fix(mise): migrate from unix only asdf backend to a universal one

fix(evm): revoke dependent grants when wallet access is revoked
fix(vault): derive the recovery operator id from the authenticated peer
2026-09-08 16:11:42 +02:00 · 2026-09-08 16:11:42 +02:00 · 2026-09-08 16:11:42 +02:00 · 2026-09-08 16:11:42 +02:00 · 2026-09-08 16:11:42 +02:00 · 2026-09-08 16:11:42 +02:00
75 changed files with 13068 additions and 1024 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -0,0 +1 @@
+* text=auto eol=lf
--- a/app/.dart_tool/extension_discovery/README.md
+++ b/app/.dart_tool/extension_discovery/README.md
@@ -1,31 +0,0 @@
-Extension Discovery Cache
-=========================
-
-This folder is used by `package:extension_discovery` to cache lists of
-packages that contains extensions for other packages.
-
-DO NOT USE THIS FOLDER
----------------------
-
- * Do not read (or rely) the contents of this folder.
- * Do write to this folder.
-
-If you're interested in the lists of extensions stored in this folder use the
-API offered by package `extension_discovery` to get this information.
-
-If this package doesn't work for your use-case, then don't try to read the
-contents of this folder. It may change, and will not remain stable.
-
-Use package `extension_discovery`
---------------------------------
-
-If you want to access information from this folder.
-
-Feel free to delete this folder
-------------------------------
-
-Files in this folder act as a cache, and the cache is discarded if the files
-are older than the modification time of `.dart_tool/package_config.json`.
-
-Hence, it should never be necessary to clear this cache manually, if you find a
-need to do please file a bug.
--- a/app/.dart_tool/extension_discovery/vs_code.json
+++ b/app/.dart_tool/extension_discovery/vs_code.json
@@ -1 +0,0 @@
-{"version":2,"entries":[{"package":"app","rootUri":"../","packageUri":"lib/"}]}
--- a/app/.dart_tool/package_config.json
+++ b/app/.dart_tool/package_config.json
@@ -1,178 +0,0 @@
-{
-  "configVersion": 2,
-  "packages": [
-    {
-      "name": "async",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/async-2.13.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "boolean_selector",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/boolean_selector-2.1.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "characters",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/characters-1.4.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "clock",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/clock-1.1.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "collection",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/collection-1.19.1",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "cupertino_icons",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/cupertino_icons-1.0.8",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "fake_async",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/fake_async-1.3.3",
-      "packageUri": "lib/",
-      "languageVersion": "3.3"
-    },
-    {
-      "name": "flutter",
-      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "flutter_lints",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/flutter_lints-6.0.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "flutter_test",
-      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/packages/flutter_test",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "leak_tracker",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker-11.0.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.2"
-    },
-    {
-      "name": "leak_tracker_flutter_testing",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_flutter_testing-3.0.10",
-      "packageUri": "lib/",
-      "languageVersion": "3.2"
-    },
-    {
-      "name": "leak_tracker_testing",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/leak_tracker_testing-3.0.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.2"
-    },
-    {
-      "name": "lints",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/lints-6.1.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "matcher",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/matcher-0.12.17",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "material_color_utilities",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/material_color_utilities-0.11.1",
-      "packageUri": "lib/",
-      "languageVersion": "2.17"
-    },
-    {
-      "name": "meta",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/meta-1.17.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.5"
-    },
-    {
-      "name": "path",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/path-1.9.1",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "sky_engine",
-      "rootUri": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable/bin/cache/pkg/sky_engine",
-      "packageUri": "lib/",
-      "languageVersion": "3.8"
-    },
-    {
-      "name": "source_span",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/source_span-1.10.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "stack_trace",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stack_trace-1.12.1",
-      "packageUri": "lib/",
-      "languageVersion": "3.4"
-    },
-    {
-      "name": "stream_channel",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/stream_channel-2.1.4",
-      "packageUri": "lib/",
-      "languageVersion": "3.3"
-    },
-    {
-      "name": "string_scanner",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/string_scanner-1.4.1",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "term_glyph",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/term_glyph-1.2.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "test_api",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/test_api-0.7.7",
-      "packageUri": "lib/",
-      "languageVersion": "3.5"
-    },
-    {
-      "name": "vector_math",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vector_math-2.2.0",
-      "packageUri": "lib/",
-      "languageVersion": "3.1"
-    },
-    {
-      "name": "vm_service",
-      "rootUri": "file:///Users/kaska/.pub-cache/hosted/pub.dev/vm_service-15.0.2",
-      "packageUri": "lib/",
-      "languageVersion": "3.5"
-    },
-    {
-      "name": "app",
-      "rootUri": "../",
-      "packageUri": "lib/",
-      "languageVersion": "3.10"
-    }
-  ],
-  "generator": "pub",
-  "generatorVersion": "3.10.8",
-  "flutterRoot": "file:///Users/kaska/.local/share/mise/installs/flutter/3.38.9-stable",
-  "flutterVersion": "3.38.9",
-  "pubCache": "file:///Users/kaska/.pub-cache"
-}
--- a/app/.dart_tool/package_graph.json
+++ b/app/.dart_tool/package_graph.json
@@ -1,230 +0,0 @@
-{
-  "roots": [
-    "app"
-  ],
-  "packages": [
-    {
-      "name": "app",
-      "version": "1.0.0+1",
-      "dependencies": [
-        "cupertino_icons",
-        "flutter"
-      ],
-      "devDependencies": [
-        "flutter_lints",
-        "flutter_test"
-      ]
-    },
-    {
-      "name": "flutter_lints",
-      "version": "6.0.0",
-      "dependencies": [
-        "lints"
-      ]
-    },
-    {
-      "name": "flutter_test",
-      "version": "0.0.0",
-      "dependencies": [
-        "clock",
-        "collection",
-        "fake_async",
-        "flutter",
-        "leak_tracker_flutter_testing",
-        "matcher",
-        "meta",
-        "path",
-        "stack_trace",
-        "stream_channel",
-        "test_api",
-        "vector_math"
-      ]
-    },
-    {
-      "name": "cupertino_icons",
-      "version": "1.0.8",
-      "dependencies": []
-    },
-    {
-      "name": "flutter",
-      "version": "0.0.0",
-      "dependencies": [
-        "characters",
-        "collection",
-        "material_color_utilities",
-        "meta",
-        "sky_engine",
-        "vector_math"
-      ]
-    },
-    {
-      "name": "lints",
-      "version": "6.1.0",
-      "dependencies": []
-    },
-    {
-      "name": "stream_channel",
-      "version": "2.1.4",
-      "dependencies": [
-        "async"
-      ]
-    },
-    {
-      "name": "meta",
-      "version": "1.17.0",
-      "dependencies": []
-    },
-    {
-      "name": "collection",
-      "version": "1.19.1",
-      "dependencies": []
-    },
-    {
-      "name": "leak_tracker_flutter_testing",
-      "version": "3.0.10",
-      "dependencies": [
-        "flutter",
-        "leak_tracker",
-        "leak_tracker_testing",
-        "matcher",
-        "meta"
-      ]
-    },
-    {
-      "name": "vector_math",
-      "version": "2.2.0",
-      "dependencies": []
-    },
-    {
-      "name": "stack_trace",
-      "version": "1.12.1",
-      "dependencies": [
-        "path"
-      ]
-    },
-    {
-      "name": "clock",
-      "version": "1.1.2",
-      "dependencies": []
-    },
-    {
-      "name": "fake_async",
-      "version": "1.3.3",
-      "dependencies": [
-        "clock",
-        "collection"
-      ]
-    },
-    {
-      "name": "path",
-      "version": "1.9.1",
-      "dependencies": []
-    },
-    {
-      "name": "matcher",
-      "version": "0.12.17",
-      "dependencies": [
-        "async",
-        "meta",
-        "stack_trace",
-        "term_glyph",
-        "test_api"
-      ]
-    },
-    {
-      "name": "test_api",
-      "version": "0.7.7",
-      "dependencies": [
-        "async",
-        "boolean_selector",
-        "collection",
-        "meta",
-        "source_span",
-        "stack_trace",
-        "stream_channel",
-        "string_scanner",
-        "term_glyph"
-      ]
-    },
-    {
-      "name": "sky_engine",
-      "version": "0.0.0",
-      "dependencies": []
-    },
-    {
-      "name": "material_color_utilities",
-      "version": "0.11.1",
-      "dependencies": [
-        "collection"
-      ]
-    },
-    {
-      "name": "characters",
-      "version": "1.4.0",
-      "dependencies": []
-    },
-    {
-      "name": "async",
-      "version": "2.13.0",
-      "dependencies": [
-        "collection",
-        "meta"
-      ]
-    },
-    {
-      "name": "leak_tracker_testing",
-      "version": "3.0.2",
-      "dependencies": [
-        "leak_tracker",
-        "matcher",
-        "meta"
-      ]
-    },
-    {
-      "name": "leak_tracker",
-      "version": "11.0.2",
-      "dependencies": [
-        "clock",
-        "collection",
-        "meta",
-        "path",
-        "vm_service"
-      ]
-    },
-    {
-      "name": "term_glyph",
-      "version": "1.2.2",
-      "dependencies": []
-    },
-    {
-      "name": "string_scanner",
-      "version": "1.4.1",
-      "dependencies": [
-        "source_span"
-      ]
-    },
-    {
-      "name": "source_span",
-      "version": "1.10.2",
-      "dependencies": [
-        "collection",
-        "path",
-        "term_glyph"
-      ]
-    },
-    {
-      "name": "boolean_selector",
-      "version": "2.1.2",
-      "dependencies": [
-        "source_span",
-        "string_scanner"
-      ]
-    },
-    {
-      "name": "vm_service",
-      "version": "15.0.2",
-      "dependencies": []
-    }
-  ],
-  "configVersion": 1
-}
--- a/app/.dart_tool/version
+++ b/app/.dart_tool/version
@@ -1 +0,0 @@
-3.38.9
--- a/mise.lock
+++ b/mise.lock
@@ -7,6 +7,7 @@ backend = "aqua:ast-grep/ast-grep"
 [tools.ast-grep."platforms.linux-arm64"]
 checksum = "sha256:3ba383839044cf9817929435f5ce0027f91d06931e8efb32d942e58d73d92be5"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-aarch64-unknown-linux-gnu.zip"
+url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388772218"

 [tools.ast-grep."platforms.linux-arm64-musl"]
 checksum = "sha256:3ba383839044cf9817929435f5ce0027f91d06931e8efb32d942e58d73d92be5"
@@ -15,6 +16,7 @@ url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-aarch64
 [tools.ast-grep."platforms.linux-x64"]
 checksum = "sha256:5de8b87cba67fc8dc3e239d54b6484802ad745a7ae3de76be4fe89661dc52657"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-unknown-linux-gnu.zip"
+url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388771275"

 [tools.ast-grep."platforms.linux-x64-musl"]
 checksum = "sha256:5de8b87cba67fc8dc3e239d54b6484802ad745a7ae3de76be4fe89661dc52657"
@@ -23,14 +25,17 @@ url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-
 [tools.ast-grep."platforms.macos-arm64"]
 checksum = "sha256:c3961d8e8a4ee0ce2d0d98c7beeb168bb331cdc766b53630118a7b6c4fd39015"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-aarch64-apple-darwin.zip"
+url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388770234"

 [tools.ast-grep."platforms.macos-x64"]
 checksum = "sha256:a038965bfd7fe44257c771cdf8918dc3467dd8ec0eef673b8b14f639b144cdbd"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-apple-darwin.zip"
+url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388770498"

 [tools.ast-grep."platforms.windows-x64"]
 checksum = "sha256:fe34f631bb24c08ad146f92ca2a92971a53d179461b509fd8d32dc863bff9f83"
 url = "https://github.com/ast-grep/ast-grep/releases/download/0.42.1/app-x86_64-pc-windows-msvc.zip"
+url_api = "https://api.github.com/repos/ast-grep/ast-grep/releases/assets/388771363"

 [[tools."cargo:cargo-audit"]]
 version = "0.22.1"
@@ -57,7 +62,7 @@ version = "0.9.133"
 backend = "cargo:cargo-nextest"

 [[tools."cargo:cargo-shear"]]
-version = "1.11.2"
+version = "1.13.4"
 backend = "cargo:cargo-shear"

 [[tools."cargo:cargo-vet"]]
@@ -78,7 +83,27 @@ backend = "cargo:flutter_rust_bridge_codegen"

 [[tools.flutter]]
 version = "3.41.7-stable"
-backend = "asdf:flutter"
+backend = "http:flutter"
+
+[tools.flutter."platforms.linux-x64"]
+checksum = "sha256:f344d5057db52abc2a63cd3a7c7370957b7685d1fca5e5fbe2ce4dfe74657a79"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.41.7-stable.tar.xz"
+
+[tools.flutter."platforms.linux-x64-musl"]
+checksum = "sha256:f344d5057db52abc2a63cd3a7c7370957b7685d1fca5e5fbe2ce4dfe74657a79"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.41.7-stable.tar.xz"
+
+[tools.flutter."platforms.macos-arm64"]
+checksum = "sha256:2e3e6af44d1adccf695deff52e5e4c8beb10e5625066b27ad082b38b83ef805e"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_arm64_3.41.7-stable.zip"
+
+[tools.flutter."platforms.macos-x64"]
+checksum = "sha256:a0b9af49e6e1a6800f31a408b98c1d7bd51e98650a8b9ebcd77168b48c916ff0"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_3.41.7-stable.zip"
+
+[tools.flutter."platforms.windows-x64"]
+checksum = "sha256:de17b513b740a931c5dbc3f96b5a659c1612dfe6b5e1f910c5ad954a8bac17ee"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/windows/flutter_windows_3.41.7-stable.zip"

 [[tools.protoc]]
 version = "29.6"
@@ -87,30 +112,37 @@ backend = "aqua:protocolbuffers/protobuf/protoc"
 [tools.protoc."platforms.linux-arm64"]
 checksum = "sha256:2594ff4fcae8cb57310d394d0961b236190ad9c5efbfdf1f597ea471d424fe79"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-aarch_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795076"

 [tools.protoc."platforms.linux-arm64-musl"]
 checksum = "sha256:2594ff4fcae8cb57310d394d0961b236190ad9c5efbfdf1f597ea471d424fe79"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-aarch_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795076"

 [tools.protoc."platforms.linux-x64"]
 checksum = "sha256:48785a926e73ffa3f68e2f22b14e7b849620c7a1d36809ac9249a5495e280323"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-x86_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795083"

 [tools.protoc."platforms.linux-x64-musl"]
 checksum = "sha256:48785a926e73ffa3f68e2f22b14e7b849620c7a1d36809ac9249a5495e280323"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-linux-x86_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795083"

 [tools.protoc."platforms.macos-arm64"]
 checksum = "sha256:b9576b5fa1a1ef3fe13a8c91d9d8204b46545759bea5ae155cd6ba2ea4cdaeed"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-osx-aarch_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795082"

 [tools.protoc."platforms.macos-x64"]
 checksum = "sha256:312f04713946921cc0187ef34df80241ddca1bab6f564c636885fd2cc90d3f88"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-osx-x86_64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795085"

 [tools.protoc."platforms.windows-x64"]
 checksum = "sha256:1ebd7c87baffb9f1c47169b640872bf5fb1e4408079c691af527be9561d8f6f7"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.6/protoc-29.6-win64.zip"
+url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/350795088"

 [[tools.python]]
 version = "3.14.4"
@@ -122,8 +154,8 @@ url = "https://github.com/astral-sh/python-build-standalone/releases/download/20
 provenance = "github-attestations"

 [tools.python."platforms.linux-arm64-musl"]
-checksum = "sha256:b8b597fdb2f8dccdc502c11947b60a4b65eb6bce79cfa60c7ccf9b6e8352c60a"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
+checksum = "sha256:a10687b226e0941632569836bc1d8fa6353a8e3e8424316467ca9cdf220b983d"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-aarch64-unknown-linux-musl-install_only_stripped.tar.gz"
 provenance = "github-attestations"

 [tools.python."platforms.linux-x64"]
@@ -132,12 +164,12 @@ url = "https://github.com/astral-sh/python-build-standalone/releases/download/20
 provenance = "github-attestations"

 [tools.python."platforms.linux-x64-musl"]
-checksum = "sha256:fe9a9c32d13870af632cbac3dfc7528ae53597e94472aa4c7d6a42e8166136cd"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
+checksum = "sha256:d6005226cd24e780630626232c7a63243d4885fdf975dcf930a0758a0759ce14"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-x86_64-unknown-linux-musl-install_only_stripped.tar.gz"
 provenance = "github-attestations"

 [tools.python."platforms.macos-arm64"]
-checksum = "blake3:0314ec66e0f33ec04959583b5900bc8edae371a396aa96b8874e750d1fe936e6"
+checksum = "sha256:6f304f4ec30854611f23316578302235fb517cd970519ecdd11a8c4db87fd843"
 url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.14.4+20260414-aarch64-apple-darwin-install_only_stripped.tar.gz"
 provenance = "github-attestations"

@@ -154,3 +186,6 @@ provenance = "github-attestations"
 [[tools.rust]]
 version = "1.95.0"
 backend = "core:rust"
+
+[tools.rust.options]
+components = "clippy,rust-analyzer"
--- a/protobufs/operator.proto
+++ b/protobufs/operator.proto
@@ -4,25 +4,28 @@ package arbiter.operator;

 import "operator/auth.proto";
 import "operator/evm.proto";
+import "operator/governance.proto";
 import "operator/sdk_client.proto";
 import "operator/vault/vault.proto";

 message OperatorRequest {
  int32 id = 16;
  oneof payload {
-    auth.Request auth = 1;
-    vault.Request vault = 2;
-    evm.Request evm = 3;
-    sdk_client.Request sdk_client = 4;
+    auth.Request            auth        = 1;
+    vault.Request           vault       = 2;
+    evm.Request             evm         = 3;
+    sdk_client.Request      sdk_client  = 4;
+    governance.Request      governance  = 5;
  }
 }

 message OperatorResponse {
  optional int32 id = 16;
  oneof payload {
-    auth.Response auth = 1;
-    vault.Response vault = 2;
-    evm.Response evm = 3;
-    sdk_client.Response sdk_client = 4;
+    auth.Response           auth        = 1;
+    vault.Response          vault       = 2;
+    evm.Response            evm         = 3;
+    sdk_client.Response     sdk_client  = 4;
+    governance.Response     governance  = 5;
  }
 }
--- a/protobufs/operator/governance.proto
+++ b/protobufs/operator/governance.proto
@@ -0,0 +1,131 @@
+syntax = "proto3";
+
+package arbiter.operator.governance;
+
+import "google/protobuf/empty.proto";
+
+message Request {
+  oneof payload {
+    CreateProposalRequest create = 1;
+    CastVoteRequest       vote   = 2;
+    QueryPendingRequest   query  = 3;
+  }
+}
+
+message CreateProposalRequest {
+  oneof kind {
+    ApproveSdkClientPayload         approve_sdk_client          = 1;
+    GrantWalletAccessPayload        grant_wallet_access         = 2;
+    ReplaceOperatorPayload          replace_operator            = 3;
+    google.protobuf.Empty           trigger_rekey               = 4;
+    ApprovePersistentGrantPayload   approve_persistent_grant    = 5;
+    ApproveOneOffTransactionPayload approve_one_off_transaction = 6;
+  }
+  optional uint32 ttl_secs = 7;
+}
+
+message ReplaceOperatorPayload {
+  int32 old_operator_id = 1;
+  bytes new_pubkey      = 2;
+}
+
+message ApproveSdkClientPayload {
+  int32 client_id = 1;
+}
+
+message GrantWalletAccessPayload {
+  int32 wallet_id = 1;
+  int32 client_id = 2;
+}
+
+message CastVoteRequest {
+  int32 proposal_id = 1;
+  bool  approve     = 2;
+  bytes signature   = 3;
+}
+
+message QueryPendingRequest {}
+
+message Response {
+  oneof payload {
+    CreateProposalResponse created = 1;
+    VoteResponse           voted   = 2;
+    QueryPendingResponse   pending = 3;
+  }
+}
+
+message CreateProposalResponse {
+  int32 proposal_id = 1;
+}
+
+message VoteResponse {
+  VoteOutcome outcome = 1;
+}
+
+enum VoteOutcome {
+  VOTE_OUTCOME_UNSPECIFIED = 0;
+  VOTE_OUTCOME_PENDING     = 1;
+  VOTE_OUTCOME_APPROVED    = 2;
+  VOTE_OUTCOME_REJECTED    = 3;
+}
+
+message ProposalSummary {
+  int32  id            = 1;
+  string kind          = 2;
+  int32  initiator_id  = 3;
+  int64  expires_at    = 4;
+  int64  approve_count = 5;
+  int64  reject_count  = 6;
+}
+
+message QueryPendingResponse {
+  repeated ProposalSummary proposals = 1;
+}
+
+message TransactionRateLimitProto {
+  uint32 count       = 1;
+  int64  window_secs = 2;
+}
+
+message VolumeLimitProto {
+  bytes max_volume  = 1;
+  int64 window_secs = 2;
+}
+
+message EtherTransferSpecProto {
+  repeated bytes   targets = 1;
+  VolumeLimitProto limit   = 2;
+}
+
+message TokenTransferSpecProto {
+  bytes                     token_contract = 1;
+  optional bytes            target         = 2;
+  repeated VolumeLimitProto volume_limits  = 3;
+}
+
+message ApproveOneOffTransactionPayload {
+  int32  client_id                = 1;
+  bytes  wallet_address           = 2;
+  uint64 chain_id                 = 3;
+  uint64 nonce                    = 4;
+  uint64 gas_limit                = 5;
+  bytes  max_fee_per_gas          = 6;
+  bytes  max_priority_fee_per_gas = 7;
+  bytes  to                       = 8;
+  bytes  value                    = 9;
+  bytes  input                    = 10;
+}
+
+message ApprovePersistentGrantPayload {
+  int32                              wallet_access_id         = 1;
+  uint64                             chain_id                 = 2;
+  optional int64                     valid_from_secs          = 3;
+  optional int64                     valid_until_secs         = 4;
+  optional bytes                     max_gas_fee_per_gas      = 5;
+  optional bytes                     max_priority_fee_per_gas = 6;
+  optional TransactionRateLimitProto rate_limit               = 7;
+  oneof specific {
+    EtherTransferSpecProto ether_transfer = 8;
+    TokenTransferSpecProto token_transfer = 9;
+  }
+}
--- a/protobufs/operator/vault/bootstrap.proto
+++ b/protobufs/operator/vault/bootstrap.proto
@@ -8,15 +8,34 @@ message BootstrapEncryptedKey {
  bytes associated_data = 3;
 }

