refactor(proposal): put DB access behind a mockable ProposalStore trait

2026-08-27 18:42:36 +02:00
42 changed files with 461 additions and 6872 deletions
--- a/mise.lock
+++ b/mise.lock
@@ -7,7 +7,6 @@ backend = "aqua:ast-grep/ast-grep"
 [tools.ast-grep."platforms.linux-arm64"]
 checksum = "sha256:3ba383839044cf9817929435f5ce0027f91d06931e8efb32d942e58d73d92be5"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-aarch64-unknown-linux-gnu.zip"
 url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388772218"
 [tools.ast-grep."platforms.linux-arm64-musl"]
 checksum = "sha256:3ba383839044cf9817929435f5ce0027f91d06931e8efb32d942e58d73d92be5"
@@ -16,7 +15,6 @@ url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-aarch64
 [tools.ast-grep."platforms.linux-x64"]
 checksum = "sha256:5de8b87cba67fc8dc3e239d54b6484802ad745a7ae3de76be4fe89661dc52657"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-unknown-linux-gnu.zip"
 url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388771275"
 [tools.ast-grep."platforms.linux-x64-musl"]
 checksum = "sha256:5de8b87cba67fc8dc3e239d54b6484802ad745a7ae3de76be4fe89661dc52657"
@@ -25,17 +23,14 @@ url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-
 [tools.ast-grep."platforms.macos-arm64"]
 checksum = "sha256:c3961d8e8a4ee0ce2d0d98c7beeb168bb331cdc766b53630118a7b6c4fd39015"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-aarch64-apple-darwin.zip"
 url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388770234"
 [tools.ast-grep."platforms.macos-x64"]
 checksum = "sha256:a038965bfd7fe44257c771cdf8918dc3467dd8ec0eef673b8b14f639b144cdbd"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-apple-darwin.zip"
 url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388770498"
 [tools.ast-grep."platforms.windows-x64"]
 checksum = "sha256:fe34f631bb24c08ad146f92ca2a92971a53d179461b509fd8d32dc863bff9f83"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-pc-windows-msvc.zip"
 url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388771363"
 [[tools."cargo:cargo-audit"]]
 version = "0.22.1"
@@ -62,7 +57,7 @@ version = "0.9.133"
 backend = "cargo:cargo-nextest"
 [[tools."cargo:cargo-shear"]]
-version = "1.13.4"
+version = "1.11.2"
 backend = "cargo:cargo-shear"
 [[tools."cargo:cargo-vet"]]
@@ -83,27 +78,7 @@ backend = "cargo:flutter_rust_bridge_codegen"
 [[tools.flutter]]
 version = "3.41.7-stable"
-backend = "http:flutter"
+backend = "asdf:flutter"
 [tools.flutter."platforms.linux-x64"]
 checksum = "sha256:f344d5057db52abc2a63cd3a7c7370957b7685d1fca5e5fbe2ce4dfe74657a79"
 url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.41.7-stable.tar.xz"
 [tools.flutter."platforms.linux-x64-musl"]
 checksum = "sha256:f344d5057db52abc2a63cd3a7c7370957b7685d1fca5e5fbe2ce4dfe74657a79"
 url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.41.7-stable.tar.xz"
 [tools.flutter."platforms.macos-arm64"]
 checksum = "sha256:2e3e6af44d1adccf695deff52e5e4c8beb10e5625066b27ad082b38b83ef805e"
 url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_arm64_3.41.7-stable.zip"
 [tools.flutter."platforms.macos-x64"]
 checksum = "sha256:a0b9af49e6e1a6800f31a408b98c1d7bd51e98650a8b9ebcd77168b48c916ff0"
 url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_3.41.7-stable.zip"
 [tools.flutter."platforms.windows-x64"]
 checksum = "sha256:de17b513b740a931c5dbc3f96b5a659c1612dfe6b5e1f910c5ad954a8bac17ee"
 url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/windows/flutter_windows_3.41.7-stable.zip"
 [[tools.protoc]]
 version = "29.6"
@@ -112,37 +87,30 @@ backend = "aqua:protocolbuffers/protobuf/protoc"
 [tools.protoc."platforms.linux-arm64"]
 checksum = "sha256:2594ff4fcae8cb57310d394d0961b236190ad9c5efbfdf1f597ea471d424fe79"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-aarch_64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795076"
 [tools.protoc."platforms.linux-arm64-musl"]
 checksum = "sha256:2594ff4fcae8cb57310d394d0961b236190ad9c5efbfdf1f597ea471d424fe79"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-aarch_64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795076"
 [tools.protoc."platforms.linux-x64"]
 checksum = "sha256:48785a926e73ffa3f68e2f22b14e7b849620c7a1d36809ac9249a5495e280323"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-x86_64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795083"
 [tools.protoc."platforms.linux-x64-musl"]
 checksum = "sha256:48785a926e73ffa3f68e2f22b14e7b849620c7a1d36809ac9249a5495e280323"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-x86_64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795083"
 [tools.protoc."platforms.macos-arm64"]
 checksum = "sha256:b9576b5fa1a1ef3fe13a8c91d9d8204b46545759bea5ae155cd6ba2ea4cdaeed"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-osx-aarch_64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795082"
 [tools.protoc."platforms.macos-x64"]
 checksum = "sha256:312f04713946921cc0187ef34df80241ddca1bab6f564c636885fd2cc90d3f88"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-osx-x86_64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795085"
 [tools.protoc."platforms.windows-x64"]
 checksum = "sha256:1ebd7c87baffb9f1c47169b640872bf5fb1e4408079c691af527be9561d8f6f7"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-win64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795088"
 [[tools.python]]
 version = "3.14.4"
@@ -154,8 +122,8 @@ url = "https://github.com/astral-sh/python-build-standalone/releases/download/20
 provenance = "github-attestations"
 [tools.python."platforms.linux-arm64-musl"]
-checksum = "sha256:a10687b226e0941632569836bc1d8fa6353a8e3e8424316467ca9cdf220b983d"
+checksum = "sha256:b8b597fdb2f8dccdc502c11947b60a4b65eb6bce79cfa60c7ccf9b6e8352c60a"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-aarch64-unknown-linux-musl-install_only_stripped.tar.gz"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
 provenance = "github-attestations"
 [tools.python."platforms.linux-x64"]
@@ -164,12 +132,12 @@ url = "https://github.com/astral-sh/python-build-standalone/releases/download/20
 provenance = "github-attestations"
 [tools.python."platforms.linux-x64-musl"]
-checksum = "sha256:d6005226cd24e780630626232c7a63243d4885fdf975dcf930a0758a0759ce14"
+checksum = "sha256:fe9a9c32d13870af632cbac3dfc7528ae53597e94472aa4c7d6a42e8166136cd"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-x86_64-unknown-linux-musl-install_only_stripped.tar.gz"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
 provenance = "github-attestations"
 [tools.python."platforms.macos-arm64"]
-checksum = "sha256:6f304f4ec30854611f23316578302235fb517cd970519ecdd11a8c4db87fd843"
+checksum = "blake3:0314ec66e0f33ec04959583b5900bc8edae371a396aa96b8874e750d1fe936e6"
 url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-aarch64-apple-darwin-install_only_stripped.tar.gz"
 provenance = "github-attestations"
@@ -186,6 +154,3 @@ provenance = "github-attestations"
 [[tools.rust]]
 version = "1.95.0"
 backend = "core:rust"
 [tools.rust.options]
 components = "clippy,rust-analyzer"
--- a/protobufs/operator/vault/bootstrap.proto
+++ b/protobufs/operator/vault/bootstrap.proto
@@ -18,7 +18,8 @@ message ContributePassphrase {
 }
 message ContributeRecoveryPassphrase {
-  bytes passphrase = 1;
+  int32 recovery_operator_id = 1;
  bytes passphrase            = 2;
 }
 enum BootstrapResult {
--- a/protobufs/operator/vault/rekey.proto
+++ b/protobufs/operator/vault/rekey.proto
@@ -7,7 +7,8 @@ message ContributePassphrase {
 }
 message ContributeRecoveryPassphrase {
-  bytes passphrase = 1;
+  int32 recovery_operator_id = 1;
  bytes passphrase           = 2;
 }
 enum RekeyResult {
--- a/protobufs/operator/vault/unseal.proto
+++ b/protobufs/operator/vault/unseal.proto
@@ -20,7 +20,8 @@ message ContributePassphrase {
 }
 message ContributeRecoveryPassphrase {
-  bytes passphrase = 1;
+  int32 recovery_operator_id = 1;
  bytes passphrase            = 2;
 }
 enum UnsealResult {
--- a/server/Cargo.lock
+++ b/server/Cargo.lock
@@ -789,7 +789,6 @@ dependencies = [
 "smlang",
 "strum 0.28.0",
 "subtle",
 "tempfile",
 "test-log",
 "thiserror",
 "tokio",
--- a/server/crates/arbiter-server/Cargo.toml
+++ b/server/crates/arbiter-server/Cargo.toml
@@ -60,7 +60,6 @@ rstest.workspace = true
 test-log = { version = "0.2", default-features = false, features = ["trace"] }
 ml-dsa.workspace = true
 mockall = "0.15.0"
 tempfile = "3.27.0"
 [lib]
 doctest = false
--- a/server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
+++ b/server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
@@ -37,11 +37,7 @@ create table if not exists tls_history (
 create table if not exists arbiter_settings (
    id INTEGER not null PRIMARY KEY CHECK (id = 1), -- singleton row, id must be 1
    root_key_id integer references root_key_history (id) on delete RESTRICT, -- if null, means wasn't bootstrapped yet
-    tls_id integer references tls_history (id) on delete RESTRICT,
+    tls_id integer references tls_history (id) on delete RESTRICT
    -- Shamir threshold of the split that produced the stored shares. Null before bootstrap.
    -- Recorded rather than recomputed: an aborted operator replacement leaves fewer share
    -- rows than the split has shares, and a recomputed threshold would then be wrong.
    shamir_threshold integer
 ) STRICT;
 insert into arbiter_settings (id) values (1) on conflict do nothing;
@@ -113,7 +109,6 @@ create table if not exists evm_wallet_access (
    id integer not null primary key,
    wallet_id integer not null references evm_wallet (id) on delete cascade,
    client_id integer not null references program_client (id) on delete cascade,
    revoked_at integer, -- unix timestamp when revoked, null = still active
    created_at integer not null default(unixepoch ('now'))
 ) STRICT;
--- a/server/crates/arbiter-server/src/actors/bootstrap.rs
+++ b/server/crates/arbiter-server/src/actors/bootstrap.rs
@@ -4,43 +4,28 @@ use arbiter_proto::{BOOTSTRAP_PATH, home_path};
 use diesel::QueryDsl;
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, messages};
-use rand::{
+use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng};
    distr::{Alphanumeric, SampleString as _},
    make_rng,
    rngs::StdRng,
 };
 use std::path::Path;
 use subtle::ConstantTimeEq as _;
 use thiserror::Error;
 const TOKEN_LENGTH: usize = 64;
-pub async fn generate_token(home: &Path) -> Result<String, std::io::Error> {
+pub async fn generate_token() -> Result<String, std::io::Error> {
-    let mut rng: StdRng = make_rng();
+    let rng: StdRng = make_rng();
-    // `Alphanumeric` samples raw `u8` ASCII codes, not `char`s -- `SampleString::sample_string`
+    let token = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
-    // is `rand`'s own documented way to turn that into an actual TOKEN_LENGTH-character string
+        String::default(),
-    // (see the "Passwords" example on `Alphanumeric`'s docs). A prior version of this function
+        |mut accum, char| {
-    // called `.to_string()` on the sampled `u8` directly, which stringifies the numeric byte
+            accum += char.to_string().as_str();
-    // value (e.g. `65` instead of `'A'`) rather than the character it represents, silently
+            accum
-    // producing a variable-length, all-decimal-digit string instead of a real token.
+        },
-    let token = Alphanumeric.sample_string(&mut rng, TOKEN_LENGTH);
+    );
-    tokio::fs::write(home.join(BOOTSTRAP_PATH), token.as_str()).await?;
+    tokio::fs::write(home_path()?.join(BOOTSTRAP_PATH), token.as_str()).await?;
    Ok(token)
 }
 /// A token file is only trustworthy if it looks like something `generate_token` could have
 /// produced. Anything else -- empty (a crash between the file's truncate and write), foreign
 /// content, or a trailing newline added by an editor -- must not be adopted as a live
 /// credential: an empty file would make every empty-string token verify, and mismatched
 /// content would silently lock out every operator holding the real, already-printed token.
 #[must_use]
 fn is_valid_token(candidate: &str) -> bool {
    candidate.len() == TOKEN_LENGTH && candidate.chars().all(|c| c.is_ascii_alphanumeric())
 }
 #[derive(Error, Debug)]
 pub enum Error {
    #[error("Database error: {0}")]
@@ -59,77 +44,31 @@ pub struct Bootstrapper {
 }
 impl Bootstrapper {
    /// Production constructor: resolves the real `~/.arbiter` directory and delegates.
    pub async fn new(db: &DatabasePool) -> Result<Self, Error> {
-        let home = home_path()?;
+        let row_count: i64 = {
-        Self::new_in(db, &home).await
+            let mut conn = db.get().await?;
    }
-    /// Carries all of `new`'s logic, parameterized on the directory the token file lives in.
+            schema::operator::table
-    /// `new` resolves the real home directory and calls this; tests call it directly with a
+                .count()
-    /// throwaway temp directory so they never touch the real `~/.arbiter/bootstrap_token`.
+                .get_result(&mut conn)
-    pub async fn new_in(db: &DatabasePool, home: &Path) -> Result<Self, Error> {
+                .await?
        let mut conn = db.get().await?;
        let bootstrapped: bool = schema::arbiter_settings::table
            .select(schema::arbiter_settings::root_key_id)
            .first::<Option<i32>>(&mut conn)
            .await?
            .is_some();
        if bootstrapped {
            return Ok(Self { token: None });
        }
        let any_operator_registered: bool = schema::operator_identity::table
            .count()
            .get_result::<i64>(&mut conn)
            .await?
            > 0;
        if !any_operator_registered {
            // Nobody has used the current token yet, so there is nothing to preserve across a
            // restart: generate a fresh one, exactly as on a first run. Reusing an old file
            // here would let a token survive a database reset, silently reviving trust in
            // whoever still held it.
            return Ok(Self {
                token: Some(generate_token(home).await?),
            });
        }
        // At least one operator has already registered with the current token: every other
        // declared operator still needs that same token, including across a restart, so an
        // existing file is reused rather than replaced -- but only if it still looks like a
        // real token. A truncated, foreign, or corrupted file must not become a live
        // credential (see `is_valid_token`).
        let path = home.join(BOOTSTRAP_PATH);
        let token = match tokio::fs::read_to_string(&path).await {
            Ok(existing) if is_valid_token(&existing) => existing,
            Ok(_) => {
                // Replacing the file invalidates whatever token the already-registered
                // operators were handed, so it must not happen quietly. The content itself is
                // a credential and stays out of the log; the path is enough to act on.
                tracing::warn!(
                    ?path,
                    "Bootstrap token file is not a well-formed token; replacing it"
                );
                generate_token(home).await?
            }
            Err(err) if err.kind() == std::io::ErrorKind::NotFound => generate_token(home).await?,
            Err(err) => return Err(Error::Io(err)),
        };
-        Ok(Self { token: Some(token) })
+        let token = if row_count == 0 {
-    }
+            let token = generate_token().await?;
            Some(token)
        } else {
            None
        };
-    /// Drops the token from memory. Called once the vault is bootstrapped: from then on,
+        Ok(Self { token })
    /// operators are added through governance rather than through the token.
    pub(crate) fn forget_token(&mut self) {
        self.token = None;
    }
 }
-    #[must_use]
+#[messages]
-    fn is_correct_token(&self, token: &str) -> bool {
+impl Bootstrapper {
    #[message]
    pub fn is_correct_token(&self, token: String) -> bool {
        self.token.as_ref().is_some_and(|expected| {
            let expected_bytes = expected.as_bytes();
            let token_bytes = token.as_bytes();
@@ -138,28 +77,15 @@ impl Bootstrapper {
            bool::from(choice)
        })
    }
 }
 #[messages]
 impl Bootstrapper {
    /// Checks the token without retiring it: every operator in a declared committee
    /// authenticates with the same token during bootstrap.
    #[message]
-    #[must_use]
+    pub fn consume_token(&mut self, token: String) -> bool {
-    pub fn verify_token(&self, token: String) -> bool {
+        if self.is_correct_token(token) {
-        self.is_correct_token(&token)
+            self.token = None;
-    }
+            true
-}
+        } else {
-
+            false
-impl kameo::prelude::Message<crate::actors::vault::events::Bootstrapped> for Bootstrapper {
+        }
    type Reply = ();
    async fn handle(
        &mut self,
        _msg: crate::actors::vault::events::Bootstrapped,
        _ctx: &mut kameo::prelude::Context<Self, Self::Reply>,
    ) -> Self::Reply {
        self.forget_token();
    }
 }
@@ -170,150 +96,3 @@ impl Bootstrapper {
        self.token.clone()
    }
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use diesel::{ExpressionMethods as _, insert_into, update};
    /// A multi-operator committee registers every member with the same token, so verifying it
    /// must not consume it. Only a completed bootstrap retires the token.
    #[tokio::test]
    async fn token_verifies_repeatedly_until_bootstrap_completes() {
        let mut bootstrapper = Bootstrapper {
            token: Some("test-token".to_owned()),
        };
        assert!(bootstrapper.verify_token("test-token".to_owned()));
        assert!(bootstrapper.verify_token("test-token".to_owned()));
        assert!(!bootstrapper.verify_token("wrong-token".to_owned()));
        bootstrapper.forget_token();
        assert!(!bootstrapper.verify_token("test-token".to_owned()));
        assert!(bootstrapper.get_token().is_none());
    }
    /// Once the vault is bootstrapped, `Bootstrapper::new_in` must return with no token -- and
    /// it must do so from `arbiter_settings.root_key_id` alone, taking the early return before
    /// `home` is ever consulted. Uses `new_in` with a throwaway temp directory (never the
    /// production `new`, which unconditionally resolves the real home directory before this
    /// method even runs) so this test cannot touch the real filesystem regardless of outcome.
    #[tokio::test]
    async fn new_returns_no_token_once_the_vault_is_bootstrapped() {
        let db = db::create_test_pool().await;
        let mut conn = db.get().await.unwrap();
        let root_key_history_id: i32 = insert_into(schema::root_key_history::table)
            .values(&db::models::NewRootKeyHistory {
                ciphertext: vec![0u8; 32],
                tag: vec![0u8; 16],
                root_key_encryption_nonce: vec![0u8; 24],
                data_encryption_nonce: vec![0u8; 24],
                schema_version: 1,
                salt: vec![0u8; 16],
            })
            .returning(schema::root_key_history::id)
            .get_result(&mut conn)
            .await
            .unwrap();
        update(schema::arbiter_settings::table)
            .set(schema::arbiter_settings::root_key_id.eq(root_key_history_id))
            .execute(&mut conn)
            .await
            .unwrap();
        drop(conn);
        let home = tempfile::tempdir().unwrap();
        let bootstrapper = Bootstrapper::new_in(&db, home.path()).await.unwrap();
        assert!(bootstrapper.get_token().is_none());
    }
    /// The file-reuse path (an operator has already registered, so bootstrap is unfinished)
    /// must not adopt a corrupted token file as a live credential: it must reject it and
    /// generate a fresh one instead. This is the Critical from the review, now reachable
    /// safely because `new_in` takes a throwaway temp directory instead of the real home.
    #[tokio::test]
    async fn new_in_rejects_and_replaces_a_corrupted_token_file() {
        let db = db::create_test_pool().await;
        let mut conn = db.get().await.unwrap();
        // At least one operator must have registered, or `new_in` would regenerate
        // unconditionally regardless of the file (Important 2) and never exercise validation.
        insert_into(schema::operator_identity::table)
            .values(schema::operator_identity::public_key.eq(vec![0u8; 32]))
            .execute(&mut conn)
            .await
            .unwrap();
        drop(conn);
        let home = tempfile::tempdir().unwrap();
        tokio::fs::write(home.path().join(BOOTSTRAP_PATH), "")
            .await
            .unwrap();
        let bootstrapper = Bootstrapper::new_in(&db, home.path()).await.unwrap();
        let token = bootstrapper
            .get_token()
            .expect("a fresh token must be generated");
        assert!(is_valid_token(&token));
        // The replacement must also have landed on disk, not just in memory, so a restart
        // reads back the same (now valid) token rather than the corrupted one again.
        let on_disk = tokio::fs::read_to_string(home.path().join(BOOTSTRAP_PATH))
            .await
            .unwrap();
        assert_eq!(on_disk, token);
    }
    /// The second defect the task exists to fix: a restart between the first registration and
    /// the completed bootstrap must not invalidate the token the other declared operators were
    /// already given. With an operator registered and a well-formed file on disk, `new_in` has
    /// to hand back exactly what it read instead of generating a replacement.
    #[tokio::test]
    async fn new_in_reuses_a_valid_token_file_across_a_restart() {
        let db = db::create_test_pool().await;
        let mut conn = db.get().await.unwrap();
        // Without a registered operator, `new_in` regenerates unconditionally (Important 2 of
        // the round-2 review) and never reaches the reuse path this test is about.
        insert_into(schema::operator_identity::table)
            .values(schema::operator_identity::public_key.eq(vec![0u8; 32]))
            .execute(&mut conn)
            .await
            .unwrap();
        drop(conn);
        let home = tempfile::tempdir().unwrap();
        // Stands in for the token a previous run wrote and printed to the console.
        let handed_out = "Zq7Z2rXaB90kLmNpQwErTyUiOpAsDfGhJkLzXcVbNmQwErTyUiOpAsDfGhJkLzXc";
        assert!(is_valid_token(handed_out));
        tokio::fs::write(home.path().join(BOOTSTRAP_PATH), handed_out)
            .await
            .unwrap();
        let bootstrapper = Bootstrapper::new_in(&db, home.path()).await.unwrap();
        assert_eq!(bootstrapper.get_token().as_deref(), Some(handed_out));
    }
    /// An empty file must not be adopted as a live credential: `is_correct_token`'s
    /// `is_some_and` would enter its closure for `Some(String::new())`, and comparing two empty
    /// byte slices is true, so an unauthenticated `Some("")` from the wire would otherwise
    /// verify. Also pins the other corrupted-content shapes `is_valid_token` must reject.
    #[test]
    fn is_valid_token_rejects_anything_that_is_not_a_real_token() {
        assert!(!is_valid_token(""));
        assert!(!is_valid_token("too-short"));
        assert!(!is_valid_token(&"a".repeat(TOKEN_LENGTH - 1)));
        assert!(!is_valid_token(&"a".repeat(TOKEN_LENGTH + 1)));
        // A trailing newline (e.g. from an editor) must not be silently accepted either.
        assert!(!is_valid_token(&format!("{}\n", "a".repeat(TOKEN_LENGTH))));
        assert!(!is_valid_token(&"!".repeat(TOKEN_LENGTH)));
        assert!(is_valid_token(&"a".repeat(TOKEN_LENGTH)));
    }
 }
--- a/server/crates/arbiter-server/src/actors/evm/mod.rs
+++ b/server/crates/arbiter-server/src/actors/evm/mod.rs
@@ -70,52 +70,6 @@ pub enum Error {
    #[error("Signing error: {0}")]
    Sign(#[from] SignTransactionError),
    #[error(
        "Grant timestamp {0} is outside the i32 range a grant boundary column can store \
         (Unix seconds, so no later than 2038-01-19T03:14:07Z)"
    )]
    InvalidTimestamp(i64),
    #[error("Wallet access {0} is revoked or does not exist")]
    AccessNotActive(i32),
 }
 /// Converts a grant boundary from Unix seconds. `None` in means "unbounded"; a value the
 /// boundary column cannot store is an error, never a silently different window.
 ///
 /// The range is `i32`, not `i64`, because that is what actually reaches the database:
 /// `SqliteTimestamp::to_sql` narrows to `i32` (`fixme! #84`), so `3_000_000_000` -- a
 /// `valid_from` in 2065 -- would wrap to 1902 and open the grant immediately instead of in
 /// forty years. Accepting only what round-trips keeps the grant that gets written the grant
 /// that was voted on.
 fn grant_timestamp(secs: Option<i64>) -> Result<Option<chrono::DateTime<chrono::Utc>>, Error> {
    secs.map(|s| {
        let storable = i32::try_from(s).map_err(|_| Error::InvalidTimestamp(s))?;
        chrono::DateTime::from_timestamp(i64::from(storable), 0).ok_or(Error::InvalidTimestamp(s))
    })
    .transpose()
 }
 /// Refuses an access id that is revoked or absent, so nothing hangs a grant off it.
 async fn ensure_access_active(
    conn: &mut crate::db::DatabaseConnection,
    access_id: i32,
 ) -> Result<(), Error> {
    let active: bool = diesel::select(diesel::dsl::exists(
        schema::evm_wallet_access::table
            .filter(schema::evm_wallet_access::id.eq(access_id))
            .filter(schema::evm_wallet_access::revoked_at.is_null()),
    ))
    .get_result(conn)
    .await
    .map_err(DatabaseError::from)?;
    if active {
        Ok(())
    } else {
        Err(Error::AccessNotActive(access_id))
    }
 }
 #[derive(Actor)]
@@ -262,7 +216,6 @@ impl EvmActor {
            .select(models::EvmWalletAccess::as_select())
            .filter(schema::evm_wallet_access::wallet_id.eq(wallet.id))
            .filter(schema::evm_wallet_access::client_id.eq(client_id))
            .filter(schema::evm_wallet_access::revoked_at.is_null())
            .first(&mut conn)
            .await
            .optional()
@@ -298,7 +251,6 @@ impl EvmActor {
            .select(models::EvmWalletAccess::as_select())
            .filter(schema::evm_wallet_access::wallet_id.eq(wallet.id))
            .filter(schema::evm_wallet_access::client_id.eq(client_id))
            .filter(schema::evm_wallet_access::revoked_at.is_null())
            .first(&mut conn)
            .await
            .optional()
@@ -361,22 +313,11 @@ impl EvmActor {
    ) -> Result<(), Error> {
        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
        // Revives a previously revoked row instead of conflicting on it forever:
        // `uniq_wallet_access` is a unique index on `(wallet_id, client_id)`. Visibility is
        // all this restores -- revocation closes the grants that hung off the access, so a
        // persistent grant needs its own vote again (§3.2). See
        // `peers::operator::session::handlers::revoke_wallet_access`.
        insert_into(schema::evm_wallet_access::table)
            .values((
                schema::evm_wallet_access::wallet_id.eq(EvmWalletId::from_raw(settings.wallet_id)),
                schema::evm_wallet_access::client_id.eq(settings.client_id),
            ))
            .on_conflict((
                schema::evm_wallet_access::wallet_id,
                schema::evm_wallet_access::client_id,
            ))
            .do_update()
            .set(schema::evm_wallet_access::revoked_at.eq(None::<models::SqliteTimestamp>))
            .execute(&mut conn)
            .await
            .map_err(DatabaseError::from)?;
@@ -394,14 +335,6 @@ impl EvmActor {
        use alloy::primitives::U256;
        use chrono::Duration;
        // A persistent grant is only as good as the visibility it hangs off (§3.2, two
        // separate votes). The proposal names the access id when it is created and can be
        // approved much later, so the access may have been revoked in between; a grant
        // against a revoked access would sit dormant and go live the moment anyone re-grants.
