 32],
+                signed_at: models::SqliteTimestamp(chrono::Utc::now()),
+            })
+            .execute(&mut conn)
+            .await
+            .unwrap();
+
+        // ...and a persistent-grant proposal that named this access before it was voted on.
+        let operator_id: models::OperatorIdentityId =
+            insert_into(schema::operator_identity::table)
+                .values(schema::operator_identity::public_key.eq(rand::random::<[u8; 32]>().to_vec()))
+                .returning(schema::operator_identity::id)
+                .get_result(&mut conn)
+                .await
+                .unwrap();
+        let proposal_id: models::ProposalId = insert_into(schema::proposal::table)
+            .values(&models::NewProposal {
+                kind: db::proposal::ProposalKindTag::ApprovePersistentGrant,
+                initiator_id: operator_id,
+                expires_at: models::SqliteTimestamp(chrono::Utc::now() + chrono::Duration::days(1)),
+            })
+            .returning(schema::proposal::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        PersistentGrant::insert(
+            proposal_id,
+            &persistent_grant::Settings {
+                wallet_access_id: access_id,
+                chain_id: 1,
+                valid_from_secs: None,
+                valid_until_secs: None,
+                max_gas_fee_per_gas: None,
+                max_priority_fee_per_gas: None,
+                rate_limit: None,
+                specific: persistent_grant::Specific::EtherTransfer {
+                    targets: vec![[0u8; 20]],
+                    limit: persistent_grant::VolumeLimit {
+                        max_volume: [0u8; 32],
+                        window_secs: 3600,
+                    },
+                },
+            },
+            &mut conn,
+        )
+        .await
+        .unwrap();
+
+        // Before this round's fix, this would fail with a foreign-key violation.
+        let removed = revoke_wallet_access(&mut conn, &[access_id]).await.unwrap();
+        assert_eq!(removed, 1);
+
+        let revoked_at: Option<models::SqliteTimestamp> = schema::evm_wallet_access::table
+            .find(access_id)
+            .select(schema::evm_wallet_access::revoked_at)
+            .first(&mut conn)
+            .await
+            .unwrap();
+        assert!(
+            revoked_at.is_some(),
+            "the row must be marked revoked, not deleted"
+        );
+    }
+
+    /// A revoked access must no longer resolve through the lookup `shared_analyze_transaction`
+    /// and `client_sign_transaction` share -- otherwise the SDK client keeps signing after
+    /// the operator believes it has been cut off.
+    #[tokio::test]
+    async fn revoked_access_no_longer_authorizes_signing() {
+        use crate::actors::{
+            GlobalActors,
+            evm::{EvmActor, SignTransactionError},
+            vault::Vault,
+        };
+        use alloy::{
+            consensus::TxEip1559,
+            eips::eip2930::AccessList,
+            primitives::{Address, Bytes, TxKind, U256},
+        };
+        use kameo::actor::Spawn as _;
+
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let (wallet_id, address) = seed_wallet(&mut conn).await;
+        let metadata_id = seed_client_metadata(&mut conn).await;
+        let client_id = seed_client(&mut conn, metadata_id).await;
+        let access_id = insert_wallet_access(&mut conn, wallet_id, client_id).await;
+        drop(conn);
+
+        let vault = Vault::spawn(
+            Vault::new(pool.clone(), GlobalActors::spawn_message_bus())
+                .await
+                .unwrap(),
+        );
+        let mut evm_actor = EvmActor::new(vault, pool.clone());
+
+        let transaction = TxEip1559 {
+            chain_id: 1,
+            nonce: 0,
+            gas_limit: 21_000,
+            max_fee_per_gas: 0,
+            max_priority_fee_per_gas: 0,
+            to: TxKind::Call(Address::ZERO),
+            value: U256::ZERO,
+            input: Bytes::new(),
+            access_list: AccessList::default(),
+        };
+        let wallet_address = Address::from_slice(&address);
+
+        // The paired positive case: while the access stands, both lookups resolve it and the
+        // calls fail further along (no grant, sealed vault) rather than at the access filter.
+        // Without this, a filter that rejected every row would pass the assertions below.
+        let live_analyze = evm_actor
+            .shared_analyze_transaction(client_id, wallet_address, transaction.clone())
+            .await;
+        assert!(
+            !matches!(live_analyze, Err(SignTransactionError::WalletNotFound)),
+            "a live access must resolve through shared_analyze_transaction: {live_analyze:?}"
+        );
+        let live_sign = evm_actor
+            .client_sign_transaction(client_id, wallet_address, transaction.clone())
+            .await;
+        assert!(
+            !matches!(live_sign, Err(SignTransactionError::WalletNotFound)),
+            "a live access must resolve through client_sign_transaction: {live_sign:?}"
+        );
+
+        let mut conn = pool.get().await.unwrap();
+        revoke_wallet_access(&mut conn, &[access_id]).await.unwrap();
+        drop(conn);
+
+        // Both lookups resolve access the same way; both must reject the revoked row before
+        // ever touching the vault (neither call bootstraps one).
+        let analyze_result = evm_actor
+            .shared_analyze_transaction(client_id, wallet_address, transaction.clone())
+            .await;
+        assert!(
+            matches!(analyze_result, Err(SignTransactionError::WalletNotFound)),
+            "a revoked access must not authorize shared_analyze_transaction: {analyze_result:?}"
+        );
+
+        let sign_result = evm_actor
+            .client_sign_transaction(client_id, wallet_address, transaction)
+            .await;
+        assert!(
+            matches!(sign_result, Err(SignTransactionError::WalletNotFound)),
+            "a revoked access must not authorize client_sign_transaction: {sign_result:?}"
+        );
+    }
+
+    /// Re-granting a revoked access must restore it rather than silently doing nothing:
+    /// `uniq_wallet_access` is a unique index on `(wallet_id, client_id)`, so a plain insert
+    /// would conflict on the revoked row forever.
+    #[tokio::test]
+    async fn regranting_a_revoked_access_restores_it() {
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let (wallet_id, _address) = seed_wallet(&mut conn).await;
+        let metadata_id = seed_client_metadata(&mut conn).await;
+        let client_id = seed_client(&mut conn, metadata_id).await;
+        let access_id = insert_wallet_access(&mut conn, wallet_id, client_id).await;
+
+        revoke_wallet_access(&mut conn, &[access_id]).await.unwrap();
+
+        grant_wallet_access(
+            &mut conn,
+            vec![models::NewEvmWalletAccess {
+                wallet_id,
+                client_id,
+            }],
+        )
+        .await
+        .unwrap();
+
+        let revoked_at: Option<models::SqliteTimestamp> = schema::evm_wallet_access::table
+            .find(access_id)
+            .select(schema::evm_wallet_access::revoked_at)
+            .first(&mut conn)
+            .await
+            .unwrap();
+        assert!(
+            revoked_at.is_none(),
+            "re-granting a revoked access must clear revoked_at"
+        );
+
+        let total: i64 = schema::evm_wallet_access::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(
+            total, 1,
+            "re-granting a revoked access must revive the existing row, not add a second one"
+        );
+    }
+
+    /// §3.2 puts wallet visibility and a persistent grant to two separate votes. Reviving a
+    /// revoked access restores visibility, and must restore nothing else: grant lookup keys on
+    /// `wallet_access_id` with `revoked_at is null`, so a grant left open when the access was
+    /// cut off would come back live -- with its original volume and rate limits -- the moment
+    /// the id revives. `EvmActor::grant_wallet_access` executes an approved `GrantWalletAccess`
+    /// proposal, so that would hand signing authority back to a committee that voted only on
+    /// visibility.
+    #[tokio::test]
+    async fn regranting_an_access_does_not_revive_its_grants() {
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let (wallet_id, _address) = seed_wallet(&mut conn).await;
+        let metadata_id = seed_client_metadata(&mut conn).await;
+        let client_id = seed_client(&mut conn, metadata_id).await;
+
+        let entry = || models::NewEvmWalletAccess {
+            wallet_id,
+            client_id,
+        };
+        grant_wallet_access(&mut conn, vec![entry()]).await.unwrap();
+        let access_id: i32 = schema::evm_wallet_access::table
+            .filter(schema::evm_wallet_access::wallet_id.eq(wallet_id))
+            .filter(schema::evm_wallet_access::client_id.eq(client_id))
+            .select(schema::evm_wallet_access::id)
+            .first(&mut conn)
+            .await
+            .unwrap();
+
+        // The row every persistent grant hangs off: the specific ether- or token-transfer
+        // rows reference it, so liveness is decided here.
+        let grant_id: i32 = insert_into(schema::evm_basic_grant::table)
+            .values(models::NewEvmBasicGrant {
+                wallet_access_id: access_id,
+                chain_id: 1u64.into(),
+                valid_from: None,
+                valid_until: None,
+                max_gas_fee_per_gas: None,
+                max_priority_fee_per_gas: None,
+                rate_limit_count: None,
+                rate_limit_window_secs: None,
+                revoked_at: None,
+            })
+            .returning(schema::evm_basic_grant::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+
+        assert_eq!(
+            live_grants_for(&mut conn, access_id).await,
+            vec![grant_id],
+            "the seeded grant must start out live, or the assertions below prove nothing"
+        );
+
+        revoke_wallet_access(&mut conn, &[access_id]).await.unwrap();
+        assert!(
+            live_grants_for(&mut conn, access_id).await.is_empty(),
+            "revoking an access must revoke the grants that hang off it"
+        );
+
+        grant_wallet_access(&mut conn, vec![entry()]).await.unwrap();
+
+        let revoked_at: Option<models::SqliteTimestamp> = schema::evm_wallet_access::table
+            .find(access_id)
+            .select(schema::evm_wallet_access::revoked_at)
+            .first(&mut conn)
+            .await
+            .unwrap();
+        assert!(
+            revoked_at.is_none(),
+            "re-granting must restore visibility for the access itself"
+        );
+        assert!(
+            live_grants_for(&mut conn, access_id).await.is_empty(),
+            "re-granting an access must not revive the grants it held before revocation"
+        );
+    }
+}
--- a/server/crates/arbiter-server/src/peers/operator/session/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/mod.rs
@@ -1,4 +1,4 @@
-use super::{Credentials, OutOfBand, OperatorConnection};
+use super::{AuthenticatedOperator, OutOfBand, OperatorConnection};
 use crate::{
    actors::{
        flow_coordinator::client_connect_approval::ClientApprovalController,
@@ -19,6 +19,17 @@ pub enum Error {
    #[error("State transition failed")]
    State,