+message DeclareCommittee {
+  uint32 count          = 1;
+  uint32 recovery_count = 2;
+}
+
+message ContributePassphrase {
+  bytes passphrase = 1;
+}
+
+message ContributeRecoveryPassphrase {
+  bytes passphrase = 1;
+}
+
 enum BootstrapResult {
  BOOTSTRAP_RESULT_UNSPECIFIED = 0;
  BOOTSTRAP_RESULT_SUCCESS = 1;
  BOOTSTRAP_RESULT_ALREADY_BOOTSTRAPPED = 2;
  BOOTSTRAP_RESULT_INVALID_KEY = 3;
+  BOOTSTRAP_RESULT_AWAITING_CONTRIBUTIONS = 4;
 }

 message Request {
-  BootstrapEncryptedKey encrypted_key = 2;
+  oneof payload {
+    BootstrapEncryptedKey        encrypted_key                    = 2;
+    DeclareCommittee             declare_committee                = 3;
+    ContributePassphrase         contribute_passphrase            = 4;
+    ContributeRecoveryPassphrase contribute_recovery_passphrase   = 5;
+  }
 }

 message Response {
--- a/protobufs/operator/vault/rekey.proto
+++ b/protobufs/operator/vault/rekey.proto
@@ -0,0 +1,29 @@
+syntax = "proto3";
+
+package arbiter.operator.vault.rekey;
+
+message ContributePassphrase {
+  bytes passphrase = 1;
+}
+
+message ContributeRecoveryPassphrase {
+  bytes passphrase = 1;
+}
+
+enum RekeyResult {
+  REKEY_RESULT_UNSPECIFIED            = 0;
+  REKEY_RESULT_SUCCESS                = 1;
+  REKEY_RESULT_AWAITING_CONTRIBUTIONS = 2;
+  REKEY_RESULT_NOT_IN_PROGRESS        = 3;
+}
+
+message Request {
+  oneof payload {
+    ContributePassphrase         contribute_passphrase          = 1;
+    ContributeRecoveryPassphrase contribute_recovery_passphrase = 2;
+  }
+}
+
+message Response {
+  RekeyResult result = 1;
+}
--- a/protobufs/operator/vault/unseal.proto
+++ b/protobufs/operator/vault/unseal.proto
@@ -15,17 +15,28 @@ message UnsealEncryptedKey {
  bytes associated_data = 3;
 }

+message ContributePassphrase {
+  bytes passphrase = 1;
+}
+
+message ContributeRecoveryPassphrase {
+  bytes passphrase = 1;
+}
+
 enum UnsealResult {
  UNSEAL_RESULT_UNSPECIFIED = 0;
  UNSEAL_RESULT_SUCCESS = 1;
  UNSEAL_RESULT_INVALID_KEY = 2;
  UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
+  UNSEAL_RESULT_AWAITING_CONTRIBUTIONS = 4;
 }

 message Request {
  oneof payload {
-    UnsealStart start = 1;
-    UnsealEncryptedKey encrypted_key = 2;
+    UnsealStart                  start                          = 1;
+    UnsealEncryptedKey           encrypted_key                  = 2;
+    ContributePassphrase         contribute_passphrase          = 3;
+    ContributeRecoveryPassphrase contribute_recovery_passphrase = 4;
  }
 }

--- a/protobufs/operator/vault/vault.proto
+++ b/protobufs/operator/vault/vault.proto
@@ -5,20 +5,23 @@ package arbiter.operator.vault;
 import "google/protobuf/empty.proto";
 import "shared/vault.proto";
 import "operator/vault/bootstrap.proto";
+import "operator/vault/rekey.proto";
 import "operator/vault/unseal.proto";

 message Request {
  oneof payload {
    google.protobuf.Empty query_state = 1;
-    unseal.Request unseal = 2;
-    bootstrap.Request bootstrap = 3;
+    unseal.Request        unseal      = 2;
+    bootstrap.Request     bootstrap   = 3;
+    rekey.Request         rekey       = 4;
  }
 }

 message Response {
  oneof payload {
-    arbiter.shared.VaultState state = 1;
-    unseal.Response unseal = 2;
-    bootstrap.Response bootstrap = 3;
+    arbiter.shared.VaultState state     = 1;
+    unseal.Response           unseal    = 2;
+    bootstrap.Response        bootstrap = 3;
+    rekey.Response            rekey     = 4;
  }
 }
--- a/protobufs/shared/vault.proto
+++ b/protobufs/shared/vault.proto
@@ -5,7 +5,8 @@ package arbiter.shared;
 enum VaultState {
  VAULT_STATE_UNSPECIFIED = 0;
  VAULT_STATE_UNBOOTSTRAPPED = 1;
-  VAULT_STATE_SEALED = 2;
-  VAULT_STATE_UNSEALED = 3;
-  VAULT_STATE_ERROR = 4;
+  VAULT_STATE_BOOSTRAPPING = 2;
+  VAULT_STATE_SEALED = 3;
+  VAULT_STATE_UNSEALED = 4;
+  VAULT_STATE_ERROR = 5;
 }
--- a/scripts/pycache/gen_erc20_registry.cpython-314.pyc
+++ b/scripts/pycache/gen_erc20_registry.cpython-314.pyc
--- a/server/Cargo.lock
+++ b/server/Cargo.lock
@@ -24,7 +24,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
 dependencies = [
 "crypto-common 0.1.7",
- "generic-array",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -674,6 +674,12 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
 [[package]]
 name = "anyhow"
 version = "1.0.102"
@@ -707,6 +713,7 @@ dependencies = [
 "memsafe",
 "ml-dsa",
 "rand 0.10.1",
+ "strum 0.28.0",
 "thiserror",
 "x-wing",
 ]
@@ -766,11 +773,14 @@ dependencies = [
 "kameo",
 "kameo_actors",
 "ml-dsa",
+ "mockall",
 "mutants",
 "pem",
 "proptest",
+ "prost",
 "prost-types",
 "rand 0.10.1",
+ "rand_core 0.6.4",
 "rcgen",
 "restructed",
 "rstest",
@@ -779,6 +789,7 @@ dependencies = [
 "smlang",
 "strum 0.28.0",
 "subtle",
+ "tempfile",
 "test-log",
 "thiserror",
 "tokio",
@@ -786,6 +797,7 @@ dependencies = [
 "tonic",
 "tracing",
 "tracing-subscriber",
+ "vsss-rs",
 "x25519-dalek 2.0.1",
 ]

@@ -1283,7 +1295,7 @@ version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -1612,8 +1624,22 @@ version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 "rand_core 0.6.4",
+ "serdect 0.2.0",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto-bigint"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96272c2ff28b807e09250b180ad1fb7889a3258f7455759b5c3c58b719467130"
+dependencies = [
+ "num-traits",
+ "rand_core 0.6.4",
+ "serdect 0.3.0",
 "subtle",
 "zeroize",
 ]
@@ -1624,7 +1650,7 @@ version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 "rand_core 0.6.4",
 "typenum",
 ]
@@ -1927,7 +1953,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -1965,6 +1991,12 @@ dependencies = [
 "syn 2.0.117",
 ]

+[[package]]
+name = "downcast"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1435fa1053d8b2fbbe9be7e97eca7f33d37b28409959813daefc1446a14247f1"
+
 [[package]]
 name = "downcast-rs"
 version = "2.0.2"
@@ -2007,7 +2039,7 @@ dependencies = [
 "digest 0.10.7",
 "elliptic-curve",
 "rfc6979",
- "serdect",
+ "serdect 0.2.0",
 "signature 2.2.0",
 "spki 0.7.3",
 ]
@@ -2040,16 +2072,32 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
 "base16ct",
- "crypto-bigint",
+ "crypto-bigint 0.5.5",
 "digest 0.10.7",
 "ff",
- "generic-array",
+ "generic-array 0.14.7",
 "group",
+ "hkdf",
 "pkcs8 0.10.2",
 "rand_core 0.6.4",
 "sec1",
- "serdect",
+ "serdect 0.2.0",
 "subtle",
+ "tap",
+ "zeroize",
+]
+
+[[package]]
+name = "elliptic-curve-tools"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1de2b6fae800f08032a6ea32995b52925b1d451bff9d445c8ab2932323277faf"
+dependencies = [
+ "elliptic-curve",
+ "heapless",
+ "hex",
+ "multiexp",
+ "serde",
 "zeroize",
 ]

@@ -2123,6 +2171,7 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
 dependencies = [
+ "bitvec",
 "rand_core 0.6.4",
 "subtle",
 ]
@@ -2200,6 +2249,15 @@ dependencies = [
 "percent-encoding",
 ]

+[[package]]
+name = "fragile"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8878864ba14bb86e818a412bfd6f18f9eabd4ec0f008a28e8f7eb61db532fcf9"
+dependencies = [
+ "futures-core",
+]
+
 [[package]]
 name = "fs_extra"
 version = "1.3.0"
@@ -2323,6 +2381,17 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "generic-array"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab9e9188e97a93276e1fe7b56401b851e2b45a46d045ca658100c1303ada649"
+dependencies = [
+ "rustversion",
+ "serde_core",
+ "typenum",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -2406,6 +2475,15 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "hash32"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d60b12902ba28e2730cd37e95b8c9223af2808df9e902d4df49588d1470606"
+dependencies = [
+ "byteorder",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -2446,6 +2524,16 @@ version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"

+[[package]]
+name = "heapless"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bfb9eb618601c89945a70e254898da93b13be0388091d42117462b265bb3fad"
+dependencies = [
+ "hash32",
+ "stable_deref_trait",
+]
+
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -2473,6 +2561,15 @@ dependencies = [
 "arrayvec",
 ]

+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac 0.12.1",
+]
+
 [[package]]
 name = "hmac"
 version = "0.12.1"
@@ -2543,6 +2640,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08d46837a0ed51fe95bd3b05de33cd64a1ee88fc797477ca48446872504507c5"
 dependencies = [
 "ctutils",
+ "serde",
 "typenum",
 "zeroize",
 ]
@@ -2808,7 +2906,7 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
- "generic-array",
+ "generic-array 0.14.7",
 ]

 [[package]]
@@ -2947,15 +3045,15 @@ dependencies = [
 "ecdsa",
 "elliptic-curve",
 "once_cell",
- "serdect",
+ "serdect 0.2.0",
 "sha2 0.10.9",
 "signature 2.2.0",
 ]

 [[package]]
 name = "kameo"
-version = "0.20.0"
-source = "git+https://github.com/hdbg/kameo.git?rev=805b417#805b41783fe90b54827ecad142b422c7a9b69b9a"
+version = "0.22.2"
+source = "git+https://github.com/hdbg/kameo.git?rev=17af90e3#17af90e3ae95fc6f89fa31a2f1b9506ac127f0b7"
 dependencies = [
 "downcast-rs",
 "dyn-clone",
@@ -2968,8 +3066,8 @@ dependencies = [

 [[package]]
 name = "kameo_actors"
-version = "0.5.0"
-source = "git+https://github.com/hdbg/kameo.git?rev=805b417#805b41783fe90b54827ecad142b422c7a9b69b9a"
+version = "0.8.1"
+source = "git+https://github.com/hdbg/kameo.git?rev=17af90e3#17af90e3ae95fc6f89fa31a2f1b9506ac127f0b7"
 dependencies = [
 "futures",
 "glob",
@@ -2980,14 +3078,13 @@ dependencies = [

 [[package]]
 name = "kameo_macros"
-version = "0.20.0"
-source = "git+https://github.com/hdbg/kameo.git?rev=805b417#805b41783fe90b54827ecad142b422c7a9b69b9a"
+version = "0.21.1"
+source = "git+https://github.com/hdbg/kameo.git?rev=17af90e3#17af90e3ae95fc6f89fa31a2f1b9506ac127f0b7"
 dependencies = [
- "darling 0.23.0",
 "heck",
 "proc-macro2",
 "quote",
- "syn 2.0.117",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -3278,6 +3375,32 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "mockall"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a6ceddfe3ce334925e96bf420fdb2dcee5bed6c632a168ece622676dadeaf8a"
+dependencies = [
+ "cfg-if",
+ "downcast",
+ "fragile",
+ "mockall_derive",
+ "predicates",
+ "predicates-tree",
+]
+
+[[package]]
+name = "mockall_derive"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cfe16fbe8a314aeec0b861ac24e60b1e123e97634bab045475b9d6a18416fd8"
+dependencies = [
+ "cfg-if",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "module-lattice"
 version = "0.2.2"
@@ -3290,6 +3413,20 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "multiexp"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ec2ce93a6f06ac6cae04c1da3f2a6a24fcfc1f0eb0b4e0f3d302f0df45326cb"
+dependencies = [
+ "ff",
+ "group",
+ "rand_core 0.6.4",
+ "rustversion",
+ "std-shims",
+ "zeroize",
+]
+
 [[package]]
 name = "multimap"
 version = "0.10.1"
@@ -3321,6 +3458,20 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
 [[package]]
 name = "num-bigint"
 version = "0.4.6"
@@ -3329,6 +3480,19 @@ checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
 dependencies = [
 "num-integer",
 "num-traits",
+ "rand 0.8.6",
+ "serde",
+]
+
+[[package]]
+name = "num-complex"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
+dependencies = [
+ "num-traits",
+ "rand 0.8.6",
+ "serde",
 ]

 [[package]]
@@ -3346,6 +3510,29 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+ "serde",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -3647,6 +3834,32 @@ dependencies = [
 "zerocopy",
 ]

+[[package]]
+name = "predicates"
+version = "3.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ada8f2932f28a27ee7b70dd6c1c39ea0675c55a36879ab92f3a715eaa1e63cfe"
+dependencies = [
+ "anstyle",
+ "predicates-core",
+]
+
+[[package]]
+name = "predicates-core"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cad38746f3166b4031b1a0d39ad9f954dd291e7854fcc0eed52ee41a0b50d144"
+
+[[package]]
+name = "predicates-tree"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0de1b847b39c8131db0467e9df1ff60e6d0562ab8e9a16e568ad0fdb372e2f2"
+dependencies = [
+ "predicates-core",
+ "termtree",
+]
+
 [[package]]
 name = "prettyplease"
 version = "0.2.37"
@@ -4454,9 +4667,9 @@ checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
 "base16ct",
 "der 0.7.10",
- "generic-array",
+ "generic-array 0.14.7",
 "pkcs8 0.10.2",
- "serdect",
+ "serdect 0.2.0",
 "subtle",
 "zeroize",
 ]
@@ -4622,6 +4835,16 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "serdect"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f42f67da2385b51a5f9652db9c93d78aeaf7610bf5ec366080b6de810604af53"
+dependencies = [
+ "base16ct",
+ "serde",
+]
+
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -4787,6 +5010,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "spin"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -4831,6 +5060,17 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"

+[[package]]
+name = "std-shims"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "227c4f8561598188d0df96dbe749824576174bba278b5b6bb2eacff1066067d0"
+dependencies = [
+ "hashbrown 0.16.1",
+ "rustversion",
+ "spin",
+]
+
 [[package]]
 name = "string_morph"
 version = "0.1.0"
@@ -4934,6 +5174,17 @@ dependencies = [
 "unicode-ident",
 ]

+[[package]]
+name = "syn"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "syn-solidity"
 version = "1.5.7"
@@ -4995,6 +5246,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "termtree"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
+
 [[package]]
 name = "test-log"
 version = "0.2.20"
@@ -5574,6 +5831,27 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"

+[[package]]
+name = "vsss-rs"
+version = "5.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ec751bdcc8bda099e269b24cc6b4ad14f9ce8b0490c1599174070e792ecd70c"
+dependencies = [
+ "crypto-bigint 0.5.5",
+ "crypto-bigint 0.6.1",
+ "elliptic-curve",
+ "elliptic-curve-tools",
+ "generic-array 1.4.1",
+ "hex",
+ "hybrid-array",
+ "num",
+ "rand_core 0.6.4",
+ "serde",
+ "sha3 0.10.9",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "wait-timeout"
 version = "0.2.1"
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -12,8 +12,8 @@ base64 = "0.22.1"
 chrono = { version = "0.4.44", features = ["serde"] }
 futures = "0.3.32"
 k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
-kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
-kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
+kameo = {git = "https://github.com/hdbg/kameo.git", rev = "17af90e3"}
+kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "17af90e3"}
 hmac = "0.13.0"
 miette = { version = "7.6.0", features = ["fancy", "serde"] }
 ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] }
@@ -27,6 +27,7 @@ rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post
 rustls-pki-types = "1.14.1"
 sha2 = "0.11"
 smlang = "0.8.0"
+strum = { version = "0.28.0", features = ["derive"] }
 thiserror = "2.0.18"
 tokio = { version = "1.52.1", features = ["full"] }
 tokio-stream = { version = "0.1.18", features = ["full"] }
@@ -106,7 +107,6 @@ indexing_slicing = "warn"
 infinite_loop = "warn"
 inline_asm_x86_att_syntax = "warn"
 inline_asm_x86_intel_syntax = "warn"
-integer_division = "warn"
 large_include_file = "warn"
 lossy_float_literal = "warn"
 map_with_unused_argument_over_ranges = "warn"
@@ -168,3 +168,4 @@ nursery = { level = "warn", priority = -1 }
 pedantic = { level = "warn", priority = -1 }

 type_repetition_in_bounds = "allow"   # sometimes, it's better for readability this way
+unused_async_trait_impl = "allow"
--- a/server/clippy.toml
+++ b/server/clippy.toml
@@ -26,3 +26,5 @@ trait-assoc-item-kinds-order = [
    "type",
    "fn",
 ] # community tested standard
+
+too-many-lines-threshold = 150
--- a/server/crates/arbiter-client/src/auth.rs
+++ b/server/crates/arbiter-client/src/auth.rs
@@ -2,7 +2,7 @@ use crate::{
    storage::StorageError,
    transport::{ClientTransport, next_request_id},
 };
-use arbiter_crypto::authn::{self, CLIENT_CONTEXT, SigningKey};
+use arbiter_crypto::authn::{self, SigningContext, SigningKey};
 use arbiter_proto::{
    ClientMetadata,
    proto::{
@@ -110,7 +110,7 @@ async fn send_auth_challenge_solution(
    };
    let challenge_payload: Vec<u8> = challenge.format();
    let signature = key
-        .sign_message(&challenge_payload, CLIENT_CONTEXT)
+        .sign_message(&challenge_payload, SigningContext::Client)
        .map_err(|_| AuthError::UnexpectedAuthResponse)?
        .to_bytes();

--- a/server/crates/arbiter-crypto/Cargo.toml
+++ b/server/crates/arbiter-crypto/Cargo.toml
@@ -7,6 +7,7 @@ edition = "2024"
 ml-dsa = {workspace = true, optional = true }
 rand = {workspace = true, optional = true}
 memsafe = {version = "0.4.0", optional = true}
+strum = { workspace = true, optional = true }
 hmac.workspace = true
 alloy.workspace = true
 x-wing = { version = "0.1.0-rc.0", features = ["zeroize"] }
@@ -18,7 +19,7 @@ workspace = true

 [features]
 default = ["authn", "safecell"]
-authn = ["dep:ml-dsa", "dep:rand"]
+authn = ["dep:ml-dsa", "dep:rand", "dep:strum"]
 safecell = ["dep:memsafe"]

 [lib]
--- a/server/crates/arbiter-crypto/src/authn/v1.rs
+++ b/server/crates/arbiter-crypto/src/authn/v1.rs
@@ -5,9 +5,25 @@ use ml_dsa::{
    SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey, signature::Keypair as _,
 };
 use rand::RngExt;
+use strum::IntoStaticStr;

-pub static CLIENT_CONTEXT: &[u8] = b"arbiter_client";
-pub static OPERATOR_CONTEXT: &[u8] = b"arbiter_operator";
+/// Domain separation tag mixed into every ML-DSA signature.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, IntoStaticStr)]
+pub enum SigningContext {
+    #[strum(serialize = "arbiter_client")]
+    Client,
+    #[strum(serialize = "arbiter_operator")]
+    Operator,
+    #[strum(serialize = "arbiter_governance_vote")]
+    GovernanceVote,
+}
+
+impl SigningContext {
+    #[must_use]
+    pub fn as_bytes(self) -> &'static [u8] {
+        <&'static str>::from(self).as_bytes()
+    }
+}

 const NONCE_SIZE: usize = 32;

@@ -85,10 +101,26 @@ impl PublicKey {
    }

    #[must_use]
-    pub fn verify(&self, challenge: &AuthChallenge, context: &[u8], signature: &Signature) -> bool {
+    pub fn verify(
+        &self,
+        challenge: &AuthChallenge,
+        context: SigningContext,
+        signature: &Signature,
+    ) -> bool {
        let challenge = challenge.format();
        self.0
-            .verify_with_context(&challenge, context, &signature.0)
+            .verify_with_context(&challenge, context.as_bytes(), &signature.0)
+    }
+
+    #[must_use]
+    pub fn verify_message(
+        &self,
+        message: &[u8],
+        context: SigningContext,
+        signature: &Signature,
+    ) -> bool {
+        self.0
+            .verify_with_context(message, context.as_bytes(), &signature.0)
    }
 }

@@ -115,17 +147,21 @@ impl SigningKey {
        self.0.verifying_key().into()
    }

-    pub fn sign_message(&self, message: &[u8], context: &[u8]) -> Result<Signature, Error> {
+    pub fn sign_message(
+        &self,
+        message: &[u8],
+        context: SigningContext,
+    ) -> Result<Signature, Error> {
        self.0
            .signing_key()
-            .sign_deterministic(message, context)
+            .sign_deterministic(message, context.as_bytes())
            .map(Into::into)
    }

    pub fn sign_challenge(
        &self,
        challenge: &AuthChallenge,
-        context: &[u8],
+        context: SigningContext,
    ) -> Result<Signature, Error> {
        let challenge = challenge.format();

@@ -192,7 +228,7 @@ mod tests {

    use crate::authn::AuthChallenge;

-    use super::{CLIENT_CONTEXT, PublicKey, Signature, SigningKey, OPERATOR_CONTEXT};
+    use super::{PublicKey, Signature, SigningContext, SigningKey};

    #[test]
    fn public_key_round_trip_decodes() {
@@ -208,7 +244,7 @@ mod tests {
    fn signature_round_trip_decodes() {
        let key = SigningKey::generate();
        let signature = key
-            .sign_message(b"challenge", CLIENT_CONTEXT)
+            .sign_message(b"challenge", SigningContext::Client)
            .expect("signature should be created");

        let decoded =
@@ -223,11 +259,11 @@ mod tests {
        let public_key = key.public_key();
        let challenge = AuthChallenge::generate(&mut rand::rng());
        let signature = key
-            .sign_challenge(&challenge, CLIENT_CONTEXT)
+            .sign_challenge(&challenge, SigningContext::Client)
            .expect("signature should be created");

-        assert!(public_key.verify(&challenge, CLIENT_CONTEXT, &signature));
-        assert!(!public_key.verify(&challenge, OPERATOR_CONTEXT, &signature));
+        assert!(public_key.verify(&challenge, SigningContext::Client, &signature));
+        assert!(!public_key.verify(&challenge, SigningContext::Operator, &signature));
    }