        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
        ensure_access_active(&mut conn, grant.wallet_access_id).await?;
        drop(conn);
        let volume = |limit: persistent_grant::VolumeLimit| VolumeRateLimit {
            max_volume: U256::from_be_bytes(limit.max_volume),
            window: Duration::seconds(limit.window_secs),
@@ -410,8 +343,12 @@ impl EvmActor {
        let basic = SharedGrantSettings {
            wallet_access_id: grant.wallet_access_id,
            chain: grant.chain_id,
-            valid_from: grant_timestamp(grant.valid_from_secs)?,
+            valid_from: grant
-            valid_until: grant_timestamp(grant.valid_until_secs)?,
+                .valid_from_secs
                .and_then(|s| chrono::DateTime::from_timestamp(s, 0)),
            valid_until: grant
                .valid_until_secs
                .and_then(|s| chrono::DateTime::from_timestamp(s, 0)),
            max_gas_fee_per_gas: grant.max_gas_fee_per_gas.map(U256::from_be_bytes),
            max_priority_fee_per_gas: grant.max_priority_fee_per_gas.map(U256::from_be_bytes),
            rate_limit: grant.rate_limit.map(|r| TransactionRateLimit {
@@ -477,218 +414,3 @@ impl EvmActor {
        Ok(())
    }
 }
 #[cfg(test)]
 mod tests {
    use super::{Error, EvmActor, ensure_access_active, grant_timestamp};
    use crate::db::{self, models, schema};
    use diesel::{ExpressionMethods as _, QueryDsl as _, dsl::insert_into};
    use diesel_async::RunQueryDsl;
    #[test]
    fn absent_timestamp_stays_absent() {
        assert!(grant_timestamp(None).unwrap().is_none());
    }
    #[test]
    fn in_range_timestamp_is_converted() {
        let converted = grant_timestamp(Some(1_800_000_000)).unwrap();
        assert_eq!(converted.unwrap().timestamp(), 1_800_000_000);
    }
    /// An unrepresentable expiry must not silently become "no expiry": that would widen the
    /// grant beyond what was voted on.
    #[test]
    fn out_of_range_timestamp_is_an_error() {
        let err = grant_timestamp(Some(i64::MAX)).unwrap_err();
        assert!(matches!(err, Error::InvalidTimestamp(i64::MAX)));
    }
    /// A `valid_from` past 2038 is representable as a `DateTime` but not as the `i32` the
    /// boundary column stores: `3_000_000_000` (2065) wraps to a negative, which reads back as
    /// 1902 and makes the grant active immediately. Refusing it is the only way the grant
    /// that lands can match the window that was voted on.
    #[test]
    fn a_timestamp_past_2038_is_an_error() {
        let past_2038 = 3_000_000_000_i64;
        assert!(
            chrono::DateTime::from_timestamp(past_2038, 0).is_some(),
            "the fixture must be a date chrono accepts, or it proves nothing about storage"
        );
        let err = grant_timestamp(Some(past_2038)).unwrap_err();
        assert!(
            matches!(err, Error::InvalidTimestamp(got) if got == past_2038),
            "expected an out-of-range error, got {err:?}"
        );
    }
    /// The last second the boundary column can hold must still be accepted: the range check
    /// has to stop at what storage can take, not short of it.
    #[test]
    fn the_last_storable_timestamp_is_accepted() {
        let converted = grant_timestamp(Some(i64::from(i32::MAX))).unwrap();
        assert_eq!(converted.unwrap().timestamp(), i64::from(i32::MAX));
    }
    /// Seeds a wallet, a client and one access row between them, and returns the access id.
    async fn seed_access(conn: &mut db::DatabaseConnection) -> i32 {
        let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
            .values(&models::NewRootKeyHistory {
                ciphertext: vec![0u8; 32],
                tag: vec![0u8; 16],
                root_key_encryption_nonce: vec![0u8; 24],
                data_encryption_nonce: vec![0u8; 24],
                schema_version: 1,
                salt: vec![0u8; 16],
            })
            .returning(schema::root_key_history::id)
            .get_result(conn)
            .await
            .unwrap();
        let aead_id: i32 = insert_into(schema::aead_encrypted::table)
            .values(&models::NewAeadEncrypted {
                ciphertext: vec![0u8; 32],
                tag: vec![0u8; 16],
                current_nonce: vec![0u8; 24],
                schema_version: 1,
                associated_root_key_id: root_key_id,
                created_at: chrono::Utc::now().into(),
            })
            .returning(schema::aead_encrypted::id)
            .get_result(conn)
            .await
            .unwrap();
        let wallet_id: models::EvmWalletId = insert_into(schema::evm_wallet::table)
            .values((
                schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
                schema::evm_wallet::aead_encrypted_id.eq(aead_id),
            ))
            .returning(schema::evm_wallet::id)
            .get_result(conn)
            .await
            .unwrap();
        let metadata_id: i32 = insert_into(schema::client_metadata::table)
            .values(schema::client_metadata::name.eq("test"))
            .returning(schema::client_metadata::id)
            .get_result(conn)
            .await
            .unwrap();
        let client_id: i32 = insert_into(schema::program_client::table)
            .values((
                schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
                schema::program_client::metadata_id.eq(metadata_id),
            ))
            .returning(schema::program_client::id)
            .get_result(conn)
            .await
            .unwrap();
        insert_into(schema::evm_wallet_access::table)
            .values((
                schema::evm_wallet_access::wallet_id.eq(wallet_id),
                schema::evm_wallet_access::client_id.eq(client_id),
            ))
            .returning(schema::evm_wallet_access::id)
            .get_result(conn)
            .await
            .unwrap()
    }
    /// Both directions, so a guard that refused everything could not pass: a live access is
    /// let through, a revoked one is not.
    #[tokio::test]
    async fn only_a_live_access_passes_the_grant_guard() {
        let pool = db::create_test_pool().await;
        let mut conn = pool.get().await.unwrap();
        let access_id = seed_access(&mut conn).await;
        ensure_access_active(&mut conn, access_id)
            .await
            .expect("a live access must pass");
        diesel::update(schema::evm_wallet_access::table)
            .filter(schema::evm_wallet_access::id.eq(access_id))
            .set(schema::evm_wallet_access::revoked_at.eq(models::SqliteTimestamp::now()))
            .execute(&mut conn)
            .await
            .unwrap();
        let err = ensure_access_active(&mut conn, access_id)
            .await
            .expect_err("a revoked access must be refused");
        assert!(
            matches!(err, Error::AccessNotActive(got) if got == access_id),
            "expected AccessNotActive, got {err:?}"
        );
    }
    /// The guard has to be wired into the executor, not just exist: an approved persistent
    /// grant whose access was revoked between proposal and approval must not create a grant
    /// that would go live again the moment anyone re-grants that access (§3.2).
    #[tokio::test]
    async fn an_approved_persistent_grant_refuses_a_revoked_access() {
        use crate::actors::{GlobalActors, vault::Vault};
        use crate::db::proposal::persistent_grant;
        use kameo::actor::Spawn as _;
        let pool = db::create_test_pool().await;
        let mut conn = pool.get().await.unwrap();
        let access_id = seed_access(&mut conn).await;
        diesel::update(schema::evm_wallet_access::table)
            .filter(schema::evm_wallet_access::id.eq(access_id))
            .set(schema::evm_wallet_access::revoked_at.eq(models::SqliteTimestamp::now()))
            .execute(&mut conn)
            .await
            .unwrap();
        drop(conn);
        let vault = Vault::spawn(
            Vault::new(pool.clone(), GlobalActors::spawn_message_bus())
                .await
                .unwrap(),
        );
        let mut evm_actor = EvmActor::new(vault, pool.clone());
        let err = evm_actor
            .create_persistent_grant(persistent_grant::Settings {
                wallet_access_id: access_id,
                chain_id: 1,
                valid_from_secs: None,
                valid_until_secs: None,
                max_gas_fee_per_gas: None,
                max_priority_fee_per_gas: None,
                rate_limit: None,
                specific: persistent_grant::Specific::EtherTransfer {
                    targets: vec![[0u8; 20]],
                    limit: persistent_grant::VolumeLimit {
                        max_volume: [0u8; 32],
                        window_secs: 3600,
                    },
                },
            })
            .await
            .expect_err("a grant against a revoked access must be refused");
        assert!(
            matches!(err, Error::AccessNotActive(got) if got == access_id),
            "expected AccessNotActive, got {err:?}"
        );
        let grants: i64 = schema::evm_basic_grant::table
            .filter(schema::evm_basic_grant::wallet_access_id.eq(access_id))
            .count()
            .get_result(&mut pool.get().await.unwrap())
            .await
            .unwrap();
        assert_eq!(
            grants, 0,
            "no grant row may be written for a revoked access"
        );
    }
 }
--- a/server/crates/arbiter-server/src/actors/mod.rs
+++ b/server/crates/arbiter-server/src/actors/mod.rs
@@ -5,7 +5,7 @@ use crate::{
        flow_coordinator::FlowCoordinator,
        operator_registry::OperatorRegistry,
        proposal_manager::{ProposalManager, events::ProposalApproved},
-        vault::{Vault, events},
+        vault::Vault,
        vault_coordinator::VaultCoordinator,
    },
    db,
@@ -17,7 +17,6 @@ use kameo_actors::{
    message_bus::{MessageBus, Register},
 };
 use thiserror::Error;
 use tracing::error;
 pub mod bootstrap;
 pub mod evm;
@@ -55,26 +54,6 @@ impl GlobalActors {
    }
    pub async fn spawn(db: db::DatabasePool) -> Result<Self, SpawnError> {
        let bootstrapper = Bootstrapper::new(&db).await?;
        Self::spawn_with_bootstrapper(db, bootstrapper).await
    }
    /// Test-facing: threads an explicit directory through to `Bootstrapper` instead of letting
    /// it resolve the real home directory, so a test spawning a full `GlobalActors` can never
    /// reach (let alone write to) the real `~/.arbiter/bootstrap_token`. Mirrors `spawn`
    /// exactly, aside from where the token file lives.
    pub async fn spawn_in(
        db: db::DatabasePool,
        home: &std::path::Path,
    ) -> Result<Self, SpawnError> {
        let bootstrapper = Bootstrapper::new_in(&db, home).await?;
        Self::spawn_with_bootstrapper(db, bootstrapper).await
    }
    async fn spawn_with_bootstrapper(
        db: db::DatabasePool,
        bootstrapper: Bootstrapper,
    ) -> Result<Self, SpawnError> {
        let message_bus = Self::spawn_message_bus();
        let key_holder = Vault::spawn(Vault::new(db.clone(), message_bus.clone()).await?);
        let operator_registry = OperatorRegistry::spawn(OperatorRegistry::default());
@@ -83,7 +62,6 @@ impl GlobalActors {
            db.clone(),
            key_holder.clone(),
        ));
        let bootstrapper = Bootstrapper::spawn(bootstrapper);
        // Approved proposals are executed by whoever owns the kind, not by ProposalManager.
        for recipient in [
            evm.clone().recipient::<ProposalApproved>(),
@@ -92,23 +70,9 @@ impl GlobalActors {
        ] {
            let _ = message_bus.tell(Register(recipient)).await;
        }
        // The token guards bootstrap only: once the vault reports success, it must be retired.
        // A dropped registration would leave the token valid forever with nothing else to
        // notice, so a failure here is logged rather than silently discarded.
        if let Err(err) = message_bus
            .tell(Register(
                bootstrapper.clone().recipient::<events::Bootstrapped>(),
            ))
            .await
        {
            error!(
                ?err,
                "Failed to register Bootstrapper for the Bootstrapped event"
            );
        }
        Ok(Self {
-            bootstrapper,
+            bootstrapper: Bootstrapper::spawn(Bootstrapper::new(&db).await?),
            proposal_manager: ProposalManager::spawn(ProposalManager::new(db, message_bus.clone())),
            vault: key_holder,
            vault_coordinator,
--- a/server/crates/arbiter-server/src/actors/proposal_manager.rs
+++ b/server/crates/arbiter-server/src/actors/proposal_manager.rs
@@ -25,6 +25,10 @@ pub mod store;
 pub const DEFAULT_TTL_SECS: u32 = 7 * 24 * 60 * 60; // 7 days
 pub const MAX_TTL_SECS: u32 = DEFAULT_TTL_SECS;
 /// Recovery operators stay asleep for this long after a wake-up is requested, so the other
 /// operators have time to dispute it (§3.6).
 const WAKEUP_DELAY_SECS: i32 = 14 * 24 * 60 * 60; // 14 days
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum VoteOutcome {
    Pending,
@@ -155,7 +159,10 @@ impl ProposalManager {
            .await?;
        let mut tally = self.store.tally(proposal_id).await?;
-        self.narrow_electorate(&proposal, &mut tally).await?;
+        // §3.5: recovery operators only join the electorate once they are awake.
        if !self.store.is_recovery_active().await? {
            tally.total_recovery = 0;
        }
        self.settle(&proposal, &tally).await
    }
@@ -233,9 +240,7 @@ impl ProposalManager {
            })
            .await?;
-        let mut tally = self.store.tally(proposal_id).await?;
+        let tally = self.store.tally(proposal_id).await?;
        self.narrow_electorate(&proposal, &mut tally).await?;
        self.settle(&proposal, &tally).await
    }
 }
@@ -252,22 +257,6 @@ impl ProposalManager {
        Ok(())
    }
    /// §3.5/§3.6: recovery operators join the electorate only for the kinds they may vote on,
    /// and only once the wake-up window has elapsed. Counting them anywhere else makes the
    /// rejection threshold unreachable and, for full-quorum kinds, approval unreachable too.
    ///
    /// The votes go out with the voters. A wake-up can be cancelled after recovery operators
    /// have already voted (`cancel_wakeup` cancels any uncancelled request, elapsed or not),
    /// so a `ReplaceOperator` tally can hold recovery approvals at the moment the committee
    /// stops being eligible. Keeping those while zeroing only the electorate size would let
    /// them cover ordinary votes that were never cast.
    async fn narrow_electorate(&self, proposal: &Proposal, tally: &mut Tally) -> Result<(), Error> {
        if !proposal.kind.recovery_may_vote() || !self.store.is_recovery_active().await? {
            tally.drop_recovery();
        }
        Ok(())
    }
    /// Pure quorum arithmetic — no I/O, so the rules can be tested directly (§3.3).
    ///
    /// A proposal is rejected once approval has become unreachable: even if every voter
@@ -276,13 +265,6 @@ impl ProposalManager {
    pub(crate) const fn evaluate_quorum(tally: &Tally, requires_full_quorum: bool) -> VoteOutcome {
        let total_eligible = tally.total_ordinary + tally.total_recovery;
        // No electorate, nothing to settle. Guarded before the branch rather than inside it:
        // the full-quorum arm would otherwise set `threshold` to 0 and read an empty tally as
        // unanimous approval.
        if total_eligible <= 0 {
            return VoteOutcome::Pending;
        }
        #[expect(
            clippy::cast_possible_truncation,
            clippy::cast_sign_loss,
@@ -295,16 +277,12 @@ impl ProposalManager {
        let threshold: i64 = if requires_full_quorum {
            total_eligible
        } else {
-            match crate::crypto::shamir::shamir_threshold(tally.total_ordinary as usize) {
+            crate::crypto::shamir::shamir_threshold(tally.total_ordinary as usize) as i64
                Some(threshold) => threshold as i64,
                // No ordinary operators means no electorate: nothing can settle.
                None => return VoteOutcome::Pending,
            }
        };
-        if tally.approve() >= threshold {
+        if tally.approve >= threshold {
            VoteOutcome::Approved
-        } else if tally.reject() > total_eligible - threshold {
+        } else if tally.reject > total_eligible - threshold {
            VoteOutcome::Rejected
        } else {
            VoteOutcome::Pending
--- a/server/crates/arbiter-server/src/actors/proposal_manager/store.rs
+++ b/server/crates/arbiter-server/src/actors/proposal_manager/store.rs
@@ -3,9 +3,10 @@
 //! The actor holds a `dyn ProposalStore` rather than a connection pool, so the quorum
 //! rules can be exercised against a mock instead of a live SQLite file.
-use super::{Error, ProposalSummary};
+use super::{Error, ProposalSummary, WAKEUP_DELAY_SECS};
 use crate::db::{
    self,
    functions::unixepoch,
    models::{
        NewProposal, NewProposalVote, NewRecoveryProposalVote, NewRecoveryWakeupRequest,
        OperatorIdentityId, Proposal, ProposalId, ProposalStatus, RecoveryOperatorIdentityId,
@@ -26,43 +27,14 @@ use std::collections::HashMap;
 use strum::IntoDiscriminant as _;
 /// Everything the quorum rules need to know about one proposal's votes.
 ///
 /// Votes are kept per electorate rather than pre-summed: an electorate can stop counting
 /// between the vote and the tally (§3.6 -- recovery goes back to sleep the moment a wake-up
 /// is cancelled), and the votes it already cast have to leave with it. A single `approve`
 /// field would carry them past [`Tally::drop_recovery`] into a threshold computed for the
 /// ordinary committee alone.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct Tally {
-    pub ordinary_approve: i64,
+    pub approve: i64,
-    pub ordinary_reject: i64,
+    pub reject: i64,
    pub recovery_approve: i64,
    pub recovery_reject: i64,
    pub total_ordinary: i64,
    pub total_recovery: i64,
 }
 impl Tally {
    /// Approvals from every electorate that still counts.
    pub const fn approve(&self) -> i64 {
        self.ordinary_approve + self.recovery_approve
    }
    /// Rejections from every electorate that still counts.
    pub const fn reject(&self) -> i64 {
        self.ordinary_reject + self.recovery_reject
    }
    /// Takes the recovery committee out of the electorate, votes and all. The three numbers
    /// go together: leaving the votes behind counts them against a threshold derived from an
    /// electorate they are no longer part of.
    pub const fn drop_recovery(&mut self) {
        self.recovery_approve = 0;
        self.recovery_reject = 0;
        self.total_recovery = 0;
    }
 }
 #[cfg_attr(test, mockall::automock)]
 #[async_trait]
 pub trait ProposalStore: Send + Sync + 'static {
@@ -302,10 +274,8 @@ impl ProposalStore for DieselProposalStore {
            .await?;
        Ok(Tally {
-            ordinary_approve,
+            approve: ordinary_approve + recovery_approve,
-            ordinary_reject,
+            reject: ordinary_reject + recovery_reject,
            recovery_approve,
            recovery_reject,
            total_ordinary,
            total_recovery,
        })
@@ -390,9 +360,17 @@ impl ProposalStore for DieselProposalStore {
    async fn is_recovery_active(&self) -> Result<bool, Error> {
        let mut conn = self.db.get().await?;
-        db::recovery::is_active(&mut conn)
+        select(exists(
-            .await
+            schema::recovery_wakeup_request::table
-            .map_err(Error::from)
+                .filter(schema::recovery_wakeup_request::cancelled_at.is_null())
                .filter(
                    schema::recovery_wakeup_request::requested_at
                        .le(unixepoch("now") - WAKEUP_DELAY_SECS),
                ),
        ))
        .get_result(&mut conn)
        .await
        .map_err(Error::from)
    }
    async fn has_uncancelled_wakeup(&self) -> Result<bool, Error> {
--- a/server/crates/arbiter-server/src/actors/proposal_manager/tests.rs
+++ b/server/crates/arbiter-server/src/actors/proposal_manager/tests.rs
@@ -20,37 +20,15 @@ use arbiter_crypto::authn::{SigningContext, SigningKey};
 use chrono::{Duration, Utc};
 use std::sync::Arc;
 /// A tally where every vote came from the ordinary committee.
 const fn tally(approve: i64, reject: i64, ordinary: i64, recovery: i64) -> Tally {
    Tally {
-        ordinary_approve: approve,
+        approve,
-        ordinary_reject: reject,
+        reject,
        recovery_approve: 0,
        recovery_reject: 0,
        total_ordinary: ordinary,
        total_recovery: recovery,
    }
 }
 /// A tally with votes from both committees, in the order approve/reject per committee.
 const fn mixed_tally(
    ordinary_approve: i64,
    ordinary_reject: i64,
    recovery_approve: i64,
    recovery_reject: i64,
    total_ordinary: i64,
    total_recovery: i64,
 ) -> Tally {
    Tally {
        ordinary_approve,
        ordinary_reject,
        recovery_approve,
        recovery_reject,
        total_ordinary,
        total_recovery,
    }
 }
 #[test]
 fn simple_majority_approves_at_two_of_three() {
    assert_eq!(
@@ -79,32 +57,16 @@ fn full_quorum_kind_needs_every_voter() {
 #[test]
 fn recovery_voters_count_towards_full_quorum() {
    assert_eq!(
-        ProposalManager::evaluate_quorum(&mixed_tally(2, 0, 1, 0, 2, 1), true),
+        ProposalManager::evaluate_quorum(&tally(3, 0, 2, 1), true),
        VoteOutcome::Approved
    );
    assert_eq!(
-        ProposalManager::evaluate_quorum(&mixed_tally(2, 0, 0, 0, 2, 1), true),
+        ProposalManager::evaluate_quorum(&tally(2, 0, 2, 1), true),
        VoteOutcome::Pending,
        "the sleeping recovery operator still owes a vote"
    );
 }
 /// An empty committee cannot approve anything. Both arms have to say so: the full-quorum arm
 /// derives its threshold from the electorate, so with nobody eligible it would compare 0
 /// approvals against a threshold of 0 and call that unanimous.
 #[test]
 fn an_empty_electorate_settles_nothing() {
    assert_eq!(
        ProposalManager::evaluate_quorum(&tally(0, 0, 0, 0), true),
        VoteOutcome::Pending,
        "a full-quorum proposal must not pass with no eligible voters"
    );
    assert_eq!(
        ProposalManager::evaluate_quorum(&tally(0, 0, 0, 0), false),
        VoteOutcome::Pending
    );
 }
 #[test]
 fn rejection_is_decided_once_approval_is_unreachable() {
    // Threshold is 2 of 3, so two rejections leave at most one approval available.
@@ -218,23 +180,11 @@ async fn a_vote_short_of_quorum_does_not_touch_the_status() {
    assert_eq!(outcome, VoteOutcome::Pending);
 }
-/// Drives one `cast_vote` on a proposal of the given `kind` through a mocked store and
+/// A sleeping recovery electorate must not raise the bar for an ordinary proposal.
-/// returns the outcome. `recovery_active` decides what `is_recovery_active` reports;
+#[tokio::test]
-/// `expected_status` is the status a settled outcome must be persisted under, or `None` for
+async fn sleeping_recovery_operators_do_not_count_towards_quorum() {
-/// a caller that expects the vote to leave the proposal pending.
+    let id = ProposalId::from_raw(9);
-///
+    let voter = OperatorIdentityId::from_raw(3);
 /// `set_status` carries an argument matcher but no `.times()`, and `None` relaxes even the
 /// matcher: the caller's own `assert_eq!` on the outcome is what pins the behaviour, so a
 /// regression fails on a readable diff rather than on a mockall cardinality panic that hides
 /// what the actor actually computed.
 async fn settle_vote_with(
    kind: ProposalKindTag,
    tally: Tally,
    recovery_active: bool,
    expected_status: Option<ProposalStatus>,
 ) -> VoteOutcome {
    let id = ProposalId::from_raw(11);
    let voter = OperatorIdentityId::from_raw(1);
    let key = SigningKey::generate();
    let signature = key
        .sign_message(&vote_message(id, true), SigningContext::GovernanceVote)
@@ -244,152 +194,29 @@ async fn settle_vote_with(
    let mut store = MockProposalStore::new();
    store
        .expect_load()
-        .returning(move |id| Ok(pending_proposal(id, kind)));
+        .returning(move |id| Ok(pending_proposal(id, ProposalKindTag::ApproveSdkClient)));
    store.expect_has_voted().returning(|_, _| Ok(false));
    store
        .expect_operator_public_key()
        .returning(move |_| Ok(public_key.clone()));
    store.expect_record_vote().returning(|_| Ok(()));
-    store
+    store.expect_is_recovery_active().returning(|| Ok(false));
-        .expect_is_recovery_active()
+    // Two recovery operators exist but are asleep, so the threshold stays at 1 of 1.
-        .returning(move || Ok(recovery_active));
+    store.expect_tally().returning(|_| Ok(tally(1, 0, 1, 2)));
-    store.expect_tally().returning(move |_| Ok(tally));
+    store.expect_set_status().times(1).returning(|_, _| Ok(()));
-    store
+    store.expect_load_kind().returning(|_, _| {
-        .expect_set_status()
+        Ok(crate::db::proposal::ProposalKind::ApproveSdkClient(
-        .withf(move |_, status| {
+            crate::db::proposal::approve_sdk_client::Settings { client_id: 1 },
-            expected_status
+        ))
                .as_ref()
                .is_none_or(|expected| status == expected)
        })
        .returning(|_, _| Ok(()));
    store.expect_load_kind().returning(move |_, _| {
        Ok(match kind {
            ProposalKindTag::TriggerRekey => crate::db::proposal::ProposalKind::TriggerRekey,
            ProposalKindTag::ApproveSdkClient => {
                crate::db::proposal::ProposalKind::ApproveSdkClient(
                    crate::db::proposal::approve_sdk_client::Settings { client_id: 1 },
                )
            }
            ProposalKindTag::ReplaceOperator => crate::db::proposal::ProposalKind::ReplaceOperator(
                crate::db::proposal::replace_operator::Settings {
                    old_operator_id: OperatorIdentityId::from_raw(1),
                    new_pubkey: vec![0u8; 32],
                },
            ),
            other => unreachable!("settle_vote_with has no load_kind fixture for {other:?}"),
        })
    });
    let mut manager =
        ProposalManager::with_store(Arc::new(store), GlobalActors::spawn_message_bus());
-    manager
+    let outcome = manager
        .cast_vote(id, voter, true, signature.to_bytes())
        .await
-        .expect("a valid vote must be accepted")
+        .expect("a valid vote must be accepted");
 }
 /// The full-quorum rejection path is insensitive to electorate size by construction:
 /// `threshold == total_eligible` there, so `total_eligible - threshold` is always 0 and any
 /// single rejection settles the proposal, whether or not recovery operators are (wrongly)
 /// counted. This does not exercise the electorate-narrowing fix -- see
 /// `unanimous_ordinary_rejection_rejects_a_non_full_quorum_proposal_while_recovery_is_awake`
 /// below for the test that does -- it just pins that `cast_vote` still writes `Rejected`
 /// through `settle` for a full-quorum kind.