+    /// §3.5: the ordinary and recovery roles reach for different handlers here. A refusal is a
+    /// policy answer, so it is named rather than folded into `Internal` beside real faults.
+    #[error("This operator role may not perform that action")]
+    RoleNotPermitted,
+
+    /// Fewer access rows were revoked than the request named. Like `RoleNotPermitted` this is
+    /// an answer about the request, not a fault, so it is named rather than folded into
+    /// `Internal`.
+    #[error("Revoked {revoked} of {requested} wallet access entries")]
+    PartialRevoke { requested: usize, revoked: usize },
+
    #[error("Internal error: {message}")]
    Internal { message: Cow<'static, str> },
 }
@@ -51,7 +62,7 @@ pub struct PendingClientApproval {

 pub struct OperatorSession {
    props: OperatorConnection,
-    credentials: Credentials,
+    credentials: AuthenticatedOperator,
    sender: Box<dyn Sender<OutOfBand>>,

    pending_client_approvals: HashMap<Vec<u8>, PendingClientApproval>,
@@ -60,7 +71,7 @@ pub struct OperatorSession {
 pub mod handlers;

 impl OperatorSession {
-    pub(crate) fn new(props: OperatorConnection, credentials: Credentials, sender: Box<dyn Sender<OutOfBand>>) -> Self {
+    pub(crate) fn new(props: OperatorConnection, credentials: AuthenticatedOperator, sender: Box<dyn Sender<OutOfBand>>) -> Self {
        Self {
            props,
            credentials,
@@ -68,6 +79,25 @@ impl OperatorSession {
            pending_client_approvals: HashMap::default(),
        }
    }
+
+    /// The id of the ordinary operator on the other end, or a refusal.
+    ///
+    /// Read from the handshake, never from a request body, so a peer cannot act under an id it
+    /// did not authenticate as.
+    const fn ordinary_id(&self) -> Result<i32, Error> {
+        match &self.credentials {
+            AuthenticatedOperator::Ordinary(credentials) => Ok(credentials.id),
+            AuthenticatedOperator::Recovery(_) => Err(Error::RoleNotPermitted),
+        }
+    }
+
+    /// The id of the recovery operator on the other end, or a refusal. See `ordinary_id`.
+    const fn recovery_id(&self) -> Result<i32, Error> {
+        match &self.credentials {
+            AuthenticatedOperator::Recovery(credentials) => Ok(credentials.id),
+            AuthenticatedOperator::Ordinary(_) => Err(Error::RoleNotPermitted),
+        }
+    }
 }

 #[messages]
--- a/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
@@ -1,4 +1,4 @@
-use super::Credentials;
+use super::AuthenticatedOperator;
 use crate::{
    actors::{
        GlobalActors,
@@ -36,6 +36,12 @@ pub enum Error {
    #[error("State transition failed")]
    State,

+    /// §3.5: ordinary and recovery operators hold different shares of the same split, so each
+    /// contribution belongs to exactly one of the two roles. A refusal here is a policy answer
+    /// and is kept out of `Internal`, which carries genuine faults.
+    #[error("This operator role may not perform that vault action")]
+    RoleNotPermitted,
+
    #[error("Internal error: {0}")]
    Internal(String),
 }
@@ -50,7 +56,7 @@ pub struct HandshakeResponse {
 }

 pub struct VaultGate {
-    pub auth_creds: Credentials,
+    pub auth_creds: AuthenticatedOperator,
    pub promotion_tx: Option<oneshot::Sender<Result<(), Error>>>,
    pub state: State,
    pub actors: GlobalActors,
@@ -59,7 +65,7 @@ pub struct VaultGate {

 impl VaultGate {
    pub fn new(
-        auth_creds: Credentials,
+        auth_creds: AuthenticatedOperator,
        actors: GlobalActors,
        db: DatabasePool,
        promotion_tx: oneshot::Sender<Result<(), Error>>,
@@ -100,6 +106,25 @@ impl Actor for VaultGate {
 }

 impl VaultGate {
+    /// The id of the ordinary operator on the other end, or a refusal.
+    ///
+    /// The id is read from the handshake rather than from the request body, so a peer cannot
+    /// name an operator it did not authenticate as.
+    const fn ordinary_id(&self) -> Result<i32, Error> {
+        match &self.auth_creds {
+            AuthenticatedOperator::Ordinary(credentials) => Ok(credentials.id),
+            AuthenticatedOperator::Recovery(_) => Err(Error::RoleNotPermitted),
+        }
+    }
+
+    /// The id of the recovery operator on the other end, or a refusal. See `ordinary_id`.
+    const fn recovery_id(&self) -> Result<i32, Error> {
+        match &self.auth_creds {
+            AuthenticatedOperator::Recovery(credentials) => Ok(credentials.id),
+            AuthenticatedOperator::Ordinary(_) => Err(Error::RoleNotPermitted),
+        }
+    }
+
    fn decrypt_key(
        secret: &SharedSecret,
        nonce: &[u8],
@@ -148,6 +173,13 @@ impl VaultGate {
        })
    }

+    /// Deliberately open to both roles, unlike `handle_bootstrap_encrypted_key` below.
+    ///
+    /// Handing over the whole seal key to open a sealed vault is participating in unsealing,
+    /// which §3.5 grants a recovery operator, and the peer has to hold that key already -- it
+    /// gains nothing here it did not bring. Bootstrap is the opposite: it *chooses* the key for
+    /// a vault that has none, which is sole custody of the root key and belongs to no §3.5
+    /// power. The reasoning that admits one does not admit the other.
    #[message]
    pub async fn handle_unseal_encrypted_key(
        &mut self,
@@ -185,6 +217,10 @@ impl VaultGate {
        }
    }

+    /// §3.4/§3.5: bootstrapping picks the root key for a vault that has none, so whoever gets
+    /// here holds sole custody until the committee splits it. That is not one of a recovery
+    /// operator's two powers, and the check comes first because the vault commits before this
+    /// handler could refuse anything afterwards.
    #[message]
    pub async fn handle_bootstrap_encrypted_key(
        &mut self,
@@ -192,6 +228,8 @@ impl VaultGate {
        ciphertext: Vec<u8>,
        associated_data: Vec<u8>,
    ) -> Result<(), Error> {
+        let _ = self.ordinary_id()?;
+
        let State::ReadyForExchange { secret, .. } = &self.state else {
            return Err(Error::State);
        };
@@ -242,10 +280,12 @@ impl VaultGate {
        count: usize,
        recovery_count: usize,
    ) -> Result<(), Error> {
+        let operator_id = self.ordinary_id()?;
+
        self.actors
            .vault_coordinator
            .ask(StartBootstrap {
-                operator_id: self.auth_creds.id,
+                operator_id,
                declared_count: count,
                recovery_count,
            })
@@ -258,11 +298,13 @@ impl VaultGate {
        &mut self,
        passphrase: Vec<u8>,
    ) -> Result<bool, Error> {
+        let operator_id = self.ordinary_id()?;
+
        let passphrase_cell = SafeCell::new(passphrase);
        self.actors
            .vault_coordinator
            .ask(ContributeBootstrap {
-                operator_id: self.auth_creds.id,
+                operator_id,
                passphrase: passphrase_cell,
            })
            .await
@@ -272,9 +314,10 @@ impl VaultGate {
    #[message]
    pub async fn handle_contribute_recovery_bootstrap_passphrase(
        &mut self,
-        recovery_operator_id: i32,
        passphrase: Vec<u8>,
    ) -> Result<bool, Error> {
+        let recovery_operator_id = self.recovery_id()?;
+
        let passphrase_cell = SafeCell::new(passphrase);
        self.actors
            .vault_coordinator
@@ -291,11 +334,13 @@ impl VaultGate {
        &mut self,
        passphrase: Vec<u8>,
    ) -> Result<bool, Error> {
+        let operator_id = self.ordinary_id()?;
+
        let passphrase_cell = SafeCell::new(passphrase);
        self.actors
            .vault_coordinator
            .ask(ContributeUnseal {
-                operator_id: self.auth_creds.id,
+                operator_id,
                passphrase: passphrase_cell,
            })
            .await
@@ -305,9 +350,10 @@ impl VaultGate {
    #[message]
    pub async fn handle_contribute_recovery_unseal_passphrase(
        &mut self,
-        recovery_operator_id: i32,
        passphrase: Vec<u8>,
    ) -> Result<bool, Error> {
+        let recovery_operator_id = self.recovery_id()?;
+
        let passphrase_cell = SafeCell::new(passphrase);
        self.actors
            .vault_coordinator
@@ -334,13 +380,28 @@ impl Message<events::Bootstrapped> for VaultGate {
                .get()
                .await
                .map_err(|_| Error::internal("DB unavailable"))?;
-            integrity::sign_entity(
-                &mut conn,
-                &self.actors.vault,
-                &self.auth_creds,
-                self.auth_creds.id,
-            )
-            .await
+            // Each role signs under its own `Integrable::KIND`, so the two id spaces cannot
+            // collide in `integrity_envelope`.
+            match &self.auth_creds {
+                AuthenticatedOperator::Ordinary(credentials) => {
+                    integrity::sign_entity(
+                        &mut conn,
+                        &self.actors.vault,
+                        credentials,
+                        credentials.id,
+                    )
+                    .await
+                }
+                AuthenticatedOperator::Recovery(credentials) => {
+                    integrity::sign_entity(
+                        &mut conn,
+                        &self.actors.vault,
+                        credentials,
+                        credentials.id,
+                    )
+                    .await
+                }
+            }
            .map_err(|e| {
                error!(?e, "Failed to sign integrity envelope on bootstrap");
                Error::internal("Integrity sign failed")
--- a/server/crates/arbiter-server/tests/client/auth.rs
+++ b/server/crates/arbiter-server/tests/client/auth.rs
@@ -1,4 +1,4 @@
-use super::common::ChannelTransport;
+use super::common::{ChannelTransport, spawn_actors};
 use arbiter_crypto::authn::{self, AuthChallenge, SigningContext};
 use arbiter_proto::{
    ClientMetadata,
@@ -93,7 +93,7 @@ async fn insert_bootstrap_sentinel_operator(db: &db::DatabasePool) {
 async fn spawn_test_actors(db: &db::DatabasePool) -> GlobalActors {
    insert_bootstrap_sentinel_operator(db).await;