    #[test]
@@ -240,13 +276,13 @@ mod tests {
        let challenge = AuthChallenge::generate(&mut rand::rng());

        let signature = restored
-            .sign_challenge(&challenge, CLIENT_CONTEXT)
+            .sign_challenge(&challenge, SigningContext::Client)
            .expect("signature should be created");

        assert!(
            restored
                .public_key()
-                .verify(&challenge, CLIENT_CONTEXT, &signature)
+                .verify(&challenge, SigningContext::Client, &signature)
        );
    }
 }
--- a/server/crates/arbiter-crypto/src/safecell.rs
+++ b/server/crates/arbiter-crypto/src/safecell.rs
@@ -22,7 +22,7 @@ pub trait SafeCellHandle<T> {
    fn read(&mut self) -> Self::CellRead<'_>;
    fn write(&mut self) -> Self::CellWrite<'_>;

-    fn new_inline<F>(f: F) -> Self
+    fn new_inline_default<F>(f: F) -> Self
    where
        Self: Sized,
        T: Default,
@@ -36,6 +36,14 @@ pub trait SafeCellHandle<T> {
        cell
    }

+    fn new_inline<F>(f: Box<F>) -> Self
+    where
+        Self: Sized,
+        F: for<'a> FnOnce() -> T,
+    {
+        Self::new(f())
+    }
+
    #[inline(always)]
    fn read_inline<F, R>(&mut self, f: F) -> R
    where
--- a/server/crates/arbiter-proto/src/lib.rs
+++ b/server/crates/arbiter-proto/src/lib.rs
@@ -23,6 +23,10 @@ pub mod proto {
            tonic::include_proto!("arbiter.operator.evm");
        }

+        pub mod governance {
+            tonic::include_proto!("arbiter.operator.governance");
+        }
+
        pub mod sdk_client {
            tonic::include_proto!("arbiter.operator.sdk_client");
        }
@@ -34,6 +38,10 @@ pub mod proto {
                tonic::include_proto!("arbiter.operator.vault.bootstrap");
            }

+            pub mod rekey {
+                tonic::include_proto!("arbiter.operator.vault.rekey");
+            }
+
            pub mod unseal {
                tonic::include_proto!("arbiter.operator.vault.unseal");
            }
--- a/server/crates/arbiter-server/Cargo.toml
+++ b/server/crates/arbiter-server/Cargo.toml
@@ -37,11 +37,12 @@ kameo.workspace = true
 chacha20poly1305 = { version = "0.10.1", features = ["std"] }
 argon2 = { version = "0.5.3", features = ["zeroize"] }
 restructed = "0.2.2"
-strum = { version = "0.28.0", features = ["derive"] }
+strum.workspace = true
 pem = "3.0.6"
 sha2.workspace = true
 hmac.workspace = true
 alloy.workspace = true
+prost.workspace = true
 prost-types.workspace = true
 arbiter-tokens-registry.path = "../arbiter-tokens-registry"
 anyhow = "1.0.102"
@@ -50,12 +51,16 @@ subtle = "2.6.1"
 x25519-dalek.workspace = true
 k256.workspace = true
 kameo_actors.workspace = true
+vsss-rs = "5.4.0"
+rand_core = "0.6"

 [dev-dependencies]
 proptest = "1.11.0"
 rstest.workspace = true
 test-log = { version = "0.2", default-features = false, features = ["trace"] }
 ml-dsa.workspace = true
+mockall = "0.15.0"
+tempfile = "3.27.0"

 [lib]
 doctest = false
--- a/server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
+++ b/server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql
@@ -37,7 +37,11 @@ create table if not exists tls_history (
 create table if not exists arbiter_settings (
    id INTEGER not null PRIMARY KEY CHECK (id = 1), -- singleton row, id must be 1
    root_key_id integer references root_key_history (id) on delete RESTRICT, -- if null, means wasn't bootstrapped yet
-    tls_id integer references tls_history (id) on delete RESTRICT
+    tls_id integer references tls_history (id) on delete RESTRICT,
+    -- Shamir threshold of the split that produced the stored shares. Null before bootstrap.
+    -- Recorded rather than recomputed: an aborted operator replacement leaves fewer share
+    -- rows than the split has shares, and a recomputed threshold would then be wrong.
+    shamir_threshold integer
 ) STRICT;

 insert into arbiter_settings (id) values (1) on conflict do nothing;
@@ -56,6 +60,7 @@ create table if not exists operator (

    share blob not null,
    share_nonce blob not null,
+    share_salt blob not null,

    created_at integer not null default(unixepoch ('now')),
    updated_at integer not null default(unixepoch ('now'))
@@ -108,6 +113,7 @@ create table if not exists evm_wallet_access (
    id integer not null primary key,
    wallet_id integer not null references evm_wallet (id) on delete cascade,
    client_id integer not null references program_client (id) on delete cascade,
+    revoked_at integer, -- unix timestamp when revoked, null = still active
    created_at integer not null default(unixepoch ('now'))
 ) STRICT;

@@ -215,3 +221,156 @@ create table if not exists integrity_envelope (
 ) STRICT;

 create unique index if not exists uniq_integrity_envelope_entity on integrity_envelope (entity_kind, entity_id);
+
+create table if not exists proposal (
+    id           integer not null primary key,
+    kind         text    not null,
+    initiator_id integer not null references operator_identity(id) on delete restrict,
+    created_at   integer not null default(unixepoch('now')),
+    expires_at   integer not null,
+    status       text    not null default 'pending'
+        check (status in ('pending', 'approved', 'rejected'))
+) STRICT;
+
+-- Parameters of an approved-or-pending proposal
+create table if not exists proposal_approve_sdk_client (
+    proposal_id integer not null primary key references proposal(id) on delete cascade,
+    client_id   integer not null references program_client(id) on delete restrict
+) STRICT;
+
+create table if not exists proposal_grant_wallet_access (
+    proposal_id integer not null primary key references proposal(id) on delete cascade,
+    wallet_id   integer not null references evm_wallet(id) on delete restrict,
+    client_id   integer not null references program_client(id) on delete restrict
+) STRICT;
+
+create table if not exists proposal_replace_operator (
+    proposal_id     integer not null primary key references proposal(id) on delete cascade,
+    old_operator_id integer not null references operator_identity(id) on delete restrict,
+    new_pubkey      blob    not null
+) STRICT;
+
+-- The transaction an operator votes to sign.
+create table if not exists proposal_one_off_transaction (
+    proposal_id              integer not null primary key references proposal(id) on delete cascade,
+    client_id                integer not null references program_client(id) on delete restrict,
+    wallet_address           blob    not null check (length(wallet_address) = 20),
+    chain_id                 integer not null,
+    nonce                    integer not null,
+    gas_limit                integer not null,
+    max_fee_per_gas          blob    not null check (length(max_fee_per_gas) = 16),
+    max_priority_fee_per_gas blob    not null check (length(max_priority_fee_per_gas) = 16),
+    to_address               blob    not null check (length(to_address) = 20),
+    value                    blob    not null check (length(value) = 32),
+    input                    blob    not null
+) STRICT;
+
+-- The grant an operator votes to creat
+create table if not exists proposal_persistent_grant (
+    proposal_id              integer not null primary key references proposal (id) on delete cascade,
+    wallet_access_id         integer not null references evm_wallet_access (id) on delete restrict,
+    chain_id                 integer not null, -- EIP-155 chain ID
+    valid_from               integer, -- unix timestamp (seconds), null = no lower bound
+    valid_until              integer, -- unix timestamp (seconds), null = no upper bound
+    max_gas_fee_per_gas      blob check (max_gas_fee_per_gas is null or length(max_gas_fee_per_gas) = 32),
+    max_priority_fee_per_gas blob check (max_priority_fee_per_gas is null or length(max_priority_fee_per_gas) = 32),
+    rate_limit_count         integer, -- max transactions in window, null = unlimited
+    rate_limit_window_secs   integer, -- window duration in seconds, null = unlimited
+    check ((rate_limit_count is null) = (rate_limit_window_secs is null))
+) STRICT;
+
+-- `specific = ether_transfer`
+create table if not exists proposal_persistent_grant_ether (
+    proposal_id integer not null primary key references proposal_persistent_grant (proposal_id) on delete cascade,
+    window_secs integer not null,
+    max_volume  blob    not null check (length(max_volume) = 32)
+) STRICT;
+
+create table if not exists proposal_persistent_grant_ether_target (
+    id          integer not null primary key,
+    proposal_id integer not null references proposal_persistent_grant_ether (proposal_id) on delete cascade,
+    address     blob    not null check (length(address) = 20)
+) STRICT;
+
+create unique index if not exists uniq_proposal_ether_target on proposal_persistent_grant_ether_target (proposal_id, address);
+
+-- `specific = token_transfer`
+create table if not exists proposal_persistent_grant_token (
+    proposal_id    integer not null primary key references proposal_persistent_grant (proposal_id) on delete cascade,
+    token_contract blob    not null check (length(token_contract) = 20),
+    receiver       blob check (receiver is null or length(receiver) = 20)
+) STRICT;
+
+create table if not exists proposal_persistent_grant_token_limit (
+    id          integer not null primary key,
+    proposal_id integer not null references proposal_persistent_grant_token (proposal_id) on delete cascade,
+    window_secs integer not null,
+    max_volume  blob    not null check (length(max_volume) = 32)
+) STRICT;
+
+create table if not exists proposal_vote (
+    id          integer not null primary key,
+    proposal_id integer not null references proposal(id) on delete cascade,
+    operator_id integer not null references operator_identity(id) on delete restrict,
+    approve     integer not null check (approve in (0, 1)),
+    signature   blob    not null,
+    voted_at    integer not null default(unixepoch('now')),
+    unique (proposal_id, operator_id)
+) STRICT;
+
+
+-- The signature the vault produced for an approved transaction, by component.
+--
+-- secp256k1 signatures have three common encodings (Electrum v=27/28, raw parity,
+-- ERC-2098 compact); a single blob would not say which one it holds. `y_parity` is
+-- the raw bit -- add 27 to rebuild the Electrum form `Signature::as_bytes` emits.
+create table if not exists proposal_one_off_transaction_result (
+    proposal_id integer not null primary key
+        references proposal_one_off_transaction (proposal_id) on delete cascade,
+    r           blob    not null check (length(r) = 32),
+    s           blob    not null check (length(s) = 32),
+    y_parity    integer not null check (y_parity in (0, 1)),
+    created_at  integer not null default(unixepoch('now'))
+) STRICT;
+
+-- ===============================
+-- Recovery Operators (§3.4/§3.5/§3.6)
+-- ===============================
+
+-- Encrypted Shamir shares for recovery operators (mirrors the `operator` table).
+create table if not exists recovery_operator (
+    id          integer not null primary key references recovery_operator_identity(id) on delete restrict,
+    share       blob    not null,
+    share_nonce blob    not null,
+    share_salt  blob    not null,
+    created_at  integer not null default(unixepoch('now')),
+    updated_at  integer not null default(unixepoch('now'))
+) STRICT;
+
+create table if not exists recovery_operator_identity (
+    id         integer not null primary key,
+    public_key blob    not null unique,
+    created_at integer not null default(unixepoch('now')),
+    updated_at integer not null default(unixepoch('now'))
+) STRICT;
+
+-- One active wakeup request at a time. A request is pending when cancelled_at IS NULL
+-- and requested_at + 14 days > now. It becomes active (recovery live) after 14 days.
+create table if not exists recovery_wakeup_request (
+    id           integer not null primary key,
+    requested_by integer not null references operator_identity(id) on delete restrict,
+    requested_at integer not null default(unixepoch('now')),
+    cancelled_by integer references operator_identity(id) on delete restrict,
+    cancelled_at integer
+) STRICT;
+
+-- Votes cast by recovery operators; only allowed on replace_operator proposals.
+create table if not exists recovery_proposal_vote (
+    id                   integer not null primary key,
+    proposal_id          integer not null references proposal(id) on delete cascade,
+    recovery_operator_id integer not null references recovery_operator_identity(id) on delete restrict,
+    approve              integer not null check (approve in (0, 1)),
+    signature            blob    not null,
+    voted_at             integer not null default(unixepoch('now')),
+    unique (proposal_id, recovery_operator_id)
+) STRICT;
--- a/server/crates/arbiter-server/src/actors/bootstrap.rs
+++ b/server/crates/arbiter-server/src/actors/bootstrap.rs
@@ -4,28 +4,43 @@ use arbiter_proto::{BOOTSTRAP_PATH, home_path};
 use diesel::QueryDsl;
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, messages};
-use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng};
+use rand::{
+    distr::{Alphanumeric, SampleString as _},
+    make_rng,
+    rngs::StdRng,
+};
+use std::path::Path;
 use subtle::ConstantTimeEq as _;
 use thiserror::Error;

 const TOKEN_LENGTH: usize = 64;

-pub async fn generate_token() -> Result<String, std::io::Error> {
-    let rng: StdRng = make_rng();
+pub async fn generate_token(home: &Path) -> Result<String, std::io::Error> {
+    let mut rng: StdRng = make_rng();

-    let token = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
-        String::default(),
-        |mut accum, char| {
-            accum += char.to_string().as_str();
-            accum
-        },
-    );
+    // `Alphanumeric` samples raw `u8` ASCII codes, not `char`s -- `SampleString::sample_string`
+    // is `rand`'s own documented way to turn that into an actual TOKEN_LENGTH-character string
+    // (see the "Passwords" example on `Alphanumeric`'s docs). A prior version of this function
+    // called `.to_string()` on the sampled `u8` directly, which stringifies the numeric byte
+    // value (e.g. `65` instead of `'A'`) rather than the character it represents, silently
+    // producing a variable-length, all-decimal-digit string instead of a real token.
+    let token = Alphanumeric.sample_string(&mut rng, TOKEN_LENGTH);

-    tokio::fs::write(home_path()?.join(BOOTSTRAP_PATH), token.as_str()).await?;
+    tokio::fs::write(home.join(BOOTSTRAP_PATH), token.as_str()).await?;

    Ok(token)
 }

+/// A token file is only trustworthy if it looks like something `generate_token` could have
+/// produced. Anything else -- empty (a crash between the file's truncate and write), foreign
+/// content, or a trailing newline added by an editor -- must not be adopted as a live
+/// credential: an empty file would make every empty-string token verify, and mismatched
+/// content would silently lock out every operator holding the real, already-printed token.
+#[must_use]
+fn is_valid_token(candidate: &str) -> bool {
+    candidate.len() == TOKEN_LENGTH && candidate.chars().all(|c| c.is_ascii_alphanumeric())
+}
+
 #[derive(Error, Debug)]
 pub enum Error {
    #[error("Database error: {0}")]
@@ -44,31 +59,77 @@ pub struct Bootstrapper {
 }

 impl Bootstrapper {
+    /// Production constructor: resolves the real `~/.arbiter` directory and delegates.
    pub async fn new(db: &DatabasePool) -> Result<Self, Error> {
-        let row_count: i64 = {
-            let mut conn = db.get().await?;
-
-            schema::operator::table
-                .count()
-                .get_result(&mut conn)
-                .await?
-        };
-
-        let token = if row_count == 0 {
-            let token = generate_token().await?;
-            Some(token)
-        } else {
-            None
-        };
-
-        Ok(Self { token })
+        let home = home_path()?;
+        Self::new_in(db, &home).await
    }
-}

-#[messages]
-impl Bootstrapper {
-    #[message]
-    pub fn is_correct_token(&self, token: String) -> bool {
+    /// Carries all of `new`'s logic, parameterized on the directory the token file lives in.
+    /// `new` resolves the real home directory and calls this; tests call it directly with a
+    /// throwaway temp directory so they never touch the real `~/.arbiter/bootstrap_token`.
+    pub async fn new_in(db: &DatabasePool, home: &Path) -> Result<Self, Error> {
+        let mut conn = db.get().await?;
+
+        let bootstrapped: bool = schema::arbiter_settings::table
+            .select(schema::arbiter_settings::root_key_id)
+            .first::<Option<i32>>(&mut conn)
+            .await?
+            .is_some();
+
+        if bootstrapped {
+            return Ok(Self { token: None });
+        }
+
+        let any_operator_registered: bool = schema::operator_identity::table
+            .count()
+            .get_result::<i64>(&mut conn)
+            .await?
+            > 0;
+
+        if !any_operator_registered {
+            // Nobody has used the current token yet, so there is nothing to preserve across a
+            // restart: generate a fresh one, exactly as on a first run. Reusing an old file
+            // here would let a token survive a database reset, silently reviving trust in
+            // whoever still held it.
+            return Ok(Self {
+                token: Some(generate_token(home).await?),
+            });
+        }
+
+        // At least one operator has already registered with the current token: every other
+        // declared operator still needs that same token, including across a restart, so an
+        // existing file is reused rather than replaced -- but only if it still looks like a
+        // real token. A truncated, foreign, or corrupted file must not become a live
+        // credential (see `is_valid_token`).
+        let path = home.join(BOOTSTRAP_PATH);
+        let token = match tokio::fs::read_to_string(&path).await {
+            Ok(existing) if is_valid_token(&existing) => existing,
+            Ok(_) => {
+                // Replacing the file invalidates whatever token the already-registered
+                // operators were handed, so it must not happen quietly. The content itself is
+                // a credential and stays out of the log; the path is enough to act on.
+                tracing::warn!(
+                    ?path,
+                    "Bootstrap token file is not a well-formed token; replacing it"
+                );
+                generate_token(home).await?
+            }
+            Err(err) if err.kind() == std::io::ErrorKind::NotFound => generate_token(home).await?,
+            Err(err) => return Err(Error::Io(err)),
+        };
+
+        Ok(Self { token: Some(token) })
+    }
+
+    /// Drops the token from memory. Called once the vault is bootstrapped: from then on,
+    /// operators are added through governance rather than through the token.
+    pub(crate) fn forget_token(&mut self) {
+        self.token = None;
+    }
+
+    #[must_use]
+    fn is_correct_token(&self, token: &str) -> bool {
        self.token.as_ref().is_some_and(|expected| {
            let expected_bytes = expected.as_bytes();
            let token_bytes = token.as_bytes();
@@ -77,15 +138,28 @@ impl Bootstrapper {
            bool::from(choice)
        })
    }
+}

+#[messages]
+impl Bootstrapper {
+    /// Checks the token without retiring it: every operator in a declared committee
+    /// authenticates with the same token during bootstrap.
    #[message]
-    pub fn consume_token(&mut self, token: String) -> bool {
-        if self.is_correct_token(token) {
-            self.token = None;
-            true
-        } else {
-            false
-        }
+    #[must_use]
+    pub fn verify_token(&self, token: String) -> bool {
+        self.is_correct_token(&token)
+    }
+}
+
+impl kameo::prelude::Message<crate::actors::vault::events::Bootstrapped> for Bootstrapper {
+    type Reply = ();
+
+    async fn handle(
+        &mut self,
+        _msg: crate::actors::vault::events::Bootstrapped,
+        _ctx: &mut kameo::prelude::Context<Self, Self::Reply>,
+    ) -> Self::Reply {
+        self.forget_token();
    }
 }

@@ -96,3 +170,150 @@ impl Bootstrapper {
        self.token.clone()
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use diesel::{ExpressionMethods as _, insert_into, update};
+
+    /// A multi-operator committee registers every member with the same token, so verifying it
+    /// must not consume it. Only a completed bootstrap retires the token.
+    #[tokio::test]
+    async fn token_verifies_repeatedly_until_bootstrap_completes() {
+        let mut bootstrapper = Bootstrapper {
+            token: Some("test-token".to_owned()),
+        };
+
+        assert!(bootstrapper.verify_token("test-token".to_owned()));
+        assert!(bootstrapper.verify_token("test-token".to_owned()));
+        assert!(!bootstrapper.verify_token("wrong-token".to_owned()));
+
+        bootstrapper.forget_token();
+
+        assert!(!bootstrapper.verify_token("test-token".to_owned()));
+        assert!(bootstrapper.get_token().is_none());
+    }
+
+    /// Once the vault is bootstrapped, `Bootstrapper::new_in` must return with no token -- and
+    /// it must do so from `arbiter_settings.root_key_id` alone, taking the early return before
+    /// `home` is ever consulted. Uses `new_in` with a throwaway temp directory (never the
+    /// production `new`, which unconditionally resolves the real home directory before this
+    /// method even runs) so this test cannot touch the real filesystem regardless of outcome.
+    #[tokio::test]
+    async fn new_returns_no_token_once_the_vault_is_bootstrapped() {
+        let db = db::create_test_pool().await;
+        let mut conn = db.get().await.unwrap();
+
+        let root_key_history_id: i32 = insert_into(schema::root_key_history::table)
+            .values(&db::models::NewRootKeyHistory {
+                ciphertext: vec![0u8; 32],
+                tag: vec![0u8; 16],
+                root_key_encryption_nonce: vec![0u8; 24],
+                data_encryption_nonce: vec![0u8; 24],
+                schema_version: 1,
+                salt: vec![0u8; 16],
+            })
+            .returning(schema::root_key_history::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+
+        update(schema::arbiter_settings::table)
+            .set(schema::arbiter_settings::root_key_id.eq(root_key_history_id))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        drop(conn);
+
+        let home = tempfile::tempdir().unwrap();
+        let bootstrapper = Bootstrapper::new_in(&db, home.path()).await.unwrap();
+
+        assert!(bootstrapper.get_token().is_none());
+    }
+
+    /// The file-reuse path (an operator has already registered, so bootstrap is unfinished)
+    /// must not adopt a corrupted token file as a live credential: it must reject it and
+    /// generate a fresh one instead. This is the Critical from the review, now reachable
+    /// safely because `new_in` takes a throwaway temp directory instead of the real home.
+    #[tokio::test]
+    async fn new_in_rejects_and_replaces_a_corrupted_token_file() {
+        let db = db::create_test_pool().await;
+        let mut conn = db.get().await.unwrap();
+
+        // At least one operator must have registered, or `new_in` would regenerate
+        // unconditionally regardless of the file (Important 2) and never exercise validation.
+        insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(vec![0u8; 32]))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        drop(conn);
+
+        let home = tempfile::tempdir().unwrap();
+        tokio::fs::write(home.path().join(BOOTSTRAP_PATH), "")
+            .await
+            .unwrap();
+
+        let bootstrapper = Bootstrapper::new_in(&db, home.path()).await.unwrap();
+
+        let token = bootstrapper
+            .get_token()
+            .expect("a fresh token must be generated");
+        assert!(is_valid_token(&token));
+
+        // The replacement must also have landed on disk, not just in memory, so a restart
+        // reads back the same (now valid) token rather than the corrupted one again.
+        let on_disk = tokio::fs::read_to_string(home.path().join(BOOTSTRAP_PATH))
+            .await
+            .unwrap();
+        assert_eq!(on_disk, token);
+    }
+
+    /// The second defect the task exists to fix: a restart between the first registration and
+    /// the completed bootstrap must not invalidate the token the other declared operators were
+    /// already given. With an operator registered and a well-formed file on disk, `new_in` has
+    /// to hand back exactly what it read instead of generating a replacement.
+    #[tokio::test]
+    async fn new_in_reuses_a_valid_token_file_across_a_restart() {
+        let db = db::create_test_pool().await;
+        let mut conn = db.get().await.unwrap();
+
+        // Without a registered operator, `new_in` regenerates unconditionally (Important 2 of
+        // the round-2 review) and never reaches the reuse path this test is about.
+        insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(vec![0u8; 32]))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        drop(conn);
+
+        let home = tempfile::tempdir().unwrap();
+        // Stands in for the token a previous run wrote and printed to the console.
+        let handed_out = "Zq7Z2rXaB90kLmNpQwErTyUiOpAsDfGhJkLzXcVbNmQwErTyUiOpAsDfGhJkLzXc";
+        assert!(is_valid_token(handed_out));
+        tokio::fs::write(home.path().join(BOOTSTRAP_PATH), handed_out)
+            .await
+            .unwrap();
+
+        let bootstrapper = Bootstrapper::new_in(&db, home.path()).await.unwrap();
+
+        assert_eq!(bootstrapper.get_token().as_deref(), Some(handed_out));
+    }
+
+    /// An empty file must not be adopted as a live credential: `is_correct_token`'s
+    /// `is_some_and` would enter its closure for `Some(String::new())`, and comparing two empty
+    /// byte slices is true, so an unauthenticated `Some("")` from the wire would otherwise
+    /// verify. Also pins the other corrupted-content shapes `is_valid_token` must reject.
+    #[test]
+    fn is_valid_token_rejects_anything_that_is_not_a_real_token() {
+        assert!(!is_valid_token(""));
+        assert!(!is_valid_token("too-short"));
+        assert!(!is_valid_token(&"a".repeat(TOKEN_LENGTH - 1)));
+        assert!(!is_valid_token(&"a".repeat(TOKEN_LENGTH + 1)));
+        // A trailing newline (e.g. from an editor) must not be silently accepted either.
+        assert!(!is_valid_token(&format!("{}\n", "a".repeat(TOKEN_LENGTH))));
+        assert!(!is_valid_token(&"!".repeat(TOKEN_LENGTH)));
+
+        assert!(is_valid_token(&"a".repeat(TOKEN_LENGTH)));
+    }
+}
--- a/server/crates/arbiter-server/src/actors/evm/mod.rs
+++ b/server/crates/arbiter-server/src/actors/evm/mod.rs
@@ -1,9 +1,13 @@
 use crate::{
-    actors::vault::{CreateNew, Decrypt, Vault},
+    actors::{
+        proposal_manager::events::ProposalApproved,
+        vault::{CreateNew, Decrypt, Vault},
+    },
    crypto::integrity,
    db::{
        DatabaseError, DatabasePool,
-        models::{self, EvmWalletId},
+        models::{self, EvmWalletId, ProposalId},
+        proposal::{ProposalKind, grant_wallet_access, one_off_transaction, persistent_grant},
        schema,
    },
    evm::{
@@ -23,8 +27,9 @@ use diesel::{
    ExpressionMethods, OptionalExtension as _, QueryDsl, SelectableHelper as _, dsl::insert_into,
 };
 use diesel_async::RunQueryDsl;
-use kameo::{Actor, actor::ActorRef, messages};
+use kameo::{Actor, actor::ActorRef, messages, prelude::Message};
 use rand::{SeedableRng, rng, rngs::StdRng};
+use tracing::error;

 pub use crate::evm::safe_signer;