 #[tokio::test]
 async fn unanimous_rejection_settles_a_full_quorum_rekey_via_cast_vote() {
    let outcome = settle_vote_with(
        ProposalKindTag::TriggerRekey,
        tally(0, 3, 3, 2),
        /* recovery_active */ true,
        Some(ProposalStatus::Rejected),
    )
    .await;
    assert_eq!(outcome, VoteOutcome::Rejected);
 }
 /// §3.3 full quorum for a rekey means every *ordinary* operator, not every identity on file.
 #[tokio::test]
 async fn unanimous_ordinary_approval_approves_a_rekey_while_recovery_is_awake() {
    let outcome = settle_vote_with(
        ProposalKindTag::TriggerRekey,
        tally(3, 0, 3, 2),
        /* recovery_active */ true,
        Some(ProposalStatus::Approved),
    )
    .await;
    assert_eq!(outcome, VoteOutcome::Approved);
 }
 /// §3.5: recovery operators do not vote on `ApproveSdkClient`, so they must not inflate its
 /// electorate. Before the fix, `total_eligible` counted them anyway (5, not 3), so the
 /// rejection test `reject > total_eligible - threshold` became `3 > 5 - 2 = 3`, which is
 /// false -- three unanimous rejections left the proposal `Pending` forever, since a fourth
 /// vote could never arrive. After the fix, `total_eligible` is 3 and the same test becomes
 /// `3 > 3 - 2 = 1`, which settles it.
 #[tokio::test]
 async fn unanimous_ordinary_rejection_rejects_a_non_full_quorum_proposal_while_recovery_is_awake() {
    let outcome = settle_vote_with(
        ProposalKindTag::ApproveSdkClient,
        tally(0, 3, 3, 2),
        /* recovery_active */ true,
        Some(ProposalStatus::Rejected),
    )
    .await;
    assert_eq!(outcome, VoteOutcome::Rejected);
 }
 /// §3.5/§3.6: `ReplaceOperator` is the one kind recovery may vote on, so it is the only kind
 /// where whether recovery is awake is observable at all -- for every other kind
 /// `narrow_electorate` zeroes `total_recovery` regardless of `is_recovery_active`, short-
 /// circuiting before that call. A sleeping recovery electorate must not raise the bar here:
 /// with 1 ordinary operator and 2 (asleep) recovery operators, the lone ordinary approval
 /// must already reach full quorum.
 #[tokio::test]
 async fn sleeping_recovery_operators_do_not_count_towards_quorum() {
    let outcome = settle_vote_with(
        ProposalKindTag::ReplaceOperator,
        tally(1, 0, 1, 2),
        /* recovery_active */ false,
        Some(ProposalStatus::Approved),
    )
    .await;
    assert_eq!(outcome, VoteOutcome::Approved);
 }
 /// The sequence the whole-branch review worked through, on a `ReplaceOperator` with 3
 /// ordinary and 2 recovery operators (§3.3: full quorum). Both recovery operators approve
 /// while awake; one ordinary operator approves; another ordinary operator then cancels the
 /// wake-up -- `cancel_wakeup` cancels an uncancelled request whether or not its window has
 /// elapsed, so the committee goes straight back to sleep with its votes on the record; a
 /// second ordinary operator approves.
 ///
 /// The store now reports 4 approvals, 2 of them from a committee that is no longer eligible.
 /// Narrowing the electorate has to drop those votes along with the voters: what is left is 2
 /// of 3 ordinary approvals, and a full quorum needs all three. Counting the electorate down
 /// to 3 while keeping all 4 votes would replace an operator on two ordinary approvals.
 #[tokio::test]
 async fn recovery_votes_leave_with_the_committee_that_cast_them() {
    let outcome = settle_vote_with(
        ProposalKindTag::ReplaceOperator,
        mixed_tally(
            /* ordinary_approve */ 2, /* ordinary_reject */ 0,
            /* recovery_approve */ 2, /* recovery_reject */ 0,
            /* total_ordinary */ 3, /* total_recovery */ 2,
        ),
        /* recovery_active */ false,
        None,
    )
    .await;
    assert_eq!(
        outcome,
        VoteOutcome::Pending,
        "two of three ordinary approvals must not carry a full-quorum proposal, whatever a \
         sleeping recovery committee voted earlier"
    );
 }
--- a/server/crates/arbiter-server/src/actors/vault/mod.rs
+++ b/server/crates/arbiter-server/src/actors/vault/mod.rs
@@ -222,9 +222,7 @@ impl Vault {
        });
        info!("Vault bootstrapped successfully");
-        if let Err(err) = self.events.tell(Publish(events::Bootstrapped)).await {
+        let _ = self.events.tell(Publish(events::Bootstrapped)).await;
            error!(?err, "Failed to publish Bootstrapped event");
        }
        Ok(())
    }
@@ -279,10 +277,8 @@ impl Vault {
        Ok(())
    }
-    /// Re-encrypts the root key with `new_seal_key`, updating its `root_key_history` row in
+    /// Re-encrypts the root key with `new_seal_key` and records a new root_key_history row.
-    /// place. Called after a Shamir re-key, so the old seal key is no longer sufficient to
+    /// Called after a Shamir re-key so the old seal key is no longer sufficient to unseal.
    /// unseal. The root key itself does not change, so its row identity (and the nonce counter
    /// and integrity envelopes bound to it) must not change either.
    #[message]
    pub async fn rekey_root_key(&mut self, mut new_seal_key: KeyCell) -> Result<(), Error> {
        let Unsealed {
@@ -302,31 +298,34 @@ impl Vault {
                })
        })?;
-        let mut conn = self.db.get().await?;
+        let data_encryption_nonce = Nonce::default();
-        // The root key is unchanged, so its row keeps its identity: `data_encryption_nonce`
+        let mut conn = self.db.get().await?;
-        // keeps counting up, and every integrity envelope stays bound to the same key version.
+        let new_root_key_history_id: i32 = conn
-        // Only the seal-key material is replaced, retiring the previous one. `tag` and
+            .transaction(async |conn| {
-        // `schema_version` are deliberately left untouched: the seal-key encryption scheme
+                let new_id = insert_into(schema::root_key_history::table)
-        // itself is unchanged by a re-key, so there is nothing new for them to describe.
+                    .values(&models::NewRootKeyHistory {
-        let rows_updated = update(schema::root_key_history::table)
+                        ciphertext: new_ciphertext,
-            .filter(schema::root_key_history::id.eq(*root_key_history_id))
+                        tag: v1::ROOT_KEY_TAG.to_vec(),
-            .set((
+                        root_key_encryption_nonce: new_nonce.to_vec(),
-                schema::root_key_history::ciphertext.eq(new_ciphertext),
+                        data_encryption_nonce: data_encryption_nonce.to_vec(),
-                schema::root_key_history::root_key_encryption_nonce.eq(new_nonce.to_vec()),
+                        schema_version: 1,
-                schema::root_key_history::salt.eq(new_salt.to_vec()),
+                        salt: new_salt.to_vec(),
-            ))
+                    })
-            .execute(&mut conn)
+                    .returning(schema::root_key_history::id)
                    .get_result::<i32>(&mut *conn)
                    .await?;
                update(schema::arbiter_settings::table)
                    .set(schema::arbiter_settings::root_key_id.eq(new_id))
                    .execute(&mut *conn)
                    .await?;
                Result::<_, diesel::result::Error>::Ok(new_id)
            })
            .await?;
-        if rows_updated == 0 {
+        *root_key_history_id = RootKeyHistoryId::from_raw(new_root_key_history_id);
            error!(
                "Broken database: rekey matched no root_key_history row id={:#?}",
                root_key_history_id
            );
            return Err(Error::BrokenDatabase);
        }
        info!("Vault root key rekeyed successfully");
        Ok(())
    }
@@ -523,6 +522,7 @@ impl Vault {
 #[cfg(test)]
 mod tests {
    use crate::actors::GlobalActors;
    use arbiter_crypto::safecell::SafeCellHandle as _;
    use super::*;
@@ -578,96 +578,4 @@ mod tests {
            "next write must advance nonce"
        );
    }
    #[tokio::test]
    #[test_log::test]
    async fn rekey_does_not_restart_the_data_nonce_counter() {
        let db = db::create_test_pool().await;
        let mut actor = bootstrapped_actor(&db).await;
        let before = actor
            .create_new(SafeCell::new(b"before-rekey".to_vec()))
            .await
            .unwrap();
        actor.rekey_root_key(KeyCell::from([7u8; 32])).await.unwrap();
        let after = actor
            .create_new(SafeCell::new(b"after-rekey".to_vec()))
            .await
            .unwrap();
        let mut conn = db.get().await.unwrap();
        // One root key, one row: the root key never changed, so its history did not fork.
        let rows: i64 = schema::root_key_history::table
            .count()
            .get_result(&mut conn)
            .await
            .unwrap();
        assert_eq!(rows, 1, "a seal-key re-key must not append a root key row");
        // Fetch each nonce by its own id, rather than `eq_any` (whose row order is
        // unspecified), and assert the counter strictly advanced. A weaker `assert_ne!` would
        // still pass if the counter reset, as long as the two nonces happened to differ.
        let before_nonce: Vec<u8> = schema::aead_encrypted::table
            .find(before)
            .select(schema::aead_encrypted::current_nonce)
            .first(&mut conn)
            .await
            .unwrap();
        let after_nonce: Vec<u8> = schema::aead_encrypted::table
            .find(after)
            .select(schema::aead_encrypted::current_nonce)
            .first(&mut conn)
            .await
            .unwrap();
        assert!(
            after_nonce > before_nonce,
            "nonce counter must keep advancing across a rekey, not reset"
        );
    }
    #[tokio::test]
    #[test_log::test]
    async fn rekey_invalidates_the_old_seal_key() {
        let db = db::create_test_pool().await;
        let mut actor = bootstrapped_actor(&db).await;
        actor.rekey_root_key(KeyCell::from([7u8; 32])).await.unwrap();
        actor.seal().await.unwrap();
        // A no-op rekey would leave the old seal key working; it must not.
        let err = actor
            .try_unseal(KeyCell::from([0u8; 32]))
            .await
            .unwrap_err();
        assert!(
            matches!(err, Error::InvalidKey),
            "old seal key must no longer unseal after a rekey, got {err:?}"
        );
        // A failed unseal must leave the sealed state intact: the new seal key must still be
        // able to unseal on the next attempt.
        actor.try_unseal(KeyCell::from([7u8; 32])).await.unwrap();
    }
    #[tokio::test]
    #[test_log::test]
    async fn integrity_envelopes_survive_a_rekey() {
        let db = db::create_test_pool().await;
        let mut actor = bootstrapped_actor(&db).await;
        let mac_input = b"operator_credentials/1".to_vec();
        let (key_version, mac) = actor.sign_integrity(mac_input.clone()).unwrap();
        actor.rekey_root_key(KeyCell::from([9u8; 32])).await.unwrap();
        assert!(
            actor
                .verify_integrity(mac_input, mac, key_version)
                .unwrap(),
            "a seal-key re-key must not invalidate existing attestations"
        );
    }
 }
--- a/server/crates/arbiter-server/src/actors/vault_coordinator/mod.rs
+++ b/server/crates/arbiter-server/src/actors/vault_coordinator/mod.rs
@@ -52,10 +52,6 @@ pub enum Error {
    TwoOperatorsRequireRecovery,
    #[error("Broken database")]
    BrokenDatabase,
    #[error("A committee must have at least one ordinary operator")]
    EmptyCommittee,
    #[error("Recovery operators are sleeping")]
    RecoveryNotActive,
 }
 // Passphrases stored as plain Vec<u8> (not SafeCell) so CoordinatorState is Sync.
@@ -144,36 +140,6 @@ fn decrypt_share(
    Ok(share_buffer.read().clone())
 }
 /// Records the threshold of the split that produced the stored shares.
 async fn store_threshold(conn: &mut db::DatabaseConnection, threshold: usize) -> Result<(), Error> {
    // A threshold that doesn't fit in the column is a bug, not a real empty-committee refusal.
    let threshold = i32::try_from(threshold).map_err(|_| Error::BrokenDatabase)?;
    let rows_updated = diesel::update(schema::arbiter_settings::table)
        .set(schema::arbiter_settings::shamir_threshold.eq(Some(threshold)))
        .execute(conn)
        .await?;
    // The singleton row always exists (up.sql seeds it), so anything else means the update did
    // not land -- bootstrap would then report success while the threshold stays NULL forever.
    if rows_updated != 1 {
        return Err(Error::BrokenDatabase);
    }
    Ok(())
 }
 /// Reads back the threshold recorded at bootstrap or re-key time.
 async fn load_threshold(conn: &mut db::DatabaseConnection) -> Result<usize, Error> {
    let stored: Option<i32> = schema::arbiter_settings::table
        .select(schema::arbiter_settings::shamir_threshold)
        .first(conn)
        .await?;
    // A missing or out-of-range value here means the recorded threshold is corrupt, not that the
    // committee is genuinely empty -- `EmptyCommittee` is reserved for the real domain refusal.
    stored
        .and_then(|threshold| usize::try_from(threshold).ok())
        .ok_or(Error::BrokenDatabase)
 }
 /// §3.4: Split the seal key across ordinary + recovery operators.
 /// Threshold = `shamir_threshold(ordinary_count)`; total shares = ordinary + recovery.
 /// When `ordinary_count` == 1 (threshold = 1), vsss-rs does not support a proper split,
@@ -187,7 +153,7 @@ async fn finalize_bootstrap(
    let ordinary_count = ordinary_passphrases.len();
    let recovery_count = recovery_passphrases.len();
    let total = ordinary_count + recovery_count;
-    let threshold = shamir_threshold(ordinary_count).ok_or(Error::EmptyCommittee)?;
+    let threshold = shamir_threshold(ordinary_count);
    let mut seal_key_bytes = [0u8; 32];
    OsRng.fill_bytes(&mut seal_key_bytes);
@@ -244,8 +210,6 @@ async fn finalize_bootstrap(
            .await?;
    }
    store_threshold(&mut conn, threshold).await?;
    vault.ask(Bootstrap { seal_key }).await.map_err(|err| {
        error!(?err, "Vault bootstrap failed");
        Error::VaultError
@@ -264,7 +228,11 @@ async fn finalize_unseal(
    let mut conn = db.get().await?;
    // Determine whether shares were stored as raw keys (threshold=1) or vsss-rs splits (threshold>=2).
-    let threshold = load_threshold(&mut conn).await?;
+    let ordinary_operator_count: i64 = schema::operator::table
        .count()
        .get_result(&mut conn)
        .await?;
    let threshold = shamir_threshold(ordinary_operator_count as usize);
    let mut shares: Vec<Vec<u8>> = Vec::new();
@@ -346,7 +314,7 @@ async fn finalize_rekey(
    let ordinary_count = ordinary_passphrases.len();
    let recovery_count = recovery_passphrases.len();
    let total = ordinary_count + recovery_count;
-    let threshold = shamir_threshold(ordinary_count).ok_or(Error::EmptyCommittee)?;
+    let threshold = shamir_threshold(ordinary_count);
    let mut new_seal_key_bytes = [0u8; 32];
    OsRng.fill_bytes(&mut new_seal_key_bytes);
@@ -401,8 +369,6 @@ async fn finalize_rekey(
            .await?;
    }
    store_threshold(&mut conn, threshold).await?;
    drop(conn);
    let new_seal_key = KeyCell::from(new_seal_key_bytes);
@@ -432,9 +398,6 @@ impl VaultCoordinator {
        if !matches!(self.state, CoordinatorState::Idle) {
            return Err(Error::AlreadyBootstrapping);
        }
        if declared_count == 0 {
            return Err(Error::EmptyCommittee);
        }
        if declared_count == 2 && recovery_count == 0 {
            return Err(Error::TwoOperatorsRequireRecovery);
        }
@@ -585,13 +548,6 @@ impl VaultCoordinator {
        recovery_operator_id: i32,
        mut passphrase: SafeCell<Vec<u8>>,
    ) -> Result<bool, Error> {
        {
            let mut conn = self.db.get().await?;
            if !db::recovery::is_active(&mut conn).await? {
                return Err(Error::RecoveryNotActive);
            }
        }
        self.ensure_unsealing_state().await?;
        let CoordinatorState::Unsealing {
@@ -620,12 +576,15 @@ impl VaultCoordinator {
 impl VaultCoordinator {
    /// Initializes `CoordinatorState::Unsealing` on first call if still `Idle`.
-    /// Threshold comes from the recorded split parameters (§3.4), not from a live row count.
+    /// Threshold is based on ordinary operator count only (§3.4).
    async fn ensure_unsealing_state(&mut self) -> Result<(), Error> {
        if matches!(self.state, CoordinatorState::Idle) {
            let mut conn = self.db.get().await?;
-            let threshold = load_threshold(&mut conn).await?;
+            let ordinary_count: i64 = schema::operator::table
-            drop(conn);
+                .count()
                .get_result(&mut conn)
                .await?;
            let threshold = shamir_threshold(usize::try_from(ordinary_count).unwrap_or_default());
            self.state = CoordinatorState::Unsealing {
                threshold,
                ordinary_passphrases: HashMap::new(),
@@ -684,7 +643,9 @@ impl VaultCoordinator {
    /// then transitions to Rekeying state awaiting contributions from all of them.
    #[message]
    pub async fn start_rekey(&mut self) -> Result<(), Error> {
-        self.ensure_idle()?;
+        if !matches!(self.state, CoordinatorState::Idle) {
            return Err(Error::AlreadyBootstrapping);
        }
        let mut conn = self.db.get().await?;
        let ordinary_count: i64 = schema::operator_identity::table
            .count()
@@ -792,28 +753,12 @@ impl Message<ProposalApproved> for VaultCoordinator {
 }
 impl VaultCoordinator {
    /// The coordinator runs one ceremony at a time; anything that starts a new one has to say
    /// so before it changes any state the ceremony depends on.
    const fn ensure_idle(&self) -> Result<(), Error> {
        if matches!(self.state, CoordinatorState::Idle) {
            Ok(())
        } else {
            Err(Error::AlreadyBootstrapping)
        }
    }
    /// Replaces the operator's public key in place, keeping their id and history, drops the
    /// share that key no longer matches, then begins a coordinated re-key (§3.3).
    async fn replace_operator(
        &mut self,
        settings: &replace_operator::Settings,
    ) -> Result<(), Error> {
        // Checked before anything is written. The re-key is what gives the replaced operator
        // a share they can use; if the coordinator is mid-ceremony, `start_rekey` refuses, and
        // swapping the key and destroying the share first would leave that operator locked
        // out with no re-key running and nothing to undo it -- the caller only logs the error.
        self.ensure_idle()?;
        let mut conn = self.db.get().await?;
        diesel::update(schema::operator_identity::table)
@@ -833,91 +778,3 @@ impl VaultCoordinator {
        self.start_rekey().await
    }
 }
 #[cfg(test)]
 mod tests {
    use super::{CoordinatorState, Error, VaultCoordinator};
    use crate::{
        actors::{GlobalActors, vault::Vault},
        db::{self, models::OperatorIdentityId, proposal::replace_operator, schema},
    };
    use diesel::{ExpressionMethods as _, QueryDsl as _, dsl::insert_into};
    use diesel_async::RunQueryDsl;
    use kameo::actor::Spawn as _;
    use std::collections::HashMap;
    /// An approved `ReplaceOperator` that arrives while another ceremony is running must
    /// change nothing. Swapping the public key and deleting the share are only safe because a
    /// re-key follows and hands the operator a share for the new key; when `start_rekey`
    /// refuses, the operator would otherwise be left holding a key with no share, and the
    /// caller does nothing with the error but log it.
    #[tokio::test]
    async fn a_refused_rekey_leaves_the_operator_untouched() {
        let pool = db::create_test_pool().await;
        let mut conn = pool.get().await.unwrap();
        let old_key = rand::random::<[u8; 32]>().to_vec();
        let operator_id: OperatorIdentityId = insert_into(schema::operator_identity::table)
            .values(schema::operator_identity::public_key.eq(&old_key))
            .returning(schema::operator_identity::id)
            .get_result(&mut conn)
            .await
            .unwrap();
        insert_into(schema::operator::table)
            .values((
                schema::operator::id.eq(Some(operator_id)),
                schema::operator::share.eq(vec![1u8; 32]),
                schema::operator::share_nonce.eq(vec![2u8; 24]),
                schema::operator::share_salt.eq(vec![3u8; 32]),
            ))
            .execute(&mut conn)
            .await
            .unwrap();
        drop(conn);
        let vault = Vault::spawn(
            Vault::new(pool.clone(), GlobalActors::spawn_message_bus())
                .await
                .unwrap(),
        );
        let mut coordinator = VaultCoordinator::new(pool.clone(), vault);
        coordinator.state = CoordinatorState::Rekeying {
            ordinary_count: 2,
            recovery_count: 0,
            passphrases: HashMap::new(),
            recovery_passphrases: HashMap::new(),
        };
        let result = coordinator
            .replace_operator(&replace_operator::Settings {
                old_operator_id: operator_id,
                new_pubkey: vec![9u8; 32],
            })
            .await;
        assert!(
            matches!(result, Err(Error::AlreadyBootstrapping)),
            "a busy coordinator must refuse the replacement, got {result:?}"
        );
        let mut conn = pool.get().await.unwrap();
        let stored_key: Vec<u8> = schema::operator_identity::table
            .find(operator_id)
            .select(schema::operator_identity::public_key)
            .first(&mut conn)
            .await
            .unwrap();
        assert_eq!(
            stored_key, old_key,
            "the public key must not be swapped when no re-key can follow"
        );
        let shares: i64 = schema::operator::table
            .filter(schema::operator::id.eq(Some(operator_id)))
            .count()
            .get_result(&mut conn)
            .await
            .unwrap();
        assert_eq!(shares, 1, "the operator's share must not be destroyed");
    }
 }
--- a/server/crates/arbiter-server/src/crypto/shamir.rs
+++ b/server/crates/arbiter-server/src/crypto/shamir.rs
@@ -21,14 +21,14 @@ pub fn split_key(
 }
 /// Returns the minimum number of shares required to reconstruct the secret
-/// for a committee of `n` operators, or `None` for an empty committee.
+/// for a committee of `n` operators.
 #[must_use]
-pub const fn shamir_threshold(n: usize) -> Option<usize> {
+pub const fn shamir_threshold(n: usize) -> usize {
    match n {
-        0 => None,
+        0 => panic!("No operators"),
-        1 => Some(1),
+        1 => 1,
-        2 => Some(2),
+        2 => 2,
-        n => Some(n / 2 + 1),
+        n => n / 2 + 1,
    }
 }
@@ -39,22 +39,3 @@ pub fn combine_shares(shares: &[Vec<u8>]) -> Result<[u8; 32], ShamirError> {
    <[u8; 32]>::try_from(bytes.as_slice())
        .map_err(|_| ShamirError::Combine("unexpected reconstructed key length".to_owned()))
 }
 #[cfg(test)]
 mod tests {
    use super::shamir_threshold;
    #[test]
    fn empty_committee_has_no_threshold() {
        assert_eq!(shamir_threshold(0), None);
    }
    #[test]
    fn threshold_follows_the_ordinary_quorum() {
        // ARCHITECTURE.md §3.1/§3.4: 1 decides alone, 2 need consensus, N needs N/2 + 1.
        assert_eq!(shamir_threshold(1), Some(1));
        assert_eq!(shamir_threshold(2), Some(2));
        assert_eq!(shamir_threshold(3), Some(2));
        assert_eq!(shamir_threshold(4), Some(3));
    }
 }
--- a/server/crates/arbiter-server/src/db/functions.rs
+++ b/server/crates/arbiter-server/src/db/functions.rs
@@ -1,6 +1,6 @@
 //! Typed bindings for the SQLite scalar functions used in Diesel expressions.
-use diesel::sql_types::Text;
+use diesel::sql_types::{Integer, Text};
 diesel::define_sql_function! {
    /// SQLite `unixepoch(modifier)` -- seconds since the Unix epoch.
--- a/server/crates/arbiter-server/src/db/mod.rs
+++ b/server/crates/arbiter-server/src/db/mod.rs
@@ -11,7 +11,6 @@ use tracing::info;
 pub mod functions;
 pub mod models;
 pub mod proposal;
 pub mod recovery;
 pub mod schema;
 pub type DatabaseConnection = SyncConnectionWrapper<SqliteConnection>;
@@ -59,39 +58,25 @@ fn database_path() -> Result<std::path::PathBuf, DatabaseSetupError> {
    Ok(db_path)
 }
 /// The pragmas `SQLite` scopes to one connection. They are defined once and run on every
 /// connection that reaches the database -- the migration connection below and each pooled
 /// connection in `create_pool` -- because a value set on one connection is invisible to the
 /// next, and every real write happens on a pooled one.
 const CONNECTION_PRAGMAS: &str = "
    -- sleep if the database is busy; this corresponds to up to 9 seconds sleeping time.
    -- see https://fractaledmind.github.io/2023/09/07/enhancing-rails-sqlite-fine-tuning/
    PRAGMA busy_timeout = 9000;
    -- fsync only in critical moments
    PRAGMA synchronous = NORMAL;
    -- write WAL changes back every 1000 pages, for an in average 1MB WAL file.
    -- May affect readers if number is increased
    PRAGMA wal_autocheckpoint = 1000;
    -- sqlite foreign keys are disabled by default, enable them for safety
    PRAGMA foreign_keys = ON;
    -- overwrite freed pages instead of leaving encrypted shares, nonces and salts
    -- readable in the file
    PRAGMA secure_delete = ON;
 ";
 #[tracing::instrument(level = "info", skip(conn))]
 fn db_config(conn: &mut SqliteConnection) -> Result<(), diesel::result::Error> {
-    conn.batch_execute(CONNECTION_PRAGMAS)?;
+    // fsync only in critical moments
-
+    conn.batch_execute("PRAGMA synchronous = NORMAL;")?;
-    // The rest belong to the database file rather than the connection, so the one-shot
+    // write WAL changes back every 1000 pages, for an in average 1MB WAL file.
-    // migration connection is the right and only place for them.
+    // May affect readers if number is increased
-
+    conn.batch_execute("PRAGMA wal_autocheckpoint = 1000;")?;
    // free some space by truncating possibly massive WAL files from the last run
    conn.batch_execute("PRAGMA wal_checkpoint(TRUNCATE);")?;
    // sqlite foreign keys are disabled by default, enable them for safety
    conn.batch_execute("PRAGMA foreign_keys = ON;")?;
    // better space reclamation
    conn.batch_execute("PRAGMA auto_vacuum = FULL;")?;
    // secure delete, overwrite deleted content with zeros to prevent recovery
    conn.batch_execute("PRAGMA secure_delete = ON;")?;
    Ok(())
 }
@@ -115,17 +100,12 @@ fn initialize_database(url: &str) -> Result<(), DatabaseSetupError> {
 /// # Panics
 /// Panics if the database path is not valid UTF-8.
 pub async fn create_pool(url: Option<&str>) -> Result<DatabasePool, DatabaseSetupError> {
-    // Matched rather than `unwrap_or`, whose argument is evaluated even when `url` is `Some`:
+    let database_url = url.map(String::from).unwrap_or(
-    // `database_path` resolves the real home directory and creates `~/.arbiter` as a side
+        database_path()?