-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap {
--- a/server/crates/arbiter-server/tests/common/mod.rs
+++ b/server/crates/arbiter-server/tests/common/mod.rs
@@ -24,6 +24,36 @@ pub(crate) async fn bootstrapped_vault(db: &db::DatabasePool) -> Vault {
    actor
 }

+/// Spawns a full `GlobalActors` for a test, backing `Bootstrapper`'s token file with a
+/// throwaway temp directory rather than the real `~/.arbiter` -- a test must never be able to
+/// reach, let alone write to, the developer's real bootstrap token file.
+pub(crate) async fn spawn_actors(db: db::DatabasePool) -> GlobalActors {
+    let home = tempfile::tempdir().expect("failed to create a temp home directory for a test");
+    GlobalActors::spawn_in(db, home.path())
+        .await
+        .expect("failed to spawn GlobalActors for a test")
+}
+
+/// Retries `probe` until it yields a value, then returns it.
+///
+/// Effects that travel over the message bus are not visible the moment the publishing call
+/// returns: `Publish` only enqueues to the bus's mailbox, which then delivers to each
+/// subscriber's mailbox in turn. A test observing such an effect waits for it instead of
+/// reading straight after the call that triggered it.
+pub(crate) async fn eventually<T, F, Fut>(what: &str, mut probe: F) -> T
+where
+    F: FnMut() -> Fut,
+    Fut: Future<Output = Option<T>>,
+{
+    for _ in 0..100 {
+        if let Some(value) = probe().await {
+            return value;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(20)).await;
+    }
+    panic!("{what} did not happen within 2s");
+}
+
 pub(crate) async fn root_key_history_id(db: &db::DatabasePool) -> i32 {
    let mut conn = db.get().await.unwrap();
    let id = schema::arbiter_settings::table
--- a/server/crates/arbiter-server/tests/governance.rs
+++ b/server/crates/arbiter-server/tests/governance.rs
@@ -21,12 +21,11 @@ use arbiter_server::{
 };
 use arbiter_server::actors::vault::Bootstrap;
 use arbiter_server::db::schema::{
-    aead_encrypted, evm_basic_grant, evm_wallet, evm_wallet_access, operator_identity,
-    proposal_one_off_transaction_result, recovery_operator_identity,
+    aead_encrypted, arbiter_settings, evm_basic_grant, evm_wallet, evm_wallet_access,
+    operator_identity, proposal_one_off_transaction_result, recovery_operator_identity,
 };
 use diesel::{ExpressionMethods, QueryDsl, insert_into};
 use diesel_async::RunQueryDsl;
-use std::future::Future;

 /// Retries `probe` until it yields a value, then returns it.
 ///
@@ -47,6 +46,16 @@ where
    panic!("{what} did not happen within 2s");
 }

+/// Spawns a full `GlobalActors` for a test, backing `Bootstrapper`'s token file with a
+/// throwaway temp directory rather than the real `~/.arbiter` -- a test must never be able to
+/// reach, let alone write to, the developer's real bootstrap token file.
+async fn spawn_actors(db: db::DatabasePool) -> GlobalActors {
+    let home = tempfile::tempdir().expect("failed to create a temp home directory for a test");
+    GlobalActors::spawn_in(db, home.path())
+        .await
+        .expect("failed to spawn GlobalActors for a test")
+}
+
 async fn register_operator(db: &db::DatabasePool, pubkey: &authn::PublicKey) -> OperatorIdentityId {
    let mut conn = db.get().await.unwrap();
    insert_into(operator_identity::table)
@@ -83,14 +92,22 @@ async fn insert_active_wakeup(db: &db::DatabasePool, operator_id: OperatorIdenti
    .unwrap();
 }

+/// Requires the vault to already be bootstrapped: it reads the root key row `Bootstrap`
+/// creates so the aead-encrypted wallet secret has a real parent to reference.
 async fn insert_evm_wallet(db: &db::DatabasePool) -> i32 {
    let mut conn = db.get().await.unwrap();
+    let root_key_id: i32 = arbiter_settings::table
+        .select(arbiter_settings::root_key_id)
+        .first::<Option<i32>>(&mut conn)
+        .await
+        .unwrap()
+        .expect("vault must be bootstrapped before creating an aead-encrypted row");
    let aead_id: i32 = insert_into(aead_encrypted::table)
        .values((
            aead_encrypted::current_nonce.eq(vec![0u8; 4]),
            aead_encrypted::ciphertext.eq(vec![0u8; 32]),
            aead_encrypted::tag.eq(vec![0u8; 16]),
-            aead_encrypted::associated_root_key_id.eq(0i32),
+            aead_encrypted::associated_root_key_id.eq(root_key_id),
        ))
        .returning(aead_encrypted::id)
        .get_result::<i32>(&mut conn)
@@ -135,7 +152,7 @@ async fn insert_unapproved_client(db: &db::DatabasePool, pubkey: &authn::PublicK
 #[tokio::test]
 async fn create_proposal_returns_id() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap {
@@ -144,11 +161,16 @@ async fn create_proposal_returns_id() {
        .await
        .unwrap();

+    let key = authn::SigningKey::generate();
+    let operator_id = register_operator(&db, &key.public_key()).await;
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
+
    let proposal_id = actors
        .proposal_manager
        .ask(CreateProposal {
-            kind: ProposalKind::ApproveSdkClient(approve_sdk_client::Settings { client_id: 42 }),
-            initiator_id: OperatorIdentityId::from_raw(1),
+            kind: ProposalKind::ApproveSdkClient(approve_sdk_client::Settings { client_id }),
+            initiator_id: operator_id,
            ttl_secs: None,
        })
        .await
@@ -160,7 +182,7 @@ async fn create_proposal_returns_id() {
 #[tokio::test]
 async fn create_proposal_caps_the_ttl() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap {
@@ -171,12 +193,14 @@ async fn create_proposal_caps_the_ttl() {

    let key = authn::SigningKey::generate();
    let op = register_operator(&db, &key.public_key()).await;
+    let client_key = authn::SigningKey::generate();
+    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;

    let create = async |ttl: u32| {
        actors
            .proposal_manager
            .ask(CreateProposal {
-                kind: ProposalKind::ApproveSdkClient(approve_sdk_client::Settings { client_id: 1 }),
+                kind: ProposalKind::ApproveSdkClient(approve_sdk_client::Settings { client_id }),
                initiator_id: op,
                ttl_secs: Some(ttl),
            })
@@ -199,7 +223,7 @@ async fn create_proposal_caps_the_ttl() {
 #[tokio::test]
 async fn single_operator_vote_reaches_quorum() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -244,7 +268,7 @@ async fn single_operator_vote_reaches_quorum() {
 #[tokio::test]
 async fn two_operator_first_vote_is_pending() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -290,7 +314,7 @@ async fn two_operator_first_vote_is_pending() {
 #[tokio::test]
 async fn duplicate_vote_rejected() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -351,7 +375,7 @@ async fn duplicate_vote_rejected() {
 #[tokio::test]
 async fn invalid_signature_rejected() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -392,7 +416,7 @@ async fn invalid_signature_rejected() {
 #[tokio::test]
 async fn query_pending_reports_a_tally_per_proposal() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap {
@@ -430,7 +454,9 @@ async fn query_pending_reports_a_tally_per_proposal() {
    };

    let mut ids = Vec::new();
-    for client_id in 1..=3 {
+    for _ in 1..=3 {
+        let client_key = authn::SigningKey::generate();
+        let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
        let id = actors
            .proposal_manager
            .ask(CreateProposal {
@@ -484,7 +510,7 @@ async fn query_pending_reports_a_tally_per_proposal() {
 #[tokio::test]
 async fn query_pending_excludes_already_voted() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -550,7 +576,7 @@ async fn query_pending_excludes_already_voted() {
 #[tokio::test]
 async fn expired_proposal_is_hidden_and_unvotable() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -608,7 +634,7 @@ async fn approve_sdk_client_writes_integrity_envelope() {
    use arbiter_server::db::schema::integrity_envelope;