@@ -62,6 +67,55 @@ pub enum Error {

    #[error("Integrity violation: {0}")]
    Integrity(#[from] integrity::Error),
+
+    #[error("Signing error: {0}")]
+    Sign(#[from] SignTransactionError),
+
+    #[error(
+        "Grant timestamp {0} is outside the i32 range a grant boundary column can store \
+         (Unix seconds, so no later than 2038-01-19T03:14:07Z)"
+    )]
+    InvalidTimestamp(i64),
+
+    #[error("Wallet access {0} is revoked or does not exist")]
+    AccessNotActive(i32),
+}
+
+/// Converts a grant boundary from Unix seconds. `None` in means "unbounded"; a value the
+/// boundary column cannot store is an error, never a silently different window.
+///
+/// The range is `i32`, not `i64`, because that is what actually reaches the database:
+/// `SqliteTimestamp::to_sql` narrows to `i32` (`fixme! #84`), so `3_000_000_000` -- a
+/// `valid_from` in 2065 -- would wrap to 1902 and open the grant immediately instead of in
+/// forty years. Accepting only what round-trips keeps the grant that gets written the grant
+/// that was voted on.
+fn grant_timestamp(secs: Option<i64>) -> Result<Option<chrono::DateTime<chrono::Utc>>, Error> {
+    secs.map(|s| {
+        let storable = i32::try_from(s).map_err(|_| Error::InvalidTimestamp(s))?;
+        chrono::DateTime::from_timestamp(i64::from(storable), 0).ok_or(Error::InvalidTimestamp(s))
+    })
+    .transpose()
+}
+
+/// Refuses an access id that is revoked or absent, so nothing hangs a grant off it.
+async fn ensure_access_active(
+    conn: &mut crate::db::DatabaseConnection,
+    access_id: i32,
+) -> Result<(), Error> {
+    let active: bool = diesel::select(diesel::dsl::exists(
+        schema::evm_wallet_access::table
+            .filter(schema::evm_wallet_access::id.eq(access_id))
+            .filter(schema::evm_wallet_access::revoked_at.is_null()),
+    ))
+    .get_result(conn)
+    .await
+    .map_err(DatabaseError::from)?;
+
+    if active {
+        Ok(())
+    } else {
+        Err(Error::AccessNotActive(access_id))
+    }
 }

 #[derive(Actor)]
@@ -160,29 +214,23 @@ impl EvmActor {
    }

    #[message]
-    #[expect(clippy::unused_async, reason = "reserved for impl")]
-    pub async fn operator_delete_grant(&mut self, _grant_id: i32) -> Result<(), Error> {
-        // let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
-        // let vault = self.vault.clone();
+    pub async fn operator_delete_grant(&mut self, grant_id: i32) -> Result<(), Error> {
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;

-        // diesel_async::AsyncConnection::transaction(&mut conn, |conn| {
-        //     Box::pin(async move {
-        //         diesel::update(schema::evm_basic_grant::table)
-        //             .filter(schema::evm_basic_grant::id.eq(grant_id))
-        //             .set(schema::evm_basic_grant::revoked_at.eq(SqliteTimestamp::now()))
-        //             .execute(conn)
-        //             .await?;
+        let affected = diesel::update(schema::evm_basic_grant::table)
+            .filter(schema::evm_basic_grant::id.eq(grant_id))
+            .set(schema::evm_basic_grant::revoked_at.eq(models::SqliteTimestamp::now()))
+            .execute(&mut conn)
+            .await
+            .map_err(DatabaseError::from)?;

-        //         let signed = integrity::evm::load_signed_grant_by_basic_id(conn, grant_id).await?;
+        if affected == 0 {
+            return Err(Error::Database(DatabaseError::from(
+                diesel::result::Error::NotFound,
+            )));
+        }

-        //         diesel::result::QueryResult::Ok(())
-        //     })
-        // })
-        // .await
-        // .map_err(DatabaseError::from)?;
-
-        // Ok(())
-        todo!()
+        Ok(())
    }

    #[message]
@@ -214,6 +262,7 @@ impl EvmActor {
            .select(models::EvmWalletAccess::as_select())
            .filter(schema::evm_wallet_access::wallet_id.eq(wallet.id))
            .filter(schema::evm_wallet_access::client_id.eq(client_id))
+            .filter(schema::evm_wallet_access::revoked_at.is_null())
            .first(&mut conn)
            .await
            .optional()
@@ -249,6 +298,7 @@ impl EvmActor {
            .select(models::EvmWalletAccess::as_select())
            .filter(schema::evm_wallet_access::wallet_id.eq(wallet.id))
            .filter(schema::evm_wallet_access::client_id.eq(client_id))
+            .filter(schema::evm_wallet_access::revoked_at.is_null())
            .first(&mut conn)
            .await
            .optional()
@@ -273,3 +323,372 @@ impl EvmActor {
        Ok(signer.sign_transaction_sync(&mut transaction)?)
    }
 }
+
+impl Message<ProposalApproved> for EvmActor {
+    type Reply = ();
+
+    /// Every subscriber sees every approval and acts only on the kinds it owns.
+    async fn handle(
+        &mut self,
+        msg: ProposalApproved,
+        _ctx: &mut kameo::prelude::Context<Self, Self::Reply>,
+    ) -> Self::Reply {
+        let result = match msg.kind {
+            ProposalKind::GrantWalletAccess(settings) => self.grant_wallet_access(&settings).await,
+            ProposalKind::ApprovePersistentGrant(settings) => {
+                self.create_persistent_grant(*settings).await
+            }
+            ProposalKind::ApproveOneOffTransaction(settings) => {
+                self.sign_one_off_transaction(msg.id, *settings).await
+            }
+            _ => return,
+        };
+
+        if let Err(error) = result {
+            error!(
+                ?error,
+                proposal_id = msg.id.to_raw(),
+                "Failed to execute an approved proposal"
+            );
+        }
+    }
+}
+
+impl EvmActor {
+    async fn grant_wallet_access(
+        &mut self,
+        settings: &grant_wallet_access::Settings,
+    ) -> Result<(), Error> {
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
+
+        // Revives a previously revoked row instead of conflicting on it forever:
+        // `uniq_wallet_access` is a unique index on `(wallet_id, client_id)`. Visibility is
+        // all this restores -- revocation closes the grants that hung off the access, so a
+        // persistent grant needs its own vote again (§3.2). See
+        // `peers::operator::session::handlers::revoke_wallet_access`.
+        insert_into(schema::evm_wallet_access::table)
+            .values((
+                schema::evm_wallet_access::wallet_id.eq(EvmWalletId::from_raw(settings.wallet_id)),
+                schema::evm_wallet_access::client_id.eq(settings.client_id),
+            ))
+            .on_conflict((
+                schema::evm_wallet_access::wallet_id,
+                schema::evm_wallet_access::client_id,
+            ))
+            .do_update()
+            .set(schema::evm_wallet_access::revoked_at.eq(None::<models::SqliteTimestamp>))
+            .execute(&mut conn)
+            .await
+            .map_err(DatabaseError::from)?;
+
+        Ok(())
+    }
+
+    async fn create_persistent_grant(
+        &mut self,
+        grant: persistent_grant::Settings,
+    ) -> Result<(), Error> {
+        use crate::evm::policies::{
+            TransactionRateLimit, VolumeRateLimit, ether_transfer, token_transfers,
+        };
+        use alloy::primitives::U256;
+        use chrono::Duration;
+
+        // A persistent grant is only as good as the visibility it hangs off (§3.2, two
+        // separate votes). The proposal names the access id when it is created and can be
+        // approved much later, so the access may have been revoked in between; a grant
+        // against a revoked access would sit dormant and go live the moment anyone re-grants.
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
+        ensure_access_active(&mut conn, grant.wallet_access_id).await?;
+        drop(conn);
+
+        let volume = |limit: persistent_grant::VolumeLimit| VolumeRateLimit {
+            max_volume: U256::from_be_bytes(limit.max_volume),
+            window: Duration::seconds(limit.window_secs),
+        };
+
+        let basic = SharedGrantSettings {
+            wallet_access_id: grant.wallet_access_id,
+            chain: grant.chain_id,
+            valid_from: grant_timestamp(grant.valid_from_secs)?,
+            valid_until: grant_timestamp(grant.valid_until_secs)?,
+            max_gas_fee_per_gas: grant.max_gas_fee_per_gas.map(U256::from_be_bytes),
+            max_priority_fee_per_gas: grant.max_priority_fee_per_gas.map(U256::from_be_bytes),
+            rate_limit: grant.rate_limit.map(|r| TransactionRateLimit {
+                count: r.count,
+                window: Duration::seconds(r.window_secs),
+            }),
+        };
+
+        let specific = match grant.specific {
+            persistent_grant::Specific::EtherTransfer { targets, limit } => {
+                SpecificGrant::EtherTransfer(ether_transfer::Settings {
+                    target: targets.into_iter().map(Address::from).collect(),
+                    limit: volume(limit),
+                })
+            }
+            persistent_grant::Specific::TokenTransfer {
+                token_contract,
+                receiver,
+                volume_limits,
+            } => SpecificGrant::TokenTransfer(token_transfers::Settings {
+                token_contract: Address::from(token_contract),
+                target: receiver.map(Address::from),
+                volume_limits: volume_limits.into_iter().map(volume).collect(),
+            }),
+        };
+
+        self.operator_create_grant(basic, specific).await?;
+
+        Ok(())
+    }
+
+    async fn sign_one_off_transaction(
+        &mut self,
+        proposal_id: ProposalId,
+        tx: one_off_transaction::Settings,
+    ) -> Result<(), Error> {
+        use alloy::{
+            eips::eip2930::AccessList,
+            primitives::{Bytes, TxKind, U256},
+        };
+
+        let transaction = TxEip1559 {
+            chain_id: tx.chain_id,
+            nonce: tx.nonce,
+            gas_limit: tx.gas_limit,
+            max_fee_per_gas: tx.max_fee_per_gas,
+            max_priority_fee_per_gas: tx.max_priority_fee_per_gas,
+            to: TxKind::Call(Address::from(tx.to)),
+            value: U256::from_be_bytes(tx.value),
+            input: Bytes::from(tx.input),
+            access_list: AccessList::default(),
+        };
+
+        let signature = self
+            .client_sign_transaction(tx.client_id, Address::from(tx.wallet_address), transaction)
+            .await?;
+
+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
+        one_off_transaction::store_signature(proposal_id, &signature, &mut conn)
+            .await
+            .map_err(DatabaseError::from)?;
+
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Error, EvmActor, ensure_access_active, grant_timestamp};
+    use crate::db::{self, models, schema};
+
+    use diesel::{ExpressionMethods as _, QueryDsl as _, dsl::insert_into};
+    use diesel_async::RunQueryDsl;
+
+    #[test]
+    fn absent_timestamp_stays_absent() {
+        assert!(grant_timestamp(None).unwrap().is_none());
+    }
+
+    #[test]
+    fn in_range_timestamp_is_converted() {
+        let converted = grant_timestamp(Some(1_800_000_000)).unwrap();
+        assert_eq!(converted.unwrap().timestamp(), 1_800_000_000);
+    }
+
+    /// An unrepresentable expiry must not silently become "no expiry": that would widen the
+    /// grant beyond what was voted on.
+    #[test]
+    fn out_of_range_timestamp_is_an_error() {
+        let err = grant_timestamp(Some(i64::MAX)).unwrap_err();
+        assert!(matches!(err, Error::InvalidTimestamp(i64::MAX)));
+    }
+
+    /// A `valid_from` past 2038 is representable as a `DateTime` but not as the `i32` the
+    /// boundary column stores: `3_000_000_000` (2065) wraps to a negative, which reads back as
+    /// 1902 and makes the grant active immediately. Refusing it is the only way the grant
+    /// that lands can match the window that was voted on.
+    #[test]
+    fn a_timestamp_past_2038_is_an_error() {
+        let past_2038 = 3_000_000_000_i64;
+        assert!(
+            chrono::DateTime::from_timestamp(past_2038, 0).is_some(),
+            "the fixture must be a date chrono accepts, or it proves nothing about storage"
+        );
+
+        let err = grant_timestamp(Some(past_2038)).unwrap_err();
+        assert!(
+            matches!(err, Error::InvalidTimestamp(got) if got == past_2038),
+            "expected an out-of-range error, got {err:?}"
+        );
+    }
+
+    /// The last second the boundary column can hold must still be accepted: the range check
+    /// has to stop at what storage can take, not short of it.
+    #[test]
+    fn the_last_storable_timestamp_is_accepted() {
+        let converted = grant_timestamp(Some(i64::from(i32::MAX))).unwrap();
+        assert_eq!(converted.unwrap().timestamp(), i64::from(i32::MAX));
+    }
+
+    /// Seeds a wallet, a client and one access row between them, and returns the access id.
+    async fn seed_access(conn: &mut db::DatabaseConnection) -> i32 {
+        let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
+            .values(&models::NewRootKeyHistory {
+                ciphertext: vec![0u8; 32],
+                tag: vec![0u8; 16],
+                root_key_encryption_nonce: vec![0u8; 24],
+                data_encryption_nonce: vec![0u8; 24],
+                schema_version: 1,
+                salt: vec![0u8; 16],
+            })
+            .returning(schema::root_key_history::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let aead_id: i32 = insert_into(schema::aead_encrypted::table)
+            .values(&models::NewAeadEncrypted {
+                ciphertext: vec![0u8; 32],
+                tag: vec![0u8; 16],
+                current_nonce: vec![0u8; 24],
+                schema_version: 1,
+                associated_root_key_id: root_key_id,
+                created_at: chrono::Utc::now().into(),
+            })
+            .returning(schema::aead_encrypted::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let wallet_id: models::EvmWalletId = insert_into(schema::evm_wallet::table)
+            .values((
+                schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
+                schema::evm_wallet::aead_encrypted_id.eq(aead_id),
+            ))
+            .returning(schema::evm_wallet::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let metadata_id: i32 = insert_into(schema::client_metadata::table)
+            .values(schema::client_metadata::name.eq("test"))
+            .returning(schema::client_metadata::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let client_id: i32 = insert_into(schema::program_client::table)
+            .values((
+                schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
+                schema::program_client::metadata_id.eq(metadata_id),
+            ))
+            .returning(schema::program_client::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        insert_into(schema::evm_wallet_access::table)
+            .values((
+                schema::evm_wallet_access::wallet_id.eq(wallet_id),
+                schema::evm_wallet_access::client_id.eq(client_id),
+            ))
+            .returning(schema::evm_wallet_access::id)
+            .get_result(conn)
+            .await
+            .unwrap()
+    }
+
+    /// Both directions, so a guard that refused everything could not pass: a live access is
+    /// let through, a revoked one is not.
+    #[tokio::test]
+    async fn only_a_live_access_passes_the_grant_guard() {
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let access_id = seed_access(&mut conn).await;
+        ensure_access_active(&mut conn, access_id)
+            .await
+            .expect("a live access must pass");
+
+        diesel::update(schema::evm_wallet_access::table)
+            .filter(schema::evm_wallet_access::id.eq(access_id))
+            .set(schema::evm_wallet_access::revoked_at.eq(models::SqliteTimestamp::now()))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+
+        let err = ensure_access_active(&mut conn, access_id)
+            .await
+            .expect_err("a revoked access must be refused");
+        assert!(
+            matches!(err, Error::AccessNotActive(got) if got == access_id),
+            "expected AccessNotActive, got {err:?}"
+        );
+    }
+
+    /// The guard has to be wired into the executor, not just exist: an approved persistent
+    /// grant whose access was revoked between proposal and approval must not create a grant
+    /// that would go live again the moment anyone re-grants that access (§3.2).
+    #[tokio::test]
+    async fn an_approved_persistent_grant_refuses_a_revoked_access() {
+        use crate::actors::{GlobalActors, vault::Vault};
+        use crate::db::proposal::persistent_grant;
+        use kameo::actor::Spawn as _;
+
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let access_id = seed_access(&mut conn).await;
+        diesel::update(schema::evm_wallet_access::table)
+            .filter(schema::evm_wallet_access::id.eq(access_id))
+            .set(schema::evm_wallet_access::revoked_at.eq(models::SqliteTimestamp::now()))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        drop(conn);
+
+        let vault = Vault::spawn(
+            Vault::new(pool.clone(), GlobalActors::spawn_message_bus())
+                .await
+                .unwrap(),
+        );
+        let mut evm_actor = EvmActor::new(vault, pool.clone());
+
+        let err = evm_actor
+            .create_persistent_grant(persistent_grant::Settings {
+                wallet_access_id: access_id,
+                chain_id: 1,
+                valid_from_secs: None,
+                valid_until_secs: None,
+                max_gas_fee_per_gas: None,
+                max_priority_fee_per_gas: None,
+                rate_limit: None,
+                specific: persistent_grant::Specific::EtherTransfer {
+                    targets: vec![[0u8; 20]],
+                    limit: persistent_grant::VolumeLimit {
+                        max_volume: [0u8; 32],
+                        window_secs: 3600,
+                    },
+                },
+            })
+            .await
+            .expect_err("a grant against a revoked access must be refused");
+        assert!(
+            matches!(err, Error::AccessNotActive(got) if got == access_id),
+            "expected AccessNotActive, got {err:?}"
+        );
+
+        let grants: i64 = schema::evm_basic_grant::table
+            .filter(schema::evm_basic_grant::wallet_access_id.eq(access_id))
+            .count()
+            .get_result(&mut pool.get().await.unwrap())
+            .await
+            .unwrap();
+        assert_eq!(
+            grants, 0,
+            "no grant row may be written for a revoked access"
+        );
+    }
+}
--- a/server/crates/arbiter-server/src/actors/mod.rs
+++ b/server/crates/arbiter-server/src/actors/mod.rs
@@ -1,20 +1,31 @@
 use crate::{
    actors::{
-        bootstrap::Bootstrapper, evm::EvmActor, flow_coordinator::FlowCoordinator,
-        operator_registry::OperatorRegistry, vault::Vault,
+        bootstrap::Bootstrapper,
+        evm::EvmActor,
+        flow_coordinator::FlowCoordinator,
+        operator_registry::OperatorRegistry,
+        proposal_manager::{ProposalManager, events::ProposalApproved},
+        vault::{Vault, events},
+        vault_coordinator::VaultCoordinator,
    },
    db,
 };

 use kameo::actor::{ActorRef, Spawn};
-use kameo_actors::{DeliveryStrategy, message_bus::MessageBus};
+use kameo_actors::{
+    DeliveryStrategy,
+    message_bus::{MessageBus, Register},
+};
 use thiserror::Error;
+use tracing::error;

 pub mod bootstrap;
 pub mod evm;
 pub mod flow_coordinator;
 pub mod operator_registry;
+pub mod proposal_manager;
 pub mod vault;
+pub mod vault_coordinator;

 #[derive(Error, Debug)]
 pub enum SpawnError {
@@ -30,9 +41,11 @@ pub enum SpawnError {
 pub struct GlobalActors {
    pub vault: ActorRef<Vault>,
    pub bootstrapper: ActorRef<Bootstrapper>,
+    pub vault_coordinator: ActorRef<VaultCoordinator>,
    pub flow_coordinator: ActorRef<FlowCoordinator>,
    pub operator_registry: ActorRef<OperatorRegistry>,
    pub evm: ActorRef<EvmActor>,
+    pub proposal_manager: ActorRef<ProposalManager>,
    pub events: ActorRef<MessageBus>,
 }