    // effect, so an eager call reaches the developer's home from every test that passes an
    // explicit temp path, and fails outright wherever no home directory is writable.
    let database_url = match url {
        Some(url) => url.to_owned(),
        None => database_path()?
            .to_str()
            .expect("database path is not valid UTF-8")
            .to_owned(),
-    };
+    );
    initialize_database(&database_url)?;
@@ -134,13 +114,13 @@ pub async fn create_pool(url: Option<&str>) -> Result<DatabasePool, DatabaseSetu
        Box::pin(async move {
            let mut conn = DatabaseConnection::establish(url).await?;
-            // better write-concurrency; a property of the file, but harmless to reassert
+            // see https://fractaledmind.github.io/2023/09/07/enhancing-rails-sqlite-fine-tuning/
-            conn.batch_execute("PRAGMA journal_mode = WAL;")
+            // sleep if the database is busy, this corresponds to up to 9 seconds sleeping time.
            conn.batch_execute("PRAGMA busy_timeout = 9000;")
                .await
                .map_err(diesel::ConnectionError::CouldntSetupConfiguration)?;
-            // The migration connection setting these is not enough: SQLite scopes them to
+            // better write-concurrency
-            // one connection, and every real query runs on a pooled one.
+            conn.batch_execute("PRAGMA journal_mode = WAL;")
            conn.batch_execute(CONNECTION_PRAGMAS)
                .await
                .map_err(diesel::ConnectionError::CouldntSetupConfiguration)?;
@@ -176,83 +156,3 @@ pub async fn create_test_pool() -> DatabasePool {
        .await
        .expect("Failed to create test database pool")
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use diesel::{
        ExpressionMethods as _,
        dsl::insert_into,
        result::{DatabaseErrorKind, Error as DieselError},
    };
    use diesel_async::RunQueryDsl;
    /// `operator.id` references `operator_identity(id)`. Without `PRAGMA foreign_keys = ON`
    /// on the pooled connection, SQLite accepts a share row for an operator that does not exist.
    #[tokio::test]
    async fn pooled_connections_enforce_foreign_keys() {
        let pool = create_test_pool().await;
        let mut conn = pool.get().await.unwrap();
        let result = insert_into(schema::operator::table)
            .values((
                schema::operator::id.eq(4242),
                schema::operator::share.eq(vec![0u8; 32]),
                schema::operator::share_nonce.eq(vec![0u8; 24]),
                schema::operator::share_salt.eq(vec![0u8; 32]),
            ))
            .execute(&mut conn)
            .await;
        // Specifically a foreign-key violation, not any error: a `NOT NULL` failure or a
        // renamed column would also make `result.is_err()` true without proving the pragma
        // is what rejected the insert.
        assert!(
            matches!(
                result,
                Err(DieselError::DatabaseError(
                    DatabaseErrorKind::ForeignKeyViolation,
                    _
                ))
            ),
            "expected a foreign-key violation for a dangling operator_identity reference, got {result:?}"
        );
    }
    #[derive(diesel::QueryableByName)]
    struct PragmaValue {
        #[diesel(sql_type = diesel::sql_types::Integer)]
        value: i32,
    }
    async fn pragma(conn: &mut DatabaseConnection, name: &str) -> i32 {
        diesel::sql_query(format!("select {name} as value from pragma_{name}()"))
            .get_result::<PragmaValue>(conn)
            .await
            .unwrap()
            .value
    }
    /// `foreign_keys` had to be repeated on the pooled connection because `SQLite` scopes it
    /// there; its siblings in `CONNECTION_PRAGMAS` are scoped the same way and were being
    /// left behind on the migration connection. `secure_delete` is the one that matters in a
    /// key-custody database: off by default, it leaves freed pages holding encrypted shares,
    /// nonces and salts readable in the file.
    #[tokio::test]
    async fn pooled_connections_carry_the_shared_pragmas() {
        let pool = create_test_pool().await;
        let mut conn = pool.get().await.unwrap();
        assert_eq!(
            pragma(&mut conn, "secure_delete").await,
            1,
            "freed pages must be overwritten on the connection that does the writing"
        );
        assert_eq!(
            pragma(&mut conn, "synchronous").await,
            1,
            "synchronous must be NORMAL (1), not the default FULL (2)"
        );
        assert_eq!(pragma(&mut conn, "foreign_keys").await, 1);
    }
 }
--- a/server/crates/arbiter-server/src/db/models.rs
+++ b/server/crates/arbiter-server/src/db/models.rs
@@ -263,22 +263,19 @@ pub struct EvmWallet {
 #[view(
    NewEvmWalletAccess,
    derive(Insertable),
-    omit(id, created_at, revoked_at),
+    omit(id, created_at),
    attributes_with = "deriveless"
 )]
 #[view(
    CoreEvmWalletAccess,
    derive(Insertable),
-    omit(created_at, revoked_at),
+    omit(created_at),
    attributes_with = "deriveless"
 )]
 pub struct EvmWalletAccess {
    pub id: i32,
    pub wallet_id: EvmWalletId,
    pub client_id: i32,
    // Grants, transaction logs, and persistent-grant proposals reference this row
    // `on delete restrict`, so revocation cannot delete it -- it marks it revoked instead.
    pub revoked_at: Option<SqliteTimestamp>,
    pub created_at: SqliteTimestamp,
 }
--- a/server/crates/arbiter-server/src/db/proposal/mod.rs
+++ b/server/crates/arbiter-server/src/db/proposal/mod.rs
@@ -82,12 +82,6 @@ impl ProposalKindTag {
    pub const fn requires_full_quorum(self) -> bool {
        matches!(self, Self::ReplaceOperator | Self::TriggerRekey)
    }
    /// §3.5: recovery operators weigh in on operator replacement and nothing else.
    #[must_use]
    pub const fn recovery_may_vote(self) -> bool {
        matches!(self, Self::ReplaceOperator)
    }
 }
 /// Pins every implementation to the variant it is dispatched from. Without this a
--- a/server/crates/arbiter-server/src/db/recovery.rs
+++ b/server/crates/arbiter-server/src/db/recovery.rs
@@ -1,102 +0,0 @@
 //! Whether the recovery committee is awake.
 //!
 //! §3.6: a wake-up request opens a dispute window; recovery powers only become active once
 //! that window has elapsed without cancellation. Both the proposal manager (for voting) and
 //! the vault coordinator (for unsealing) gate on this, so the rule lives in one place.
 use crate::db::{functions::unixepoch, schema};
 use diesel::{
    ExpressionMethods as _, QueryDsl as _,
    dsl::{exists, select},
 };
 use diesel_async::RunQueryDsl;
 /// Recovery operators stay asleep for this long after a wake-up is requested, so the other
 /// operators have time to dispute it (§3.6).
 pub const WAKEUP_DELAY_SECS: i32 = 14 * 24 * 60 * 60;
 /// True when an uncancelled wake-up request is older than the dispute window.
 pub async fn is_active(
    conn: &mut crate::db::DatabaseConnection,
 ) -> Result<bool, diesel::result::Error> {
    select(exists(
        schema::recovery_wakeup_request::table
            .filter(schema::recovery_wakeup_request::cancelled_at.is_null())
            .filter(
                schema::recovery_wakeup_request::requested_at
                    .le(unixepoch("now") - WAKEUP_DELAY_SECS),
            ),
    ))
    .get_result(conn)
    .await
 }
 #[cfg(test)]
 mod tests {
    use super::{WAKEUP_DELAY_SECS, is_active};
    use crate::db::{self, schema};
    use diesel::{ExpressionMethods as _, insert_into};
    use diesel_async::RunQueryDsl;
    /// `recovery_wakeup_request.requested_by` references `operator_identity(id)`, and pooled
    /// connections enforce foreign keys, so every wake-up row needs a real identity behind it.
    async fn insert_operator(pool: &db::DatabasePool) -> i32 {
        let mut conn = pool.get().await.unwrap();
        insert_into(schema::operator_identity::table)
            .values(schema::operator_identity::public_key.eq(vec![7u8; 32]))
            .returning(schema::operator_identity::id)
            .get_result(&mut conn)
            .await
            .unwrap()
    }
    /// Pins `.filter(requested_at.le(...))`: a wake-up requested moments ago must not be
    /// active yet, even though nothing has cancelled it. Deleting that filter turns this
    /// assertion false without touching any other test in the suite.
    #[tokio::test]
    async fn a_recent_wakeup_is_not_yet_active() {
        let pool = db::create_test_pool().await;
        let operator_id = insert_operator(&pool).await;
        let mut conn = pool.get().await.unwrap();
        diesel::sql_query(format!(
            "INSERT INTO recovery_wakeup_request (requested_by, requested_at) \
             VALUES ({operator_id}, unixepoch('now'))"
        ))
        .execute(&mut conn)
        .await
        .unwrap();
        assert!(
            !is_active(&mut conn).await.unwrap(),
            "a wake-up requested moments ago must still be asleep"
        );
    }
    /// Pins `.filter(cancelled_at.is_null())`: a cancelled wake-up must not count towards
    /// activity even once its original request has outlived the dispute window. Deleting
    /// that filter turns this assertion false without touching any other test in the suite.
    #[tokio::test]
    async fn a_cancelled_wakeup_is_not_active_even_past_the_window() {
        let pool = db::create_test_pool().await;
        let operator_id = insert_operator(&pool).await;
        let mut conn = pool.get().await.unwrap();
        diesel::sql_query(format!(
            "INSERT INTO recovery_wakeup_request \
             (requested_by, requested_at, cancelled_by, cancelled_at) \
             VALUES ({operator_id}, unixepoch('now') - {WAKEUP_DELAY_SECS} - 1, \
             {operator_id}, unixepoch('now'))"
        ))
        .execute(&mut conn)
        .await
        .unwrap();
        assert!(
            !is_active(&mut conn).await.unwrap(),
            "a cancelled wake-up must not activate recovery even past the window"
        );
    }
 }
--- a/server/crates/arbiter-server/src/db/schema.rs
+++ b/server/crates/arbiter-server/src/db/schema.rs
@@ -17,7 +17,6 @@ diesel::table! {
        id -> Integer,
        root_key_id -> Nullable<Integer>,
        tls_id -> Nullable<Integer>,
        shamir_threshold -> Nullable<Integer>,
    }
 }
@@ -136,7 +135,6 @@ diesel::table! {
        id -> Integer,
        wallet_id -> Integer,
        client_id -> Integer,
        revoked_at -> Nullable<Integer>,
        created_at -> Integer,
    }
 }
--- a/server/crates/arbiter-server/src/evm/mod.rs
+++ b/server/crates/arbiter-server/src/evm/mod.rs
@@ -352,17 +352,16 @@ impl Engine {
 mod tests {
    use alloy::primitives::{Address, Bytes, U256, address};
    use chrono::{Duration, Utc};
-    use diesel::{ExpressionMethods as _, SelectableHelper, insert_into};
+    use diesel::{SelectableHelper, insert_into};
    use diesel_async::RunQueryDsl;
    use rstest::rstest;
    use crate::db::{
-        self, DatabaseConnection, models,
+        self, DatabaseConnection,
        models::{
            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
            SqliteTimestamp,
        },
        schema,
        schema::{evm_basic_grant, evm_transaction_log},
    };
    use crate::evm::policies::{
@@ -381,7 +380,6 @@ mod tests {
                id: WALLET_ACCESS_ID,
                wallet_id: EvmWalletId::from_raw(5),
                client_id: 20,
                revoked_at: None,
                created_at: SqliteTimestamp(Utc::now()),
            },
            chain: CHAIN_ID,
@@ -405,85 +403,10 @@ mod tests {
        }
    }
    /// Creates the parent chain a fresh `evm_wallet_access` row needs under foreign-key
    /// enforcement (a root key, an aead-encrypted secret, a wallet, and a client) and
    /// returns the new access row's id.
    async fn seed_wallet_access(conn: &mut DatabaseConnection) -> i32 {
        let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
            .values(&models::NewRootKeyHistory {
                ciphertext: vec![0u8; 32],
                tag: vec![0u8; 16],
                root_key_encryption_nonce: vec![0u8; 24],
                data_encryption_nonce: vec![0u8; 24],
                schema_version: 1,
                salt: vec![0u8; 16],
            })
            .returning(schema::root_key_history::id)
            .get_result(conn)
            .await
            .unwrap();
        let aead_id: i32 = insert_into(schema::aead_encrypted::table)
            .values(&models::NewAeadEncrypted {
                ciphertext: vec![0u8; 32],
                tag: vec![0u8; 16],
                current_nonce: vec![0u8; 24],
                schema_version: 1,
                associated_root_key_id: root_key_id,
                created_at: Utc::now().into(),
            })
            .returning(schema::aead_encrypted::id)
            .get_result(conn)
            .await
            .unwrap();
        let wallet_id: EvmWalletId = insert_into(schema::evm_wallet::table)
            .values((
                schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
                schema::evm_wallet::aead_encrypted_id.eq(aead_id),
            ))
            .returning(schema::evm_wallet::id)
            .get_result(conn)
            .await
            .unwrap();
        let metadata_id: i32 = insert_into(schema::client_metadata::table)
            .values(schema::client_metadata::name.eq("test"))
            .returning(schema::client_metadata::id)
            .get_result(conn)
            .await
            .unwrap();
        let client_id: i32 = insert_into(schema::program_client::table)
            .values((
                schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
                schema::program_client::metadata_id.eq(metadata_id),
            ))
            .returning(schema::program_client::id)
            .get_result(conn)
            .await
            .unwrap();
        insert_into(schema::evm_wallet_access::table)
            .values((
                schema::evm_wallet_access::wallet_id.eq(wallet_id),
                schema::evm_wallet_access::client_id.eq(client_id),
            ))
            .returning(schema::evm_wallet_access::id)
            .get_result(conn)
            .await
            .unwrap()
    }
    async fn insert_basic_grant(
        conn: &mut DatabaseConnection,
        shared: &SharedGrantSettings,
    ) -> EvmBasicGrant {
        // The seeded id deliberately wins over `shared.wallet_access_id`: every other field
        // below is read from `shared`, but a caller-supplied access id would almost never
        // reference a row that actually exists under foreign-key enforcement.
        let wallet_access_id = seed_wallet_access(conn).await;
        #[expect(
            clippy::cast_possible_truncation,
            clippy::cast_possible_wrap,
@@ -492,7 +415,7 @@ mod tests {
        )]
        insert_into(evm_basic_grant::table)
            .values(NewEvmBasicGrant {
-                wallet_access_id,
+                wallet_access_id: shared.wallet_access_id,
                chain_id: shared.chain.into(),
                valid_from: shared.valid_from.map(SqliteTimestamp),
                valid_until: shared.valid_until.map(SqliteTimestamp),
@@ -656,7 +579,7 @@ mod tests {
        insert_into(evm_transaction_log::table)
            .values(NewEvmTransactionLog {
                grant_id: basic_grant.id,
-                wallet_access_id: basic_grant.wallet_access_id,
+                wallet_access_id: WALLET_ACCESS_ID,
                chain_id: CHAIN_ID.into(),
                eth_value: super::utils::u256_to_bytes(U256::ZERO).to_vec(),
                signed_at: SqliteTimestamp(Utc::now()),
--- a/server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
+++ b/server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
@@ -1,12 +1,11 @@
 use super::{EtherTransfer, Settings};
 use crate::{
    db::{
-        self, DatabaseConnection, models,
+        self, DatabaseConnection,
        models::{
            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
            SqliteTimestamp,
        },
        schema,
        schema::{evm_basic_grant, evm_transaction_log},
    },
    evm::{
@@ -20,7 +19,7 @@ use crate::{
 use alloy::primitives::{Address, Bytes, U256, address};
 use chrono::{Duration, Utc};
-use diesel::{ExpressionMethods as _, SelectableHelper, insert_into};
+use diesel::{SelectableHelper, insert_into};
 use diesel_async::RunQueryDsl;
 const WALLET_ACCESS_ID: i32 = 1;
@@ -35,7 +34,6 @@ fn ctx(to: Address, value: U256) -> EvalContext {
            id: WALLET_ACCESS_ID,
            wallet_id: EvmWalletId::from_raw(10),
            client_id: 20,
            revoked_at: None,
            created_at: SqliteTimestamp(Utc::now()),
        },
        chain: CHAIN_ID,
@@ -47,82 +45,10 @@ fn ctx(to: Address, value: U256) -> EvalContext {
    }
 }
 /// Creates the parent chain a fresh `evm_wallet_access` row needs under foreign-key
 /// enforcement (a root key, an aead-encrypted secret, a wallet, and a client) and returns
 /// the new access row's id.
 async fn seed_wallet_access(conn: &mut DatabaseConnection) -> i32 {
    let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
        .values(&models::NewRootKeyHistory {
            ciphertext: vec![0u8; 32],
            tag: vec![0u8; 16],
            root_key_encryption_nonce: vec![0u8; 24],
            data_encryption_nonce: vec![0u8; 24],
            schema_version: 1,
            salt: vec![0u8; 16],
        })
        .returning(schema::root_key_history::id)
        .get_result(conn)
        .await
        .unwrap();
    let aead_id: i32 = insert_into(schema::aead_encrypted::table)
        .values(&models::NewAeadEncrypted {
            ciphertext: vec![0u8; 32],
            tag: vec![0u8; 16],
            current_nonce: vec![0u8; 24],
            schema_version: 1,
            associated_root_key_id: root_key_id,
            created_at: Utc::now().into(),
        })
        .returning(schema::aead_encrypted::id)
        .get_result(conn)
        .await
        .unwrap();
    let wallet_id: EvmWalletId = insert_into(schema::evm_wallet::table)
        .values((
            schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
            schema::evm_wallet::aead_encrypted_id.eq(aead_id),
        ))
        .returning(schema::evm_wallet::id)
        .get_result(conn)
        .await
        .unwrap();
    let metadata_id: i32 = insert_into(schema::client_metadata::table)
        .values(schema::client_metadata::name.eq("test"))
        .returning(schema::client_metadata::id)
        .get_result(conn)
        .await
        .unwrap();
    let client_id: i32 = insert_into(schema::program_client::table)
        .values((
            schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
            schema::program_client::metadata_id.eq(metadata_id),
        ))
        .returning(schema::program_client::id)
        .get_result(conn)
        .await
        .unwrap();
    insert_into(schema::evm_wallet_access::table)
        .values((
            schema::evm_wallet_access::wallet_id.eq(wallet_id),
            schema::evm_wallet_access::client_id.eq(client_id),
        ))
        .returning(schema::evm_wallet_access::id)
        .get_result(conn)
        .await
        .unwrap()
 }
 async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicGrant {
    let wallet_access_id = seed_wallet_access(conn).await;
    insert_into(evm_basic_grant::table)
        .values(NewEvmBasicGrant {
-            wallet_access_id,
+            wallet_access_id: WALLET_ACCESS_ID,
            chain_id: CHAIN_ID.into(),
            valid_from: None,
            valid_until: None,
@@ -235,7 +161,7 @@ async fn evaluate_passes_when_volume_within_limit() {
    insert_into(evm_transaction_log::table)
        .values(NewEvmTransactionLog {
            grant_id,
-            wallet_access_id: basic.wallet_access_id,
+            wallet_access_id: WALLET_ACCESS_ID,
            chain_id: CHAIN_ID.into(),
            eth_value: utils::u256_to_bytes(U256::from(500u64)).to_vec(),
            signed_at: SqliteTimestamp(Utc::now()),
@@ -277,7 +203,7 @@ async fn evaluate_rejects_volume_over_limit() {
    insert_into(evm_transaction_log::table)
        .values(NewEvmTransactionLog {
            grant_id,
-            wallet_access_id: basic.wallet_access_id,
+            wallet_access_id: WALLET_ACCESS_ID,
            chain_id: CHAIN_ID.into(),
            eth_value: utils::u256_to_bytes(U256::from(1_000u64)).to_vec(),
            signed_at: SqliteTimestamp(Utc::now()),
@@ -320,7 +246,7 @@ async fn evaluate_passes_at_exactly_volume_limit() {
    insert_into(evm_transaction_log::table)
        .values(NewEvmTransactionLog {
            grant_id,
-            wallet_access_id: basic.wallet_access_id,
+            wallet_access_id: WALLET_ACCESS_ID,
            chain_id: CHAIN_ID.into(),
            eth_value: utils::u256_to_bytes(U256::from(900u64)).to_vec(),
            signed_at: SqliteTimestamp(Utc::now()),
--- a/server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
+++ b/server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
@@ -1,9 +1,8 @@
 use super::{Settings, TokenTransfer};
 use crate::{
    db::{
-        self, DatabaseConnection, models,
+        self, DatabaseConnection,
        models::{EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, SqliteTimestamp},
        schema,
        schema::evm_basic_grant,
    },
    evm::{
@@ -21,7 +20,7 @@ use alloy::{
    sol_types::SolCall,
 };
 use chrono::{Duration, Utc};
-use diesel::{ExpressionMethods as _, SelectableHelper, insert_into};
+use diesel::{SelectableHelper, insert_into};
 use diesel_async::RunQueryDsl;
 // DAI on Ethereum mainnet — present in the static token registry
@@ -48,7 +47,6 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
            id: WALLET_ACCESS_ID,
            wallet_id: EvmWalletId::from_raw(10),
            client_id: 20,
            revoked_at: None,
            created_at: SqliteTimestamp(Utc::now()),
        },
        chain: CHAIN_ID,
@@ -60,82 +58,10 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
    }
 }
 /// Creates the parent chain a fresh `evm_wallet_access` row needs under foreign-key
 /// enforcement (a root key, an aead-encrypted secret, a wallet, and a client) and returns
 /// the new access row's id.
 async fn seed_wallet_access(conn: &mut DatabaseConnection) -> i32 {
    let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
        .values(&models::NewRootKeyHistory {
            ciphertext: vec![0u8; 32],
            tag: vec![0u8; 16],
            root_key_encryption_nonce: vec![0u8; 24],
            data_encryption_nonce: vec![0u8; 24],
            schema_version: 1,
            salt: vec![0u8; 16],
        })
        .returning(schema::root_key_history::id)
        .get_result(conn)
        .await
        .unwrap();
    let aead_id: i32 = insert_into(schema::aead_encrypted::table)
        .values(&models::NewAeadEncrypted {
            ciphertext: vec![0u8; 32],
            tag: vec![0u8; 16],
            current_nonce: vec![0u8; 24],
            schema_version: 1,
            associated_root_key_id: root_key_id,
            created_at: Utc::now().into(),
        })
        .returning(schema::aead_encrypted::id)
        .get_result(conn)
        .await
        .unwrap();
    let wallet_id: EvmWalletId = insert_into(schema::evm_wallet::table)
        .values((
            schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
            schema::evm_wallet::aead_encrypted_id.eq(aead_id),
        ))
        .returning(schema::evm_wallet::id)
        .get_result(conn)
        .await
        .unwrap();
    let metadata_id: i32 = insert_into(schema::client_metadata::table)
        .values(schema::client_metadata::name.eq("test"))
        .returning(schema::client_metadata::id)
        .get_result(conn)
        .await
        .unwrap();
    let client_id: i32 = insert_into(schema::program_client::table)
        .values((
            schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
            schema::program_client::metadata_id.eq(metadata_id),
        ))
        .returning(schema::program_client::id)
        .get_result(conn)
        .await
        .unwrap();
    insert_into(schema::evm_wallet_access::table)
        .values((
            schema::evm_wallet_access::wallet_id.eq(wallet_id),
            schema::evm_wallet_access::client_id.eq(client_id),
        ))
        .returning(schema::evm_wallet_access::id)
        .get_result(conn)
        .await
        .unwrap()
 }
 async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicGrant {
    let wallet_access_id = seed_wallet_access(conn).await;
    insert_into(evm_basic_grant::table)
        .values(NewEvmBasicGrant {
-            wallet_access_id,
+            wallet_access_id: WALLET_ACCESS_ID,
            chain_id: CHAIN_ID.into(),
            valid_from: None,
            valid_until: None,
@@ -151,27 +77,6 @@ async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicG
        .unwrap()
 }
 /// `evm_token_transfer_log.log_id` references the shared `evm_transaction_log` table, so
 /// tests recording a token transfer need a real row there to point at.
 async fn insert_transaction_log(
    conn: &mut DatabaseConnection,
    basic: &EvmBasicGrant,
    eth_value: U256,
 ) -> i32 {
    insert_into(schema::evm_transaction_log::table)
        .values(models::NewEvmTransactionLog {
            grant_id: basic.id,
            wallet_access_id: basic.wallet_access_id,
            chain_id: CHAIN_ID.into(),
            eth_value: utils::u256_to_bytes(eth_value).to_vec(),
            signed_at: SqliteTimestamp(Utc::now()),
        })
        .returning(schema::evm_transaction_log::id)
        .get_result(conn)
        .await
        .unwrap()
 }
 fn make_settings(target: Option<Address>, max_volume: Option<u64>) -> Settings {
    Settings {
        token_contract: DAI,
@@ -336,11 +241,10 @@ async fn evaluate_passes_volume_at_exact_limit() {
        .unwrap();
    // Record a past transfer of 900, with current transfer 100 => exactly 1000 limit
-    let log_id = insert_transaction_log(&mut conn, &basic, U256::from(900u64)).await;
+    insert_into(db::schema::evm_token_transfer_log::table)
-    insert_into(schema::evm_token_transfer_log::table)
+        .values(db::models::NewEvmTokenTransferLog {
        .values(models::NewEvmTokenTransferLog {
            grant_id,
-            log_id,
+            log_id: 0,
            chain_id: CHAIN_ID.into(),
            token_contract: DAI.to_vec(),
            recipient_address: RECIPIENT.to_vec(),
@@ -381,11 +285,10 @@ async fn evaluate_rejects_volume_over_limit() {
        .await
        .unwrap();
-    let log_id = insert_transaction_log(&mut conn, &basic, U256::from(1_000u64)).await;
+    insert_into(db::schema::evm_token_transfer_log::table)
-    insert_into(schema::evm_token_transfer_log::table)
+        .values(db::models::NewEvmTokenTransferLog {
        .values(models::NewEvmTokenTransferLog {
            grant_id,
-            log_id,
+            log_id: 0,
            chain_id: CHAIN_ID.into(),
            token_contract: DAI.to_vec(),
            recipient_address: RECIPIENT.to_vec(),
--- a/server/crates/arbiter-server/src/grpc/operator.rs
+++ b/server/crates/arbiter-server/src/grpc/operator.rs
@@ -129,23 +129,14 @@ pub async fn start(
    let (oob_sender, oob_receiver) = mpsc::channel(16);
    let oob_adapter = OutOfBandAdapter(oob_sender);
-    let started = {
+    let actor = {
        let transport = auth::AuthTransportAdapter::new(&mut bi, &mut request_tracker);
-        crate::peers::operator::start(&mut conn, transport, Box::new(oob_adapter)).await
+        match crate::peers::operator::start(&mut conn, transport, Box::new(oob_adapter)).await {
-    };
+            Ok(actor) => actor,
-
+            Err(e) => {
-    let actor = match started {
+                warn!(error = ?e, "Operator connection failed");
-        Ok(actor) => actor,
+                return;
-        // §3.5: a recovery operator is turned away from the session rather than failing. Say so
+            }
        // on the stream, so it does not look like the server dropped the connection.