    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -667,7 +693,7 @@ async fn approve_sdk_client_writes_integrity_envelope() {
 #[tokio::test]
 async fn grant_wallet_access_on_quorum_approval() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -728,7 +754,7 @@ async fn grant_wallet_access_on_quorum_approval() {
 #[tokio::test]
 async fn approve_persistent_grant_creates_basic_grant_row() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -825,7 +851,7 @@ async fn approve_one_off_transaction_stores_result() {
    use chrono::Duration;

    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -945,7 +971,7 @@ async fn approve_one_off_transaction_stores_result() {
 #[tokio::test]
 async fn replace_operator_updates_pubkey_and_starts_rekey() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -1017,7 +1043,7 @@ async fn replace_operator_updates_pubkey_and_starts_rekey() {
 #[tokio::test]
 async fn trigger_rekey_reaches_quorum() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -1059,7 +1085,7 @@ async fn trigger_rekey_reaches_quorum() {
 async fn key_rotation_requires_full_quorum() {
    // §3.3: ReplaceOperator needs all 3 operators to approve, not just shamir_threshold(3)=2
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -1113,7 +1139,7 @@ async fn key_rotation_requires_full_quorum() {
 #[tokio::test]
 async fn recovery_vote_rejected_when_sleeping() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors.vault.ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) }).await.unwrap();

    let op_key = authn::SigningKey::generate();
@@ -1159,7 +1185,7 @@ async fn recovery_vote_rejected_when_sleeping() {
 #[tokio::test]
 async fn recovery_vote_blocked_on_non_replace_proposal() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors.vault.ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) }).await.unwrap();

    let op_key = authn::SigningKey::generate();
@@ -1208,7 +1234,7 @@ async fn recovery_vote_blocked_on_non_replace_proposal() {
 #[tokio::test]
 async fn recovery_wakeup_can_be_cancelled() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors.vault.ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) }).await.unwrap();

    let key = authn::SigningKey::generate();
@@ -1237,7 +1263,7 @@ async fn recovery_wakeup_can_be_cancelled() {
 #[tokio::test]
 async fn recovery_wakeup_prevents_duplicate_request() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors.vault.ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) }).await.unwrap();

    let key = authn::SigningKey::generate();
@@ -1265,7 +1291,7 @@ async fn recovery_wakeup_prevents_duplicate_request() {
 async fn recovery_operator_vote_contributes_to_replace_quorum() {
    // 1 ordinary operator + 1 recovery operator; replace_operator needs both.
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors.vault.ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) }).await.unwrap();

    let op_key = authn::SigningKey::generate();
--- a/server/crates/arbiter-server/tests/operator/auth.rs
+++ b/server/crates/arbiter-server/tests/operator/auth.rs
@@ -1,11 +1,16 @@
-use super::common::ChannelTransport;
+use super::common::{ChannelTransport, bootstrapped_vault, eventually, spawn_actors};
 use arbiter_crypto::authn::{self, AuthChallenge, SigningContext};
 use arbiter_proto::transport::{Error as TransportError, Receiver, Sender};
 use arbiter_server::{
-    actors::{GlobalActors, bootstrap::GetToken, vault::Bootstrap},
+    actors::{
+        bootstrap::GetToken,
+        vault::{self, Bootstrap},
+    },
    crypto::integrity,
    db::{self, schema},
-    peers::operator::{self, Credentials, OperatorConnection, auth, vault_gate},
+    peers::operator::{
+        self, AuthenticatedOperator, Credentials, OperatorConnection, auth, vault_gate,
+    },
 };

 use async_trait::async_trait;
@@ -150,14 +155,7 @@ impl Sender<auth::Inbound> for StartTestTransport {
 #[test_log::test]
 pub async fn bootstrap_token_auth() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
-    actors
-        .vault
-        .ask(Bootstrap {
-            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
-        })
-        .await
-        .unwrap();
+    let actors = spawn_actors(db.clone()).await;
    let token = actors.bootstrapper.ask(GetToken).await.unwrap().unwrap();

    let (mut server_transport, mut test_transport) = ChannelTransport::new();
@@ -200,22 +198,156 @@ pub async fn bootstrap_token_auth() {
        .expect("should receive auth result");
    assert!(matches!(response, Ok(auth::Outbound::AuthSuccess)));

-    task.await.unwrap().unwrap();
+    let authenticated = task.await.unwrap().unwrap();

    let mut conn = db.get().await.unwrap();
-    let stored_pubkey: Vec<u8> = schema::operator_identity::table
-        .select(schema::operator_identity::public_key)
-        .first::<Vec<u8>>(&mut conn)
+    let (stored_id, stored_pubkey): (i32, Vec<u8>) = schema::operator_identity::table
+        .select((
+            schema::operator_identity::id,
+            schema::operator_identity::public_key,
+        ))
+        .first::<(i32, Vec<u8>)>(&mut conn)
        .await
        .unwrap();
    assert_eq!(stored_pubkey, verifying_key(&new_key).encode().0.to_vec());
+
+    // A key registered through the bootstrap token is an ordinary operator, carrying the id its
+    // registration wrote. Asserted here because this is the file's only bootstrap-arm check on
+    // what `authenticate` actually returns.
+    match authenticated {
+        AuthenticatedOperator::Ordinary(creds) => assert_eq!(creds.id, stored_id),
+        AuthenticatedOperator::Recovery(creds) => panic!(
+            "expected the ordinary role, got a recovery operator with id {}",
+            creds.id
+        ),
+    }
 }

+/// A multi-operator committee must all register with the same bootstrap token before bootstrap
+/// completes, so verifying the token must not consume it. This is the reachability bug fixed by
+/// replacing `consume_token` with `verify_token`.
 #[tokio::test]
 #[test_log::test]
-pub async fn bootstrap_invalid_token_auth() {
+pub async fn bootstrap_token_registers_every_committee_member() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
+    let token = actors.bootstrapper.ask(GetToken).await.unwrap().unwrap();
+
+    for _ in 0..2 {
+        let (mut server_transport, mut test_transport) = ChannelTransport::new();
+        let db_for_task = db.clone();
+        let actors_for_task = actors.clone();
+        let task = tokio::spawn(async move {
+            let mut props = OperatorConnection::new(db_for_task, actors_for_task);
+            auth::authenticate(&mut props, &mut server_transport).await
+        });
+
+        let new_key = MlDsa87::key_gen(&mut rand::rng());
+        test_transport
+            .send(auth::Inbound::AuthChallengeRequest {
+                pubkey: verifying_key(&new_key).into(),
+                bootstrap_token: Some(token.clone()),
+            })
+            .await
+            .unwrap();
+
+        let response = test_transport
+            .recv()
+            .await
+            .expect("should receive challenge");
+        let challenge = match response {
+            Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
+            other => panic!("Expected AuthChallenge, got {other:?}"),
+        };
+
+        let signature = sign_operator_challenge(&new_key, &challenge);
+        test_transport
+            .send(auth::Inbound::AuthChallengeSolution {
+                signature: signature.to_bytes(),
+            })
+            .await
+            .unwrap();
+
+        let response = test_transport
+            .recv()
+            .await
+            .expect("should receive auth result");
+        assert!(matches!(response, Ok(auth::Outbound::AuthSuccess)));
+
+        task.await.unwrap().unwrap();
+    }
+
+    let mut conn = db.get().await.unwrap();
+    let registered: i64 = schema::operator_identity::table
+        .count()
+        .get_result(&mut conn)
+        .await
+        .unwrap();
+    assert_eq!(registered, 2);
+
+    // Bootstrap has not completed: the token must still be valid.
+    assert_eq!(
+        actors.bootstrapper.ask(GetToken).await.unwrap(),
+        Some(token)
+    );
+}
+
+/// `GlobalActors` must subscribe `Bootstrapper` to `events::Bootstrapped` on the message bus.
+/// Without that one registration the token stays valid forever in production, which is the
+/// defect this task exists to fix, and no other test notices: the test below drives the event
+/// handler directly, and the `challenge_auth` family never re-reads the token after
+/// bootstrapping. This one goes the whole way round -- real `Vault::bootstrap`, real bus --
+/// and waits for the effect rather than reading straight after the call, because `Publish`
+/// only enqueues to the bus's mailbox.
+#[tokio::test]
+#[test_log::test]
+pub async fn bootstrapped_event_retires_the_token_through_the_message_bus() {
+    let db = db::create_test_pool().await;
+    let actors = spawn_actors(db.clone()).await;
+
+    assert!(
+        actors.bootstrapper.ask(GetToken).await.unwrap().is_some(),
+        "the token must exist before the vault is bootstrapped"
+    );
+
+    actors
+        .vault
+        .ask(Bootstrap {
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
+        })
+        .await
+        .unwrap();
+
+    eventually("the bootstrap token to be retired", || async {
+        actors
+            .bootstrapper
+            .ask(GetToken)
+            .await
+            .unwrap()
+            .is_none()
+            .then_some(())
+    })
+    .await;
+}
+
+/// Once the vault reports `Bootstrapped`, the token is retired: further registrations must be
+/// rejected even with a token that verified successfully moments earlier.
+#[tokio::test]
+#[test_log::test]
+pub async fn bootstrap_token_rejected_after_bootstrapped_event() {
+    let db = db::create_test_pool().await;
+    let actors = spawn_actors(db.clone()).await;
+    let token = actors.bootstrapper.ask(GetToken).await.unwrap().unwrap();
+
+    // Drive the Bootstrapper's own event handler directly rather than through
+    // `actors.vault.ask(Bootstrap { .. })` + the message bus: bus delivery is fire-and-forget,
+    // so asserting on it would be racy. The handler under test is the same either way.
+    actors
+        .bootstrapper
+        .ask(vault::events::Bootstrapped)
+        .await
+        .unwrap();
+    assert!(actors.bootstrapper.ask(GetToken).await.unwrap().is_none());

    let (mut server_transport, mut test_transport) = ChannelTransport::new();
    let db_for_task = db.clone();
@@ -228,7 +360,7 @@ pub async fn bootstrap_invalid_token_auth() {
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
-            bootstrap_token: Some("invalid_token".to_owned()),
+            bootstrap_token: Some(token),
        })
        .await
        .unwrap();
@@ -264,11 +396,150 @@ pub async fn bootstrap_invalid_token_auth() {
    assert_eq!(count, 0);
 }