@@ -42,18 +55,69 @@ impl GlobalActors {
    }

    pub async fn spawn(db: db::DatabasePool) -> Result<Self, SpawnError> {
+        let bootstrapper = Bootstrapper::new(&db).await?;
+        Self::spawn_with_bootstrapper(db, bootstrapper).await
+    }
+
+    /// Test-facing: threads an explicit directory through to `Bootstrapper` instead of letting
+    /// it resolve the real home directory, so a test spawning a full `GlobalActors` can never
+    /// reach (let alone write to) the real `~/.arbiter/bootstrap_token`. Mirrors `spawn`
+    /// exactly, aside from where the token file lives.
+    pub async fn spawn_in(
+        db: db::DatabasePool,
+        home: &std::path::Path,
+    ) -> Result<Self, SpawnError> {
+        let bootstrapper = Bootstrapper::new_in(&db, home).await?;
+        Self::spawn_with_bootstrapper(db, bootstrapper).await
+    }
+
+    async fn spawn_with_bootstrapper(
+        db: db::DatabasePool,
+        bootstrapper: Bootstrapper,
+    ) -> Result<Self, SpawnError> {
        let message_bus = Self::spawn_message_bus();
        let key_holder = Vault::spawn(Vault::new(db.clone(), message_bus.clone()).await?);
        let operator_registry = OperatorRegistry::spawn(OperatorRegistry::default());
+        let evm = EvmActor::spawn(EvmActor::new(key_holder.clone(), db.clone()));
+        let vault_coordinator = VaultCoordinator::spawn(VaultCoordinator::new(
+            db.clone(),
+            key_holder.clone(),
+        ));
+        let bootstrapper = Bootstrapper::spawn(bootstrapper);
+        // Approved proposals are executed by whoever owns the kind, not by ProposalManager.
+        for recipient in [
+            evm.clone().recipient::<ProposalApproved>(),
+            vault_coordinator.clone().recipient::<ProposalApproved>(),
+            key_holder.clone().recipient::<ProposalApproved>(),
+        ] {
+            let _ = message_bus.tell(Register(recipient)).await;
+        }
+        // The token guards bootstrap only: once the vault reports success, it must be retired.
+        // A dropped registration would leave the token valid forever with nothing else to
+        // notice, so a failure here is logged rather than silently discarded.
+        if let Err(err) = message_bus
+            .tell(Register(
+                bootstrapper.clone().recipient::<events::Bootstrapped>(),
+            ))
+            .await
+        {
+            error!(
+                ?err,
+                "Failed to register Bootstrapper for the Bootstrapped event"
+            );
+        }
+
        Ok(Self {
-            bootstrapper: Bootstrapper::spawn(Bootstrapper::new(&db).await?),
-            evm: EvmActor::spawn(EvmActor::new(key_holder.clone(), db)),
+            bootstrapper,
+            proposal_manager: ProposalManager::spawn(ProposalManager::new(db, message_bus.clone())),
            vault: key_holder,
+            vault_coordinator,
            flow_coordinator: FlowCoordinator::spawn(FlowCoordinator::new(
                operator_registry.clone(),
            )),
            operator_registry,
            events: message_bus,
+            evm,
        })
    }
 }
--- a/server/crates/arbiter-server/src/actors/proposal_manager.rs
+++ b/server/crates/arbiter-server/src/actors/proposal_manager.rs
@@ -0,0 +1,355 @@
+use crate::{
+    actors::proposal_manager::{
+        events::ProposalApproved,
+        store::{DieselProposalStore, ProposalStore, Tally},
+    },
+    crypto::governance,
+    db::{
+        self,
+        models::{
+            NewProposalVote, NewRecoveryProposalVote, OperatorIdentityId, Proposal, ProposalId,
+            ProposalStatus, RecoveryOperatorIdentityId, SqliteTimestamp,
+        },
+        proposal::{ProposalKind, ProposalKindTag},
+    },
+};
+use chrono::Utc;
+use kameo::{Actor, actor::ActorRef, messages};
+use kameo_actors::message_bus::{MessageBus, Publish};
+use std::sync::Arc;
+use tracing::warn;
+
+pub mod events;
+pub mod store;
+
+pub const DEFAULT_TTL_SECS: u32 = 7 * 24 * 60 * 60; // 7 days
+pub const MAX_TTL_SECS: u32 = DEFAULT_TTL_SECS;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum VoteOutcome {
+    Pending,
+    Approved,
+    Rejected,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("Proposal not found")]
+    ProposalNotFound,
+    #[error("Proposal is not pending")]
+    ProposalNotPending,
+    #[error("Proposal has expired")]
+    ProposalExpired,
+    #[error("Requested TTL exceeds the maximum of {} seconds", MAX_TTL_SECS)]
+    TtlTooLong,
+    #[error("Operator already voted on this proposal")]
+    AlreadyVoted,
+    #[error("Invalid vote signature")]
+    InvalidSignature,
+    #[error("Operator not found")]
+    OperatorNotFound,
+    #[error("Database connection error: {0}")]
+    DatabaseConnection(#[from] db::PoolError),
+    #[error("Database query error: {0}")]
+    DatabaseQuery(#[from] diesel::result::Error),
+    #[error("Proposal manager is unavailable")]
+    Unavailable,
+    #[error("Recovery operators are sleeping")]
+    RecoveryNotActive,
+    #[error("Recovery operators may only vote on operator replacement")]
+    NotAllowedForRecoveryOperator,
+    #[error("A recovery wake-up is already pending or active")]
+    WakeupAlreadyPending,
+    #[error("No active recovery wake-up to cancel")]
+    NoActiveWakeup,
+}
+
+#[derive(Debug)]
+pub struct ProposalSummary {
+    pub id: ProposalId,
+    pub kind: ProposalKindTag,
+    pub initiator_id: OperatorIdentityId,
+    pub expires_at: SqliteTimestamp,
+    pub approve_count: i64,
+    pub reject_count: i64,
+}
+
+#[derive(Actor)]
+pub struct ProposalManager {
+    pub(crate) store: Arc<dyn ProposalStore>,
+    pub(crate) events: ActorRef<MessageBus>,
+}
+
+impl ProposalManager {
+    pub fn new(db: db::DatabasePool, events: ActorRef<MessageBus>) -> Self {
+        Self::with_store(Arc::new(DieselProposalStore::new(db)), events)
+    }
+
+    /// Builds the actor over an arbitrary store, so tests can supply a mock.
+    pub(crate) const fn with_store(
+        store: Arc<dyn ProposalStore>,
+        events: ActorRef<MessageBus>,
+    ) -> Self {
+        Self { store, events }
+    }
+}
+
+#[messages]
+impl ProposalManager {
+    #[message]
+    pub async fn create_proposal(
+        &mut self,
+        kind: ProposalKind,
+        initiator_id: OperatorIdentityId,
+        ttl_secs: Option<u32>,
+    ) -> Result<ProposalId, Error> {
+        let ttl = ttl_secs.unwrap_or(DEFAULT_TTL_SECS);
+        if ttl > MAX_TTL_SECS {
+            return Err(Error::TtlTooLong);
+        }
+        let expires_at =
+            SqliteTimestamp::from(Utc::now() + chrono::Duration::seconds(i64::from(ttl)));
+
+        self.store.create(kind, initiator_id, expires_at).await
+    }
+
+    #[message]
+    pub async fn query_pending(&mut self, operator_id: OperatorIdentityId) -> Vec<ProposalSummary> {
+        self.store
+            .pending_for(operator_id)
+            .await
+            .unwrap_or_else(|e| {
+                warn!(?e, "query_pending failed");
+                vec![]
+            })
+    }
+
+    #[message]
+    pub async fn cast_vote(
+        &mut self,
+        proposal_id: ProposalId,
+        operator_id: OperatorIdentityId,
+        approve: bool,
+        signature: Vec<u8>,
+    ) -> Result<VoteOutcome, Error> {
+        let proposal = self.store.load(proposal_id).await?;
+
+        // Checked before the status check so AlreadyVoted takes priority.
+        if self.store.has_voted(proposal_id, operator_id).await? {
+            return Err(Error::AlreadyVoted);
+        }
+
+        Self::check_votable(&proposal)?;
+
+        let public_key = self.store.operator_public_key(operator_id).await?;
+        governance::verify_vote(&public_key, proposal_id, approve, &signature)
+            .map_err(|_| Error::InvalidSignature)?;
+
+        self.store
+            .record_vote(NewProposalVote {
+                proposal_id,
+                operator_id,
+                approve,
+                signature,
+            })
+            .await?;
+
+        let mut tally = self.store.tally(proposal_id).await?;
+        self.narrow_electorate(&proposal, &mut tally).await?;
+
+        self.settle(&proposal, &tally).await
+    }
+
+    /// §3.6: Any ordinary operator may request recovery wake-up.
+    /// Fails if a wake-up is already pending or active.
+    #[message]
+    pub async fn request_recovery_wakeup(
+        &mut self,
+        operator_id: OperatorIdentityId,
+    ) -> Result<(), Error> {
+        if self.store.has_uncancelled_wakeup().await? {
+            return Err(Error::WakeupAlreadyPending);
+        }
+        self.store.request_wakeup(operator_id).await
+    }
+
+    /// §3.6: Any ordinary operator may cancel a pending wake-up request.
+    /// Fails if there is no uncancelled request.
+    #[message]
+    pub async fn cancel_recovery_wakeup(
+        &mut self,
+        operator_id: OperatorIdentityId,
+    ) -> Result<(), Error> {
+        if self.store.cancel_wakeup(operator_id).await? {
+            Ok(())
+        } else {
+            Err(Error::NoActiveWakeup)
+        }
+    }
+
+    /// §3.5: Recovery operators may only vote on operator replacement proposals.
+    /// §3.6: Voting is gated behind recovery being active (14-day window elapsed).
+    #[message]
+    pub async fn cast_recovery_vote(
+        &mut self,
+        proposal_id: ProposalId,
+        recovery_operator_id: RecoveryOperatorIdentityId,
+        approve: bool,
+        signature: Vec<u8>,
+    ) -> Result<VoteOutcome, Error> {
+        let proposal = self.store.load(proposal_id).await?;
+
+        if proposal.kind != ProposalKindTag::ReplaceOperator {
+            return Err(Error::NotAllowedForRecoveryOperator);
+        }
+
+        if !self.store.is_recovery_active().await? {
+            return Err(Error::RecoveryNotActive);
+        }
+
+        if self
+            .store
+            .has_recovery_voted(proposal_id, recovery_operator_id)
+            .await?
+        {
+            return Err(Error::AlreadyVoted);
+        }
+
+        Self::check_votable(&proposal)?;
+
+        let public_key = self
+            .store
+            .recovery_operator_public_key(recovery_operator_id)
+            .await?;
+        governance::verify_vote(&public_key, proposal_id, approve, &signature)
+            .map_err(|_| Error::InvalidSignature)?;
+
+        self.store
+            .record_recovery_vote(NewRecoveryProposalVote {
+                proposal_id,
+                recovery_operator_id,
+                approve,
+                signature,
+            })
+            .await?;
+
+        let mut tally = self.store.tally(proposal_id).await?;
+        self.narrow_electorate(&proposal, &mut tally).await?;
+
+        self.settle(&proposal, &tally).await
+    }
+}
+
+impl ProposalManager {
+    /// A vote only counts while the proposal is still open.
+    fn check_votable(proposal: &Proposal) -> Result<(), Error> {
+        if proposal.status != ProposalStatus::Pending {
+            return Err(Error::ProposalNotPending);
+        }
+        if proposal.expires_at.0 <= Utc::now() {
+            return Err(Error::ProposalExpired);
+        }
+        Ok(())
+    }
+
+    /// §3.5/§3.6: recovery operators join the electorate only for the kinds they may vote on,
+    /// and only once the wake-up window has elapsed. Counting them anywhere else makes the
+    /// rejection threshold unreachable and, for full-quorum kinds, approval unreachable too.
+    ///
+    /// The votes go out with the voters. A wake-up can be cancelled after recovery operators
+    /// have already voted (`cancel_wakeup` cancels any uncancelled request, elapsed or not),
+    /// so a `ReplaceOperator` tally can hold recovery approvals at the moment the committee
+    /// stops being eligible. Keeping those while zeroing only the electorate size would let
+    /// them cover ordinary votes that were never cast.
+    async fn narrow_electorate(&self, proposal: &Proposal, tally: &mut Tally) -> Result<(), Error> {
+        if !proposal.kind.recovery_may_vote() || !self.store.is_recovery_active().await? {
+            tally.drop_recovery();
+        }
+        Ok(())
+    }
+
+    /// Pure quorum arithmetic — no I/O, so the rules can be tested directly (§3.3).
+    ///
+    /// A proposal is rejected once approval has become unreachable: even if every voter
+    /// who has not spoken yet approved, the threshold could not be met.
+    #[must_use]
+    pub(crate) const fn evaluate_quorum(tally: &Tally, requires_full_quorum: bool) -> VoteOutcome {
+        let total_eligible = tally.total_ordinary + tally.total_recovery;
+
+        // No electorate, nothing to settle. Guarded before the branch rather than inside it:
+        // the full-quorum arm would otherwise set `threshold` to 0 and read an empty tally as
+        // unanimous approval.
+        if total_eligible <= 0 {
+            return VoteOutcome::Pending;
+        }
+
+        #[expect(
+            clippy::cast_possible_truncation,
+            clippy::cast_sign_loss,
+            clippy::cast_possible_wrap,
+            clippy::as_conversions,
+            reason = "operator counts are always small positive integers"
+        )]
+        // §3.3: key-rotation proposals require every eligible voter to approve.
+        // §3.5: when recovery is active, recovery operators are eligible too.
+        let threshold: i64 = if requires_full_quorum {
+            total_eligible
+        } else {
+            match crate::crypto::shamir::shamir_threshold(tally.total_ordinary as usize) {
+                Some(threshold) => threshold as i64,
+                // No ordinary operators means no electorate: nothing can settle.
+                None => return VoteOutcome::Pending,
+            }
+        };
+
+        if tally.approve() >= threshold {
+            VoteOutcome::Approved
+        } else if tally.reject() > total_eligible - threshold {
+            VoteOutcome::Rejected
+        } else {
+            VoteOutcome::Pending
+        }
+    }
+
+    /// Applies the quorum rules to a fresh tally and records whatever they decide.
+    async fn settle(&self, proposal: &Proposal, tally: &Tally) -> Result<VoteOutcome, Error> {
+        let outcome = Self::evaluate_quorum(tally, proposal.kind.requires_full_quorum());
+
+        match outcome {
+            VoteOutcome::Approved => self.announce_approval(proposal).await?,
+            VoteOutcome::Rejected => {
+                self.store
+                    .set_status(proposal.id, ProposalStatus::Rejected)
+                    .await?;
+            }
+            VoteOutcome::Pending => {}
+        }
+
+        Ok(outcome)
+    }
+
+    /// Marks the proposal approved and hands the outcome to whoever owns that kind.
+    ///
+    /// The outcome is published, not executed: this actor coordinates voting and nothing
+    /// else. Executors subscribe on the bus, so a vote is answered once the quorum is
+    /// recorded rather than once the effect has landed.
+    async fn announce_approval(&self, proposal: &Proposal) -> Result<(), Error> {
+        self.store
+            .set_status(proposal.id, ProposalStatus::Approved)
+            .await?;
+
+        let kind = self.store.load_kind(proposal.id, proposal.kind).await?;
+        let _ = self
+            .events
+            .tell(Publish(ProposalApproved {
+                id: proposal.id,
+                kind,
+            }))
+            .await;
+
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests;
--- a/server/crates/arbiter-server/src/actors/proposal_manager/events.rs
+++ b/server/crates/arbiter-server/src/actors/proposal_manager/events.rs
@@ -0,0 +1,11 @@
+use crate::db::{models::ProposalId, proposal::ProposalKind};
+
+/// Published once a proposal reaches its approval threshold.
+///
+/// Executors subscribe on the global `MessageBus` and act on the kinds they own;
+/// `ProposalManager` does not know who acts on an outcome, or whether anyone does.
+#[derive(Debug, Clone)]
+pub struct ProposalApproved {
+    pub id: ProposalId,
+    pub kind: ProposalKind,
+}
--- a/server/crates/arbiter-server/src/actors/proposal_manager/store.rs
+++ b/server/crates/arbiter-server/src/actors/proposal_manager/store.rs
@@ -0,0 +1,431 @@
+//! Database access for [`super::ProposalManager`], behind a trait.
+//!
+//! The actor holds a `dyn ProposalStore` rather than a connection pool, so the quorum
+//! rules can be exercised against a mock instead of a live SQLite file.
+
+use super::{Error, ProposalSummary};
+use crate::db::{
+    self,
+    models::{
+        NewProposal, NewProposalVote, NewRecoveryProposalVote, NewRecoveryWakeupRequest,
+        OperatorIdentityId, Proposal, ProposalId, ProposalStatus, RecoveryOperatorIdentityId,
+        SqliteTimestamp,
+    },
+    proposal::{ProposalKind, ProposalKindTag},
+    schema,
+};
+
+use async_trait::async_trait;
+use chrono::Utc;
+use diesel::{
+    ExpressionMethods as _, QueryDsl,
+    dsl::{exists, select},
+};
+use diesel_async::{AsyncConnection as _, RunQueryDsl};
+use std::collections::HashMap;
+use strum::IntoDiscriminant as _;
+
+/// Everything the quorum rules need to know about one proposal's votes.
+///
+/// Votes are kept per electorate rather than pre-summed: an electorate can stop counting
+/// between the vote and the tally (§3.6 -- recovery goes back to sleep the moment a wake-up
+/// is cancelled), and the votes it already cast have to leave with it. A single `approve`
+/// field would carry them past [`Tally::drop_recovery`] into a threshold computed for the
+/// ordinary committee alone.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Tally {
+    pub ordinary_approve: i64,
+    pub ordinary_reject: i64,
+    pub recovery_approve: i64,
+    pub recovery_reject: i64,
+    pub total_ordinary: i64,
+    pub total_recovery: i64,
+}
+
+impl Tally {
+    /// Approvals from every electorate that still counts.
+    pub const fn approve(&self) -> i64 {
+        self.ordinary_approve + self.recovery_approve
+    }
+
+    /// Rejections from every electorate that still counts.
+    pub const fn reject(&self) -> i64 {
+        self.ordinary_reject + self.recovery_reject
+    }
+
+    /// Takes the recovery committee out of the electorate, votes and all. The three numbers
+    /// go together: leaving the votes behind counts them against a threshold derived from an
+    /// electorate they are no longer part of.
+    pub const fn drop_recovery(&mut self) {
+        self.recovery_approve = 0;
+        self.recovery_reject = 0;
+        self.total_recovery = 0;
+    }
+}
+
+#[cfg_attr(test, mockall::automock)]
+#[async_trait]
+pub trait ProposalStore: Send + Sync + 'static {
+    /// Writes the proposal and its kind-specific rows in one transaction.
+    async fn create(
+        &self,
+        kind: ProposalKind,
+        initiator_id: OperatorIdentityId,
+        expires_at: SqliteTimestamp,
+    ) -> Result<ProposalId, Error>;
+
+    async fn load(&self, id: ProposalId) -> Result<Proposal, Error>;
+
+    async fn load_kind(&self, id: ProposalId, tag: ProposalKindTag) -> Result<ProposalKind, Error>;
+
+    async fn has_voted(
+        &self,
+        id: ProposalId,
+        operator_id: OperatorIdentityId,
+    ) -> Result<bool, Error>;
+
+    async fn has_recovery_voted(
+        &self,
+        id: ProposalId,
+        recovery_operator_id: RecoveryOperatorIdentityId,
+    ) -> Result<bool, Error>;
+
+    async fn operator_public_key(&self, id: OperatorIdentityId) -> Result<Vec<u8>, Error>;
+
+    async fn recovery_operator_public_key(
+        &self,
+        id: RecoveryOperatorIdentityId,
+    ) -> Result<Vec<u8>, Error>;
+
+    async fn record_vote(&self, vote: NewProposalVote) -> Result<(), Error>;
+
+    async fn record_recovery_vote(&self, vote: NewRecoveryProposalVote) -> Result<(), Error>;
+
+    /// Vote counts for one proposal, alongside the size of each electorate.
+    async fn tally(&self, id: ProposalId) -> Result<Tally, Error>;
+
+    async fn set_status(&self, id: ProposalId, status: ProposalStatus) -> Result<(), Error>;
+
+    /// Pending, unexpired proposals this operator has not voted on yet.
+    async fn pending_for(
+        &self,
+        operator_id: OperatorIdentityId,
+    ) -> Result<Vec<ProposalSummary>, Error>;
+
+    /// True once an uncancelled wake-up request has outlived the dispute window.
+    async fn is_recovery_active(&self) -> Result<bool, Error>;
+
+    /// True while any wake-up request stands, whether or not the window has elapsed.
+    async fn has_uncancelled_wakeup(&self) -> Result<bool, Error>;
+
+    async fn request_wakeup(&self, operator_id: OperatorIdentityId) -> Result<(), Error>;
+
+    /// Returns false when there was no uncancelled request to cancel.
+    async fn cancel_wakeup(&self, operator_id: OperatorIdentityId) -> Result<bool, Error>;
+}
+
+pub struct DieselProposalStore {
+    db: db::DatabasePool,
+}
+
+impl DieselProposalStore {
+    pub const fn new(db: db::DatabasePool) -> Self {
+        Self { db }
+    }
+}
+
+/// `NotFound` means the row is absent, which every caller reports as its own error.
+fn missing(absent: Error) -> impl FnOnce(diesel::result::Error) -> Error {
+    move |e| match e {
+        diesel::result::Error::NotFound => absent,
+        other => Error::DatabaseQuery(other),
+    }
+}
+
+#[async_trait]
+impl ProposalStore for DieselProposalStore {
+    async fn create(
+        &self,
+        kind: ProposalKind,
+        initiator_id: OperatorIdentityId,
+        expires_at: SqliteTimestamp,
+    ) -> Result<ProposalId, Error> {
+        let id = self
+            .db
+            .get()
+            .await?
+            .transaction(async |conn| {
+                let id: ProposalId = diesel::insert_into(schema::proposal::table)
+                    .values(&NewProposal {
+                        kind: kind.discriminant(),
+                        initiator_id,
+                        expires_at,
+                    })
+                    .returning(schema::proposal::id)
+                    .get_result(conn)
+                    .await?;
+                db::proposal::insert_kind(conn, id, &kind).await?;
+                Ok::<_, diesel::result::Error>(id)
+            })
+            .await?;
+
+        Ok(id)
+    }
+
+    async fn load(&self, id: ProposalId) -> Result<Proposal, Error> {
+        let mut conn = self.db.get().await?;
+        schema::proposal::table
+            .find(id)
+            .first(&mut conn)
+            .await
+            .map_err(missing(Error::ProposalNotFound))
+    }
+
+    async fn load_kind(&self, id: ProposalId, tag: ProposalKindTag) -> Result<ProposalKind, Error> {
+        let mut conn = self.db.get().await?;
+        db::proposal::load_kind(&mut conn, id, tag)
+            .await
+            .map_err(Error::from)
+    }
+
+    async fn has_voted(
+        &self,
+        id: ProposalId,
+        operator_id: OperatorIdentityId,
+    ) -> Result<bool, Error> {
+        let mut conn = self.db.get().await?;
+        select(exists(
+            schema::proposal_vote::table
+                .filter(schema::proposal_vote::proposal_id.eq(id))
+                .filter(schema::proposal_vote::operator_id.eq(operator_id)),
+        ))
+        .get_result(&mut conn)
+        .await
+        .map_err(Error::from)
+    }
+
+    async fn has_recovery_voted(
+        &self,
+        id: ProposalId,
+        recovery_operator_id: RecoveryOperatorIdentityId,
+    ) -> Result<bool, Error> {
+        let mut conn = self.db.get().await?;
+        select(exists(
+            schema::recovery_proposal_vote::table
+                .filter(schema::recovery_proposal_vote::proposal_id.eq(id))
+                .filter(