        Err(e @ crate::peers::operator::Error::RecoveryOperatorHasNoSession) => {
            info!("Recovery operator connection closed after the vault gate");
            let _ = bi.send(Err(Status::permission_denied(e.to_string()))).await;
            return;
        }
        Err(e) => {
            warn!(error = ?e, "Operator connection failed");
            return;
        }
    };
--- a/server/crates/arbiter-server/src/grpc/operator/vault.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault.rs
@@ -2,12 +2,9 @@ use crate::{
    actors::vault::VaultState,
    peers::operator::{
        OperatorSession,
-        session::{
+        session::handlers::{
-            Error as SessionError,
+            HandleContributeRecoveryRekeyPassphrase, HandleContributeRekeyPassphrase,
-            handlers::{
+            HandleQueryVaultState,
                HandleContributeRecoveryRekeyPassphrase, HandleContributeRekeyPassphrase,
                HandleQueryVaultState,
            },
        },
    },
 };
@@ -24,7 +21,7 @@ use arbiter_proto::{
    proto::shared::VaultState as ProtoVaultState,
 };
-use kameo::{actor::ActorRef, error::SendError};
+use kameo::actor::ActorRef;
 use tonic::Status;
 use tracing::warn;
@@ -53,20 +50,6 @@ pub(super) async fn dispatch(
    }
 }
 /// A re-key share belongs to exactly one role (§3.3), so a contribution from the wrong one is a
 /// policy answer and must not reach the peer as an opaque `internal`.
 fn rekey_status<M>(err: SendError<M, SessionError>, context: &'static str) -> Status {
    match err {
        SendError::HandlerError(err @ SessionError::RoleNotPermitted) => {
            Status::permission_denied(err.to_string())
        }
        err => {
            warn!(?err, "{context}");
            Status::internal(context)
        }
    }
 }
 async fn handle_rekey(
    actor: &ActorRef<OperatorSession>,
    req: proto_rekey::Request,
@@ -83,13 +66,20 @@ async fn handle_rekey(
                passphrase: cp.passphrase,
            })
            .await
-            .map_err(|e| rekey_status(e, "Rekey contribution failed"))?,
+            .map_err(|e| {
                warn!(?e, "rekey passphrase contribution failed");
                Status::internal("Rekey contribution failed")
            })?,
        RekeyPayload::ContributeRecoveryPassphrase(crp) => actor
            .ask(HandleContributeRecoveryRekeyPassphrase {
                recovery_operator_id: crp.recovery_operator_id,
                passphrase: crp.passphrase,
            })
            .await
-            .map_err(|e| rekey_status(e, "Rekey recovery contribution failed"))?,
+            .map_err(|e| {
                warn!(?e, "rekey recovery passphrase contribution failed");
                Status::internal("Rekey recovery contribution failed")
            })?,
    };
    let proto_result = if done {
--- a/server/crates/arbiter-server/src/grpc/operator/vault_gate/inbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault_gate/inbound.rs
@@ -89,6 +89,7 @@ impl TryConvert for UnsealRequestPayload {
            Self::ContributeRecoveryPassphrase(crp) => Ok(
                vault_gate::Inbound::HandleContributeRecoveryUnsealPassphrase(
                    HandleContributeRecoveryUnsealPassphrase {
                        recovery_operator_id: crp.recovery_operator_id,
                        passphrase: crp.passphrase,
                    },
                ),
@@ -156,6 +157,7 @@ impl TryConvert for BootstrapRequestPayload {
            Self::ContributeRecoveryPassphrase(crp) => Ok(
                vault_gate::Inbound::HandleContributeRecoveryBootstrapPassphrase(
                    HandleContributeRecoveryBootstrapPassphrase {
                        recovery_operator_id: crp.recovery_operator_id,
                        passphrase: crp.passphrase,
                    },
                ),
--- a/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
@@ -103,9 +103,6 @@ impl TryConvert for vault_gate::Outbound {
                    Err(vault_gate::Error::AlreadyBootstrapped) => {
                        ProtoBootstrapResult::AlreadyBootstrapped
                    }
                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
                        return Err(Status::permission_denied(err.to_string()));
                    }
                    Err(err) => {
                        warn!(?err, "bootstrap failed");
                        return Err(Status::internal("Failed to bootstrap vault"));
@@ -116,11 +113,6 @@ impl TryConvert for vault_gate::Outbound {
            Self::HandleDeclareCommittee(result) => {
                let proto_result = match result {
                    Ok(()) => ProtoBootstrapResult::Success,
                    // A role refusal is a policy answer, not a server fault, so it leaves the
                    // gate as `PERMISSION_DENIED` rather than as an opaque `internal`.
                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
                        return Err(Status::permission_denied(err.to_string()));
                    }
                    Err(err) => {
                        warn!(?err, "declare committee failed");
                        return Err(Status::internal("Failed to declare committee"));
@@ -132,9 +124,6 @@ impl TryConvert for vault_gate::Outbound {
                let proto_result = match result {
                    Ok(true) => ProtoBootstrapResult::Success,
                    Ok(false) => ProtoBootstrapResult::AwaitingContributions,
                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
                        return Err(Status::permission_denied(err.to_string()));
                    }
                    Err(err) => {
                        warn!(?err, "contribute bootstrap passphrase failed");
                        return Err(Status::internal("Failed to contribute bootstrap passphrase"));
@@ -146,9 +135,6 @@ impl TryConvert for vault_gate::Outbound {
                let proto_result = match result {
                    Ok(true) => ProtoBootstrapResult::Success,
                    Ok(false) => ProtoBootstrapResult::AwaitingContributions,
                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
                        return Err(Status::permission_denied(err.to_string()));
                    }
                    Err(err) => {
                        warn!(?err, "contribute recovery bootstrap passphrase failed");
                        return Err(Status::internal(
@@ -162,9 +148,6 @@ impl TryConvert for vault_gate::Outbound {
                let proto_result = match result {
                    Ok(true) => ProtoUnsealResult::Success,
                    Ok(false) => ProtoUnsealResult::AwaitingContributions,
                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
                        return Err(Status::permission_denied(err.to_string()));
                    }
                    Err(err) => {
                        warn!(?err, "contribute unseal passphrase failed");
                        return Err(Status::internal("Failed to contribute unseal passphrase"));
@@ -178,9 +161,6 @@ impl TryConvert for vault_gate::Outbound {
                let proto_result = match result {
                    Ok(true) => ProtoUnsealResult::Success,
                    Ok(false) => ProtoUnsealResult::AwaitingContributions,
                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
                        return Err(Status::permission_denied(err.to_string()));
                    }
                    Err(err) => {
                        warn!(?err, "contribute recovery unseal passphrase failed");
                        return Err(Status::internal(
--- a/server/crates/arbiter-server/src/peers/operator/auth/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/mod.rs
@@ -1,4 +1,4 @@
-use super::{AuthenticatedOperator, OperatorConnection};
+use super::{Credentials, OperatorConnection};
 use arbiter_crypto::authn::{self, AuthChallenge};
 use arbiter_proto::transport::Bi;
@@ -71,7 +71,7 @@ fn parse_auth_event(payload: Inbound) -> AuthEvents {
 pub async fn authenticate<T>(
    props: &mut OperatorConnection,
    transport: &mut T,
-) -> Result<AuthenticatedOperator, Error>
+) -> Result<Credentials, Error>
 where
    T: Bi<Inbound, Result<Outbound, Error>> + Send + ?Sized,
 {
--- a/server/crates/arbiter-server/src/peers/operator/auth/state.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/state.rs
@@ -1,20 +1,17 @@
 use super::{
-    super::{AuthenticatedOperator, Credentials, OperatorConnection, RecoveryCredentials},
+    super::{Credentials, OperatorConnection},
    Error,
 };
 use crate::{
-    actors::bootstrap::VerifyToken,
+    actors::bootstrap::ConsumeToken,
-    db::{
+    db::{DatabasePool, schema::operator_identity},
        DatabasePool,
        schema::{arbiter_settings, operator_identity, recovery_operator_identity},
    },
    peers::operator::auth::Outbound,
 };
 use arbiter_crypto::authn::{self, AuthChallenge, SigningContext};
 use arbiter_proto::transport::Bi;
 use diesel::{ExpressionMethods as _, OptionalExtension as _, QueryDsl};
-use diesel_async::{AsyncConnection as _, RunQueryDsl};
+use diesel_async::RunQueryDsl;
 use tracing::error;
 pub(crate) struct ChallengeRequest {
@@ -37,7 +34,7 @@ smlang::statemachine!(
    custom_error: true,
    transitions: {
        *Init + AuthRequest(ChallengeRequest) / async prepare_challenge = SentChallenge(ChallengeContext),
-        SentChallenge(ChallengeContext) + ReceivedSolution(ChallengeSolution) / async verify_solution = AuthOk(AuthenticatedOperator),
+        SentChallenge(ChallengeContext) + ReceivedSolution(ChallengeSolution) / async verify_solution = AuthOk(Credentials),
    }
 );
@@ -59,27 +56,6 @@ async fn get_client_id(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<O
        })
 }
 async fn get_recovery_operator_id(
    db: &DatabasePool,
    pubkey: &authn::PublicKey,
 ) -> Result<Option<i32>, Error> {
    let mut conn = db.get().await.map_err(|e| {
        error!(error = ?e, "Database pool error");
        Error::internal("Database unavailable")
    })?;
    recovery_operator_identity::table
        .filter(recovery_operator_identity::public_key.eq(pubkey.to_bytes()))
        .select(recovery_operator_identity::id)
        .first::<i32>(&mut conn)
        .await
        .optional()
        .map_err(|e| {
            error!(error = ?e, "Database error");
            Error::internal("Database operation failed")
        })
 }
 async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i32, Error> {
    let pubkey_bytes = pubkey.to_bytes();
    let mut conn = db.get().await.map_err(|e| {
@@ -87,32 +63,17 @@ async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i3
        Error::internal("Database unavailable")
    })?;
-    conn.transaction(async move |conn| {
+    let id: i32 = diesel::insert_into(operator_identity::table)
-        // The database is authoritative on whether bootstrap has completed: `Vault::bootstrap`
+        .values((operator_identity::public_key.eq(pubkey_bytes),))
-        // commits `root_key_id` before it publishes `events::Bootstrapped`, and `Bootstrapper`
+        .returning(operator_identity::id)
-        // only learns of that two mailbox hops later. Re-checking it here, in the same
+        .get_result(&mut conn)
-        // transaction as the insert, closes that window deterministically instead of trusting
+        .await
-        // a token that verified against `Bootstrapper`'s possibly-stale in-memory state.
+        .map_err(|e| {
-        let already_bootstrapped: bool = arbiter_settings::table
+            error!(error = ?e, "Database error");
-            .select(arbiter_settings::root_key_id)
+            Error::internal("Database operation failed")
-            .first::<Option<i32>>(&mut *conn)
+        })?;
            .await?
            .is_some();
-        if already_bootstrapped {
+    Ok(id)
            error!("Bootstrap token used to register after the vault was already bootstrapped");
            return Err(Error::InvalidBootstrapToken);
        }
        let id: i32 = diesel::insert_into(operator_identity::table)
            .values((operator_identity::public_key.eq(pubkey_bytes),))
            .returning(operator_identity::id)
            .get_result(&mut *conn)
            .await?;
        Ok(id)
    })
    .await
 }
 pub(super) struct AuthContext<'a, T: ?Sized> {
@@ -139,14 +100,12 @@ where
            bootstrap_token,
        }: ChallengeRequest,
    ) -> Result<ChallengeContext, Self::Error> {
-        // Verify pubkey is registered in either identity table (unless bootstrapping)
+        // Verify pubkey is registered (unless bootstrapping)
-        if bootstrap_token.is_none()
+        if bootstrap_token.is_none() {
-            && get_client_id(&self.conn.db, &pubkey).await?.is_none()
+            let id = get_client_id(&self.conn.db, &pubkey).await?;
-            && get_recovery_operator_id(&self.conn.db, &pubkey)
+            if id.is_none() {
-                .await?
+                return Err(Error::UnregisteredPublicKey);
-                .is_none()
+            }
        {
            return Err(Error::UnregisteredPublicKey);
        }
        let challenge = AuthChallenge::generate(&mut rand::rng());
@@ -176,7 +135,7 @@ where
            bootstrap_token,
        }: &ChallengeContext,
        ChallengeSolution { solution }: ChallengeSolution,
-    ) -> Result<AuthenticatedOperator, Self::Error> {
+    ) -> Result<Credentials, Self::Error> {
        let signature = authn::Signature::try_from(solution.as_slice()).map_err(|()| {
            error!("Failed to decode signature in challenge solution");
            Error::InvalidChallengeSolution
@@ -192,21 +151,20 @@ where
            return Err(Error::InvalidChallengeSolution);
        }
-        // Resolve the peer's role: bootstrap (verify token, then register as an ordinary
+        // Resolve client id: bootstrap (consume token + register) or lookup
-        // operator) or look the key up in whichever identity table holds it.
+        let id = match bootstrap_token {
        let authenticated = match bootstrap_token {
            Some(token) => {
                let token_ok: bool = self
                    .conn
                    .actors
                    .bootstrapper
-                    .ask(VerifyToken {
+                    .ask(ConsumeToken {
                        token: token.clone(),
                    })
                    .await
                    .map_err(|e| {
-                        error!(?e, "Failed to verify bootstrap token");
+                        error!(?e, "Failed to consume bootstrap token");
-                        Error::internal("Failed to verify bootstrap token")
+                        Error::internal("Failed to consume bootstrap token")
                    })?;
                if !token_ok {
@@ -218,59 +176,11 @@ where
                    return Err(Error::InvalidBootstrapToken);
                }
-                let id = match register_key(&self.conn.db, pubkey).await {
+                register_key(&self.conn.db, pubkey).await?
                    Ok(id) => id,
                    // `register_key` refuses a token that verified here but lost the race
                    // against bootstrap. Reported to the peer exactly like the refusal above,
                    // so that operator sees a protocol error rather than a handshake that
                    // stops with nothing on the wire.
                    Err(Error::InvalidBootstrapToken) => {
                        self.transport
                            .send(Err(Error::InvalidBootstrapToken))
                            .await
                            .map_err(|_| Error::Transport)?;
                        return Err(Error::InvalidBootstrapToken);
                    }
                    Err(err) => return Err(err),
                };
                AuthenticatedOperator::Ordinary(Credentials {
                    id,
                    pubkey: pubkey.clone(),
                })
            }
            None => {
                // The tables are searched in this order, so a key registered in both resolves
                // as `Ordinary` and could never submit its recovery share. Nothing enforces
                // that the two sets are disjoint: `unique` is per table, and the only writer
                // today is `register_key` above -- `recovery_operator_identity` has no
                // registration path yet. Whoever builds one must refuse a key that
                // `operator_identity` already holds, and vice versa, or §3.5's "separate peer
                // type" holds only by convention.
                if let Some(id) = get_client_id(&self.conn.db, pubkey).await? {
                    AuthenticatedOperator::Ordinary(Credentials {
                        id,
                        pubkey: pubkey.clone(),
                    })
                } else {
                    // `prepare_challenge` already found the key in one of the tables, so
                    // arriving here means it was removed mid-handshake. Reported to the peer
                    // for the same reason `InvalidBootstrapToken` is above: an operator that
                    // has sent its solution sees a protocol error rather than a handshake that
                    // stops with nothing on the wire.
                    let Some(id) = get_recovery_operator_id(&self.conn.db, pubkey).await? else {
                        self.transport
                            .send(Err(Error::UnregisteredPublicKey))
                            .await
                            .map_err(|_| Error::Transport)?;
                        return Err(Error::UnregisteredPublicKey);
                    };
                    AuthenticatedOperator::Recovery(RecoveryCredentials {
                        id,
                        pubkey: pubkey.clone(),
                    })
                }
            }
            None => get_client_id(&self.conn.db, pubkey)
                .await?
                .ok_or(Error::UnregisteredPublicKey)?,
        };
        self.transport
@@ -278,6 +188,9 @@ where
            .await
            .map_err(|_| Error::Transport)?;
-        Ok(authenticated)
+        Ok(Credentials {
            id,
            pubkey: pubkey.clone(),
        })
    }
 }
--- a/server/crates/arbiter-server/src/peers/operator/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/mod.rs
@@ -33,26 +33,6 @@ impl Integrable for Credentials {
    const KIND: &'static str = "operator_credentials";
 }
 /// §3.5: recovery operators are a separate peer type with their own identity table. Their
 /// attestation kind differs from an ordinary operator's so the two id spaces cannot collide.
 #[derive(Debug, Clone, Hashable)]
 pub struct RecoveryCredentials {
    pub id: i32,
    pub pubkey: authn::PublicKey,
 }
 impl Integrable for RecoveryCredentials {
    const KIND: &'static str = "recovery_operator_credentials";
 }
 /// The outcome of an operator handshake. The variant, not a field, decides what the peer may
 /// do — so no call site can pass an unauthenticated recovery id.
 #[derive(Debug, Clone)]
 pub enum AuthenticatedOperator {
    Ordinary(Credentials),
    Recovery(RecoveryCredentials),
 }
 // Messages, sent by operator to connection client without having a request
 #[derive(Debug)]
 pub enum OutOfBand {
@@ -82,12 +62,6 @@ pub enum Error {
    Transport,
    #[error("database error: {0}")]
    Database(DatabaseError),
    /// §3.5: a recovery operator's authority stops at the vault gate. It has no operator
    /// session, because a session is the whole ordinary-governance surface -- wallets, grants,
    /// SDK clients, proposals -- which §3.5 puts out of a recovery operator's reach. Named
    /// rather than folded into `Internal`, so a policy refusal is not logged as a fault.
    #[error("recovery operators do not have an operator session")]
    RecoveryOperatorHasNoSession,
    #[error("internal: {0}")]
    Internal(String),
 }
@@ -134,7 +108,7 @@ async fn should_run_gate(vault: &ActorRef<Vault>) -> Result<bool, Error> {
 async fn run_vault_gate<T>(
    props: &OperatorConnection,
    transport: &mut T,
-    auth_creds: AuthenticatedOperator,
+    auth_creds: Credentials,
 ) -> Result<(), Error>
 where
    T: Bi<vault_gate::Inbound, Result<vault_gate::Outbound, vault_gate::Error>> + Send + ?Sized,
@@ -194,27 +168,19 @@ where
    T: Bi<auth::Inbound, Result<auth::Outbound, auth::Error>> + Send,
    T: Bi<vault_gate::Inbound, Result<vault_gate::Outbound, vault_gate::Error>> + Send,
 {
-    let authenticated = authenticate(props, &mut transport).await?;
+    let creds = authenticate(props, &mut transport).await?;
    // should run vault gate only if sealed / unbootstrapped
    if should_run_gate(&props.actors.vault).await? {
-        // §3.5 lets a recovery operator take part in unsealing, and the gate is where that
+        run_vault_gate(props, &mut transport, creds.clone()).await?;
        // happens, so both roles run it. The gate decides per message which role may send it.
        run_vault_gate(props, &mut transport, authenticated.clone()).await?;
    }
    // Past the gate the connection turns into an ordinary operator session, which a recovery
    // operator may not have.
    let AuthenticatedOperator::Ordinary(creds) = &authenticated else {
        return Err(Error::RecoveryOperatorHasNoSession);
    };
    // checking the integrity
-    verify_integrity(&props.db, &props.actors.vault, creds).await?;
+    verify_integrity(&props.db, &props.actors.vault, &creds).await?;
    Ok(OperatorSession::spawn(OperatorSession::new(
        props.clone(),
-        authenticated.clone(),
+        creds.clone(),
        oob_sender,
    )))
 }
--- a/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
@@ -177,27 +177,41 @@ impl OperatorSession {
        entries: Vec<NewEvmWalletAccess>,
    ) -> Result<(), Error> {
        let mut conn = self.props.db.get().await?;
-        grant_wallet_access(&mut conn, entries).await?;
+        conn.transaction(async |conn| {
            use crate::db::schema::evm_wallet_access;
            for entry in entries {
                diesel::insert_into(evm_wallet_access::table)
                    .values(&entry)
                    .on_conflict_do_nothing()
                    .execute(&mut *conn)
                    .await?;
            }
            Result::<_, Error>::Ok(())
        })
        .await?;
        Ok(())
    }
    /// A revoke that matched fewer rows than it named did not do what the operator asked:
    /// the id was never granted, or someone revoked it first. Answering `Ok` there tells the
    /// operator access is cut off when nothing changed. The rows that did match stay revoked
    /// -- rolling them back to report the shortfall would leave live access behind.
    #[message]
    pub(crate) async fn handle_revoke_evm_wallet_access(
        &mut self,
        entries: Vec<i32>,
    ) -> Result<(), Error> {
        let mut conn = self.props.db.get().await?;
-        let revoked = revoke_wallet_access(&mut conn, &entries).await?;
+        conn.transaction(async |conn| {
-        if revoked != entries.len() {
+            use crate::db::schema::evm_wallet_access;
-            return Err(Error::PartialRevoke {
+            for entry in entries {
-                requested: entries.len(),
+                diesel::delete(evm_wallet_access::table)
-                revoked,
+                    .filter(evm_wallet_access::wallet_id.eq(entry))
-            });
+                    .execute(&mut *conn)
-        }
+                    .await?;
            }
            Result::<_, Error>::Ok(())
        })
        .await?;
        Ok(())
    }
@@ -208,7 +222,6 @@ impl OperatorSession {
        use crate::db::schema::evm_wallet_access;
        let mut conn = self.props.db.get().await?;
        let access_entries = evm_wallet_access::table
            .filter(evm_wallet_access::revoked_at.is_null())
            .select(EvmWalletAccess::as_select())
            .load::<_>(&mut conn)
            .await?;
@@ -216,81 +229,6 @@ impl OperatorSession {
    }
 }
 /// Grants access, reviving a previously revoked row rather than leaving it shadowed:
 /// `uniq_wallet_access` is a unique index on `(wallet_id, client_id)`, so a plain insert
 /// would conflict forever on a row that was revoked but never deleted.
 ///
 /// Reviving restores visibility and nothing else: [`revoke_wallet_access`] closes the grants
 /// that hung off the access, so a persistent grant takes its own vote again (§3.2).
 pub(crate) async fn grant_wallet_access(
    conn: &mut crate::db::DatabaseConnection,
    entries: Vec<NewEvmWalletAccess>,
 ) -> Result<(), diesel::result::Error> {
    use crate::db::{models::SqliteTimestamp, schema::evm_wallet_access};
    conn.transaction(async |conn| {
        for entry in entries {
            diesel::insert_into(evm_wallet_access::table)
                .values(&entry)
                .on_conflict((evm_wallet_access::wallet_id, evm_wallet_access::client_id))
                .do_update()
                .set(evm_wallet_access::revoked_at.eq(None::<SqliteTimestamp>))
                .execute(&mut *conn)
                .await?;
        }
        Ok(())
    })
    .await
 }
 /// Marks access rows revoked by their own id rather than deleting them, and revokes every
 /// grant that hangs off them. Returns how many access rows this call revoked.
 ///
 /// The wire carries `WalletAccessEntry.id` values, so filtering by `wallet_id` here would
 /// revoke every client's access to that wallet. Deleting is not an option: `evm_basic_grant`,
 /// `evm_transaction_log`, and `proposal_persistent_grant` all reference this row
 /// `on delete restrict`, so an access that was ever granted, signed with, or proposed
 /// against can never be deleted -- only marked revoked.
 ///
 /// The dependent grants have to go with it. `grant_wallet_access` revives a revoked row by
 /// its id, and grant lookup keys on `wallet_access_id` alone, so leaving the grants live
 /// would make a later re-grant restore every persistent grant the access ever held, with its
 /// original volume and rate limits. §3.2 votes visibility and a persistent grant separately;
 /// a committee that approves visibility must not silently hand back signing authority it did
 /// not vote on. The filter names every requested id, not just the rows this call flipped, so
 /// an access revoked before this fix has its orphaned grants closed too.
 pub(crate) async fn revoke_wallet_access(
    conn: &mut crate::db::DatabaseConnection,
    ids: &[i32],
 ) -> Result<usize, diesel::result::Error> {
    use crate::db::{
        models::SqliteTimestamp,
        schema::{evm_basic_grant, evm_wallet_access},
    };
    conn.transaction(async |conn| {
        let now = SqliteTimestamp::now();
        let revoked = diesel::update(evm_wallet_access::table)
            .filter(evm_wallet_access::id.eq_any(ids))
            .filter(evm_wallet_access::revoked_at.is_null())
            .set(evm_wallet_access::revoked_at.eq(now.clone()))
            .execute(&mut *conn)
            .await?;
        diesel::update(evm_basic_grant::table)
            .filter(evm_basic_grant::wallet_access_id.eq_any(ids))
            .filter(evm_basic_grant::revoked_at.is_null())
            .set(evm_basic_grant::revoked_at.eq(now))
            .execute(&mut *conn)
            .await?;
        Ok(revoked)
    })
    .await
 }
 #[messages]
 impl OperatorSession {
    #[message(ctx)]
@@ -352,7 +290,7 @@ impl OperatorSession {
        ttl_secs: Option<u32>,
    ) -> Result<ProposalId, Error> {
        use crate::actors::proposal_manager::CreateProposal;
-        let initiator_id = OperatorIdentityId::from_raw(self.ordinary_id()?);
+        let initiator_id = OperatorIdentityId::from_raw(self.credentials.id);
        self.props
            .actors
            .proposal_manager
@@ -372,10 +310,7 @@ impl OperatorSession {
        signature: Vec<u8>,
    ) -> Result<crate::actors::proposal_manager::VoteOutcome, crate::actors::proposal_manager::Error> {
        use crate::actors::proposal_manager::CastVote;
-        let operator_id = OperatorIdentityId::from_raw(
+        let operator_id = OperatorIdentityId::from_raw(self.credentials.id);
            self.ordinary_id()
                .map_err(|_| crate::actors::proposal_manager::Error::NotAllowedForRecoveryOperator)?,
        );
        self.props
            .actors
            .proposal_manager
@@ -392,11 +327,7 @@ impl OperatorSession {
        &mut self,
    ) -> Vec<crate::actors::proposal_manager::ProposalSummary> {
        use crate::actors::proposal_manager::QueryPending;
-        let Ok(id) = self.ordinary_id() else {
+        let operator_id = OperatorIdentityId::from_raw(self.credentials.id);
            // The pending list is per ordinary operator; a recovery operator has no view of it.
            return Vec::new();
        };
        let operator_id = OperatorIdentityId::from_raw(id);
        self.props
            .actors
            .proposal_manager
@@ -416,7 +347,7 @@ impl OperatorSession {
        use crate::actors::vault_coordinator::ContributeRekey;
        use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-        let operator_id = self.ordinary_id()?;
+        let operator_id = self.credentials.id;
        self.props
            .actors
            .vault_coordinator
@@ -428,23 +359,15 @@ impl OperatorSession {
            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
    }
    /// §3.3: a re-key refreshes every share, recovery shares included, so a recovery operator
    /// has one to contribute here.