+/// `register_key`'s database gate must refuse a registration once `arbiter_settings.root_key_id`
+/// is set, even when `Bootstrapper`'s own in-memory token has not yet been retired -- exactly
+/// the two-mailbox-hop window between `Vault::bootstrap`'s commit and the `Bootstrapped` event
+/// reaching `Bootstrapper` in production. "database bootstrapped, Bootstrapper not yet notified"
+/// is reproduced deterministically by bootstrapping a throwaway `Vault` wired to its own message
+/// bus: it commits `root_key_id` in the same database without ever publishing to the bus
+/// `actors.bootstrapper` is registered on, so `actors.bootstrapper`'s token is left untouched.
+#[tokio::test]
+#[test_log::test]
+pub async fn bootstrap_token_rejected_once_the_database_is_bootstrapped() {
+    let db = db::create_test_pool().await;
+    let actors = spawn_actors(db.clone()).await;
+    let token = actors.bootstrapper.ask(GetToken).await.unwrap().unwrap();
+
+    bootstrapped_vault(&db).await;
+
+    // From Bootstrapper's point of view the token still verifies: it never received an event.
+    assert_eq!(
+        actors.bootstrapper.ask(GetToken).await.unwrap(),
+        Some(token.clone())
+    );
+
+    let (mut server_transport, mut test_transport) = ChannelTransport::new();
+    let db_for_task = db.clone();
+    let task = tokio::spawn(async move {
+        let mut props = OperatorConnection::new(db_for_task, actors);
+        auth::authenticate(&mut props, &mut server_transport).await
+    });
+
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    test_transport
+        .send(auth::Inbound::AuthChallengeRequest {
+            pubkey: verifying_key(&new_key).into(),
+            bootstrap_token: Some(token),
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport
+        .recv()
+        .await
+        .expect("should receive challenge");
+    let challenge = match response {
+        Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
+        other => panic!("Expected AuthChallenge, got {other:?}"),
+    };
+
+    let signature = sign_operator_challenge(&new_key, &challenge);
+    test_transport
+        .send(auth::Inbound::AuthChallengeSolution {
+            signature: signature.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    // The refusal has to reach the peer, not just the task's return value: a registration
+    // refused after the database was bootstrapped must look like the refusal of a token that
+    // never verified, rather than a handshake that stops with nothing on the wire.
+    let refusal = test_transport
+        .recv()
+        .await
+        .expect("the refusal must be sent to the peer");
+    assert!(matches!(refusal, Err(auth::Error::InvalidBootstrapToken)));
+
+    assert!(matches!(
+        task.await.unwrap(),
+        Err(auth::Error::InvalidBootstrapToken)
+    ));
+
+    let mut conn = db.get().await.unwrap();
+    let count: i64 = schema::operator_identity::table
+        .count()
+        .get_result::<i64>(&mut conn)
+        .await
+        .unwrap();
+    assert_eq!(count, 0);
+}
+
+#[tokio::test]
+#[test_log::test]
+pub async fn bootstrap_invalid_token_auth() {
+    let db = db::create_test_pool().await;
+    let actors = spawn_actors(db.clone()).await;
+
+    let (mut server_transport, mut test_transport) = ChannelTransport::new();
+    let db_for_task = db.clone();
+    let task = tokio::spawn(async move {
+        let mut props = OperatorConnection::new(db_for_task, actors);
+        auth::authenticate(&mut props, &mut server_transport).await
+    });
+
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    test_transport
+        .send(auth::Inbound::AuthChallengeRequest {
+            pubkey: verifying_key(&new_key).into(),
+            bootstrap_token: Some("invalid_token".to_owned()),
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport
+        .recv()
+        .await
+        .expect("should receive challenge");
+    let challenge = match response {
+        Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
+        other => panic!("Expected AuthChallenge, got {other:?}"),
+    };
+
+    let signature = sign_operator_challenge(&new_key, &challenge);
+    test_transport
+        .send(auth::Inbound::AuthChallengeSolution {
+            signature: signature.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    // The reference behaviour the refusal above has to match: a token that never verified is
+    // reported to the peer. Pinned here so the two refusal paths cannot drift apart again.
+    let refusal = test_transport
+        .recv()
+        .await
+        .expect("the refusal must be sent to the peer");
+    assert!(matches!(refusal, Err(auth::Error::InvalidBootstrapToken)));
+
+    assert!(matches!(
+        task.await.unwrap(),
+        Err(auth::Error::InvalidBootstrapToken)
+    ));
+
+    let mut conn = db.get().await.unwrap();
+    let count: i64 = schema::operator_identity::table
+        .count()
+        .get_result::<i64>(&mut conn)
+        .await
+        .unwrap();
+    assert_eq!(count, 0);
+}
+
 #[tokio::test]
 #[test_log::test]
 pub async fn challenge_auth() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap {
@@ -353,7 +624,7 @@ pub async fn challenge_auth() {
 #[test_log::test]
 pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;