+                    schema::recovery_proposal_vote::recovery_operator_id.eq(recovery_operator_id),
+                ),
+        ))
+        .get_result(&mut conn)
+        .await
+        .map_err(Error::from)
+    }
+
+    async fn operator_public_key(&self, id: OperatorIdentityId) -> Result<Vec<u8>, Error> {
+        let mut conn = self.db.get().await?;
+        schema::operator_identity::table
+            .find(id)
+            .select(schema::operator_identity::public_key)
+            .first(&mut conn)
+            .await
+            .map_err(missing(Error::OperatorNotFound))
+    }
+
+    async fn recovery_operator_public_key(
+        &self,
+        id: RecoveryOperatorIdentityId,
+    ) -> Result<Vec<u8>, Error> {
+        let mut conn = self.db.get().await?;
+        schema::recovery_operator_identity::table
+            .find(id)
+            .select(schema::recovery_operator_identity::public_key)
+            .first(&mut conn)
+            .await
+            .map_err(missing(Error::OperatorNotFound))
+    }
+
+    async fn record_vote(&self, vote: NewProposalVote) -> Result<(), Error> {
+        let mut conn = self.db.get().await?;
+        diesel::insert_into(schema::proposal_vote::table)
+            .values(&vote)
+            .execute(&mut conn)
+            .await?;
+        Ok(())
+    }
+
+    async fn record_recovery_vote(&self, vote: NewRecoveryProposalVote) -> Result<(), Error> {
+        let mut conn = self.db.get().await?;
+        diesel::insert_into(schema::recovery_proposal_vote::table)
+            .values(&vote)
+            .execute(&mut conn)
+            .await?;
+        Ok(())
+    }
+
+    async fn tally(&self, id: ProposalId) -> Result<Tally, Error> {
+        let mut conn = self.db.get().await?;
+
+        let ordinary_approve: i64 = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq(id))
+            .filter(schema::proposal_vote::approve.eq(true))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let recovery_approve: i64 = schema::recovery_proposal_vote::table
+            .filter(schema::recovery_proposal_vote::proposal_id.eq(id))
+            .filter(schema::recovery_proposal_vote::approve.eq(true))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+
+        let ordinary_reject: i64 = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq(id))
+            .filter(schema::proposal_vote::approve.eq(false))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let recovery_reject: i64 = schema::recovery_proposal_vote::table
+            .filter(schema::recovery_proposal_vote::proposal_id.eq(id))
+            .filter(schema::recovery_proposal_vote::approve.eq(false))
+            .count()
+            .get_result(&mut conn)
+            .await?;
+
+        let total_ordinary: i64 = schema::operator_identity::table
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let total_recovery: i64 = schema::recovery_operator_identity::table
+            .count()
+            .get_result(&mut conn)
+            .await?;
+
+        Ok(Tally {
+            ordinary_approve,
+            ordinary_reject,
+            recovery_approve,
+            recovery_reject,
+            total_ordinary,
+            total_recovery,
+        })
+    }
+
+    async fn set_status(&self, id: ProposalId, status: ProposalStatus) -> Result<(), Error> {
+        let mut conn = self.db.get().await?;
+        diesel::update(schema::proposal::table.find(id))
+            .set(schema::proposal::status.eq(status))
+            .execute(&mut conn)
+            .await?;
+        Ok(())
+    }
+
+    async fn pending_for(
+        &self,
+        operator_id: OperatorIdentityId,
+    ) -> Result<Vec<ProposalSummary>, Error> {
+        #[expect(
+            clippy::cast_possible_truncation,
+            clippy::as_conversions,
+            reason = "fixme! #84; this will break in 2038"
+        )]
+        let now_ts = Utc::now().timestamp() as i32;
+
+        let mut conn = self.db.get().await?;
+
+        let voted_ids: Vec<ProposalId> = schema::proposal_vote::table
+            .filter(schema::proposal_vote::operator_id.eq(operator_id))
+            .select(schema::proposal_vote::proposal_id)
+            .load(&mut conn)
+            .await?;
+
+        let proposals: Vec<Proposal> = schema::proposal::table
+            .filter(schema::proposal::status.eq(ProposalStatus::Pending))
+            .filter(schema::proposal::expires_at.gt(now_ts))
+            .filter(diesel::dsl::not(schema::proposal::id.eq_any(&voted_ids)))
+            .load(&mut conn)
+            .await?;
+
+        let ids: Vec<ProposalId> = proposals.iter().map(|p| p.id).collect();
+        let tallies: Vec<(ProposalId, bool, i64)> = schema::proposal_vote::table
+            .filter(schema::proposal_vote::proposal_id.eq_any(&ids))
+            .group_by((
+                schema::proposal_vote::proposal_id,
+                schema::proposal_vote::approve,
+            ))
+            .select((
+                schema::proposal_vote::proposal_id,
+                schema::proposal_vote::approve,
+                diesel::dsl::count_star(),
+            ))
+            .load(&mut conn)
+            .await?;
+
+        let mut by_proposal: HashMap<ProposalId, (i64, i64)> = HashMap::new();
+        for (proposal_id, approve, count) in tallies {
+            let entry = by_proposal.entry(proposal_id).or_insert((0, 0));
+            if approve {
+                entry.0 += count;
+            } else {
+                entry.1 += count;
+            }
+        }
+
+        Ok(proposals
+            .into_iter()
+            .map(|p| {
+                let (approve_count, reject_count) =
+                    by_proposal.get(&p.id).copied().unwrap_or((0, 0));
+                ProposalSummary {
+                    id: p.id,
+                    kind: p.kind,
+                    initiator_id: p.initiator_id,
+                    expires_at: p.expires_at,
+                    approve_count,
+                    reject_count,
+                }
+            })
+            .collect())
+    }
+
+    async fn is_recovery_active(&self) -> Result<bool, Error> {
+        let mut conn = self.db.get().await?;
+        db::recovery::is_active(&mut conn)
+            .await
+            .map_err(Error::from)
+    }
+
+    async fn has_uncancelled_wakeup(&self) -> Result<bool, Error> {
+        let mut conn = self.db.get().await?;
+        select(exists(schema::recovery_wakeup_request::table.filter(
+            schema::recovery_wakeup_request::cancelled_at.is_null(),
+        )))
+        .get_result(&mut conn)
+        .await
+        .map_err(Error::from)
+    }
+
+    async fn request_wakeup(&self, operator_id: OperatorIdentityId) -> Result<(), Error> {
+        let mut conn = self.db.get().await?;
+        diesel::insert_into(schema::recovery_wakeup_request::table)
+            .values(&NewRecoveryWakeupRequest {
+                requested_by: operator_id,
+            })
+            .execute(&mut conn)
+            .await?;
+        Ok(())
+    }
+
+    async fn cancel_wakeup(&self, operator_id: OperatorIdentityId) -> Result<bool, Error> {
+        let mut conn = self.db.get().await?;
+        let rows = diesel::update(schema::recovery_wakeup_request::table)
+            .filter(schema::recovery_wakeup_request::cancelled_at.is_null())
+            .set((
+                schema::recovery_wakeup_request::cancelled_by.eq(Some(operator_id)),
+                schema::recovery_wakeup_request::cancelled_at.eq(Some(SqliteTimestamp::now())),
+            ))
+            .execute(&mut conn)
+            .await?;
+        Ok(rows > 0)
+    }
+}
--- a/server/crates/arbiter-server/src/actors/proposal_manager/tests.rs
+++ b/server/crates/arbiter-server/src/actors/proposal_manager/tests.rs
@@ -0,0 +1,395 @@
+//! The quorum rules, exercised without a database.
+//!
+//! These assertions are the point of [`super::store::ProposalStore`]: until the actor took
+//! its data through a trait, checking that two of three operators carry an ordinary
+//! proposal meant opening SQLite and registering operators first.
+
+use super::{
+    ProposalManager, VoteOutcome,
+    store::{MockProposalStore, Tally},
+};
+use crate::{
+    actors::GlobalActors,
+    crypto::governance::vote_message,
+    db::{
+        models::{OperatorIdentityId, Proposal, ProposalId, ProposalStatus, SqliteTimestamp},
+        proposal::ProposalKindTag,
+    },
+};
+use arbiter_crypto::authn::{SigningContext, SigningKey};
+use chrono::{Duration, Utc};
+use std::sync::Arc;
+
+/// A tally where every vote came from the ordinary committee.
+const fn tally(approve: i64, reject: i64, ordinary: i64, recovery: i64) -> Tally {
+    Tally {
+        ordinary_approve: approve,
+        ordinary_reject: reject,
+        recovery_approve: 0,
+        recovery_reject: 0,
+        total_ordinary: ordinary,
+        total_recovery: recovery,
+    }
+}
+
+/// A tally with votes from both committees, in the order approve/reject per committee.
+const fn mixed_tally(
+    ordinary_approve: i64,
+    ordinary_reject: i64,
+    recovery_approve: i64,
+    recovery_reject: i64,
+    total_ordinary: i64,
+    total_recovery: i64,
+) -> Tally {
+    Tally {
+        ordinary_approve,
+        ordinary_reject,
+        recovery_approve,
+        recovery_reject,
+        total_ordinary,
+        total_recovery,
+    }
+}
+
+#[test]
+fn simple_majority_approves_at_two_of_three() {
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(2, 0, 3, 0), false),
+        VoteOutcome::Approved
+    );
+}
+
+#[test]
+fn one_of_three_is_not_yet_a_majority() {
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(1, 0, 3, 0), false),
+        VoteOutcome::Pending
+    );
+}
+
+#[test]
+fn full_quorum_kind_needs_every_voter() {
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(2, 0, 3, 0), true),
+        VoteOutcome::Pending,
+        "two of three must not carry a key-rotation proposal"
+    );
+}
+
+#[test]
+fn recovery_voters_count_towards_full_quorum() {
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&mixed_tally(2, 0, 1, 0, 2, 1), true),
+        VoteOutcome::Approved
+    );
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&mixed_tally(2, 0, 0, 0, 2, 1), true),
+        VoteOutcome::Pending,
+        "the sleeping recovery operator still owes a vote"
+    );
+}
+
+/// An empty committee cannot approve anything. Both arms have to say so: the full-quorum arm
+/// derives its threshold from the electorate, so with nobody eligible it would compare 0
+/// approvals against a threshold of 0 and call that unanimous.
+#[test]
+fn an_empty_electorate_settles_nothing() {
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(0, 0, 0, 0), true),
+        VoteOutcome::Pending,
+        "a full-quorum proposal must not pass with no eligible voters"
+    );
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(0, 0, 0, 0), false),
+        VoteOutcome::Pending
+    );
+}
+
+#[test]
+fn rejection_is_decided_once_approval_is_unreachable() {
+    // Threshold is 2 of 3, so two rejections leave at most one approval available.
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(0, 2, 3, 0), false),
+        VoteOutcome::Rejected
+    );
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(0, 1, 3, 0), false),
+        VoteOutcome::Pending,
+        "one rejection still leaves two approvals reachable"
+    );
+}
+
+#[test]
+fn a_single_rejection_sinks_a_full_quorum_proposal() {
+    assert_eq!(
+        ProposalManager::evaluate_quorum(&tally(2, 1, 3, 0), true),
+        VoteOutcome::Rejected
+    );
+}
+
+fn pending_proposal(id: ProposalId, kind: ProposalKindTag) -> Proposal {
+    let now = Utc::now();
+    Proposal {
+        id,
+        kind,
+        initiator_id: OperatorIdentityId::from_raw(1),
+        created_at: SqliteTimestamp::from(now),
+        expires_at: SqliteTimestamp::from(now + Duration::days(1)),
+        status: ProposalStatus::Pending,
+    }
+}
+
+/// The mock earns its keep here: reaching quorum must flip the stored status to
+/// `Approved` exactly once. Signature verification stays real -- only the database is
+/// stubbed out.
+#[tokio::test]
+async fn reaching_quorum_marks_the_proposal_approved() {
+    let id = ProposalId::from_raw(1);
+    let voter = OperatorIdentityId::from_raw(1);
+    let key = SigningKey::generate();
+    let signature = key
+        .sign_message(&vote_message(id, true), SigningContext::GovernanceVote)
+        .expect("signing a vote must succeed");
+    let public_key = key.public_key().to_bytes();
+
+    let mut store = MockProposalStore::new();
+    store
+        .expect_load()
+        .returning(move |id| Ok(pending_proposal(id, ProposalKindTag::TriggerRekey)));
+    store.expect_has_voted().returning(|_, _| Ok(false));
+    store
+        .expect_operator_public_key()
+        .returning(move |_| Ok(public_key.clone()));
+    store.expect_record_vote().returning(|_| Ok(()));
+    store.expect_is_recovery_active().returning(|| Ok(false));
+    store.expect_tally().returning(|_| Ok(tally(1, 0, 1, 0)));
+    store
+        .expect_set_status()
+        .withf(move |got, status| *got == id && *status == ProposalStatus::Approved)
+        .times(1)
+        .returning(|_, _| Ok(()));
+    store
+        .expect_load_kind()
+        .returning(|_, _| Ok(crate::db::proposal::ProposalKind::TriggerRekey));
+
+    let mut manager =
+        ProposalManager::with_store(Arc::new(store), GlobalActors::spawn_message_bus());
+
+    let outcome = manager
+        .cast_vote(id, voter, true, signature.to_bytes())
+        .await
+        .expect("a valid vote must be accepted");
+
+    assert_eq!(outcome, VoteOutcome::Approved);
+}
+
+/// A vote that does not reach the threshold must leave the stored status alone.
+#[tokio::test]
+async fn a_vote_short_of_quorum_does_not_touch_the_status() {
+    let id = ProposalId::from_raw(7);
+    let voter = OperatorIdentityId::from_raw(2);
+    let key = SigningKey::generate();
+    let signature = key
+        .sign_message(&vote_message(id, true), SigningContext::GovernanceVote)
+        .expect("signing a vote must succeed");
+    let public_key = key.public_key().to_bytes();
+
+    let mut store = MockProposalStore::new();
+    store
+        .expect_load()
+        .returning(move |id| Ok(pending_proposal(id, ProposalKindTag::ApproveSdkClient)));
+    store.expect_has_voted().returning(|_, _| Ok(false));
+    store
+        .expect_operator_public_key()
+        .returning(move |_| Ok(public_key.clone()));
+    store.expect_record_vote().returning(|_| Ok(()));
+    store.expect_is_recovery_active().returning(|| Ok(false));
+    store.expect_tally().returning(|_| Ok(tally(1, 0, 3, 0)));
+    store.expect_set_status().never();
+
+    let mut manager =
+        ProposalManager::with_store(Arc::new(store), GlobalActors::spawn_message_bus());
+
+    let outcome = manager
+        .cast_vote(id, voter, true, signature.to_bytes())
+        .await
+        .expect("a valid vote must be accepted");
+
+    assert_eq!(outcome, VoteOutcome::Pending);
+}
+
+/// Drives one `cast_vote` on a proposal of the given `kind` through a mocked store and
+/// returns the outcome. `recovery_active` decides what `is_recovery_active` reports;
+/// `expected_status` is the status a settled outcome must be persisted under, or `None` for
+/// a caller that expects the vote to leave the proposal pending.
+///
+/// `set_status` carries an argument matcher but no `.times()`, and `None` relaxes even the
+/// matcher: the caller's own `assert_eq!` on the outcome is what pins the behaviour, so a
+/// regression fails on a readable diff rather than on a mockall cardinality panic that hides
+/// what the actor actually computed.
+async fn settle_vote_with(
+    kind: ProposalKindTag,
+    tally: Tally,
+    recovery_active: bool,
+    expected_status: Option<ProposalStatus>,
+) -> VoteOutcome {
+    let id = ProposalId::from_raw(11);
+    let voter = OperatorIdentityId::from_raw(1);
+    let key = SigningKey::generate();
+    let signature = key
+        .sign_message(&vote_message(id, true), SigningContext::GovernanceVote)
+        .expect("signing a vote must succeed");
+    let public_key = key.public_key().to_bytes();
+
+    let mut store = MockProposalStore::new();
+    store
+        .expect_load()
+        .returning(move |id| Ok(pending_proposal(id, kind)));
+    store.expect_has_voted().returning(|_, _| Ok(false));
+    store
+        .expect_operator_public_key()
+        .returning(move |_| Ok(public_key.clone()));
+    store.expect_record_vote().returning(|_| Ok(()));
+    store
+        .expect_is_recovery_active()
+        .returning(move || Ok(recovery_active));
+    store.expect_tally().returning(move |_| Ok(tally));
+    store
+        .expect_set_status()
+        .withf(move |_, status| {
+            expected_status
+                .as_ref()
+                .is_none_or(|expected| status == expected)
+        })
+        .returning(|_, _| Ok(()));
+    store.expect_load_kind().returning(move |_, _| {
+        Ok(match kind {
+            ProposalKindTag::TriggerRekey => crate::db::proposal::ProposalKind::TriggerRekey,
+            ProposalKindTag::ApproveSdkClient => {
+                crate::db::proposal::ProposalKind::ApproveSdkClient(
+                    crate::db::proposal::approve_sdk_client::Settings { client_id: 1 },
+                )
+            }
+            ProposalKindTag::ReplaceOperator => crate::db::proposal::ProposalKind::ReplaceOperator(
+                crate::db::proposal::replace_operator::Settings {
+                    old_operator_id: OperatorIdentityId::from_raw(1),
+                    new_pubkey: vec![0u8; 32],
+                },
+            ),
+            other => unreachable!("settle_vote_with has no load_kind fixture for {other:?}"),
+        })
+    });
+
+    let mut manager =
+        ProposalManager::with_store(Arc::new(store), GlobalActors::spawn_message_bus());
+
+    manager
+        .cast_vote(id, voter, true, signature.to_bytes())
+        .await
+        .expect("a valid vote must be accepted")
+}
+
+/// The full-quorum rejection path is insensitive to electorate size by construction:
+/// `threshold == total_eligible` there, so `total_eligible - threshold` is always 0 and any
+/// single rejection settles the proposal, whether or not recovery operators are (wrongly)
+/// counted. This does not exercise the electorate-narrowing fix -- see
+/// `unanimous_ordinary_rejection_rejects_a_non_full_quorum_proposal_while_recovery_is_awake`
+/// below for the test that does -- it just pins that `cast_vote` still writes `Rejected`
+/// through `settle` for a full-quorum kind.
+#[tokio::test]
+async fn unanimous_rejection_settles_a_full_quorum_rekey_via_cast_vote() {
+    let outcome = settle_vote_with(
+        ProposalKindTag::TriggerRekey,
+        tally(0, 3, 3, 2),
+        /* recovery_active */ true,
+        Some(ProposalStatus::Rejected),
+    )
+    .await;
+
+    assert_eq!(outcome, VoteOutcome::Rejected);
+}
+
+/// §3.3 full quorum for a rekey means every *ordinary* operator, not every identity on file.
+#[tokio::test]
+async fn unanimous_ordinary_approval_approves_a_rekey_while_recovery_is_awake() {
+    let outcome = settle_vote_with(
+        ProposalKindTag::TriggerRekey,
+        tally(3, 0, 3, 2),
+        /* recovery_active */ true,
+        Some(ProposalStatus::Approved),
+    )
+    .await;
+
+    assert_eq!(outcome, VoteOutcome::Approved);
+}
+
+/// §3.5: recovery operators do not vote on `ApproveSdkClient`, so they must not inflate its
+/// electorate. Before the fix, `total_eligible` counted them anyway (5, not 3), so the
+/// rejection test `reject > total_eligible - threshold` became `3 > 5 - 2 = 3`, which is
+/// false -- three unanimous rejections left the proposal `Pending` forever, since a fourth
+/// vote could never arrive. After the fix, `total_eligible` is 3 and the same test becomes
+/// `3 > 3 - 2 = 1`, which settles it.
+#[tokio::test]
+async fn unanimous_ordinary_rejection_rejects_a_non_full_quorum_proposal_while_recovery_is_awake() {
+    let outcome = settle_vote_with(
+        ProposalKindTag::ApproveSdkClient,
+        tally(0, 3, 3, 2),
+        /* recovery_active */ true,
+        Some(ProposalStatus::Rejected),
+    )
+    .await;
+
+    assert_eq!(outcome, VoteOutcome::Rejected);
+}
+
+/// §3.5/§3.6: `ReplaceOperator` is the one kind recovery may vote on, so it is the only kind
+/// where whether recovery is awake is observable at all -- for every other kind
+/// `narrow_electorate` zeroes `total_recovery` regardless of `is_recovery_active`, short-
+/// circuiting before that call. A sleeping recovery electorate must not raise the bar here:
+/// with 1 ordinary operator and 2 (asleep) recovery operators, the lone ordinary approval
+/// must already reach full quorum.
+#[tokio::test]
+async fn sleeping_recovery_operators_do_not_count_towards_quorum() {
+    let outcome = settle_vote_with(
+        ProposalKindTag::ReplaceOperator,
+        tally(1, 0, 1, 2),
+        /* recovery_active */ false,
+        Some(ProposalStatus::Approved),
+    )
+    .await;
+
+    assert_eq!(outcome, VoteOutcome::Approved);
+}
+
+/// The sequence the whole-branch review worked through, on a `ReplaceOperator` with 3
+/// ordinary and 2 recovery operators (§3.3: full quorum). Both recovery operators approve
+/// while awake; one ordinary operator approves; another ordinary operator then cancels the
+/// wake-up -- `cancel_wakeup` cancels an uncancelled request whether or not its window has
+/// elapsed, so the committee goes straight back to sleep with its votes on the record; a
+/// second ordinary operator approves.
+///
+/// The store now reports 4 approvals, 2 of them from a committee that is no longer eligible.
+/// Narrowing the electorate has to drop those votes along with the voters: what is left is 2
+/// of 3 ordinary approvals, and a full quorum needs all three. Counting the electorate down
+/// to 3 while keeping all 4 votes would replace an operator on two ordinary approvals.
+#[tokio::test]
+async fn recovery_votes_leave_with_the_committee_that_cast_them() {
+    let outcome = settle_vote_with(
+        ProposalKindTag::ReplaceOperator,
+        mixed_tally(
+            /* ordinary_approve */ 2, /* ordinary_reject */ 0,
+            /* recovery_approve */ 2, /* recovery_reject */ 0,
+            /* total_ordinary */ 3, /* total_recovery */ 2,
+        ),
+        /* recovery_active */ false,
+        None,
+    )
+    .await;
+
+    assert_eq!(
+        outcome,
+        VoteOutcome::Pending,
+        "two of three ordinary approvals must not carry a full-quorum proposal, whatever a \
+         sleeping recovery committee voted earlier"
+    );
+}
--- a/server/crates/arbiter-server/src/actors/vault/mod.rs
+++ b/server/crates/arbiter-server/src/actors/vault/mod.rs
@@ -1,13 +1,15 @@
 use crate::{
+    actors::proposal_manager::events::ProposalApproved,
    crypto::{
-        KeyCell, derive_key,
+        KeyCell,
        encryption::v1::{self, Nonce},
-        integrity::v1::HmacSha256,
+        integrity::{self, v1::HmacSha256},
    },
    db::{
        self,
        models::{self, RootKeyHistory, RootKeyHistoryId},
-        schema::{self},
+        proposal::ProposalKind,
+        schema,
    },
 };
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
@@ -19,7 +21,7 @@ use diesel::{
 };
 use diesel_async::{AsyncConnection, RunQueryDsl};
 use hmac::{KeyInit as _, Mac as _};
-use kameo::{Actor, Reply, actor::ActorRef, messages};
+use kameo::{Actor, Reply, actor::ActorRef, messages, prelude::Message};
 use kameo_actors::message_bus::{MessageBus, Publish};
 use strum::{EnumDiscriminants, IntoDiscriminant};
 use tracing::{error, info};
@@ -90,7 +92,6 @@ pub struct Vault {
    events: ActorRef<MessageBus>,
 }