    ///
    /// It cannot reach this handler yet: `peers::operator::start` refuses a recovery peer an
    /// operator session, because a session carries the whole ordinary-governance surface that
    /// §3.5 keeps out of a recovery operator's hands. Until a recovery-scoped session exists,
    /// this refuses every caller -- which is the safe direction, and the id it would use comes
    /// from the handshake either way.
    #[message]
    pub(crate) async fn handle_contribute_recovery_rekey_passphrase(
        &mut self,
        recovery_operator_id: i32,
        passphrase: Vec<u8>,
    ) -> Result<bool, Error> {
        use crate::actors::vault_coordinator::ContributeRecoveryRekey;
        use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
        let recovery_operator_id = self.recovery_id()?;
        self.props
            .actors
            .vault_coordinator
@@ -456,476 +379,3 @@ impl OperatorSession {
            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
    }
 }
 #[cfg(test)]
 mod tests {
    use super::{grant_wallet_access, revoke_wallet_access};
    use crate::db::{self, models, schema};
    use diesel::{ExpressionMethods as _, QueryDsl as _, dsl::insert_into};
    use diesel_async::RunQueryDsl;
    /// Inserts a fresh root key, an aead-encrypted wallet secret, and the wallet itself.
    /// Returns the wallet's id and its 20-byte address.
    async fn seed_wallet(conn: &mut db::DatabaseConnection) -> (models::EvmWalletId, Vec<u8>) {
        let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
            .values(&models::NewRootKeyHistory {
                ciphertext: vec![0u8; 32],
                tag: vec![0u8; 16],
                root_key_encryption_nonce: vec![0u8; 24],
                data_encryption_nonce: vec![0u8; 24],
                schema_version: 1,
                salt: vec![0u8; 16],
            })
            .returning(schema::root_key_history::id)
            .get_result(conn)
            .await
            .unwrap();
        let aead_id: i32 = insert_into(schema::aead_encrypted::table)
            .values(&models::NewAeadEncrypted {
                ciphertext: vec![0u8; 32],
                tag: vec![0u8; 16],
                current_nonce: vec![0u8; 24],
                schema_version: 1,
                associated_root_key_id: root_key_id,
                created_at: chrono::Utc::now().into(),
            })
            .returning(schema::aead_encrypted::id)
            .get_result(conn)
            .await
            .unwrap();
        let address = rand::random::<[u8; 20]>().to_vec();
        let wallet_id: models::EvmWalletId = insert_into(schema::evm_wallet::table)
            .values((
                schema::evm_wallet::address.eq(address.clone()),
                schema::evm_wallet::aead_encrypted_id.eq(aead_id),
            ))
            .returning(schema::evm_wallet::id)
            .get_result(conn)
            .await
            .unwrap();
        (wallet_id, address)
    }
    async fn seed_client_metadata(conn: &mut db::DatabaseConnection) -> i32 {
        insert_into(schema::client_metadata::table)
            .values(schema::client_metadata::name.eq("test"))
            .returning(schema::client_metadata::id)
            .get_result(conn)
            .await
            .unwrap()
    }
    /// Inserts a `program_client` row under the given `client_metadata` row, keyed by its
    /// own random public key.
    async fn seed_client(conn: &mut db::DatabaseConnection, metadata_id: i32) -> i32 {
        insert_into(schema::program_client::table)
            .values((
                schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
                schema::program_client::metadata_id.eq(metadata_id),
            ))
            .returning(schema::program_client::id)
            .get_result(conn)
            .await
            .unwrap()
    }
    /// Inserts an access row directly, for fixtures that need one to already exist.
    /// Production code grants access through [`grant_wallet_access`].
    async fn insert_wallet_access(
        conn: &mut db::DatabaseConnection,
        wallet_id: models::EvmWalletId,
        client_id: i32,
    ) -> i32 {
        insert_into(schema::evm_wallet_access::table)
            .values((
                schema::evm_wallet_access::wallet_id.eq(wallet_id),
                schema::evm_wallet_access::client_id.eq(client_id),
            ))
            .returning(schema::evm_wallet_access::id)
            .get_result(conn)
            .await
            .unwrap()
    }
    /// The grants that grant lookup would treat as live for this access: the exact filter
    /// `EtherTransfer::try_find_grant` and `TokenTransfer::try_find_grant` apply.
    async fn live_grants_for(conn: &mut db::DatabaseConnection, access_id: i32) -> Vec<i32> {
        schema::evm_basic_grant::table
            .filter(schema::evm_basic_grant::wallet_access_id.eq(access_id))
            .filter(schema::evm_basic_grant::revoked_at.is_null())
            .select(schema::evm_basic_grant::id)
            .load(conn)
            .await
            .unwrap()
    }
    /// Two clients share one wallet. Revoking one access row must leave the other alone,
    /// and must mark the row revoked rather than deleting it.
    #[tokio::test]
    async fn revoking_one_access_leaves_the_other_client_alone() {
        let pool = db::create_test_pool().await;
        let mut conn = pool.get().await.unwrap();
        let (wallet_id, _address) = seed_wallet(&mut conn).await;
        let metadata_id = seed_client_metadata(&mut conn).await;
        let first_client = seed_client(&mut conn, metadata_id).await;
        let second_client = seed_client(&mut conn, metadata_id).await;
        let first_access = insert_wallet_access(&mut conn, wallet_id, first_client).await;
        let _second_access = insert_wallet_access(&mut conn, wallet_id, second_client).await;
        let removed = revoke_wallet_access(&mut conn, &[first_access])
            .await
            .unwrap();
        assert_eq!(removed, 1);
        let active: Vec<i32> = schema::evm_wallet_access::table
            .filter(schema::evm_wallet_access::revoked_at.is_null())
            .select(schema::evm_wallet_access::client_id)
            .load(&mut conn)
            .await
            .unwrap();
        assert_eq!(
            active,
            vec![second_client],
            "revoking one access row removed another client's access"
        );
        let total: i64 = schema::evm_wallet_access::table
            .count()
            .get_result(&mut conn)
            .await
            .unwrap();
        assert_eq!(
            total, 2,
            "revoking an access row must mark it revoked, not delete it"
        );
        // The count `handle_revoke_evm_wallet_access` answers on: a second revoke of the same
        // id, like a revoke of an id that never existed, changes nothing and must say so.
        let again = revoke_wallet_access(&mut conn, &[first_access])
            .await
            .unwrap();
        assert_eq!(again, 0, "an already revoked access must report no rows");
    }
    /// The bug this round fixes: once an access has been used for a grant, a signed
    /// transaction, or a proposed persistent grant, three tables reference
    /// `evm_wallet_access` `on delete restrict`, so deleting the row is no longer possible
    /// once foreign keys are enforced. Revoking must still succeed by marking it revoked.
    #[tokio::test]
    async fn revoking_an_access_with_grant_log_and_proposal_succeeds() {
        use crate::db::proposal::{Proposal as _, persistent_grant, persistent_grant::PersistentGrant};
        let pool = db::create_test_pool().await;
        let mut conn = pool.get().await.unwrap();
        let (wallet_id, _address) = seed_wallet(&mut conn).await;
        let metadata_id = seed_client_metadata(&mut conn).await;
        let client_id = seed_client(&mut conn, metadata_id).await;
        let access_id = insert_wallet_access(&mut conn, wallet_id, client_id).await;
        // A grant against this access...
        let grant_id: i32 = insert_into(schema::evm_basic_grant::table)
            .values(models::NewEvmBasicGrant {
                wallet_access_id: access_id,
                chain_id: 1u64.into(),
                valid_from: None,
                valid_until: None,
                max_gas_fee_per_gas: None,
                max_priority_fee_per_gas: None,
                rate_limit_count: None,
                rate_limit_window_secs: None,
                revoked_at: None,
            })
            .returning(schema::evm_basic_grant::id)
            .get_result(&mut conn)
            .await
            .unwrap();
        // ...a signed transaction against that grant...
        insert_into(schema::evm_transaction_log::table)
            .values(models::NewEvmTransactionLog {
                grant_id,
                wallet_access_id: access_id,
                chain_id: 1u64.into(),
                eth_value: vec![0u8; 32],
                signed_at: models::SqliteTimestamp(chrono::Utc::now()),
            })
            .execute(&mut conn)
            .await
            .unwrap();
        // ...and a persistent-grant proposal that named this access before it was voted on.
        let operator_id: models::OperatorIdentityId =
            insert_into(schema::operator_identity::table)
                .values(schema::operator_identity::public_key.eq(rand::random::<[u8; 32]>().to_vec()))
                .returning(schema::operator_identity::id)
                .get_result(&mut conn)
                .await
                .unwrap();
        let proposal_id: models::ProposalId = insert_into(schema::proposal::table)
            .values(&models::NewProposal {
                kind: db::proposal::ProposalKindTag::ApprovePersistentGrant,
                initiator_id: operator_id,
                expires_at: models::SqliteTimestamp(chrono::Utc::now() + chrono::Duration::days(1)),
            })
            .returning(schema::proposal::id)
            .get_result(&mut conn)
            .await
            .unwrap();
        PersistentGrant::insert(
            proposal_id,
            &persistent_grant::Settings {
                wallet_access_id: access_id,
                chain_id: 1,
                valid_from_secs: None,
                valid_until_secs: None,
                max_gas_fee_per_gas: None,
                max_priority_fee_per_gas: None,
                rate_limit: None,
                specific: persistent_grant::Specific::EtherTransfer {
                    targets: vec![[0u8; 20]],
                    limit: persistent_grant::VolumeLimit {
                        max_volume: [0u8; 32],
                        window_secs: 3600,
                    },
                },
            },
            &mut conn,
        )
        .await
        .unwrap();
        // Before this round's fix, this would fail with a foreign-key violation.
        let removed = revoke_wallet_access(&mut conn, &[access_id]).await.unwrap();
        assert_eq!(removed, 1);
        let revoked_at: Option<models::SqliteTimestamp> = schema::evm_wallet_access::table
            .find(access_id)
            .select(schema::evm_wallet_access::revoked_at)
            .first(&mut conn)
            .await
            .unwrap();
        assert!(
            revoked_at.is_some(),
            "the row must be marked revoked, not deleted"
        );
    }
    /// A revoked access must no longer resolve through the lookup `shared_analyze_transaction`
    /// and `client_sign_transaction` share -- otherwise the SDK client keeps signing after
    /// the operator believes it has been cut off.
    #[tokio::test]
    async fn revoked_access_no_longer_authorizes_signing() {
        use crate::actors::{
            GlobalActors,
            evm::{EvmActor, SignTransactionError},
            vault::Vault,
        };
        use alloy::{
            consensus::TxEip1559,
            eips::eip2930::AccessList,
            primitives::{Address, Bytes, TxKind, U256},
        };
        use kameo::actor::Spawn as _;
        let pool = db::create_test_pool().await;
        let mut conn = pool.get().await.unwrap();
        let (wallet_id, address) = seed_wallet(&mut conn).await;
        let metadata_id = seed_client_metadata(&mut conn).await;
        let client_id = seed_client(&mut conn, metadata_id).await;
        let access_id = insert_wallet_access(&mut conn, wallet_id, client_id).await;
        drop(conn);
        let vault = Vault::spawn(
            Vault::new(pool.clone(), GlobalActors::spawn_message_bus())
                .await
                .unwrap(),
        );
        let mut evm_actor = EvmActor::new(vault, pool.clone());
        let transaction = TxEip1559 {
            chain_id: 1,
            nonce: 0,
            gas_limit: 21_000,
            max_fee_per_gas: 0,
            max_priority_fee_per_gas: 0,
            to: TxKind::Call(Address::ZERO),
            value: U256::ZERO,
            input: Bytes::new(),
            access_list: AccessList::default(),
        };
        let wallet_address = Address::from_slice(&address);
        // The paired positive case: while the access stands, both lookups resolve it and the
        // calls fail further along (no grant, sealed vault) rather than at the access filter.
        // Without this, a filter that rejected every row would pass the assertions below.
        let live_analyze = evm_actor
            .shared_analyze_transaction(client_id, wallet_address, transaction.clone())
            .await;
        assert!(
            !matches!(live_analyze, Err(SignTransactionError::WalletNotFound)),
            "a live access must resolve through shared_analyze_transaction: {live_analyze:?}"
        );
        let live_sign = evm_actor
            .client_sign_transaction(client_id, wallet_address, transaction.clone())
            .await;
        assert!(
            !matches!(live_sign, Err(SignTransactionError::WalletNotFound)),
            "a live access must resolve through client_sign_transaction: {live_sign:?}"
        );
        let mut conn = pool.get().await.unwrap();
        revoke_wallet_access(&mut conn, &[access_id]).await.unwrap();
        drop(conn);
        // Both lookups resolve access the same way; both must reject the revoked row before
        // ever touching the vault (neither call bootstraps one).
        let analyze_result = evm_actor
            .shared_analyze_transaction(client_id, wallet_address, transaction.clone())
            .await;
        assert!(
            matches!(analyze_result, Err(SignTransactionError::WalletNotFound)),
            "a revoked access must not authorize shared_analyze_transaction: {analyze_result:?}"
        );
        let sign_result = evm_actor
            .client_sign_transaction(client_id, wallet_address, transaction)
            .await;
        assert!(
            matches!(sign_result, Err(SignTransactionError::WalletNotFound)),
            "a revoked access must not authorize client_sign_transaction: {sign_result:?}"
        );
    }
    /// Re-granting a revoked access must restore it rather than silently doing nothing:
    /// `uniq_wallet_access` is a unique index on `(wallet_id, client_id)`, so a plain insert
    /// would conflict on the revoked row forever.
    #[tokio::test]
    async fn regranting_a_revoked_access_restores_it() {
        let pool = db::create_test_pool().await;
        let mut conn = pool.get().await.unwrap();
        let (wallet_id, _address) = seed_wallet(&mut conn).await;
        let metadata_id = seed_client_metadata(&mut conn).await;
        let client_id = seed_client(&mut conn, metadata_id).await;
        let access_id = insert_wallet_access(&mut conn, wallet_id, client_id).await;
        revoke_wallet_access(&mut conn, &[access_id]).await.unwrap();
        grant_wallet_access(
            &mut conn,
            vec![models::NewEvmWalletAccess {
                wallet_id,
                client_id,
            }],
        )
        .await
        .unwrap();
        let revoked_at: Option<models::SqliteTimestamp> = schema::evm_wallet_access::table
            .find(access_id)
            .select(schema::evm_wallet_access::revoked_at)
            .first(&mut conn)
            .await
            .unwrap();
        assert!(
            revoked_at.is_none(),
            "re-granting a revoked access must clear revoked_at"
        );
        let total: i64 = schema::evm_wallet_access::table
            .count()
            .get_result(&mut conn)
            .await
            .unwrap();
        assert_eq!(
            total, 1,
            "re-granting a revoked access must revive the existing row, not add a second one"
        );
    }
    /// §3.2 puts wallet visibility and a persistent grant to two separate votes. Reviving a
    /// revoked access restores visibility, and must restore nothing else: grant lookup keys on
    /// `wallet_access_id` with `revoked_at is null`, so a grant left open when the access was
    /// cut off would come back live -- with its original volume and rate limits -- the moment
    /// the id revives. `EvmActor::grant_wallet_access` executes an approved `GrantWalletAccess`
    /// proposal, so that would hand signing authority back to a committee that voted only on
    /// visibility.
    #[tokio::test]
    async fn regranting_an_access_does_not_revive_its_grants() {
        let pool = db::create_test_pool().await;
        let mut conn = pool.get().await.unwrap();
        let (wallet_id, _address) = seed_wallet(&mut conn).await;
        let metadata_id = seed_client_metadata(&mut conn).await;
        let client_id = seed_client(&mut conn, metadata_id).await;
        let entry = || models::NewEvmWalletAccess {
            wallet_id,
            client_id,
        };
        grant_wallet_access(&mut conn, vec![entry()]).await.unwrap();
        let access_id: i32 = schema::evm_wallet_access::table
            .filter(schema::evm_wallet_access::wallet_id.eq(wallet_id))
            .filter(schema::evm_wallet_access::client_id.eq(client_id))
            .select(schema::evm_wallet_access::id)
            .first(&mut conn)
            .await
            .unwrap();
        // The row every persistent grant hangs off: the specific ether- or token-transfer
        // rows reference it, so liveness is decided here.
        let grant_id: i32 = insert_into(schema::evm_basic_grant::table)
            .values(models::NewEvmBasicGrant {
                wallet_access_id: access_id,
                chain_id: 1u64.into(),
                valid_from: None,
                valid_until: None,
                max_gas_fee_per_gas: None,
                max_priority_fee_per_gas: None,
                rate_limit_count: None,
                rate_limit_window_secs: None,
                revoked_at: None,
            })
            .returning(schema::evm_basic_grant::id)
            .get_result(&mut conn)
            .await
            .unwrap();
        assert_eq!(
            live_grants_for(&mut conn, access_id).await,
            vec![grant_id],
            "the seeded grant must start out live, or the assertions below prove nothing"
        );
        revoke_wallet_access(&mut conn, &[access_id]).await.unwrap();
        assert!(
            live_grants_for(&mut conn, access_id).await.is_empty(),
            "revoking an access must revoke the grants that hang off it"
        );
        grant_wallet_access(&mut conn, vec![entry()]).await.unwrap();
        let revoked_at: Option<models::SqliteTimestamp> = schema::evm_wallet_access::table
            .find(access_id)
            .select(schema::evm_wallet_access::revoked_at)
            .first(&mut conn)
            .await
            .unwrap();
        assert!(
            revoked_at.is_none(),
            "re-granting must restore visibility for the access itself"
        );
        assert!(
            live_grants_for(&mut conn, access_id).await.is_empty(),
            "re-granting an access must not revive the grants it held before revocation"
        );
    }
 }
--- a/server/crates/arbiter-server/src/peers/operator/session/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/mod.rs
@@ -1,4 +1,4 @@
-use super::{AuthenticatedOperator, OutOfBand, OperatorConnection};
+use super::{Credentials, OutOfBand, OperatorConnection};
 use crate::{
    actors::{
        flow_coordinator::client_connect_approval::ClientApprovalController,
@@ -19,17 +19,6 @@ pub enum Error {
    #[error("State transition failed")]
    State,
    /// §3.5: the ordinary and recovery roles reach for different handlers here. A refusal is a
    /// policy answer, so it is named rather than folded into `Internal` beside real faults.
    #[error("This operator role may not perform that action")]
    RoleNotPermitted,
    /// Fewer access rows were revoked than the request named. Like `RoleNotPermitted` this is
    /// an answer about the request, not a fault, so it is named rather than folded into
    /// `Internal`.
    #[error("Revoked {revoked} of {requested} wallet access entries")]
    PartialRevoke { requested: usize, revoked: usize },
    #[error("Internal error: {message}")]
    Internal { message: Cow<'static, str> },
 }
@@ -62,7 +51,7 @@ pub struct PendingClientApproval {
 pub struct OperatorSession {
    props: OperatorConnection,
-    credentials: AuthenticatedOperator,
+    credentials: Credentials,
    sender: Box<dyn Sender<OutOfBand>>,
    pending_client_approvals: HashMap<Vec<u8>, PendingClientApproval>,
@@ -71,7 +60,7 @@ pub struct OperatorSession {
 pub mod handlers;
 impl OperatorSession {
-    pub(crate) fn new(props: OperatorConnection, credentials: AuthenticatedOperator, sender: Box<dyn Sender<OutOfBand>>) -> Self {
+    pub(crate) fn new(props: OperatorConnection, credentials: Credentials, sender: Box<dyn Sender<OutOfBand>>) -> Self {
        Self {
            props,
            credentials,
@@ -79,25 +68,6 @@ impl OperatorSession {
            pending_client_approvals: HashMap::default(),
        }
    }
    /// The id of the ordinary operator on the other end, or a refusal.
    ///
    /// Read from the handshake, never from a request body, so a peer cannot act under an id it
    /// did not authenticate as.
    const fn ordinary_id(&self) -> Result<i32, Error> {
        match &self.credentials {
            AuthenticatedOperator::Ordinary(credentials) => Ok(credentials.id),
            AuthenticatedOperator::Recovery(_) => Err(Error::RoleNotPermitted),
        }
    }
    /// The id of the recovery operator on the other end, or a refusal. See `ordinary_id`.
    const fn recovery_id(&self) -> Result<i32, Error> {
        match &self.credentials {
            AuthenticatedOperator::Recovery(credentials) => Ok(credentials.id),
            AuthenticatedOperator::Ordinary(_) => Err(Error::RoleNotPermitted),
        }
    }
 }
 #[messages]
--- a/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
@@ -1,4 +1,4 @@
-use super::AuthenticatedOperator;
+use super::Credentials;
 use crate::{
    actors::{
        GlobalActors,
@@ -36,12 +36,6 @@ pub enum Error {
    #[error("State transition failed")]
    State,
    /// §3.5: ordinary and recovery operators hold different shares of the same split, so each
    /// contribution belongs to exactly one of the two roles. A refusal here is a policy answer
    /// and is kept out of `Internal`, which carries genuine faults.
    #[error("This operator role may not perform that vault action")]
    RoleNotPermitted,
    #[error("Internal error: {0}")]
    Internal(String),
 }
@@ -56,7 +50,7 @@ pub struct HandshakeResponse {
 }
 pub struct VaultGate {
-    pub auth_creds: AuthenticatedOperator,
+    pub auth_creds: Credentials,
    pub promotion_tx: Option<oneshot::Sender<Result<(), Error>>>,
    pub state: State,
    pub actors: GlobalActors,
@@ -65,7 +59,7 @@ pub struct VaultGate {
 impl VaultGate {
    pub fn new(
-        auth_creds: AuthenticatedOperator,
+        auth_creds: Credentials,
        actors: GlobalActors,
        db: DatabasePool,
        promotion_tx: oneshot::Sender<Result<(), Error>>,
@@ -106,25 +100,6 @@ impl Actor for VaultGate {
 }
 impl VaultGate {
    /// The id of the ordinary operator on the other end, or a refusal.
    ///
    /// The id is read from the handshake rather than from the request body, so a peer cannot
    /// name an operator it did not authenticate as.
    const fn ordinary_id(&self) -> Result<i32, Error> {
        match &self.auth_creds {
            AuthenticatedOperator::Ordinary(credentials) => Ok(credentials.id),
            AuthenticatedOperator::Recovery(_) => Err(Error::RoleNotPermitted),
        }
    }
    /// The id of the recovery operator on the other end, or a refusal. See `ordinary_id`.
    const fn recovery_id(&self) -> Result<i32, Error> {
        match &self.auth_creds {
            AuthenticatedOperator::Recovery(credentials) => Ok(credentials.id),
            AuthenticatedOperator::Ordinary(_) => Err(Error::RoleNotPermitted),
        }
    }
    fn decrypt_key(
        secret: &SharedSecret,
        nonce: &[u8],
@@ -173,13 +148,6 @@ impl VaultGate {
        })
    }
    /// Deliberately open to both roles, unlike `handle_bootstrap_encrypted_key` below.
    ///
    /// Handing over the whole seal key to open a sealed vault is participating in unsealing,
    /// which §3.5 grants a recovery operator, and the peer has to hold that key already -- it
    /// gains nothing here it did not bring. Bootstrap is the opposite: it *chooses* the key for
    /// a vault that has none, which is sole custody of the root key and belongs to no §3.5
    /// power. The reasoning that admits one does not admit the other.
    #[message]
    pub async fn handle_unseal_encrypted_key(
        &mut self,
@@ -217,10 +185,6 @@ impl VaultGate {
        }
    }
    /// §3.4/§3.5: bootstrapping picks the root key for a vault that has none, so whoever gets
    /// here holds sole custody until the committee splits it. That is not one of a recovery
    /// operator's two powers, and the check comes first because the vault commits before this
    /// handler could refuse anything afterwards.
    #[message]
    pub async fn handle_bootstrap_encrypted_key(
        &mut self,
@@ -228,8 +192,6 @@ impl VaultGate {
        ciphertext: Vec<u8>,
        associated_data: Vec<u8>,
    ) -> Result<(), Error> {
        let _ = self.ordinary_id()?;
        let State::ReadyForExchange { secret, .. } = &self.state else {
            return Err(Error::State);
        };
@@ -280,12 +242,10 @@ impl VaultGate {
        count: usize,
        recovery_count: usize,
    ) -> Result<(), Error> {
        let operator_id = self.ordinary_id()?;
        self.actors
            .vault_coordinator
            .ask(StartBootstrap {
-                operator_id,
+                operator_id: self.auth_creds.id,
                declared_count: count,
                recovery_count,
            })
@@ -298,13 +258,11 @@ impl VaultGate {
        &mut self,
        passphrase: Vec<u8>,
    ) -> Result<bool, Error> {
        let operator_id = self.ordinary_id()?;
        let passphrase_cell = SafeCell::new(passphrase);
        self.actors
            .vault_coordinator
            .ask(ContributeBootstrap {
-                operator_id,
+                operator_id: self.auth_creds.id,
                passphrase: passphrase_cell,
            })
            .await
@@ -314,10 +272,9 @@ impl VaultGate {
    #[message]
    pub async fn handle_contribute_recovery_bootstrap_passphrase(
        &mut self,
        recovery_operator_id: i32,
        passphrase: Vec<u8>,
    ) -> Result<bool, Error> {
        let recovery_operator_id = self.recovery_id()?;
        let passphrase_cell = SafeCell::new(passphrase);
        self.actors
            .vault_coordinator
@@ -334,13 +291,11 @@ impl VaultGate {
        &mut self,
        passphrase: Vec<u8>,
    ) -> Result<bool, Error> {
        let operator_id = self.ordinary_id()?;
        let passphrase_cell = SafeCell::new(passphrase);
        self.actors
            .vault_coordinator
            .ask(ContributeUnseal {
-                operator_id,
+                operator_id: self.auth_creds.id,
                passphrase: passphrase_cell,
            })
            .await
@@ -350,10 +305,9 @@ impl VaultGate {
    #[message]
    pub async fn handle_contribute_recovery_unseal_passphrase(
        &mut self,
        recovery_operator_id: i32,
        passphrase: Vec<u8>,
    ) -> Result<bool, Error> {
        let recovery_operator_id = self.recovery_id()?;
        let passphrase_cell = SafeCell::new(passphrase);
        self.actors
            .vault_coordinator
@@ -380,28 +334,13 @@ impl Message<events::Bootstrapped> for VaultGate {
                .get()
                .await
                .map_err(|_| Error::internal("DB unavailable"))?;
-            // Each role signs under its own `Integrable::KIND`, so the two id spaces cannot
+            integrity::sign_entity(
-            // collide in `integrity_envelope`.