    actors
        .vault
@@ -427,7 +698,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
 #[test_log::test]
 pub async fn challenge_auth_rejects_invalid_signature() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap {
@@ -503,3 +774,230 @@ pub async fn challenge_auth_rejects_invalid_signature() {
        Err(auth::Error::InvalidChallengeSolution)
    ));
 }
+
+/// §3.5: a recovery operator is a separate peer type. Its key resolves against
+/// `recovery_operator_identity`, and authentication reports the recovery role.
+///
+/// An ordinary operator is registered alongside it so the recovery key is not simply the only
+/// key on file: the handshake has to reach the recovery table while `operator_identity` is
+/// populated. Both tables autoincrement from 1, so the fixture also pushes the authenticating
+/// recovery operator to id 2 -- with one row in each table an id taken from the wrong table
+/// would still read as 1, and only the variant would be under test.
+#[tokio::test]
+#[test_log::test]
+pub async fn recovery_operator_authenticates_with_its_own_identity() {
+    let db = db::create_test_pool().await;
+    let actors = spawn_actors(db.clone()).await;
+
+    let ordinary_key = MlDsa87::key_gen(&mut rand::rng());
+    let other_recovery_key = MlDsa87::key_gen(&mut rand::rng());
+    let recovery_key = MlDsa87::key_gen(&mut rand::rng());
+    let recovery_pubkey_bytes = authn::PublicKey::from(verifying_key(&recovery_key)).to_bytes();
+
+    let recovery_id: i32 = {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::operator_identity::table)
+            .values((schema::operator_identity::public_key
+                .eq(authn::PublicKey::from(verifying_key(&ordinary_key)).to_bytes()),))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        insert_into(schema::recovery_operator_identity::table)
+            .values((schema::recovery_operator_identity::public_key
+                .eq(authn::PublicKey::from(verifying_key(&other_recovery_key)).to_bytes()),))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        insert_into(schema::recovery_operator_identity::table)
+            .values((schema::recovery_operator_identity::public_key.eq(recovery_pubkey_bytes),))
+            .returning(schema::recovery_operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+    assert_eq!(
+        recovery_id, 2,
+        "the fixture must give the authenticating recovery operator an id no ordinary \
+         operator holds, or the id assertion below cannot discriminate"
+    );
+
+    let (mut server_transport, mut test_transport) = ChannelTransport::new();
+    let db_for_task = db.clone();
+    let task = tokio::spawn(async move {
+        let mut props = OperatorConnection::new(db_for_task, actors);
+        auth::authenticate(&mut props, &mut server_transport).await
+    });
+
+    test_transport
+        .send(auth::Inbound::AuthChallengeRequest {
+            pubkey: verifying_key(&recovery_key).into(),
+            bootstrap_token: None,
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport
+        .recv()
+        .await
+        .expect("should receive challenge");
+    let challenge = match response {
+        Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
+        other => panic!("Expected AuthChallenge, got {other:?}"),
+    };
+
+    let signature = sign_operator_challenge(&recovery_key, &challenge);
+    test_transport
+        .send(auth::Inbound::AuthChallengeSolution {
+            signature: signature.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport
+        .recv()
+        .await
+        .expect("should receive auth result");
+    assert!(matches!(response, Ok(auth::Outbound::AuthSuccess)));
+
+    let authenticated = task
+        .await
+        .unwrap()
+        .expect("recovery operator should authenticate");
+    match authenticated {
+        AuthenticatedOperator::Recovery(creds) => assert_eq!(creds.id, recovery_id),
+        AuthenticatedOperator::Ordinary(creds) => panic!(
+            "expected the recovery role, got the ordinary operator with id {}",
+            creds.id
+        ),
+    }
+}
+
+/// A key present in neither identity table is still rejected: accepting a key found in either
+/// table must not degrade into accepting any key at all. Both tables hold a row so the refusal
+/// cannot come from an empty lookup.
+#[tokio::test]
+#[test_log::test]
+pub async fn unknown_key_is_rejected_when_both_tables_are_populated() {
+    let db = db::create_test_pool().await;
+    let actors = spawn_actors(db.clone()).await;
+
+    let ordinary_key = MlDsa87::key_gen(&mut rand::rng());
+    let recovery_key = MlDsa87::key_gen(&mut rand::rng());
+    {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::operator_identity::table)
+            .values((schema::operator_identity::public_key
+                .eq(authn::PublicKey::from(verifying_key(&ordinary_key)).to_bytes()),))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        insert_into(schema::recovery_operator_identity::table)
+            .values((schema::recovery_operator_identity::public_key
+                .eq(authn::PublicKey::from(verifying_key(&recovery_key)).to_bytes()),))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+    }
+
+    let (mut server_transport, mut test_transport) = ChannelTransport::new();
+    let db_for_task = db.clone();
+    let task = tokio::spawn(async move {
+        let mut props = OperatorConnection::new(db_for_task, actors);
+        auth::authenticate(&mut props, &mut server_transport).await
+    });
+
+    let unknown_key = MlDsa87::key_gen(&mut rand::rng());
+    test_transport
+        .send(auth::Inbound::AuthChallengeRequest {
+            pubkey: verifying_key(&unknown_key).into(),
+            bootstrap_token: None,
+        })
+        .await
+        .unwrap();
+
+    assert!(matches!(
+        task.await.unwrap(),
+        Err(auth::Error::UnregisteredPublicKey)
+    ));
+}
+
+/// `verify_solution` resolves the recovery id only after the peer has sent its solution, so a
+/// recovery row removed between challenge and solution reaches that refusal. It has to be sent
+/// on the transport, like the `InvalidBootstrapToken` refusals in the arm above: an operator
+/// that has answered the challenge sees a protocol error rather than a handshake that stops
+/// with nothing on the wire.
+#[tokio::test]
+#[test_log::test]
+pub async fn recovery_key_removed_mid_handshake_is_refused_on_the_wire() {
+    let db = db::create_test_pool().await;
+    let actors = spawn_actors(db.clone()).await;
+
+    let recovery_key = MlDsa87::key_gen(&mut rand::rng());
+    let recovery_pubkey_bytes = authn::PublicKey::from(verifying_key(&recovery_key)).to_bytes();
+    {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::recovery_operator_identity::table)
+            .values((
+                schema::recovery_operator_identity::public_key.eq(recovery_pubkey_bytes.clone()),
+            ))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+    }
+
+    let (mut server_transport, mut test_transport) = ChannelTransport::new();
+    let db_for_task = db.clone();
+    let task = tokio::spawn(async move {
+        let mut props = OperatorConnection::new(db_for_task, actors);
+        auth::authenticate(&mut props, &mut server_transport).await
+    });
+
+    test_transport
+        .send(auth::Inbound::AuthChallengeRequest {
+            pubkey: verifying_key(&recovery_key).into(),
+            bootstrap_token: None,
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport
+        .recv()
+        .await
+        .expect("should receive challenge");
+    let challenge = match response {
+        Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
+        other => panic!("Expected AuthChallenge, got {other:?}"),
+    };
+
+    // The challenge has been issued and the solution has not been sent, so the server cannot
+    // have read the table again yet: the row is gone by the time `verify_solution` looks.
+    {
+        let mut conn = db.get().await.unwrap();
+        diesel::delete(
+            schema::recovery_operator_identity::table
+                .filter(schema::recovery_operator_identity::public_key.eq(recovery_pubkey_bytes)),
+        )
+        .execute(&mut conn)
+        .await
+        .unwrap();
+    }
+
+    let signature = sign_operator_challenge(&recovery_key, &challenge);
+    test_transport
+        .send(auth::Inbound::AuthChallengeSolution {
+            signature: signature.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    let refusal = test_transport
+        .recv()
+        .await
+        .expect("the refusal must be sent to the peer");
+    assert!(matches!(refusal, Err(auth::Error::UnregisteredPublicKey)));
+
+    assert!(matches!(
+        task.await.unwrap(),
+        Err(auth::Error::UnregisteredPublicKey)
+    ));
+}
--- a/server/crates/arbiter-server/tests/operator/unseal.rs
+++ b/server/crates/arbiter-server/tests/operator/unseal.rs
@@ -1,12 +1,10 @@
+use super::common::spawn_actors;
 use arbiter_crypto::authn;
 use arbiter_server::{
-    actors::{
-        GlobalActors,
-        vault::{Bootstrap, Seal},
-    },
+    actors::vault::{Bootstrap, Seal},
    db,
    peers::operator::{
-        Credentials,
+        AuthenticatedOperator, Credentials,
        vault_gate::{
            Error as VaultGateError, HandleHandshake, HandleUnsealEncryptedKey, VaultGate,
        },
@@ -26,7 +24,7 @@ async fn setup_sealed_gate(
    oneshot::Receiver<Result<(), VaultGateError>>,
 ) {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;

    actors
        .vault
@@ -39,7 +37,7 @@ async fn setup_sealed_gate(

    let (promotion_tx, promotion_rx) = oneshot::channel();
    let pubkey = authn::SigningKey::generate().public_key();
-    let auth_creds = Credentials { id: 1, pubkey };
+    let auth_creds = AuthenticatedOperator::Ordinary(Credentials { id: 1, pubkey });
    let gate = VaultGate::spawn(VaultGate::new(auth_creds, actors, db.clone(), promotion_tx));

    (db, gate, promotion_rx)
--- a/server/crates/arbiter-server/tests/vault/lifecycle.rs
+++ b/server/crates/arbiter-server/tests/vault/lifecycle.rs
@@ -1,21 +1,36 @@
 use crate::common;
-use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
+use arbiter_crypto::{
+    authn,
+    safecell::{SafeCell, SafeCellHandle as _},
+};
 use arbiter_server::{
    actors::{
        GlobalActors,
        vault::{Error, GetState, Vault, VaultState},
        vault_coordinator::{
            ContributeBootstrap, ContributeRecoveryBootstrap, ContributeRecoveryUnseal,
-            Error as CoordinatorError, StartBootstrap, VaultCoordinator,
+            ContributeUnseal, Error as CoordinatorError, StartBootstrap, VaultCoordinator,
        },
    },
    crypto::{KeyCell, encryption::v1::{Nonce, ROOT_KEY_TAG}},
    db::{self, models, schema},
+    peers::operator::{
+        AuthenticatedOperator, Credentials, RecoveryCredentials,
+        vault_gate::{
+            Error as VaultGateError, HandleBootstrapEncryptedKey,
+            HandleContributeBootstrapPassphrase, HandleContributeRecoveryBootstrapPassphrase,
+            HandleContributeRecoveryUnsealPassphrase, HandleContributeUnsealPassphrase,
+            HandleDeclareCommittee, HandleHandshake, VaultGate,
+        },
+    },
 };

-use diesel::{ExpressionMethods, QueryDsl, SelectableHelper, insert_into};
+use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
+use diesel::{ExpressionMethods, QueryDsl, SelectableHelper, insert_into, sql_query};
 use diesel_async::RunQueryDsl;
 use kameo::actor::Spawn as _;
+use tokio::sync::oneshot;
+use x25519_dalek::{EphemeralSecret, PublicKey};

 #[tokio::test]
 #[test_log::test]
@@ -254,6 +269,19 @@ async fn recovery_share_stored_and_used_for_unseal() {
    let state = vault_ref2.ask(GetState {}).await.unwrap();
    assert_eq!(state, VaultState::Sealed);