-#[messages]
 impl Vault {
    pub async fn new(db: db::DatabasePool, events: ActorRef<MessageBus>) -> Result<Self, Error> {
        let state = {
@@ -113,7 +114,7 @@ impl Vault {
        Ok(Self { db, state, events })
    }

-    // Exclusive transaction to avoid race condtions if multiple vaults write
+    // Exclusive transaction to avoid race conditions if multiple vaults write
    // additional layer of protection against nonce-reuse
    async fn get_new_nonce(
        pool: &db::DatabasePool,
@@ -158,33 +159,37 @@ impl Vault {
            State::Sealed { .. } => Err(Error::Sealed),
        }
    }
+}

+#[messages]
+impl Vault {
    #[message]
-    pub async fn bootstrap(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
-        if !matches!(self.state, State::Unbootstrapped) {
+    pub async fn bootstrap(&mut self, mut seal_key: KeyCell) -> Result<(), Error> {
+        if !matches!(&self.state, State::Unbootstrapped) {
            return Err(Error::AlreadyBootstrapped);
        }
-        let salt = v1::generate_salt();
-        let mut seal_key = derive_key(seal_key_raw, &salt);
+
        let mut root_key = KeyCell::new_secure_random();

        // Zero nonces are fine because they are one-time
        let root_key_nonce = Nonce::default();
        let data_encryption_nonce = Nonce::default();

-        let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|reader| {
-            let root_key_reader = reader.as_slice();
+        // Generate salt (kept for schema compat)
+        let root_key_salt = v1::generate_salt();
+
+        let root_key_ciphertext: Vec<u8> = root_key.0.read_inline(|rk| {
            seal_key
-                .encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, root_key_reader)
+                .encrypt(&root_key_nonce, v1::ROOT_KEY_TAG, rk.as_slice())
                .map_err(|err| {
                    error!(?err, "Fatal bootstrap error");
                    Error::Encryption(err)
                })
        })?;

+        let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
        let mut conn = self.db.get().await?;

-        let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
        let root_key_history_id = conn
            .transaction(async |conn| {
                let root_key_history_id = insert_into(schema::root_key_history::table)
@@ -194,7 +199,7 @@ impl Vault {
                        root_key_encryption_nonce: root_key_nonce.to_vec(),
                        data_encryption_nonce: data_encryption_nonce_bytes.clone(),
                        schema_version: 1,
-                        salt: salt.to_vec(),
+                        salt: root_key_salt.to_vec(),
                    })
                    .returning(schema::root_key_history::id)
                    .get_result(&mut *conn)
@@ -217,58 +222,55 @@ impl Vault {
        });

        info!("Vault bootstrapped successfully");
-        let _ = self.events.tell(Publish(events::Bootstrapped)).await;
+        if let Err(err) = self.events.tell(Publish(events::Bootstrapped)).await {
+            error!(?err, "Failed to publish Bootstrapped event");
+        }

        Ok(())
    }

    #[message]
-    pub async fn try_unseal(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
+    pub async fn try_unseal(&mut self, mut seal_key: KeyCell) -> Result<(), Error> {
        let State::Sealed {
            root_key_history_id,
        } = &self.state
        else {
            return Err(Error::NotBootstrapped);
        };
+        let root_key_history_id = *root_key_history_id;

-        // We don't want to hold connection while doing expensive KDF work
+        // We don't want to hold connection while doing expensive work
        let current_key = {
            let mut conn = self.db.get().await?;
            schema::root_key_history::table
-                .filter(schema::root_key_history::id.eq(*root_key_history_id))
+                .filter(schema::root_key_history::id.eq(root_key_history_id))
                .select(RootKeyHistory::as_select())
                .first(&mut conn)
                .await?
        };

-        let salt = &current_key.salt;
-        let salt = v1::Salt::try_from(salt.as_slice()).map_err(|_| {
-            error!("Broken database: invalid salt for root key");
-            Error::BrokenDatabase
-        })?;
-        let mut seal_key = derive_key(seal_key_raw, &salt);
-
-        let mut root_key = SafeCell::new(current_key.ciphertext.clone());
-
        let nonce =
            Nonce::try_from(current_key.root_key_encryption_nonce.as_slice()).map_err(|()| {
                error!("Broken database: invalid nonce for root key");
                Error::BrokenDatabase
            })?;

+        let mut root_key_bytes = SafeCell::new(current_key.ciphertext.clone());
        seal_key
-            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key)
+            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key_bytes)
            .map_err(|err| {
                error!(?err, "Failed to unseal root key: invalid seal key");
                Error::InvalidKey
            })?;

+        let root_key = KeyCell::try_from(root_key_bytes).map_err(|()| {
+            error!("Broken database: invalid encryption key size");
+            Error::BrokenDatabase
+        })?;
+
        self.state = State::Unsealed(Unsealed {
            root_key_history_id: current_key.id,
-            root_key: KeyCell::try_from(root_key).map_err(|err| {
-                error!(?err, "Broken database: invalid encryption key size");
-                Error::BrokenDatabase
-            })?,
+            root_key,
        });

        info!("Vault unsealed successfully");
@@ -277,6 +279,76 @@ impl Vault {
        Ok(())
    }

+    /// Re-encrypts the root key with `new_seal_key`, updating its `root_key_history` row in
+    /// place. Called after a Shamir re-key, so the old seal key is no longer sufficient to
+    /// unseal. The root key itself does not change, so its row identity (and the nonce counter
+    /// and integrity envelopes bound to it) must not change either.
+    #[message]
+    pub async fn rekey_root_key(&mut self, mut new_seal_key: KeyCell) -> Result<(), Error> {
+        let Unsealed {
+            root_key,
+            root_key_history_id,
+        } = Self::expect_unsealed(&mut self.state)?;
+
+        let new_nonce = Nonce::default();
+        let new_salt = v1::generate_salt();
+
+        let new_ciphertext: Vec<u8> = root_key.0.read_inline(|rk| {
+            new_seal_key
+                .encrypt(&new_nonce, v1::ROOT_KEY_TAG, rk.as_slice())
+                .map_err(|err| {
+                    error!(?err, "Fatal rekey error");
+                    Error::Encryption(err)
+                })
+        })?;
+
+        let mut conn = self.db.get().await?;
+
+        // The root key is unchanged, so its row keeps its identity: `data_encryption_nonce`
+        // keeps counting up, and every integrity envelope stays bound to the same key version.
+        // Only the seal-key material is replaced, retiring the previous one. `tag` and
+        // `schema_version` are deliberately left untouched: the seal-key encryption scheme
+        // itself is unchanged by a re-key, so there is nothing new for them to describe.
+        let rows_updated = update(schema::root_key_history::table)
+            .filter(schema::root_key_history::id.eq(*root_key_history_id))
+            .set((
+                schema::root_key_history::ciphertext.eq(new_ciphertext),
+                schema::root_key_history::root_key_encryption_nonce.eq(new_nonce.to_vec()),
+                schema::root_key_history::salt.eq(new_salt.to_vec()),
+            ))
+            .execute(&mut conn)
+            .await?;
+
+        if rows_updated == 0 {
+            error!(
+                "Broken database: rekey matched no root_key_history row id={:#?}",
+                root_key_history_id
+            );
+            return Err(Error::BrokenDatabase);
+        }
+
+        info!("Vault root key rekeyed successfully");
+        Ok(())
+    }
+
+    #[message]
+    pub async fn seal(&mut self) -> Result<(), Error> {
+        let Unsealed {
+            root_key_history_id,
+            ..
+        } = Self::expect_unsealed(&mut self.state)?;
+
+        self.state = State::Sealed {
+            root_key_history_id: *root_key_history_id,
+        };
+        let _ = self.events.tell(Publish(events::VaultResealed)).await;
+        Ok(())
+    }
+}
+
+// Server-side cryptographic operations
+#[messages]
+impl Vault {
    #[message]
    pub async fn decrypt(&mut self, aead_id: i32) -> Result<SafeCell<Vec<u8>>, Error> {
        let Unsealed { root_key, .. } = Self::expect_unsealed(&mut self.state)?;
@@ -354,12 +426,10 @@ impl Vault {
            root_key_history_id,
        } = Self::expect_unsealed(&mut self.state)?;

-        let mut hmac = root_key
-            .0
-            .read_inline(|k| match HmacSha256::new_from_slice(k) {
-                Ok(v) => v,
-                Err(_) => unreachable!("HMAC accepts keys of any size"),
-            });
+        let mut hmac = root_key.0.read_inline(|k| {
+            HmacSha256::new_from_slice(k)
+                .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
+        });
        hmac.update(&root_key_history_id.to_raw().to_be_bytes());
        hmac.update(&mac_input);

@@ -383,29 +453,69 @@ impl Vault {
            return Ok(false);
        }

-        let mut hmac = root_key
-            .0
-            .read_inline(|k| match HmacSha256::new_from_slice(k) {
-                Ok(v) => v,
-                Err(_) => unreachable!("HMAC accepts keys of any size"),
-            });
+        let mut hmac = root_key.0.read_inline(|k| {
+            HmacSha256::new_from_slice(k)
+                .unwrap_or_else(|_| unreachable!("HMAC accepts keys of any size"))
+        });
        hmac.update(&key_version.to_raw().to_be_bytes());
        hmac.update(&mac_input);

        Ok(hmac.verify_slice(&expected_mac).is_ok())
    }
+}

-    #[message]
-    pub async fn seal(&mut self) -> Result<(), Error> {
-        let Unsealed {
-            root_key_history_id,
-            ..
-        } = Self::expect_unsealed(&mut self.state)?;
+impl Message<ProposalApproved> for Vault {
+    type Reply = ();

-        self.state = State::Sealed {
-            root_key_history_id: *root_key_history_id,
+    /// Every subscriber sees every approval and acts only on the kinds it owns.
+    async fn handle(
+        &mut self,
+        msg: ProposalApproved,
+        _ctx: &mut kameo::prelude::Context<Self, Self::Reply>,
+    ) -> Self::Reply {
+        let ProposalKind::ApproveSdkClient(settings) = msg.kind else {
+            return;
        };
-        let _ = self.events.tell(Publish(events::VaultResealed)).await;
+
+        if let Err(error) = self.approve_sdk_client(settings.client_id).await {
+            error!(
+                ?error,
+                proposal_id = msg.id.to_raw(),
+                "Failed to execute an approved proposal"
+            );
+        }
+    }
+}
+
+impl Vault {
+    /// Attests an approved SDK client with the root key.
+    ///
+    /// Builds the envelope from its parts rather than calling `integrity::sign_entity`,
+    /// which would have this actor ask itself for a signature and deadlock.
+    async fn approve_sdk_client(&mut self, client_id: i32) -> Result<(), Error> {
+        use crate::peers::client::ClientCredentials;
+        use arbiter_crypto::authn;
+
+        // Cloned so the connection does not hold a borrow of `self` across `sign_integrity`.
+        let db = self.db.clone();
+        let mut conn = db.get().await?;
+
+        let pubkey_bytes: Vec<u8> = schema::program_client::table
+            .find(client_id)
+            .select(schema::program_client::public_key)
+            .first(&mut conn)
+            .await?;
+
+        let pubkey =
+            authn::PublicKey::try_from(pubkey_bytes.as_slice()).map_err(|()| Error::InvalidKey)?;
+        let credentials = ClientCredentials { pubkey };
+
+        let (entity_id, mac_input) = integrity::envelope_input(&credentials, client_id);
+        let (key_version, mac) = self.sign_integrity(mac_input)?;
+
+        integrity::store_envelope::<ClientCredentials>(&mut conn, entity_id, key_version, mac)
+            .await?;
+
        Ok(())
    }
 }
@@ -413,8 +523,6 @@ impl Vault {
 #[cfg(test)]
 mod tests {
    use crate::actors::GlobalActors;
-    use crate::db::models::RootKeyHistory;
-    use arbiter_crypto::safecell::SafeCellHandle as _;

    use super::*;

@@ -422,8 +530,7 @@ mod tests {
        let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
            .await
            .unwrap();
-        let seal_key = SafeCell::new(b"test-seal-key".to_vec());
-        actor.bootstrap(seal_key).await.unwrap();
+        actor.bootstrap(KeyCell::from([0u8; 32])).await.unwrap();
        actor
    }

@@ -432,12 +539,12 @@ mod tests {
    async fn nonce_monotonic_even_when_nonce_allocation_interleaves() {
        let db = db::create_test_pool().await;
        let mut actor = bootstrapped_actor(&db).await;
-        let root_key_history_id = match actor.state {
-            State::Unsealed(Unsealed {
-                root_key_history_id,
-                ..
-            }) => root_key_history_id,
-            _ => panic!("expected unsealed state"),
+        let State::Unsealed(Unsealed {
+            root_key_history_id,
+            ..
+        }) = actor.state
+        else {
+            panic!("expected unsealed state");
        };