+                &mut conn,
-            match &self.auth_creds {
+                &self.actors.vault,
-                AuthenticatedOperator::Ordinary(credentials) => {
+                &self.auth_creds,
-                    integrity::sign_entity(
+                self.auth_creds.id,
-                        &mut conn,
+            )
-                        &self.actors.vault,
+            .await
                        credentials,
                        credentials.id,
                    )
                    .await
                }
                AuthenticatedOperator::Recovery(credentials) => {
                    integrity::sign_entity(
                        &mut conn,
                        &self.actors.vault,
                        credentials,
                        credentials.id,
                    )
                    .await
                }
            }
            .map_err(|e| {
                error!(?e, "Failed to sign integrity envelope on bootstrap");
                Error::internal("Integrity sign failed")
--- a/server/crates/arbiter-server/tests/client/auth.rs
+++ b/server/crates/arbiter-server/tests/client/auth.rs
@@ -1,4 +1,4 @@
-use super::common::{ChannelTransport, spawn_actors};
+use super::common::ChannelTransport;
 use arbiter_crypto::authn::{self, AuthChallenge, SigningContext};
 use arbiter_proto::{
    ClientMetadata,
@@ -93,7 +93,7 @@ async fn insert_bootstrap_sentinel_operator(db: &db::DatabasePool) {
 async fn spawn_test_actors(db: &db::DatabasePool) -> GlobalActors {
    insert_bootstrap_sentinel_operator(db).await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap {
--- a/server/crates/arbiter-server/tests/common/mod.rs
+++ b/server/crates/arbiter-server/tests/common/mod.rs
@@ -24,36 +24,6 @@ pub(crate) async fn bootstrapped_vault(db: &db::DatabasePool) -> Vault {
    actor
 }
 /// Spawns a full `GlobalActors` for a test, backing `Bootstrapper`'s token file with a
 /// throwaway temp directory rather than the real `~/.arbiter` -- a test must never be able to
 /// reach, let alone write to, the developer's real bootstrap token file.
 pub(crate) async fn spawn_actors(db: db::DatabasePool) -> GlobalActors {
    let home = tempfile::tempdir().expect("failed to create a temp home directory for a test");
    GlobalActors::spawn_in(db, home.path())
        .await
        .expect("failed to spawn GlobalActors for a test")
 }
 /// Retries `probe` until it yields a value, then returns it.
 ///
 /// Effects that travel over the message bus are not visible the moment the publishing call
 /// returns: `Publish` only enqueues to the bus's mailbox, which then delivers to each
 /// subscriber's mailbox in turn. A test observing such an effect waits for it instead of
 /// reading straight after the call that triggered it.
 pub(crate) async fn eventually<T, F, Fut>(what: &str, mut probe: F) -> T
 where
    F: FnMut() -> Fut,
    Fut: Future<Output = Option<T>>,
 {
    for _ in 0..100 {
        if let Some(value) = probe().await {
            return value;
        }
        tokio::time::sleep(std::time::Duration::from_millis(20)).await;
    }
    panic!("{what} did not happen within 2s");
 }
 pub(crate) async fn root_key_history_id(db: &db::DatabasePool) -> i32 {
    let mut conn = db.get().await.unwrap();
    let id = schema::arbiter_settings::table
--- a/server/crates/arbiter-server/tests/governance.rs
+++ b/server/crates/arbiter-server/tests/governance.rs
@@ -21,8 +21,8 @@ use arbiter_server::{
 };
 use arbiter_server::actors::vault::Bootstrap;
 use arbiter_server::db::schema::{
-    aead_encrypted, arbiter_settings, evm_basic_grant, evm_wallet, evm_wallet_access,
+    aead_encrypted, evm_basic_grant, evm_wallet, evm_wallet_access, operator_identity,
-    operator_identity, proposal_one_off_transaction_result, recovery_operator_identity,
+    proposal_one_off_transaction_result, recovery_operator_identity,
 };
 use diesel::{ExpressionMethods, QueryDsl, insert_into};
 use diesel_async::RunQueryDsl;
@@ -46,16 +46,6 @@ where
    panic!("{what} did not happen within 2s");
 }
 /// Spawns a full `GlobalActors` for a test, backing `Bootstrapper`'s token file with a
 /// throwaway temp directory rather than the real `~/.arbiter` -- a test must never be able to
 /// reach, let alone write to, the developer's real bootstrap token file.
 async fn spawn_actors(db: db::DatabasePool) -> GlobalActors {
    let home = tempfile::tempdir().expect("failed to create a temp home directory for a test");
    GlobalActors::spawn_in(db, home.path())
        .await
        .expect("failed to spawn GlobalActors for a test")
 }
 async fn register_operator(db: &db::DatabasePool, pubkey: &authn::PublicKey) -> OperatorIdentityId {
    let mut conn = db.get().await.unwrap();
    insert_into(operator_identity::table)
@@ -92,22 +82,14 @@ async fn insert_active_wakeup(db: &db::DatabasePool, operator_id: OperatorIdenti
    .unwrap();
 }
 /// Requires the vault to already be bootstrapped: it reads the root key row `Bootstrap`
 /// creates so the aead-encrypted wallet secret has a real parent to reference.
 async fn insert_evm_wallet(db: &db::DatabasePool) -> i32 {
    let mut conn = db.get().await.unwrap();
    let root_key_id: i32 = arbiter_settings::table
        .select(arbiter_settings::root_key_id)
        .first::<Option<i32>>(&mut conn)
        .await
        .unwrap()
        .expect("vault must be bootstrapped before creating an aead-encrypted row");
    let aead_id: i32 = insert_into(aead_encrypted::table)
        .values((
            aead_encrypted::current_nonce.eq(vec![0u8; 4]),
            aead_encrypted::ciphertext.eq(vec![0u8; 32]),
            aead_encrypted::tag.eq(vec![0u8; 16]),
-            aead_encrypted::associated_root_key_id.eq(root_key_id),
+            aead_encrypted::associated_root_key_id.eq(0i32),
        ))
        .returning(aead_encrypted::id)
        .get_result::<i32>(&mut conn)
@@ -152,7 +134,7 @@ async fn insert_unapproved_client(db: &db::DatabasePool, pubkey: &authn::PublicK
 #[tokio::test]
 async fn create_proposal_returns_id() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap {
@@ -161,16 +143,11 @@ async fn create_proposal_returns_id() {
        .await
        .unwrap();
    let key = authn::SigningKey::generate();
    let operator_id = register_operator(&db, &key.public_key()).await;
    let client_key = authn::SigningKey::generate();
    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
    let proposal_id = actors
        .proposal_manager
        .ask(CreateProposal {
-            kind: ProposalKind::ApproveSdkClient(approve_sdk_client::Settings { client_id }),
+            kind: ProposalKind::ApproveSdkClient(approve_sdk_client::Settings { client_id: 42 }),
-            initiator_id: operator_id,
+            initiator_id: OperatorIdentityId::from_raw(1),
            ttl_secs: None,
        })
        .await
@@ -182,7 +159,7 @@ async fn create_proposal_returns_id() {
 #[tokio::test]
 async fn create_proposal_caps_the_ttl() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap {
@@ -193,14 +170,12 @@ async fn create_proposal_caps_the_ttl() {
    let key = authn::SigningKey::generate();
    let op = register_operator(&db, &key.public_key()).await;
    let client_key = authn::SigningKey::generate();
    let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
    let create = async |ttl: u32| {
        actors
            .proposal_manager
            .ask(CreateProposal {
-                kind: ProposalKind::ApproveSdkClient(approve_sdk_client::Settings { client_id }),
+                kind: ProposalKind::ApproveSdkClient(approve_sdk_client::Settings { client_id: 1 }),
                initiator_id: op,
                ttl_secs: Some(ttl),
            })
@@ -223,7 +198,7 @@ async fn create_proposal_caps_the_ttl() {
 #[tokio::test]
 async fn single_operator_vote_reaches_quorum() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -268,7 +243,7 @@ async fn single_operator_vote_reaches_quorum() {
 #[tokio::test]
 async fn two_operator_first_vote_is_pending() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -314,7 +289,7 @@ async fn two_operator_first_vote_is_pending() {
 #[tokio::test]
 async fn duplicate_vote_rejected() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -375,7 +350,7 @@ async fn duplicate_vote_rejected() {
 #[tokio::test]
 async fn invalid_signature_rejected() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -416,7 +391,7 @@ async fn invalid_signature_rejected() {
 #[tokio::test]
 async fn query_pending_reports_a_tally_per_proposal() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap {
@@ -454,9 +429,7 @@ async fn query_pending_reports_a_tally_per_proposal() {
    };
    let mut ids = Vec::new();
-    for _ in 1..=3 {
+    for client_id in 1..=3 {
        let client_key = authn::SigningKey::generate();
        let client_id = insert_unapproved_client(&db, &client_key.public_key()).await;
        let id = actors
            .proposal_manager
            .ask(CreateProposal {
@@ -510,7 +483,7 @@ async fn query_pending_reports_a_tally_per_proposal() {
 #[tokio::test]
 async fn query_pending_excludes_already_voted() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -576,7 +549,7 @@ async fn query_pending_excludes_already_voted() {
 #[tokio::test]
 async fn expired_proposal_is_hidden_and_unvotable() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -634,7 +607,7 @@ async fn approve_sdk_client_writes_integrity_envelope() {
    use arbiter_server::db::schema::integrity_envelope;
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -693,7 +666,7 @@ async fn approve_sdk_client_writes_integrity_envelope() {
 #[tokio::test]
 async fn grant_wallet_access_on_quorum_approval() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -754,7 +727,7 @@ async fn grant_wallet_access_on_quorum_approval() {
 #[tokio::test]
 async fn approve_persistent_grant_creates_basic_grant_row() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -851,7 +824,7 @@ async fn approve_one_off_transaction_stores_result() {
    use chrono::Duration;
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -971,7 +944,7 @@ async fn approve_one_off_transaction_stores_result() {
 #[tokio::test]
 async fn replace_operator_updates_pubkey_and_starts_rekey() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -1043,7 +1016,7 @@ async fn replace_operator_updates_pubkey_and_starts_rekey() {
 #[tokio::test]
 async fn trigger_rekey_reaches_quorum() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -1085,7 +1058,7 @@ async fn trigger_rekey_reaches_quorum() {
 async fn key_rotation_requires_full_quorum() {
    // §3.3: ReplaceOperator needs all 3 operators to approve, not just shamir_threshold(3)=2
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) })
@@ -1139,7 +1112,7 @@ async fn key_rotation_requires_full_quorum() {
 #[tokio::test]
 async fn recovery_vote_rejected_when_sleeping() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors.vault.ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) }).await.unwrap();
    let op_key = authn::SigningKey::generate();
@@ -1185,7 +1158,7 @@ async fn recovery_vote_rejected_when_sleeping() {
 #[tokio::test]
 async fn recovery_vote_blocked_on_non_replace_proposal() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors.vault.ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) }).await.unwrap();
    let op_key = authn::SigningKey::generate();
@@ -1234,7 +1207,7 @@ async fn recovery_vote_blocked_on_non_replace_proposal() {
 #[tokio::test]
 async fn recovery_wakeup_can_be_cancelled() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors.vault.ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) }).await.unwrap();
    let key = authn::SigningKey::generate();
@@ -1263,7 +1236,7 @@ async fn recovery_wakeup_can_be_cancelled() {
 #[tokio::test]
 async fn recovery_wakeup_prevents_duplicate_request() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors.vault.ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) }).await.unwrap();
    let key = authn::SigningKey::generate();
@@ -1291,7 +1264,7 @@ async fn recovery_wakeup_prevents_duplicate_request() {
 async fn recovery_operator_vote_contributes_to_replace_quorum() {
    // 1 ordinary operator + 1 recovery operator; replace_operator needs both.
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors.vault.ask(Bootstrap { seal_key: KeyCell::from([0u8; 32]) }).await.unwrap();
    let op_key = authn::SigningKey::generate();
--- a/server/crates/arbiter-server/tests/operator/auth.rs
+++ b/server/crates/arbiter-server/tests/operator/auth.rs
@@ -1,16 +1,11 @@
-use super::common::{ChannelTransport, bootstrapped_vault, eventually, spawn_actors};
+use super::common::ChannelTransport;
 use arbiter_crypto::authn::{self, AuthChallenge, SigningContext};
 use arbiter_proto::transport::{Error as TransportError, Receiver, Sender};
 use arbiter_server::{
-    actors::{
+    actors::{GlobalActors, bootstrap::GetToken, vault::Bootstrap},
        bootstrap::GetToken,
        vault::{self, Bootstrap},
    },
    crypto::integrity,
    db::{self, schema},
-    peers::operator::{
+    peers::operator::{self, Credentials, OperatorConnection, auth, vault_gate},
        self, AuthenticatedOperator, Credentials, OperatorConnection, auth, vault_gate,
    },
 };
 use async_trait::async_trait;
@@ -155,7 +150,14 @@ impl Sender<auth::Inbound> for StartTestTransport {
 #[test_log::test]
 pub async fn bootstrap_token_auth() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap {
            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
    let token = actors.bootstrapper.ask(GetToken).await.unwrap().unwrap();
    let (mut server_transport, mut test_transport) = ChannelTransport::new();
@@ -198,287 +200,22 @@ pub async fn bootstrap_token_auth() {
        .expect("should receive auth result");
    assert!(matches!(response, Ok(auth::Outbound::AuthSuccess)));
-    let authenticated = task.await.unwrap().unwrap();
+    task.await.unwrap().unwrap();
    let mut conn = db.get().await.unwrap();
-    let (stored_id, stored_pubkey): (i32, Vec<u8>) = schema::operator_identity::table
+    let stored_pubkey: Vec<u8> = schema::operator_identity::table
-        .select((
+        .select(schema::operator_identity::public_key)
-            schema::operator_identity::id,
+        .first::<Vec<u8>>(&mut conn)
            schema::operator_identity::public_key,
        ))
        .first::<(i32, Vec<u8>)>(&mut conn)
        .await
        .unwrap();
    assert_eq!(stored_pubkey, verifying_key(&new_key).encode().0.to_vec());
    // A key registered through the bootstrap token is an ordinary operator, carrying the id its
    // registration wrote. Asserted here because this is the file's only bootstrap-arm check on
    // what `authenticate` actually returns.
    match authenticated {
        AuthenticatedOperator::Ordinary(creds) => assert_eq!(creds.id, stored_id),
        AuthenticatedOperator::Recovery(creds) => panic!(
            "expected the ordinary role, got a recovery operator with id {}",
            creds.id
        ),
    }
 }
 /// A multi-operator committee must all register with the same bootstrap token before bootstrap
 /// completes, so verifying the token must not consume it. This is the reachability bug fixed by
 /// replacing `consume_token` with `verify_token`.
 #[tokio::test]
 #[test_log::test]
 pub async fn bootstrap_token_registers_every_committee_member() {
    let db = db::create_test_pool().await;
    let actors = spawn_actors(db.clone()).await;
    let token = actors.bootstrapper.ask(GetToken).await.unwrap().unwrap();
    for _ in 0..2 {
        let (mut server_transport, mut test_transport) = ChannelTransport::new();
        let db_for_task = db.clone();
        let actors_for_task = actors.clone();
        let task = tokio::spawn(async move {
            let mut props = OperatorConnection::new(db_for_task, actors_for_task);
            auth::authenticate(&mut props, &mut server_transport).await
        });
        let new_key = MlDsa87::key_gen(&mut rand::rng());
        test_transport
            .send(auth::Inbound::AuthChallengeRequest {
                pubkey: verifying_key(&new_key).into(),
                bootstrap_token: Some(token.clone()),
            })
            .await
            .unwrap();
        let response = test_transport
            .recv()
            .await
            .expect("should receive challenge");
        let challenge = match response {
            Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
            other => panic!("Expected AuthChallenge, got {other:?}"),
        };
        let signature = sign_operator_challenge(&new_key, &challenge);
        test_transport
            .send(auth::Inbound::AuthChallengeSolution {
                signature: signature.to_bytes(),
            })
            .await
            .unwrap();
        let response = test_transport
            .recv()
            .await
            .expect("should receive auth result");
        assert!(matches!(response, Ok(auth::Outbound::AuthSuccess)));
        task.await.unwrap().unwrap();
    }
    let mut conn = db.get().await.unwrap();
    let registered: i64 = schema::operator_identity::table
        .count()
        .get_result(&mut conn)
        .await
        .unwrap();
    assert_eq!(registered, 2);
    // Bootstrap has not completed: the token must still be valid.
    assert_eq!(
        actors.bootstrapper.ask(GetToken).await.unwrap(),
        Some(token)
    );
 }
 /// `GlobalActors` must subscribe `Bootstrapper` to `events::Bootstrapped` on the message bus.
 /// Without that one registration the token stays valid forever in production, which is the
 /// defect this task exists to fix, and no other test notices: the test below drives the event
 /// handler directly, and the `challenge_auth` family never re-reads the token after
 /// bootstrapping. This one goes the whole way round -- real `Vault::bootstrap`, real bus --
 /// and waits for the effect rather than reading straight after the call, because `Publish`
 /// only enqueues to the bus's mailbox.
 #[tokio::test]
 #[test_log::test]
 pub async fn bootstrapped_event_retires_the_token_through_the_message_bus() {
    let db = db::create_test_pool().await;
    let actors = spawn_actors(db.clone()).await;
    assert!(
        actors.bootstrapper.ask(GetToken).await.unwrap().is_some(),
        "the token must exist before the vault is bootstrapped"
    );
    actors
        .vault
        .ask(Bootstrap {
            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
    eventually("the bootstrap token to be retired", || async {
        actors
            .bootstrapper
            .ask(GetToken)
            .await
            .unwrap()
            .is_none()
            .then_some(())
    })
    .await;
 }
 /// Once the vault reports `Bootstrapped`, the token is retired: further registrations must be
 /// rejected even with a token that verified successfully moments earlier.
 #[tokio::test]
 #[test_log::test]
 pub async fn bootstrap_token_rejected_after_bootstrapped_event() {
    let db = db::create_test_pool().await;
    let actors = spawn_actors(db.clone()).await;
    let token = actors.bootstrapper.ask(GetToken).await.unwrap().unwrap();
    // Drive the Bootstrapper's own event handler directly rather than through
    // `actors.vault.ask(Bootstrap { .. })` + the message bus: bus delivery is fire-and-forget,
    // so asserting on it would be racy. The handler under test is the same either way.
    actors
        .bootstrapper
        .ask(vault::events::Bootstrapped)
        .await
        .unwrap();
    assert!(actors.bootstrapper.ask(GetToken).await.unwrap().is_none());
    let (mut server_transport, mut test_transport) = ChannelTransport::new();
    let db_for_task = db.clone();
    let task = tokio::spawn(async move {
        let mut props = OperatorConnection::new(db_for_task, actors);
        auth::authenticate(&mut props, &mut server_transport).await
    });
    let new_key = MlDsa87::key_gen(&mut rand::rng());
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
            bootstrap_token: Some(token),
        })
        .await
        .unwrap();
    let response = test_transport
        .recv()
        .await
        .expect("should receive challenge");
    let challenge = match response {
        Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
        other => panic!("Expected AuthChallenge, got {other:?}"),
    };
    let signature = sign_operator_challenge(&new_key, &challenge);
    test_transport
        .send(auth::Inbound::AuthChallengeSolution {
            signature: signature.to_bytes(),
        })
        .await
        .unwrap();
    assert!(matches!(
        task.await.unwrap(),
        Err(auth::Error::InvalidBootstrapToken)
    ));
    let mut conn = db.get().await.unwrap();
    let count: i64 = schema::operator_identity::table
        .count()
        .get_result::<i64>(&mut conn)
        .await
        .unwrap();
    assert_eq!(count, 0);
 }
 /// `register_key`'s database gate must refuse a registration once `arbiter_settings.root_key_id`
 /// is set, even when `Bootstrapper`'s own in-memory token has not yet been retired -- exactly
 /// the two-mailbox-hop window between `Vault::bootstrap`'s commit and the `Bootstrapped` event
 /// reaching `Bootstrapper` in production. "database bootstrapped, Bootstrapper not yet notified"
 /// is reproduced deterministically by bootstrapping a throwaway `Vault` wired to its own message
 /// bus: it commits `root_key_id` in the same database without ever publishing to the bus
 /// `actors.bootstrapper` is registered on, so `actors.bootstrapper`'s token is left untouched.
 #[tokio::test]
 #[test_log::test]
 pub async fn bootstrap_token_rejected_once_the_database_is_bootstrapped() {
    let db = db::create_test_pool().await;
    let actors = spawn_actors(db.clone()).await;
    let token = actors.bootstrapper.ask(GetToken).await.unwrap().unwrap();
    bootstrapped_vault(&db).await;
    // From Bootstrapper's point of view the token still verifies: it never received an event.
    assert_eq!(
        actors.bootstrapper.ask(GetToken).await.unwrap(),
        Some(token.clone())
    );
    let (mut server_transport, mut test_transport) = ChannelTransport::new();
    let db_for_task = db.clone();
    let task = tokio::spawn(async move {
        let mut props = OperatorConnection::new(db_for_task, actors);
        auth::authenticate(&mut props, &mut server_transport).await
    });
    let new_key = MlDsa87::key_gen(&mut rand::rng());
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
            bootstrap_token: Some(token),
        })
        .await
        .unwrap();
    let response = test_transport
        .recv()
        .await
        .expect("should receive challenge");
    let challenge = match response {
        Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
        other => panic!("Expected AuthChallenge, got {other:?}"),
    };
    let signature = sign_operator_challenge(&new_key, &challenge);
    test_transport
        .send(auth::Inbound::AuthChallengeSolution {
            signature: signature.to_bytes(),
        })
        .await
        .unwrap();
    // The refusal has to reach the peer, not just the task's return value: a registration
    // refused after the database was bootstrapped must look like the refusal of a token that
    // never verified, rather than a handshake that stops with nothing on the wire.
    let refusal = test_transport
        .recv()
        .await
        .expect("the refusal must be sent to the peer");
    assert!(matches!(refusal, Err(auth::Error::InvalidBootstrapToken)));
    assert!(matches!(
        task.await.unwrap(),
        Err(auth::Error::InvalidBootstrapToken)
    ));
    let mut conn = db.get().await.unwrap();
    let count: i64 = schema::operator_identity::table
        .count()
        .get_result::<i64>(&mut conn)
        .await
        .unwrap();
    assert_eq!(count, 0);
 }
 #[tokio::test]
 #[test_log::test]
 pub async fn bootstrap_invalid_token_auth() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    let (mut server_transport, mut test_transport) = ChannelTransport::new();
    let db_for_task = db.clone();
@@ -513,14 +250,6 @@ pub async fn bootstrap_invalid_token_auth() {
        .await
        .unwrap();
    // The reference behaviour the refusal above has to match: a token that never verified is
    // reported to the peer. Pinned here so the two refusal paths cannot drift apart again.
    let refusal = test_transport
        .recv()
        .await
        .expect("the refusal must be sent to the peer");
    assert!(matches!(refusal, Err(auth::Error::InvalidBootstrapToken)));
    assert!(matches!(
        task.await.unwrap(),
        Err(auth::Error::InvalidBootstrapToken)
@@ -539,7 +268,7 @@ pub async fn bootstrap_invalid_token_auth() {
 #[test_log::test]
 pub async fn challenge_auth() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap {
@@ -624,7 +353,7 @@ pub async fn challenge_auth() {
 #[test_log::test]
 pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
@@ -698,7 +427,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
 #[test_log::test]
 pub async fn challenge_auth_rejects_invalid_signature() {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
        .ask(Bootstrap {
@@ -774,230 +503,3 @@ pub async fn challenge_auth_rejects_invalid_signature() {
        Err(auth::Error::InvalidChallengeSolution)
    ));
 }
 /// §3.5: a recovery operator is a separate peer type. Its key resolves against
 /// `recovery_operator_identity`, and authentication reports the recovery role.
 ///
 /// An ordinary operator is registered alongside it so the recovery key is not simply the only
 /// key on file: the handshake has to reach the recovery table while `operator_identity` is
 /// populated. Both tables autoincrement from 1, so the fixture also pushes the authenticating
 /// recovery operator to id 2 -- with one row in each table an id taken from the wrong table
 /// would still read as 1, and only the variant would be under test.
 #[tokio::test]
 #[test_log::test]
 pub async fn recovery_operator_authenticates_with_its_own_identity() {
    let db = db::create_test_pool().await;
    let actors = spawn_actors(db.clone()).await;
    let ordinary_key = MlDsa87::key_gen(&mut rand::rng());
    let other_recovery_key = MlDsa87::key_gen(&mut rand::rng());
    let recovery_key = MlDsa87::key_gen(&mut rand::rng());
    let recovery_pubkey_bytes = authn::PublicKey::from(verifying_key(&recovery_key)).to_bytes();
    let recovery_id: i32 = {
        let mut conn = db.get().await.unwrap();
        insert_into(schema::operator_identity::table)
            .values((schema::operator_identity::public_key
                .eq(authn::PublicKey::from(verifying_key(&ordinary_key)).to_bytes()),))
            .execute(&mut conn)
            .await
            .unwrap();
        insert_into(schema::recovery_operator_identity::table)
            .values((schema::recovery_operator_identity::public_key
                .eq(authn::PublicKey::from(verifying_key(&other_recovery_key)).to_bytes()),))
            .execute(&mut conn)
            .await
            .unwrap();
        insert_into(schema::recovery_operator_identity::table)
            .values((schema::recovery_operator_identity::public_key.eq(recovery_pubkey_bytes),))
            .returning(schema::recovery_operator_identity::id)
            .get_result(&mut conn)
            .await
            .unwrap()
    };
    assert_eq!(
        recovery_id, 2,
        "the fixture must give the authenticating recovery operator an id no ordinary \
         operator holds, or the id assertion below cannot discriminate"
    );
    let (mut server_transport, mut test_transport) = ChannelTransport::new();
    let db_for_task = db.clone();
    let task = tokio::spawn(async move {
        let mut props = OperatorConnection::new(db_for_task, actors);
        auth::authenticate(&mut props, &mut server_transport).await
    });
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&recovery_key).into(),
            bootstrap_token: None,
        })
        .await
        .unwrap();
    let response = test_transport
        .recv()
        .await
        .expect("should receive challenge");
    let challenge = match response {
        Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
        other => panic!("Expected AuthChallenge, got {other:?}"),
    };
    let signature = sign_operator_challenge(&recovery_key, &challenge);
    test_transport
        .send(auth::Inbound::AuthChallengeSolution {
            signature: signature.to_bytes(),
        })
        .await
        .unwrap();
    let response = test_transport
        .recv()
        .await
        .expect("should receive auth result");
    assert!(matches!(response, Ok(auth::Outbound::AuthSuccess)));
    let authenticated = task
        .await
        .unwrap()
        .expect("recovery operator should authenticate");
    match authenticated {
        AuthenticatedOperator::Recovery(creds) => assert_eq!(creds.id, recovery_id),
        AuthenticatedOperator::Ordinary(creds) => panic!(
            "expected the recovery role, got the ordinary operator with id {}",
            creds.id
        ),
    }
 }
 /// A key present in neither identity table is still rejected: accepting a key found in either
 /// table must not degrade into accepting any key at all. Both tables hold a row so the refusal
 /// cannot come from an empty lookup.