+    // §3.6: the recovery operator's share only counts once a wake-up request has stood
+    // uncancelled for the full dispute window, so back-date one here before unsealing.
+    {
+        let mut conn = db.get().await.unwrap();
+        sql_query(format!(
+            "INSERT INTO recovery_wakeup_request (requested_by, requested_at) \
+             VALUES ({ordinary_id}, unixepoch('now') - 14*24*3600 - 1)"
+        ))
+        .execute(&mut conn)
+        .await
+        .unwrap();
+    }
+
    // §3.5: Unseal using ONLY the recovery operator share (threshold = shamir_threshold(1) = 1).
    let coordinator2 = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref2.clone()));
    let done = coordinator2
@@ -268,3 +296,527 @@ async fn recovery_share_stored_and_used_for_unseal() {
    let state = vault_ref2.ask(GetState {}).await.unwrap();
    assert_eq!(state, VaultState::Unsealed);
 }
+
+/// A committee of zero ordinary operators used to reach `shamir_threshold(0)` and panic,
+/// taking the global coordinator down with it.
+#[tokio::test]
+#[test_log::test]
+async fn empty_committee_is_rejected_without_panicking() {
+    let db = db::create_test_pool().await;
+    let bus = GlobalActors::spawn_message_bus();
+    let vault_ref = Vault::spawn(Vault::new(db.clone(), bus).await.unwrap());
+    let coordinator = VaultCoordinator::spawn(VaultCoordinator::new(db, vault_ref));
+
+    let err = coordinator
+        .ask(StartBootstrap {
+            operator_id: 1,
+            declared_count: 0,
+            recovery_count: 1,
+        })
+        .await
+        .unwrap_err();
+
+    assert!(
+        matches!(
+            err,
+            kameo::error::SendError::HandlerError(CoordinatorError::EmptyCommittee)
+        ),
+        "expected EmptyCommittee, got {err:?}"
+    );
+
+    // The actor must still be alive to serve the next caller.
+    let err = coordinator
+        .ask(StartBootstrap {
+            operator_id: 1,
+            declared_count: 0,
+            recovery_count: 0,
+        })
+        .await
+        .unwrap_err();
+    assert!(matches!(
+        err,
+        kameo::error::SendError::HandlerError(CoordinatorError::EmptyCommittee)
+    ));
+}
+
+/// An approved-but-unfinished operator replacement deletes a share row. The unseal threshold
+/// must still describe the split that is actually stored, not the surviving row count.
+///
+/// Four ordinary operators give a real 3-of-4 `vsss-rs` split (`shamir_threshold(4) == 3`).
+/// Deleting one share row leaves 3 rows, and `shamir_threshold(3) == 2` -- a *different* number
+/// from the recorded threshold. A recount-based unseal would therefore finalize one contribution
+/// early, combine only 2 shares of a 3-of-4 split, and fail to reconstruct the seal key.
+#[tokio::test]
+#[test_log::test]
+async fn unseal_threshold_survives_a_deleted_share_row() {
+    let db = db::create_test_pool().await;
+    let bus = GlobalActors::spawn_message_bus();
+    let vault_ref = Vault::spawn(Vault::new(db.clone(), bus).await.unwrap());
+    let coordinator = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref));
+
+    // Four ordinary operators: threshold is 3-of-4.
+    let mut ids = Vec::new();
+    for n in 1..=4u8 {
+        let mut conn = db.get().await.unwrap();
+        let id: i32 = insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(vec![n; 32]))
+            .returning(schema::operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        ids.push(id);
+    }
+
+    coordinator
+        .ask(StartBootstrap {
+            operator_id: ids[0],
+            declared_count: 4,
+            recovery_count: 0,
+        })
+        .await
+        .unwrap();
+    for (n, id) in ids.iter().enumerate() {
+        coordinator
+            .ask(ContributeBootstrap {
+                operator_id: *id,
+                passphrase: SafeCell::new(format!("pass-{n}").into_bytes()),
+            })
+            .await
+            .unwrap();
+    }
+
+    let stored: Option<i32> = {
+        let mut conn = db.get().await.unwrap();
+        schema::arbiter_settings::table
+            .select(schema::arbiter_settings::shamir_threshold)
+            .first(&mut conn)
+            .await
+            .unwrap()
+    };
+    assert_eq!(stored, Some(3), "bootstrap must record the split threshold");
+
+    // Simulate the aborted replacement: one share row is gone, leaving 3 of the 4 shares.
+    {
+        let mut conn = db.get().await.unwrap();
+        diesel::delete(schema::operator::table)
+            .filter(schema::operator::id.eq(Some(ids[3])))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+    }
+
+    // Restart and unseal with the three surviving operators' original passphrases.
+    drop(coordinator);
+    let bus2 = GlobalActors::spawn_message_bus();
+    let vault_ref2 = Vault::spawn(Vault::new(db.clone(), bus2).await.unwrap());
+    let coordinator2 = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref2.clone()));
+
+    let done = coordinator2
+        .ask(ContributeUnseal {
+            operator_id: ids[0],
+            passphrase: SafeCell::new(b"pass-0".to_vec()),
+        })
+        .await
+        .unwrap();
+    assert!(!done, "one share must not be enough for a 3-of-4 split");
+
+    let done = coordinator2
+        .ask(ContributeUnseal {
+            operator_id: ids[1],
+            passphrase: SafeCell::new(b"pass-1".to_vec()),
+        })
+        .await
+        .unwrap();
+    assert!(
+        !done,
+        "two shares must not be enough for a 3-of-4 split -- a recount would wrongly finalize here"
+    );
+
+    let done = coordinator2
+        .ask(ContributeUnseal {
+            operator_id: ids[2],
+            passphrase: SafeCell::new(b"pass-2".to_vec()),
+        })
+        .await
+        .unwrap();
+    assert!(done, "three shares must reconstruct a 3-of-4 split");
+    assert_eq!(
+        vault_ref2.ask(GetState {}).await.unwrap(),
+        VaultState::Unsealed
+    );
+}
+
+/// §3.6: recovery operators are asleep by default. Without a wake-up whose 14-day dispute
+/// window has elapsed, their share must not count towards an unseal.
+#[tokio::test]
+#[test_log::test]
+async fn sleeping_recovery_operator_cannot_contribute_to_unseal() {
+    let db = db::create_test_pool().await;
+    let bus = GlobalActors::spawn_message_bus();
+    let vault_ref = Vault::spawn(Vault::new(db.clone(), bus).await.unwrap());
+    let coordinator = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref.clone()));
+
+    let ordinary_id: i32 = {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(vec![1u8; 32]))
+            .returning(schema::operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+    let recovery_id: i32 = {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::recovery_operator_identity::table)
+            .values(schema::recovery_operator_identity::public_key.eq(vec![2u8; 32]))
+            .returning(schema::recovery_operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+
+    coordinator
+        .ask(StartBootstrap {
+            operator_id: ordinary_id,
+            declared_count: 1,
+            recovery_count: 1,
+        })
+        .await
+        .unwrap();
+    coordinator
+        .ask(ContributeRecoveryBootstrap {
+            recovery_operator_id: recovery_id,
+            passphrase: SafeCell::new(b"recovery-pass".to_vec()),
+        })
+        .await
+        .unwrap();
+    coordinator
+        .ask(ContributeBootstrap {
+            operator_id: ordinary_id,
+            passphrase: SafeCell::new(b"ordinary-pass".to_vec()),
+        })
+        .await
+        .unwrap();
+
+    // Restart so the vault comes up Sealed.
+    drop(coordinator);
+    drop(vault_ref);
+    let bus2 = GlobalActors::spawn_message_bus();
+    let vault_ref2 = Vault::spawn(Vault::new(db.clone(), bus2).await.unwrap());
+    let coordinator2 = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref2.clone()));
+
+    let err = coordinator2
+        .ask(ContributeRecoveryUnseal {
+            recovery_operator_id: recovery_id,
+            passphrase: SafeCell::new(b"recovery-pass".to_vec()),
+        })
+        .await
+        .unwrap_err();
+
+    assert!(
+        matches!(
+            err,
+            kameo::error::SendError::HandlerError(CoordinatorError::RecoveryNotActive)
+        ),
+        "expected RecoveryNotActive, got {err:?}"
+    );
+    assert_eq!(
+        vault_ref2.ask(GetState {}).await.unwrap(),
+        VaultState::Sealed,
+        "a sleeping recovery operator unsealed the vault"
+    );
+}
+
+type PromotionRx = oneshot::Receiver<Result<(), VaultGateError>>;
+
+/// One `VaultGate` per authenticated role against a shared `GlobalActors`, which is what
+/// `peers::operator::start` builds for two connected peers.
+struct RoleGates {
+    ordinary: kameo::actor::ActorRef<VaultGate>,
+    recovery: kameo::actor::ActorRef<VaultGate>,
+    ordinary_id: i32,
+    recovery_id: i32,
+    /// Held only so the gates' promotion channels stay open for the fixture's lifetime.
+    _promotions: (PromotionRx, PromotionRx),
+}
+
+/// Registers one ordinary and one recovery identity, then spawns a gate for each.
+async fn spawn_role_gates(db: &db::DatabasePool, actors: &GlobalActors) -> RoleGates {
+    let ordinary_pubkey = authn::SigningKey::generate().public_key();
+    let recovery_pubkey = authn::SigningKey::generate().public_key();
+
+    let ordinary_id: i32 = {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(ordinary_pubkey.to_bytes()))
+            .returning(schema::operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+    let recovery_id: i32 = {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::recovery_operator_identity::table)
+            .values(schema::recovery_operator_identity::public_key.eq(recovery_pubkey.to_bytes()))
+            .returning(schema::recovery_operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+
+    let (ordinary_promotion_tx, ordinary_promotion_rx) = oneshot::channel();
+    let ordinary = VaultGate::spawn(VaultGate::new(
+        AuthenticatedOperator::Ordinary(Credentials {
+            id: ordinary_id,
+            pubkey: ordinary_pubkey,
+        }),
+        actors.clone(),
+        db.clone(),
+        ordinary_promotion_tx,
+    ));
+
+    let (recovery_promotion_tx, recovery_promotion_rx) = oneshot::channel();
+    let recovery = VaultGate::spawn(VaultGate::new(
+        AuthenticatedOperator::Recovery(RecoveryCredentials {
+            id: recovery_id,
+            pubkey: recovery_pubkey,
+        }),
+        actors.clone(),
+        db.clone(),
+        recovery_promotion_tx,
+    ));
+
+    RoleGates {
+        ordinary,
+        recovery,
+        ordinary_id,
+        recovery_id,
+        _promotions: (ordinary_promotion_rx, recovery_promotion_rx),
+    }
+}
+
+/// Runs the gate's X25519 handshake and encrypts `seal_key` to the shared secret, producing the
+/// message a peer would send to bootstrap the vault. Mirrors `tests/operator/unseal.rs`'s
+/// `client_dh_encrypt`, which does the same for the unseal side.
+async fn bootstrap_key_for(
+    gate: &kameo::actor::ActorRef<VaultGate>,
+    seal_key: &[u8; 32],
+) -> HandleBootstrapEncryptedKey {
+    let client_secret = EphemeralSecret::random();
+    let client_public = PublicKey::from(&client_secret);
+
+    let response = gate
+        .ask(HandleHandshake {
+            client_pubkey: client_public,
+        })
+        .await
+        .unwrap();
+
+    let shared_secret = client_secret.diffie_hellman(&response.server_pubkey);
+    let cipher = XChaCha20Poly1305::new(shared_secret.as_bytes().into());
+    let nonce = XNonce::from([0u8; 24]);
+    let associated_data = b"bootstrap";
+    let mut ciphertext = seal_key.to_vec();
+    cipher
+        .encrypt_in_place(&nonce, associated_data, &mut ciphertext)
+        .unwrap();
+
+    HandleBootstrapEncryptedKey {
+        nonce: nonce.to_vec(),
+        ciphertext,
+        associated_data: associated_data.to_vec(),
+    }
+}
+
+/// Asserts a gate turned a request down on the peer's role rather than on anything else --
+/// notably not on coordinator state, which is what an unguarded handler would have reported.
+#[track_caller]
+fn assert_role_refused<T: std::fmt::Debug, M>(
+    what: &str,
+    result: Result<T, kameo::error::SendError<M, VaultGateError>>,
+) {
+    match result {
+        Err(kameo::error::SendError::HandlerError(VaultGateError::RoleNotPermitted)) => {}
+        other => panic!("{what}: expected RoleNotPermitted, got {other:?}"),
+    }
+}
+
+/// §3.5: which committee seat a passphrase fills is decided by the handshake, not by the
+/// request, so neither role can spend the other's slot.
+///
+/// Neither request carries an operator id, so the ordinary peer has nothing left to forge; the
+/// point of running the bootstrap to completion afterwards is that its refusal left the
+/// recovery seat empty rather than filling it under a chosen id.
+#[tokio::test]
+#[test_log::test]
+async fn ordinary_operator_cannot_contribute_a_recovery_share() {
+    let db = db::create_test_pool().await;
+    let actors = common::spawn_actors(db.clone()).await;
+    let gates = spawn_role_gates(&db, &actors).await;
+    assert_eq!(
+        gates.ordinary_id, gates.recovery_id,
+        "the two ids must collide for the attestation check at the end to mean anything"
+    );
+
+    gates
+        .ordinary
+        .ask(HandleDeclareCommittee {
+            count: 1,
+            recovery_count: 1,
+        })
+        .await
+        .unwrap();
+
+    assert_role_refused(
+        "an ordinary operator contributed a recovery share",
+        gates
+            .ordinary
+            .ask(HandleContributeRecoveryBootstrapPassphrase {
+                passphrase: b"forged-recovery-pass".to_vec(),
+            })
+            .await,
+    );
+
+    assert_role_refused(
+        "a recovery operator contributed an ordinary share",
+        gates
+            .recovery
+            .ask(HandleContributeBootstrapPassphrase {
+                passphrase: b"forged-ordinary-pass".to_vec(),
+            })
+            .await,
+    );
+
+    // The recovery seat is still empty: had the forged contribution landed, this one would come
+    // back as a duplicate instead of being accepted.
+    let done = gates
+        .recovery
+        .ask(HandleContributeRecoveryBootstrapPassphrase {
+            passphrase: b"recovery-pass".to_vec(),
+        })
+        .await
+        .unwrap();
+    assert!(!done, "the ordinary share is still outstanding");
+
+    let done = gates
+        .ordinary
+        .ask(HandleContributeBootstrapPassphrase {
+            passphrase: b"ordinary-pass".to_vec(),
+        })
+        .await
+        .unwrap();
+    assert!(done, "both seats are filled, so bootstrap must finalize");
+    assert_eq!(
+        actors.vault.ask(GetState {}).await.unwrap(),
+        VaultState::Unsealed
+    );
+
+    // Both peers hold the same id in their own table (asserted above), so only the attestation
+    // kind tells the two envelopes apart. Two rows means the recovery peer signed as itself
+    // rather than overwriting the ordinary operator's attestation.
+    let kinds = common::eventually("both bootstrap attestations are written", || {
+        let db = db.clone();
+        async move {
+            let mut conn = db.get().await.unwrap();
+            let mut kinds: Vec<String> = schema::integrity_envelope::table
+                .select(schema::integrity_envelope::entity_kind)
+                .load(&mut conn)
+                .await
+                .unwrap();
+            kinds.sort();
+            (kinds.len() == 2).then_some(kinds)
+        }
+    })
+    .await;
+    assert_eq!(
+        kinds,
+        vec![
+            "operator_credentials".to_owned(),
+            "recovery_operator_credentials".to_owned(),
+        ]
+    );
+}
+
+/// Every gate action that belongs to one role refuses the other, and refuses it before the
+/// action takes effect.
+///
+/// The vault is left unbootstrapped and the coordinator idle on purpose: an unguarded handler
+/// would reach the vault or the coordinator and come back with `State`, `NotBootstrapping` or
+/// `NotUnsealing`, so `RoleNotPermitted` can only come from the role check itself.
+///
+/// §3.4/§3.5: `HandleBootstrapEncryptedKey` matters most here. It hands the vault a root key of
+/// the peer's choosing, and the window it needs -- an unbootstrapped vault that already holds
+/// recovery identity rows -- is exactly the state committee formation has to pass through.
+#[tokio::test]
+#[test_log::test]
+async fn vault_gate_refuses_the_actions_of_the_other_role() {
+    let db = db::create_test_pool().await;
+    let actors = common::spawn_actors(db.clone()).await;
+    let gates = spawn_role_gates(&db, &actors).await;
+
+    assert_role_refused(
+        "a recovery operator declared the committee",
+        gates
+            .recovery
+            .ask(HandleDeclareCommittee {
+                count: 1,
+                recovery_count: 1,
+            })
+            .await,
+    );
+
+    // A key the vault would have accepted, negotiated through the gate's own handshake -- so
+    // the refusal comes from the role and not from a malformed request.
+    let seized_key = bootstrap_key_for(&gates.recovery, b"recovery-seized-32-byte-seal-key").await;
+    assert_role_refused(
+        "a recovery operator bootstrapped the vault",
+        gates.recovery.ask(seized_key).await,
+    );
+
+    assert_role_refused(
+        "a recovery operator contributed an ordinary bootstrap share",
+        gates
+            .recovery
+            .ask(HandleContributeBootstrapPassphrase {
+                passphrase: b"forged-ordinary-pass".to_vec(),
+            })
+            .await,
+    );
+
+    assert_role_refused(
+        "an ordinary operator contributed a recovery bootstrap share",
+        gates
+            .ordinary
+            .ask(HandleContributeRecoveryBootstrapPassphrase {
+                passphrase: b"forged-recovery-pass".to_vec(),
+            })
+            .await,
+    );
+
+    assert_role_refused(
+        "a recovery operator contributed an ordinary unseal share",
+        gates
+            .recovery
+            .ask(HandleContributeUnsealPassphrase {
+                passphrase: b"forged-ordinary-pass".to_vec(),
+            })
+            .await,
+    );
+
+    assert_role_refused(
+        "an ordinary operator contributed a recovery unseal share",
+        gates
+            .ordinary
+            .ask(HandleContributeRecoveryUnsealPassphrase {
+                passphrase: b"forged-recovery-pass".to_vec(),
+            })
+            .await,
+    );
+
+    // Nothing above took effect: the refusals came before the vault and the coordinator.
+    assert_eq!(
+        actors.vault.ask(GetState {}).await.unwrap(),
+        VaultState::Unbootstrapped,
+        "a refused request still reached the vault"
+    );
+}
--- a/useragent/rust/Cargo.lock
+++ b/useragent/rust/Cargo.lock
Author	SHA1	Message	Date
CleverWild	a80cd39695	fix(mise): migrate from unix only `asdf` backend to a universal one	2026-09-08 16:11:42 +02:00
CleverWild	23183efd0c	fix(evm): revoke dependent grants when wallet access is revoked	2026-09-08 16:11:42 +02:00
CleverWild	8402691514	fix(vault): derive the recovery operator id from the authenticated peer	2026-09-08 16:11:42 +02:00
CleverWild	8d25d6640b	feat(operator): authenticate recovery operators as a distinct peer type	2026-09-08 16:11:42 +02:00
CleverWild	2b02d4a9b1	fix(bootstrap): keep the token valid until the vault is bootstrapped	2026-09-08 16:11:42 +02:00
CleverWild	5ade05d475	fix(vault): require an elapsed wake-up before a recovery share can unseal	2026-09-08 16:11:42 +02:00
CleverWild	e80dc53b0e	fix(vault): read the unseal threshold from the recorded split parameters	2026-09-08 16:11:42 +02:00
CleverWild	e10cc762d6	fix(proposal): count recovery operators only in electorates they can vote in	2026-09-08 16:11:42 +02:00
CleverWild	6e21505a7f	fix(operator): soft-revoke wallet access instead of deleting the row	2026-09-08 16:11:42 +02:00
CleverWild	a37af6bc1c	fix(db): enable foreign key enforcement on pooled connections	2026-09-08 16:11:42 +02:00
CleverWild	5d811f2ee9	fix(evm): reject unrepresentable grant timestamps instead of dropping the bound	2026-09-08 16:11:42 +02:00
CleverWild	5937ae8112	fix(operator): revoke wallet access by access id instead of wallet id	2026-09-08 16:11:42 +02:00
CleverWild	a9bc533129	test(vault): pin attestation validity across a re-key	2026-09-08 16:11:42 +02:00
CleverWild	3907241644	fix(vault): keep the root key row identity across a seal-key re-key	2026-09-08 16:11:42 +02:00
CleverWild	d916997ef3	fix(crypto): return None from shamir_threshold for an empty committee	2026-09-08 16:11:42 +02:00
CleverWild	f32da65467	refactor(proposal): put DB access behind a mockable ProposalStore trait	2026-09-08 16:11:42 +02:00