 #[tokio::test]
 #[test_log::test]
 pub async fn unknown_key_is_rejected_when_both_tables_are_populated() {
    let db = db::create_test_pool().await;
    let actors = spawn_actors(db.clone()).await;
    let ordinary_key = MlDsa87::key_gen(&mut rand::rng());
    let recovery_key = MlDsa87::key_gen(&mut rand::rng());
    {
        let mut conn = db.get().await.unwrap();
        insert_into(schema::operator_identity::table)
            .values((schema::operator_identity::public_key
                .eq(authn::PublicKey::from(verifying_key(&ordinary_key)).to_bytes()),))
            .execute(&mut conn)
            .await
            .unwrap();
        insert_into(schema::recovery_operator_identity::table)
            .values((schema::recovery_operator_identity::public_key
                .eq(authn::PublicKey::from(verifying_key(&recovery_key)).to_bytes()),))
            .execute(&mut conn)
            .await
            .unwrap();
    }
    let (mut server_transport, mut test_transport) = ChannelTransport::new();
    let db_for_task = db.clone();
    let task = tokio::spawn(async move {
        let mut props = OperatorConnection::new(db_for_task, actors);
        auth::authenticate(&mut props, &mut server_transport).await
    });
    let unknown_key = MlDsa87::key_gen(&mut rand::rng());
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&unknown_key).into(),
            bootstrap_token: None,
        })
        .await
        .unwrap();
    assert!(matches!(
        task.await.unwrap(),
        Err(auth::Error::UnregisteredPublicKey)
    ));
 }
 /// `verify_solution` resolves the recovery id only after the peer has sent its solution, so a
 /// recovery row removed between challenge and solution reaches that refusal. It has to be sent
 /// on the transport, like the `InvalidBootstrapToken` refusals in the arm above: an operator
 /// that has answered the challenge sees a protocol error rather than a handshake that stops
 /// with nothing on the wire.
 #[tokio::test]
 #[test_log::test]
 pub async fn recovery_key_removed_mid_handshake_is_refused_on_the_wire() {
    let db = db::create_test_pool().await;
    let actors = spawn_actors(db.clone()).await;
    let recovery_key = MlDsa87::key_gen(&mut rand::rng());
    let recovery_pubkey_bytes = authn::PublicKey::from(verifying_key(&recovery_key)).to_bytes();
    {
        let mut conn = db.get().await.unwrap();
        insert_into(schema::recovery_operator_identity::table)
            .values((
                schema::recovery_operator_identity::public_key.eq(recovery_pubkey_bytes.clone()),
            ))
            .execute(&mut conn)
            .await
            .unwrap();
    }
    let (mut server_transport, mut test_transport) = ChannelTransport::new();
    let db_for_task = db.clone();
    let task = tokio::spawn(async move {
        let mut props = OperatorConnection::new(db_for_task, actors);
        auth::authenticate(&mut props, &mut server_transport).await
    });
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&recovery_key).into(),
            bootstrap_token: None,
        })
        .await
        .unwrap();
    let response = test_transport
        .recv()
        .await
        .expect("should receive challenge");
    let challenge = match response {
        Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
        other => panic!("Expected AuthChallenge, got {other:?}"),
    };
    // The challenge has been issued and the solution has not been sent, so the server cannot
    // have read the table again yet: the row is gone by the time `verify_solution` looks.
    {
        let mut conn = db.get().await.unwrap();
        diesel::delete(
            schema::recovery_operator_identity::table
                .filter(schema::recovery_operator_identity::public_key.eq(recovery_pubkey_bytes)),
        )
        .execute(&mut conn)
        .await
        .unwrap();
    }
    let signature = sign_operator_challenge(&recovery_key, &challenge);
    test_transport
        .send(auth::Inbound::AuthChallengeSolution {
            signature: signature.to_bytes(),
        })
        .await
        .unwrap();
    let refusal = test_transport
        .recv()
        .await
        .expect("the refusal must be sent to the peer");
    assert!(matches!(refusal, Err(auth::Error::UnregisteredPublicKey)));
    assert!(matches!(
        task.await.unwrap(),
        Err(auth::Error::UnregisteredPublicKey)
    ));
 }
--- a/server/crates/arbiter-server/tests/operator/unseal.rs
+++ b/server/crates/arbiter-server/tests/operator/unseal.rs
@@ -1,10 +1,12 @@
 use super::common::spawn_actors;
 use arbiter_crypto::authn;
 use arbiter_server::{
-    actors::vault::{Bootstrap, Seal},
+    actors::{
        GlobalActors,
        vault::{Bootstrap, Seal},
    },
    db,
    peers::operator::{
-        AuthenticatedOperator, Credentials,
+        Credentials,
        vault_gate::{
            Error as VaultGateError, HandleHandshake, HandleUnsealEncryptedKey, VaultGate,
        },
@@ -24,7 +26,7 @@ async fn setup_sealed_gate(
    oneshot::Receiver<Result<(), VaultGateError>>,
 ) {
    let db = db::create_test_pool().await;
-    let actors = spawn_actors(db.clone()).await;
+    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
    actors
        .vault
@@ -37,7 +39,7 @@ async fn setup_sealed_gate(
    let (promotion_tx, promotion_rx) = oneshot::channel();
    let pubkey = authn::SigningKey::generate().public_key();
-    let auth_creds = AuthenticatedOperator::Ordinary(Credentials { id: 1, pubkey });
+    let auth_creds = Credentials { id: 1, pubkey };
    let gate = VaultGate::spawn(VaultGate::new(auth_creds, actors, db.clone(), promotion_tx));
    (db, gate, promotion_rx)
--- a/server/crates/arbiter-server/tests/vault/lifecycle.rs
+++ b/server/crates/arbiter-server/tests/vault/lifecycle.rs
@@ -1,36 +1,21 @@
 use crate::common;
-use arbiter_crypto::{
+use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
    authn,
    safecell::{SafeCell, SafeCellHandle as _},
 };
 use arbiter_server::{
    actors::{
        GlobalActors,
        vault::{Error, GetState, Vault, VaultState},
        vault_coordinator::{
            ContributeBootstrap, ContributeRecoveryBootstrap, ContributeRecoveryUnseal,
-            ContributeUnseal, Error as CoordinatorError, StartBootstrap, VaultCoordinator,
+            Error as CoordinatorError, StartBootstrap, VaultCoordinator,
        },
    },
    crypto::{KeyCell, encryption::v1::{Nonce, ROOT_KEY_TAG}},
    db::{self, models, schema},
    peers::operator::{
        AuthenticatedOperator, Credentials, RecoveryCredentials,
        vault_gate::{
            Error as VaultGateError, HandleBootstrapEncryptedKey,
            HandleContributeBootstrapPassphrase, HandleContributeRecoveryBootstrapPassphrase,
            HandleContributeRecoveryUnsealPassphrase, HandleContributeUnsealPassphrase,
            HandleDeclareCommittee, HandleHandshake, VaultGate,
        },
    },
 };
-use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
+use diesel::{ExpressionMethods, QueryDsl, SelectableHelper, insert_into};
 use diesel::{ExpressionMethods, QueryDsl, SelectableHelper, insert_into, sql_query};
 use diesel_async::RunQueryDsl;
 use kameo::actor::Spawn as _;
 use tokio::sync::oneshot;
 use x25519_dalek::{EphemeralSecret, PublicKey};
 #[tokio::test]
 #[test_log::test]
@@ -269,19 +254,6 @@ async fn recovery_share_stored_and_used_for_unseal() {
    let state = vault_ref2.ask(GetState {}).await.unwrap();
    assert_eq!(state, VaultState::Sealed);
    // §3.6: the recovery operator's share only counts once a wake-up request has stood
    // uncancelled for the full dispute window, so back-date one here before unsealing.
    {
        let mut conn = db.get().await.unwrap();
        sql_query(format!(
            "INSERT INTO recovery_wakeup_request (requested_by, requested_at) \
             VALUES ({ordinary_id}, unixepoch('now') - 14*24*3600 - 1)"
        ))
        .execute(&mut conn)
        .await
        .unwrap();
    }
    // §3.5: Unseal using ONLY the recovery operator share (threshold = shamir_threshold(1) = 1).
    let coordinator2 = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref2.clone()));
    let done = coordinator2
@@ -296,527 +268,3 @@ async fn recovery_share_stored_and_used_for_unseal() {
    let state = vault_ref2.ask(GetState {}).await.unwrap();
    assert_eq!(state, VaultState::Unsealed);
 }
 /// A committee of zero ordinary operators used to reach `shamir_threshold(0)` and panic,
 /// taking the global coordinator down with it.
 #[tokio::test]
 #[test_log::test]
 async fn empty_committee_is_rejected_without_panicking() {
    let db = db::create_test_pool().await;
    let bus = GlobalActors::spawn_message_bus();
    let vault_ref = Vault::spawn(Vault::new(db.clone(), bus).await.unwrap());
    let coordinator = VaultCoordinator::spawn(VaultCoordinator::new(db, vault_ref));
    let err = coordinator
        .ask(StartBootstrap {
            operator_id: 1,
            declared_count: 0,
            recovery_count: 1,
        })
        .await
        .unwrap_err();
    assert!(
        matches!(
            err,
            kameo::error::SendError::HandlerError(CoordinatorError::EmptyCommittee)
        ),
        "expected EmptyCommittee, got {err:?}"
    );
    // The actor must still be alive to serve the next caller.
    let err = coordinator
        .ask(StartBootstrap {
            operator_id: 1,
            declared_count: 0,
            recovery_count: 0,
        })
        .await
        .unwrap_err();
    assert!(matches!(
        err,
        kameo::error::SendError::HandlerError(CoordinatorError::EmptyCommittee)
    ));
 }
 /// An approved-but-unfinished operator replacement deletes a share row. The unseal threshold
 /// must still describe the split that is actually stored, not the surviving row count.
 ///
 /// Four ordinary operators give a real 3-of-4 `vsss-rs` split (`shamir_threshold(4) == 3`).
 /// Deleting one share row leaves 3 rows, and `shamir_threshold(3) == 2` -- a *different* number
 /// from the recorded threshold. A recount-based unseal would therefore finalize one contribution
 /// early, combine only 2 shares of a 3-of-4 split, and fail to reconstruct the seal key.
 #[tokio::test]
 #[test_log::test]
 async fn unseal_threshold_survives_a_deleted_share_row() {
    let db = db::create_test_pool().await;
    let bus = GlobalActors::spawn_message_bus();
    let vault_ref = Vault::spawn(Vault::new(db.clone(), bus).await.unwrap());
    let coordinator = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref));
    // Four ordinary operators: threshold is 3-of-4.
    let mut ids = Vec::new();
    for n in 1..=4u8 {
        let mut conn = db.get().await.unwrap();
        let id: i32 = insert_into(schema::operator_identity::table)
            .values(schema::operator_identity::public_key.eq(vec![n; 32]))
            .returning(schema::operator_identity::id)
            .get_result(&mut conn)
            .await
            .unwrap();
        ids.push(id);
    }
    coordinator
        .ask(StartBootstrap {
            operator_id: ids[0],
            declared_count: 4,
            recovery_count: 0,
        })
        .await
        .unwrap();
    for (n, id) in ids.iter().enumerate() {
        coordinator
            .ask(ContributeBootstrap {
                operator_id: *id,
                passphrase: SafeCell::new(format!("pass-{n}").into_bytes()),
            })
            .await
            .unwrap();
    }
    let stored: Option<i32> = {
        let mut conn = db.get().await.unwrap();
        schema::arbiter_settings::table
            .select(schema::arbiter_settings::shamir_threshold)
            .first(&mut conn)
            .await
            .unwrap()
    };
    assert_eq!(stored, Some(3), "bootstrap must record the split threshold");
    // Simulate the aborted replacement: one share row is gone, leaving 3 of the 4 shares.
    {
        let mut conn = db.get().await.unwrap();
        diesel::delete(schema::operator::table)
            .filter(schema::operator::id.eq(Some(ids[3])))
            .execute(&mut conn)
            .await
            .unwrap();
    }
    // Restart and unseal with the three surviving operators' original passphrases.
    drop(coordinator);
    let bus2 = GlobalActors::spawn_message_bus();
    let vault_ref2 = Vault::spawn(Vault::new(db.clone(), bus2).await.unwrap());
    let coordinator2 = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref2.clone()));
    let done = coordinator2
        .ask(ContributeUnseal {
            operator_id: ids[0],
            passphrase: SafeCell::new(b"pass-0".to_vec()),
        })
        .await
        .unwrap();
    assert!(!done, "one share must not be enough for a 3-of-4 split");
    let done = coordinator2
        .ask(ContributeUnseal {
            operator_id: ids[1],
            passphrase: SafeCell::new(b"pass-1".to_vec()),
        })
        .await
        .unwrap();
    assert!(
        !done,
        "two shares must not be enough for a 3-of-4 split -- a recount would wrongly finalize here"
    );
    let done = coordinator2
        .ask(ContributeUnseal {
            operator_id: ids[2],
            passphrase: SafeCell::new(b"pass-2".to_vec()),
        })
        .await
        .unwrap();
    assert!(done, "three shares must reconstruct a 3-of-4 split");
    assert_eq!(
        vault_ref2.ask(GetState {}).await.unwrap(),
        VaultState::Unsealed
    );
 }
 /// §3.6: recovery operators are asleep by default. Without a wake-up whose 14-day dispute
 /// window has elapsed, their share must not count towards an unseal.
 #[tokio::test]
 #[test_log::test]
 async fn sleeping_recovery_operator_cannot_contribute_to_unseal() {
    let db = db::create_test_pool().await;
    let bus = GlobalActors::spawn_message_bus();
    let vault_ref = Vault::spawn(Vault::new(db.clone(), bus).await.unwrap());
    let coordinator = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref.clone()));
    let ordinary_id: i32 = {
        let mut conn = db.get().await.unwrap();
        insert_into(schema::operator_identity::table)
            .values(schema::operator_identity::public_key.eq(vec![1u8; 32]))
            .returning(schema::operator_identity::id)
            .get_result(&mut conn)
            .await
            .unwrap()
    };
    let recovery_id: i32 = {
        let mut conn = db.get().await.unwrap();
        insert_into(schema::recovery_operator_identity::table)
            .values(schema::recovery_operator_identity::public_key.eq(vec![2u8; 32]))
            .returning(schema::recovery_operator_identity::id)
            .get_result(&mut conn)
            .await
            .unwrap()
    };
    coordinator
        .ask(StartBootstrap {
            operator_id: ordinary_id,
            declared_count: 1,
            recovery_count: 1,
        })
        .await
        .unwrap();
    coordinator
        .ask(ContributeRecoveryBootstrap {
            recovery_operator_id: recovery_id,
            passphrase: SafeCell::new(b"recovery-pass".to_vec()),
        })
        .await
        .unwrap();
    coordinator
        .ask(ContributeBootstrap {
            operator_id: ordinary_id,
            passphrase: SafeCell::new(b"ordinary-pass".to_vec()),
        })
        .await
        .unwrap();
    // Restart so the vault comes up Sealed.
    drop(coordinator);
    drop(vault_ref);
    let bus2 = GlobalActors::spawn_message_bus();
    let vault_ref2 = Vault::spawn(Vault::new(db.clone(), bus2).await.unwrap());
    let coordinator2 = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref2.clone()));
    let err = coordinator2
        .ask(ContributeRecoveryUnseal {
            recovery_operator_id: recovery_id,
            passphrase: SafeCell::new(b"recovery-pass".to_vec()),
        })
        .await
        .unwrap_err();
    assert!(
        matches!(
            err,
            kameo::error::SendError::HandlerError(CoordinatorError::RecoveryNotActive)
        ),
        "expected RecoveryNotActive, got {err:?}"
    );
    assert_eq!(
        vault_ref2.ask(GetState {}).await.unwrap(),
        VaultState::Sealed,
        "a sleeping recovery operator unsealed the vault"
    );
 }
 type PromotionRx = oneshot::Receiver<Result<(), VaultGateError>>;
 /// One `VaultGate` per authenticated role against a shared `GlobalActors`, which is what
 /// `peers::operator::start` builds for two connected peers.
 struct RoleGates {
    ordinary: kameo::actor::ActorRef<VaultGate>,
    recovery: kameo::actor::ActorRef<VaultGate>,
    ordinary_id: i32,
    recovery_id: i32,
    /// Held only so the gates' promotion channels stay open for the fixture's lifetime.
    _promotions: (PromotionRx, PromotionRx),
 }
 /// Registers one ordinary and one recovery identity, then spawns a gate for each.
 async fn spawn_role_gates(db: &db::DatabasePool, actors: &GlobalActors) -> RoleGates {
    let ordinary_pubkey = authn::SigningKey::generate().public_key();
    let recovery_pubkey = authn::SigningKey::generate().public_key();
    let ordinary_id: i32 = {
        let mut conn = db.get().await.unwrap();
        insert_into(schema::operator_identity::table)
            .values(schema::operator_identity::public_key.eq(ordinary_pubkey.to_bytes()))
            .returning(schema::operator_identity::id)
            .get_result(&mut conn)
            .await
            .unwrap()
    };
    let recovery_id: i32 = {
        let mut conn = db.get().await.unwrap();
        insert_into(schema::recovery_operator_identity::table)
            .values(schema::recovery_operator_identity::public_key.eq(recovery_pubkey.to_bytes()))
            .returning(schema::recovery_operator_identity::id)
            .get_result(&mut conn)
            .await
            .unwrap()
    };
    let (ordinary_promotion_tx, ordinary_promotion_rx) = oneshot::channel();
    let ordinary = VaultGate::spawn(VaultGate::new(
        AuthenticatedOperator::Ordinary(Credentials {
            id: ordinary_id,
            pubkey: ordinary_pubkey,
        }),
        actors.clone(),
        db.clone(),
        ordinary_promotion_tx,
    ));
    let (recovery_promotion_tx, recovery_promotion_rx) = oneshot::channel();
    let recovery = VaultGate::spawn(VaultGate::new(
        AuthenticatedOperator::Recovery(RecoveryCredentials {
            id: recovery_id,
            pubkey: recovery_pubkey,
        }),
        actors.clone(),
        db.clone(),
        recovery_promotion_tx,
    ));
    RoleGates {
        ordinary,
        recovery,
        ordinary_id,
        recovery_id,
        _promotions: (ordinary_promotion_rx, recovery_promotion_rx),
    }
 }
 /// Runs the gate's X25519 handshake and encrypts `seal_key` to the shared secret, producing the
 /// message a peer would send to bootstrap the vault. Mirrors `tests/operator/unseal.rs`'s
 /// `client_dh_encrypt`, which does the same for the unseal side.
 async fn bootstrap_key_for(
    gate: &kameo::actor::ActorRef<VaultGate>,
    seal_key: &[u8; 32],
 ) -> HandleBootstrapEncryptedKey {
    let client_secret = EphemeralSecret::random();
    let client_public = PublicKey::from(&client_secret);
    let response = gate
        .ask(HandleHandshake {
            client_pubkey: client_public,
        })
        .await
        .unwrap();
    let shared_secret = client_secret.diffie_hellman(&response.server_pubkey);
    let cipher = XChaCha20Poly1305::new(shared_secret.as_bytes().into());
    let nonce = XNonce::from([0u8; 24]);
    let associated_data = b"bootstrap";
    let mut ciphertext = seal_key.to_vec();
    cipher
        .encrypt_in_place(&nonce, associated_data, &mut ciphertext)
        .unwrap();
    HandleBootstrapEncryptedKey {
        nonce: nonce.to_vec(),
        ciphertext,
        associated_data: associated_data.to_vec(),
    }
 }
 /// Asserts a gate turned a request down on the peer's role rather than on anything else --
 /// notably not on coordinator state, which is what an unguarded handler would have reported.
 #[track_caller]
 fn assert_role_refused<T: std::fmt::Debug, M>(
    what: &str,
    result: Result<T, kameo::error::SendError<M, VaultGateError>>,
 ) {
    match result {
        Err(kameo::error::SendError::HandlerError(VaultGateError::RoleNotPermitted)) => {}
        other => panic!("{what}: expected RoleNotPermitted, got {other:?}"),
    }
 }
 /// §3.5: which committee seat a passphrase fills is decided by the handshake, not by the
 /// request, so neither role can spend the other's slot.
 ///
 /// Neither request carries an operator id, so the ordinary peer has nothing left to forge; the
 /// point of running the bootstrap to completion afterwards is that its refusal left the
 /// recovery seat empty rather than filling it under a chosen id.
 #[tokio::test]
 #[test_log::test]
 async fn ordinary_operator_cannot_contribute_a_recovery_share() {
    let db = db::create_test_pool().await;
    let actors = common::spawn_actors(db.clone()).await;
    let gates = spawn_role_gates(&db, &actors).await;
    assert_eq!(
        gates.ordinary_id, gates.recovery_id,
        "the two ids must collide for the attestation check at the end to mean anything"
    );
    gates
        .ordinary
        .ask(HandleDeclareCommittee {
            count: 1,
            recovery_count: 1,
        })
        .await
        .unwrap();
    assert_role_refused(
        "an ordinary operator contributed a recovery share",
        gates
            .ordinary
            .ask(HandleContributeRecoveryBootstrapPassphrase {
                passphrase: b"forged-recovery-pass".to_vec(),
            })
            .await,
    );
    assert_role_refused(
        "a recovery operator contributed an ordinary share",
        gates
            .recovery
            .ask(HandleContributeBootstrapPassphrase {
                passphrase: b"forged-ordinary-pass".to_vec(),
            })
            .await,
    );
    // The recovery seat is still empty: had the forged contribution landed, this one would come
    // back as a duplicate instead of being accepted.
    let done = gates
        .recovery
        .ask(HandleContributeRecoveryBootstrapPassphrase {
            passphrase: b"recovery-pass".to_vec(),
        })
        .await
        .unwrap();
    assert!(!done, "the ordinary share is still outstanding");
    let done = gates
        .ordinary
        .ask(HandleContributeBootstrapPassphrase {
            passphrase: b"ordinary-pass".to_vec(),
        })
        .await
        .unwrap();
    assert!(done, "both seats are filled, so bootstrap must finalize");
    assert_eq!(
        actors.vault.ask(GetState {}).await.unwrap(),
        VaultState::Unsealed
    );
    // Both peers hold the same id in their own table (asserted above), so only the attestation
    // kind tells the two envelopes apart. Two rows means the recovery peer signed as itself
    // rather than overwriting the ordinary operator's attestation.
    let kinds = common::eventually("both bootstrap attestations are written", || {
        let db = db.clone();
        async move {
            let mut conn = db.get().await.unwrap();
            let mut kinds: Vec<String> = schema::integrity_envelope::table
                .select(schema::integrity_envelope::entity_kind)
                .load(&mut conn)
                .await
                .unwrap();
            kinds.sort();
            (kinds.len() == 2).then_some(kinds)
        }
    })
    .await;
    assert_eq!(
        kinds,
        vec![
            "operator_credentials".to_owned(),
            "recovery_operator_credentials".to_owned(),
        ]
    );
 }
 /// Every gate action that belongs to one role refuses the other, and refuses it before the
 /// action takes effect.
 ///
 /// The vault is left unbootstrapped and the coordinator idle on purpose: an unguarded handler
 /// would reach the vault or the coordinator and come back with `State`, `NotBootstrapping` or
 /// `NotUnsealing`, so `RoleNotPermitted` can only come from the role check itself.
 ///
 /// §3.4/§3.5: `HandleBootstrapEncryptedKey` matters most here. It hands the vault a root key of
 /// the peer's choosing, and the window it needs -- an unbootstrapped vault that already holds
 /// recovery identity rows -- is exactly the state committee formation has to pass through.
 #[tokio::test]
 #[test_log::test]
 async fn vault_gate_refuses_the_actions_of_the_other_role() {
    let db = db::create_test_pool().await;
    let actors = common::spawn_actors(db.clone()).await;
    let gates = spawn_role_gates(&db, &actors).await;
    assert_role_refused(
        "a recovery operator declared the committee",
        gates
            .recovery
            .ask(HandleDeclareCommittee {
                count: 1,
                recovery_count: 1,
            })
            .await,
    );
    // A key the vault would have accepted, negotiated through the gate's own handshake -- so
    // the refusal comes from the role and not from a malformed request.
    let seized_key = bootstrap_key_for(&gates.recovery, b"recovery-seized-32-byte-seal-key").await;
    assert_role_refused(
        "a recovery operator bootstrapped the vault",
        gates.recovery.ask(seized_key).await,
    );
    assert_role_refused(
        "a recovery operator contributed an ordinary bootstrap share",
        gates
            .recovery
            .ask(HandleContributeBootstrapPassphrase {
                passphrase: b"forged-ordinary-pass".to_vec(),
            })
            .await,
    );
    assert_role_refused(
        "an ordinary operator contributed a recovery bootstrap share",
        gates
            .ordinary
            .ask(HandleContributeRecoveryBootstrapPassphrase {
                passphrase: b"forged-recovery-pass".to_vec(),
            })
            .await,
    );
    assert_role_refused(
        "a recovery operator contributed an ordinary unseal share",
        gates
            .recovery
            .ask(HandleContributeUnsealPassphrase {
                passphrase: b"forged-ordinary-pass".to_vec(),
            })
            .await,
    );
    assert_role_refused(
        "an ordinary operator contributed a recovery unseal share",
        gates
            .ordinary
            .ask(HandleContributeRecoveryUnsealPassphrase {
                passphrase: b"forged-recovery-pass".to_vec(),
            })
            .await,
    );
    // Nothing above took effect: the refusals came before the vault and the coordinator.
    assert_eq!(
        actors.vault.ask(GetState {}).await.unwrap(),
        VaultState::Unbootstrapped,
        "a refused request still reached the vault"
    );
 }
--- a/useragent/rust/Cargo.lock
+++ b/useragent/rust/Cargo.lock