        let n1 = Vault::get_new_nonce(&db, root_key_history_id)
@@ -471,4 +578,96 @@ mod tests {
            "next write must advance nonce"
        );
    }
+
+    #[tokio::test]
+    #[test_log::test]
+    async fn rekey_does_not_restart_the_data_nonce_counter() {
+        let db = db::create_test_pool().await;
+        let mut actor = bootstrapped_actor(&db).await;
+
+        let before = actor
+            .create_new(SafeCell::new(b"before-rekey".to_vec()))
+            .await
+            .unwrap();
+
+        actor.rekey_root_key(KeyCell::from([7u8; 32])).await.unwrap();
+
+        let after = actor
+            .create_new(SafeCell::new(b"after-rekey".to_vec()))
+            .await
+            .unwrap();
+
+        let mut conn = db.get().await.unwrap();
+
+        // One root key, one row: the root key never changed, so its history did not fork.
+        let rows: i64 = schema::root_key_history::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(rows, 1, "a seal-key re-key must not append a root key row");
+
+        // Fetch each nonce by its own id, rather than `eq_any` (whose row order is
+        // unspecified), and assert the counter strictly advanced. A weaker `assert_ne!` would
+        // still pass if the counter reset, as long as the two nonces happened to differ.
+        let before_nonce: Vec<u8> = schema::aead_encrypted::table
+            .find(before)
+            .select(schema::aead_encrypted::current_nonce)
+            .first(&mut conn)
+            .await
+            .unwrap();
+        let after_nonce: Vec<u8> = schema::aead_encrypted::table
+            .find(after)
+            .select(schema::aead_encrypted::current_nonce)
+            .first(&mut conn)
+            .await
+            .unwrap();
+        assert!(
+            after_nonce > before_nonce,
+            "nonce counter must keep advancing across a rekey, not reset"
+        );
+    }
+
+    #[tokio::test]
+    #[test_log::test]
+    async fn rekey_invalidates_the_old_seal_key() {
+        let db = db::create_test_pool().await;
+        let mut actor = bootstrapped_actor(&db).await;
+
+        actor.rekey_root_key(KeyCell::from([7u8; 32])).await.unwrap();
+        actor.seal().await.unwrap();
+
+        // A no-op rekey would leave the old seal key working; it must not.
+        let err = actor
+            .try_unseal(KeyCell::from([0u8; 32]))
+            .await
+            .unwrap_err();
+        assert!(
+            matches!(err, Error::InvalidKey),
+            "old seal key must no longer unseal after a rekey, got {err:?}"
+        );
+
+        // A failed unseal must leave the sealed state intact: the new seal key must still be
+        // able to unseal on the next attempt.
+        actor.try_unseal(KeyCell::from([7u8; 32])).await.unwrap();
+    }
+
+    #[tokio::test]
+    #[test_log::test]
+    async fn integrity_envelopes_survive_a_rekey() {
+        let db = db::create_test_pool().await;
+        let mut actor = bootstrapped_actor(&db).await;
+
+        let mac_input = b"operator_credentials/1".to_vec();
+        let (key_version, mac) = actor.sign_integrity(mac_input.clone()).unwrap();
+
+        actor.rekey_root_key(KeyCell::from([9u8; 32])).await.unwrap();
+
+        assert!(
+            actor
+                .verify_integrity(mac_input, mac, key_version)
+                .unwrap(),
+            "a seal-key re-key must not invalidate existing attestations"
+        );
+    }
 }
--- a/server/crates/arbiter-server/src/actors/vault_coordinator/mod.rs
+++ b/server/crates/arbiter-server/src/actors/vault_coordinator/mod.rs
@@ -0,0 +1,923 @@
+use std::collections::HashMap;
+
+use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
+use diesel::{ExpressionMethods as _, QueryDsl};
+use diesel_async::RunQueryDsl;
+use kameo::{Actor, actor::ActorRef, messages, prelude::Message};
+use rand_core::{OsRng, RngCore as _};
+use tracing::error;
+
+use crate::{
+    actors::{
+        proposal_manager::events::ProposalApproved,
+        vault::{Bootstrap, RekeyRootKey, TryUnseal, Vault},
+    },
+    crypto::{KeyCell, derive_key, encryption::v1::Nonce, shamir, shamir::shamir_threshold},
+    db::{
+        self, models,
+        proposal::{ProposalKind, replace_operator},
+        schema,
+    },
+};
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("Already coordinating a bootstrap")]
+    AlreadyBootstrapping,
+    #[error("Already coordinating an unseal")]
+    AlreadyUnsealing,
+    #[error("Rekey not in progress")]
+    NotRekeying,
+    #[error("Bootstrap not in progress")]
+    NotBootstrapping,
+    #[error("Unseal not in progress")]
+    NotUnsealing,
+    #[error("Operator already contributed")]
+    DuplicateContribution,
+    #[error("Operator not found in database")]
+    OperatorNotFound,
+    #[error("Invalid passphrase (decryption failed)")]
+    InvalidPassphrase,
+    #[error("Shamir error: {0}")]
+    Shamir(String),
+    #[error("Database connection error: {0}")]
+    DatabaseConnection(#[from] db::PoolError),
+    #[error("Database query error: {0}")]
+    DatabaseQuery(#[from] diesel::result::Error),
+    #[error("Encryption error")]
+    Encryption,
+    #[error("Vault error")]
+    VaultError,
+    #[error("Two-operator vaults require at least one recovery share")]
+    TwoOperatorsRequireRecovery,
+    #[error("Broken database")]
+    BrokenDatabase,
+    #[error("A committee must have at least one ordinary operator")]
+    EmptyCommittee,
+    #[error("Recovery operators are sleeping")]
+    RecoveryNotActive,
+}
+
+// Passphrases stored as plain Vec<u8> (not SafeCell) so CoordinatorState is Sync.
+// They are ephemeral and dropped immediately after use.
+enum CoordinatorState {
+    Idle,
+    Bootstrapping {
+        declared_count: usize,
+        recovery_count: usize,
+        passphrases: HashMap<i32, Vec<u8>>,
+        recovery_passphrases: HashMap<i32, Vec<u8>>,
+    },
+    Unsealing {
+        threshold: usize,
+        ordinary_passphrases: HashMap<i32, Vec<u8>>,
+        recovery_passphrases: HashMap<i32, Vec<u8>>,
+    },
+    /// Shamir re-key after `replace_operator` or `trigger_rekey` is approved (§3.3).
+    /// Collects new passphrases from all current operators, then generates a fresh seal key,
+    /// re-splits it, and re-encrypts the vault root key.
+    Rekeying {
+        ordinary_count: usize,
+        recovery_count: usize,
+        passphrases: HashMap<i32, Vec<u8>>,
+        recovery_passphrases: HashMap<i32, Vec<u8>>,
+    },
+}
+
+#[derive(Actor)]
+pub struct VaultCoordinator {
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    state: CoordinatorState,
+}
+
+impl VaultCoordinator {
+    pub const fn new(db: db::DatabasePool, vault: ActorRef<Vault>) -> Self {
+        Self {
+            db,
+            vault,
+            state: CoordinatorState::Idle,
+        }
+    }
+}
+
+const SHARE_AAD: &[u8] = b"arbiter/shamir-share/v1";
+
+fn encrypt_share(
+    passphrase_bytes: Vec<u8>,
+    share: &[u8],
+) -> Result<(Vec<u8>, Vec<u8>, Vec<u8>), Error> {
+    let mut share_salt = vec![0u8; 32];
+    OsRng.fill_bytes(&mut share_salt);
+
+    let mut passphrase_cell = SafeCell::new(passphrase_bytes);
+    let mut share_seal_key = derive_key(&mut passphrase_cell, &share_salt);
+
+    let nonce = Nonce::default();
+    let encrypted_share = share_seal_key
+        .encrypt(&nonce, SHARE_AAD, share)
+        .map_err(|_| Error::Encryption)?;
+
+    Ok((encrypted_share, nonce.to_vec(), share_salt))
+}
+
+fn decrypt_share(
+    passphrase_bytes: Vec<u8>,
+    encrypted_share: Vec<u8>,
+    share_nonce_bytes: &[u8],
+    share_salt: &[u8],
+    operator_id: i32,
+) -> Result<Vec<u8>, Error> {
+    let nonce = Nonce::try_from(share_nonce_bytes).map_err(|()| {
+        error!(operator_id, "Invalid nonce in DB");
+        Error::BrokenDatabase
+    })?;
+
+    let mut passphrase_cell = SafeCell::new(passphrase_bytes);
+    let mut share_seal_key = derive_key(&mut passphrase_cell, share_salt);
+
+    let mut share_buffer = SafeCell::new(encrypted_share);
+    share_seal_key
+        .decrypt_in_place(&nonce, SHARE_AAD, &mut share_buffer)
+        .map_err(|_| Error::InvalidPassphrase)?;
+
+    Ok(share_buffer.read().clone())
+}
+
+/// Records the threshold of the split that produced the stored shares.
+async fn store_threshold(conn: &mut db::DatabaseConnection, threshold: usize) -> Result<(), Error> {
+    // A threshold that doesn't fit in the column is a bug, not a real empty-committee refusal.
+    let threshold = i32::try_from(threshold).map_err(|_| Error::BrokenDatabase)?;
+    let rows_updated = diesel::update(schema::arbiter_settings::table)
+        .set(schema::arbiter_settings::shamir_threshold.eq(Some(threshold)))
+        .execute(conn)
+        .await?;
+    // The singleton row always exists (up.sql seeds it), so anything else means the update did
+    // not land -- bootstrap would then report success while the threshold stays NULL forever.
+    if rows_updated != 1 {
+        return Err(Error::BrokenDatabase);
+    }
+    Ok(())
+}
+
+/// Reads back the threshold recorded at bootstrap or re-key time.
+async fn load_threshold(conn: &mut db::DatabaseConnection) -> Result<usize, Error> {
+    let stored: Option<i32> = schema::arbiter_settings::table
+        .select(schema::arbiter_settings::shamir_threshold)
+        .first(conn)
+        .await?;
+
+    // A missing or out-of-range value here means the recorded threshold is corrupt, not that the
+    // committee is genuinely empty -- `EmptyCommittee` is reserved for the real domain refusal.
+    stored
+        .and_then(|threshold| usize::try_from(threshold).ok())
+        .ok_or(Error::BrokenDatabase)
+}
+
+/// §3.4: Split the seal key across ordinary + recovery operators.
+/// Threshold = `shamir_threshold(ordinary_count)`; total shares = ordinary + recovery.
+/// When `ordinary_count` == 1 (threshold = 1), vsss-rs does not support a proper split,
+/// so each share is the seal key itself — any single participant can reconstruct.
+async fn finalize_bootstrap(
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    ordinary_passphrases: HashMap<i32, Vec<u8>>,
+    recovery_passphrases: HashMap<i32, Vec<u8>>,
+) -> Result<(), Error> {
+    let ordinary_count = ordinary_passphrases.len();
+    let recovery_count = recovery_passphrases.len();
+    let total = ordinary_count + recovery_count;
+    let threshold = shamir_threshold(ordinary_count).ok_or(Error::EmptyCommittee)?;
+
+    let mut seal_key_bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut seal_key_bytes);
+
+    // threshold == 1 means any single share reconstructs the key (degenerate split).
+    // vsss-rs requires threshold >= 2, so we store the key directly in this case.
+    let shares: Vec<Vec<u8>> = if threshold >= 2 {
+        shamir::split_key(threshold, total, &seal_key_bytes, OsRng)
+            .map_err(|e| Error::Shamir(e.to_string()))?
+    } else {
+        std::iter::repeat_with(|| seal_key_bytes.to_vec()).take(total).collect()
+    };
+
+    let seal_key = KeyCell::from(seal_key_bytes);
+
+    let mut conn = db.get().await?;
+    let mut shares_iter = shares.into_iter();
+
+    for (operator_id_raw, passphrase_bytes) in ordinary_passphrases {
+        let share = shares_iter
+            .next()
+            .expect("split_key returned enough shares");
+        let (encrypted_share, nonce_bytes, share_salt) = encrypt_share(passphrase_bytes, &share)?;
+
+        diesel::replace_into(schema::operator::table)
+            .values((
+                schema::operator::id.eq(Some(operator_id_raw)),
+                schema::operator::share.eq(&encrypted_share),
+                schema::operator::share_nonce.eq(&nonce_bytes),
+                schema::operator::share_salt.eq(&share_salt),
+                schema::operator::created_at.eq(models::SqliteTimestamp::now()),
+                schema::operator::updated_at.eq(models::SqliteTimestamp::now()),
+            ))
+            .execute(&mut conn)
+            .await?;
+    }
+
+    for (recovery_id_raw, passphrase_bytes) in recovery_passphrases {
+        let share = shares_iter
+            .next()
+            .expect("split_key returned enough shares");
+        let (encrypted_share, nonce_bytes, share_salt) = encrypt_share(passphrase_bytes, &share)?;
+
+        diesel::replace_into(schema::recovery_operator::table)
+            .values((
+                schema::recovery_operator::id.eq(recovery_id_raw),
+                schema::recovery_operator::share.eq(&encrypted_share),
+                schema::recovery_operator::share_nonce.eq(&nonce_bytes),
+                schema::recovery_operator::share_salt.eq(&share_salt),
+                schema::recovery_operator::created_at.eq(models::SqliteTimestamp::now()),
+                schema::recovery_operator::updated_at.eq(models::SqliteTimestamp::now()),
+            ))
+            .execute(&mut conn)
+            .await?;
+    }
+
+    store_threshold(&mut conn, threshold).await?;
+
+    vault.ask(Bootstrap { seal_key }).await.map_err(|err| {
+        error!(?err, "Vault bootstrap failed");
+        Error::VaultError
+    })?;
+
+    Ok(())
+}
+
+/// §3.5: Unseal using any threshold-sized mix of ordinary + recovery shares.
+async fn finalize_unseal(
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    ordinary_passphrases: HashMap<i32, Vec<u8>>,
+    recovery_passphrases: HashMap<i32, Vec<u8>>,
+) -> Result<(), Error> {
+    let mut conn = db.get().await?;
+
+    // Determine whether shares were stored as raw keys (threshold=1) or vsss-rs splits (threshold>=2).
+    let threshold = load_threshold(&mut conn).await?;
+
+    let mut shares: Vec<Vec<u8>> = Vec::new();
+
+    for (operator_id_raw, passphrase_bytes) in ordinary_passphrases {
+        let (encrypted_share, share_nonce_bytes, share_salt): (Vec<u8>, Vec<u8>, Vec<u8>) =
+            schema::operator::table
+                .filter(schema::operator::id.eq(Some(operator_id_raw)))
+                .select((
+                    schema::operator::share,
+                    schema::operator::share_nonce,
+                    schema::operator::share_salt,
+                ))
+                .first(&mut conn)
+                .await
+                .map_err(|_| Error::OperatorNotFound)?;
+
+        shares.push(decrypt_share(
+            passphrase_bytes,
+            encrypted_share,
+            &share_nonce_bytes,
+            &share_salt,
+            operator_id_raw,
+        )?);
+    }
+
+    for (recovery_id_raw, passphrase_bytes) in recovery_passphrases {
+        let (encrypted_share, share_nonce_bytes, share_salt): (Vec<u8>, Vec<u8>, Vec<u8>) =
+            schema::recovery_operator::table
+                .find(recovery_id_raw)
+                .select((
+                    schema::recovery_operator::share,
+                    schema::recovery_operator::share_nonce,
+                    schema::recovery_operator::share_salt,
+                ))
+                .first(&mut conn)
+                .await
+                .map_err(|_| Error::OperatorNotFound)?;
+
+        shares.push(decrypt_share(
+            passphrase_bytes,
+            encrypted_share,
+            &share_nonce_bytes,
+            &share_salt,
+            recovery_id_raw,
+        )?);
+    }
+
+    // When threshold==1, shares are raw 32-byte seal keys (vsss-rs cannot split 1-of-N).
+    // Any single decrypted share is the key itself.
+    let seal_key_bytes: [u8; 32] = if threshold <= 1 {
+        let raw = shares
+            .into_iter()
+            .next()
+            .ok_or_else(|| Error::Shamir("No shares available".into()))?;
+        raw.try_into()
+            .map_err(|_| Error::Shamir("Invalid share length".into()))?
+    } else {
+        shamir::combine_shares(&shares).map_err(|e| Error::Shamir(e.to_string()))?
+    };
+
+    let seal_key = KeyCell::from(seal_key_bytes);
+
+    vault.ask(TryUnseal { seal_key }).await.map_err(|err| {
+        error!(?err, "Vault unseal failed");
+        Error::VaultError
+    })?;
+
+    Ok(())
+}
+
+/// §3.3: Generate a fresh seal key, split across current operators, re-encrypt the vault root key.
+/// Called after `replace_operator` or `trigger_rekey` is approved and all contributors submit.
+async fn finalize_rekey(
+    db: db::DatabasePool,
+    vault: ActorRef<Vault>,
+    ordinary_passphrases: HashMap<i32, Vec<u8>>,
+    recovery_passphrases: HashMap<i32, Vec<u8>>,
+) -> Result<(), Error> {
+    let ordinary_count = ordinary_passphrases.len();
+    let recovery_count = recovery_passphrases.len();
+    let total = ordinary_count + recovery_count;
+    let threshold = shamir_threshold(ordinary_count).ok_or(Error::EmptyCommittee)?;
+
+    let mut new_seal_key_bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut new_seal_key_bytes);
+
+    let shares: Vec<Vec<u8>> = if threshold >= 2 {
+        shamir::split_key(threshold, total, &new_seal_key_bytes, OsRng)
+            .map_err(|e| Error::Shamir(e.to_string()))?
+    } else {
+        std::iter::repeat_with(|| new_seal_key_bytes.to_vec())
+            .take(total)
+            .collect()
+    };
+
+    let mut conn = db.get().await?;
+    let mut shares_iter = shares.into_iter();
+
+    for (operator_id_raw, passphrase_bytes) in ordinary_passphrases {
+        let share = shares_iter
+            .next()
+            .expect("split_key returned enough shares");
+        let (encrypted_share, nonce_bytes, share_salt) = encrypt_share(passphrase_bytes, &share)?;
+
+        diesel::replace_into(schema::operator::table)
+            .values((
+                schema::operator::id.eq(Some(operator_id_raw)),
+                schema::operator::share.eq(&encrypted_share),
+                schema::operator::share_nonce.eq(&nonce_bytes),
+                schema::operator::share_salt.eq(&share_salt),
+                schema::operator::created_at.eq(models::SqliteTimestamp::now()),
+                schema::operator::updated_at.eq(models::SqliteTimestamp::now()),
+            ))
+            .execute(&mut conn)
+            .await?;
+    }
+
+    for (recovery_id_raw, passphrase_bytes) in recovery_passphrases {
+        let share = shares_iter
+            .next()
+            .expect("split_key returned enough shares");
+        let (encrypted_share, nonce_bytes, share_salt) = encrypt_share(passphrase_bytes, &share)?;
+
+        diesel::replace_into(schema::recovery_operator::table)
+            .values((
+                schema::recovery_operator::id.eq(recovery_id_raw),
+                schema::recovery_operator::share.eq(&encrypted_share),
+                schema::recovery_operator::share_nonce.eq(&nonce_bytes),
+                schema::recovery_operator::share_salt.eq(&share_salt),
+                schema::recovery_operator::created_at.eq(models::SqliteTimestamp::now()),
+                schema::recovery_operator::updated_at.eq(models::SqliteTimestamp::now()),
+            ))
+            .execute(&mut conn)
+            .await?;
+    }
+
+    store_threshold(&mut conn, threshold).await?;
+
+    drop(conn);
+
+    let new_seal_key = KeyCell::from(new_seal_key_bytes);
+    vault
+        .ask(RekeyRootKey { new_seal_key })
+        .await
+        .map_err(|err| {
+            error!(?err, "Vault rekey failed");
+            Error::VaultError
+        })?;
+
+    Ok(())
+}
+
+#[messages]
+impl VaultCoordinator {
+    /// Phase 1 of multi-operator bootstrap: declare the committee size.
+    #[message]
+    #[expect(clippy::unused_async, reason = "kameo requires messages to be async")]
+    pub async fn start_bootstrap(
+        &mut self,
+        operator_id: i32,
+        declared_count: usize,
+        recovery_count: usize,
+    ) -> Result<(), Error> {
+        let _ = operator_id; // fixme!: any authenticated operator may announce the committee size. the first call wins
+        if !matches!(self.state, CoordinatorState::Idle) {
+            return Err(Error::AlreadyBootstrapping);
+        }
+        if declared_count == 0 {
+            return Err(Error::EmptyCommittee);
+        }
+        if declared_count == 2 && recovery_count == 0 {
+            return Err(Error::TwoOperatorsRequireRecovery);
+        }
+        self.state = CoordinatorState::Bootstrapping {
+            declared_count,
+            recovery_count,
+            passphrases: HashMap::new(),
+            recovery_passphrases: HashMap::new(),
+        };
+        Ok(())
+    }
+
+    /// Phase 2 of multi-operator bootstrap: ordinary operator contributes a passphrase.
+    /// Returns Ok(true) when all ordinary + recovery operators contributed and bootstrap finalized.
+    #[message]
+    pub async fn contribute_bootstrap(
+        &mut self,
+        operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        let CoordinatorState::Bootstrapping {
+            declared_count,
+            recovery_count,
+            passphrases,
+            recovery_passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotBootstrapping);
+        };
+
+        if passphrases.contains_key(&operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        let passphrase_bytes = passphrase.read().to_vec();
+        passphrases.insert(operator_id, passphrase_bytes);
+
+        if passphrases.len() < *declared_count || recovery_passphrases.len() < *recovery_count {
+            return Ok(false);
+        }
+
+        let CoordinatorState::Bootstrapping {
+            passphrases,
+            recovery_passphrases,
+            ..
+        } = std::mem::replace(&mut self.state, CoordinatorState::Idle)
+        else {
+            unreachable!()
+        };
+
+        finalize_bootstrap(
+            self.db.clone(),
+            self.vault.clone(),
+            passphrases,
+            recovery_passphrases,
+        )
+        .await?;
+        Ok(true)
+    }
+
+    /// Phase 2 of multi-operator bootstrap: recovery operator contributes a passphrase.
+    /// Returns Ok(true) when all contributors are in and bootstrap finalized.
+    #[message]
+    pub async fn contribute_recovery_bootstrap(
+        &mut self,
+        recovery_operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        let CoordinatorState::Bootstrapping {
+            declared_count,
+            recovery_count,
+            passphrases,
+            recovery_passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotBootstrapping);
+        };
+
+        if recovery_passphrases.contains_key(&recovery_operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        let passphrase_bytes = passphrase.read().to_vec();
+        recovery_passphrases.insert(recovery_operator_id, passphrase_bytes);
+
+        if passphrases.len() < *declared_count || recovery_passphrases.len() < *recovery_count {
+            return Ok(false);
+        }
+
+        let CoordinatorState::Bootstrapping {
+            passphrases,
+            recovery_passphrases,
+            ..
+        } = std::mem::replace(&mut self.state, CoordinatorState::Idle)
+        else {
+            unreachable!()
+        };
+
+        finalize_bootstrap(
+            self.db.clone(),
+            self.vault.clone(),
+            passphrases,
+            recovery_passphrases,
+        )
+        .await?;
+        Ok(true)
+    }
+
+    /// Contribute a passphrase for vault unseal (ordinary operator).
+    /// Returns Ok(true) when threshold reached and vault is unsealed.
+    #[message]
+    pub async fn contribute_unseal(
+        &mut self,
+        operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        self.ensure_unsealing_state().await?;
+
+        let CoordinatorState::Unsealing {
+            threshold,
+            ordinary_passphrases,
+            recovery_passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotUnsealing);
+        };
+
+        if ordinary_passphrases.contains_key(&operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        let passphrase_bytes = passphrase.read().to_vec();
+        ordinary_passphrases.insert(operator_id, passphrase_bytes);
+
+        if ordinary_passphrases.len() + recovery_passphrases.len() < *threshold {
+            return Ok(false);
+        }
+
+        self.do_finalize_unseal().await
+    }
+
+    /// Contribute a passphrase for vault unseal (recovery operator, §3.5).
+    /// Recovery operators may contribute during unseal when recovery is active.
+    /// Returns Ok(true) when threshold reached and vault is unsealed.
+    #[message]
+    pub async fn contribute_recovery_unseal(
+        &mut self,
+        recovery_operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        {
+            let mut conn = self.db.get().await?;
+            if !db::recovery::is_active(&mut conn).await? {
+                return Err(Error::RecoveryNotActive);
+            }
+        }
+
+        self.ensure_unsealing_state().await?;
+
+        let CoordinatorState::Unsealing {
+            threshold,
+            ordinary_passphrases,
+            recovery_passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotUnsealing);
+        };
+
+        if recovery_passphrases.contains_key(&recovery_operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        let passphrase_bytes = passphrase.read().to_vec();
+        recovery_passphrases.insert(recovery_operator_id, passphrase_bytes);
+
+        if ordinary_passphrases.len() + recovery_passphrases.len() < *threshold {
+            return Ok(false);
+        }
+
+        self.do_finalize_unseal().await
+    }
+}
+
+impl VaultCoordinator {
+    /// Initializes `CoordinatorState::Unsealing` on first call if still `Idle`.
+    /// Threshold comes from the recorded split parameters (§3.4), not from a live row count.
+    async fn ensure_unsealing_state(&mut self) -> Result<(), Error> {
+        if matches!(self.state, CoordinatorState::Idle) {
+            let mut conn = self.db.get().await?;
+            let threshold = load_threshold(&mut conn).await?;
+            drop(conn);
+            self.state = CoordinatorState::Unsealing {
+                threshold,
+                ordinary_passphrases: HashMap::new(),
+                recovery_passphrases: HashMap::new(),
+            };
+        }
+        Ok(())
+    }
+
+    /// Moves state back to Idle and calls finalize_unseal.
+    async fn do_finalize_unseal(&mut self) -> Result<bool, Error> {
+        let CoordinatorState::Unsealing {
+            ordinary_passphrases,
+            recovery_passphrases,
+            ..
+        } = std::mem::replace(&mut self.state, CoordinatorState::Idle)
+        else {
+            unreachable!()
+        };
+
+        finalize_unseal(
+            self.db.clone(),
+            self.vault.clone(),
+            ordinary_passphrases,
+            recovery_passphrases,
+        )
+        .await?;
+        Ok(true)
+    }
+
+    async fn do_finalize_rekey(&mut self) -> Result<bool, Error> {
+        let CoordinatorState::Rekeying {
+            passphrases,
+            recovery_passphrases,
+            ..
+        } = std::mem::replace(&mut self.state, CoordinatorState::Idle)
+        else {
+            unreachable!()
+        };
+
+        finalize_rekey(
+            self.db.clone(),
+            self.vault.clone(),
+            passphrases,
+            recovery_passphrases,
+        )
+        .await?;
+        Ok(true)
+    }
+}
+
+#[messages]
+impl VaultCoordinator {
+    /// Begin Shamir re-key after a key-rotation proposal is approved (§3.3).
+    /// Queries the current operator and recovery operator counts from the DB,
+    /// then transitions to Rekeying state awaiting contributions from all of them.
+    #[message]
+    pub async fn start_rekey(&mut self) -> Result<(), Error> {
+        self.ensure_idle()?;
+        let mut conn = self.db.get().await?;
+        let ordinary_count: i64 = schema::operator_identity::table
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        let recovery_count: i64 = schema::recovery_operator_identity::table
+            .count()
+            .get_result(&mut conn)
+            .await?;
+        self.state = CoordinatorState::Rekeying {
+            ordinary_count: ordinary_count as usize,
+            recovery_count: recovery_count as usize,
+            passphrases: HashMap::new(),
+            recovery_passphrases: HashMap::new(),
+        };
+        Ok(())
+    }
+
+    /// Contribute an ordinary operator passphrase for the re-key.
+    /// Returns Ok(true) when all contributors have submitted and the re-key is complete.
+    #[message]
+    pub async fn contribute_rekey(
+        &mut self,
+        operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        let CoordinatorState::Rekeying {
+            ordinary_count,
+            recovery_count,
+            passphrases,
+            recovery_passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotRekeying);
+        };
+
+        if passphrases.contains_key(&operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        passphrases.insert(operator_id, passphrase.read().to_vec());
+
+        if passphrases.len() < *ordinary_count || recovery_passphrases.len() < *recovery_count {
+            return Ok(false);
+        }
+
+        self.do_finalize_rekey().await
+    }
+
+    /// Contribute a recovery operator passphrase for the re-key.
+    /// Returns Ok(true) when all contributors have submitted and the re-key is complete.
+    #[message]
+    pub async fn contribute_recovery_rekey(
+        &mut self,
+        recovery_operator_id: i32,
+        mut passphrase: SafeCell<Vec<u8>>,
+    ) -> Result<bool, Error> {
+        let CoordinatorState::Rekeying {
+            ordinary_count,
+            recovery_count,
+            passphrases,
+            recovery_passphrases,
+        } = &mut self.state
+        else {
+            return Err(Error::NotRekeying);
+        };
+
+        if recovery_passphrases.contains_key(&recovery_operator_id) {
+            return Err(Error::DuplicateContribution);
+        }
+
+        recovery_passphrases.insert(recovery_operator_id, passphrase.read().to_vec());
+
+        if passphrases.len() < *ordinary_count || recovery_passphrases.len() < *recovery_count {
+            return Ok(false);
+        }
+
+        self.do_finalize_rekey().await
+    }
+}
+
+impl Message<ProposalApproved> for VaultCoordinator {
+    type Reply = ();
+
+    /// Every subscriber sees every approval and acts only on the kinds it owns.
+    async fn handle(
+        &mut self,
+        msg: ProposalApproved,
+        _ctx: &mut kameo::prelude::Context<Self, Self::Reply>,
+    ) -> Self::Reply {
+        let result = match msg.kind {
+            ProposalKind::ReplaceOperator(settings) => self.replace_operator(&settings).await,
+            ProposalKind::TriggerRekey => self.start_rekey().await,
+            _ => return,
+        };
+
+        if let Err(error) = result {
+            error!(
+                ?error,
+                proposal_id = msg.id.to_raw(),
+                "Failed to execute an approved proposal"
+            );
+        }
+    }
+}
+
+impl VaultCoordinator {
+    /// The coordinator runs one ceremony at a time; anything that starts a new one has to say
+    /// so before it changes any state the ceremony depends on.
+    const fn ensure_idle(&self) -> Result<(), Error> {
+        if matches!(self.state, CoordinatorState::Idle) {
+            Ok(())
+        } else {
+            Err(Error::AlreadyBootstrapping)
+        }
+    }
+
+    /// Replaces the operator's public key in place, keeping their id and history, drops the
+    /// share that key no longer matches, then begins a coordinated re-key (§3.3).
+    async fn replace_operator(
+        &mut self,
+        settings: &replace_operator::Settings,
+    ) -> Result<(), Error> {
+        // Checked before anything is written. The re-key is what gives the replaced operator
+        // a share they can use; if the coordinator is mid-ceremony, `start_rekey` refuses, and
+        // swapping the key and destroying the share first would leave that operator locked
+        // out with no re-key running and nothing to undo it -- the caller only logs the error.
+        self.ensure_idle()?;
+
+        let mut conn = self.db.get().await?;
+
+        diesel::update(schema::operator_identity::table)
+            .filter(schema::operator_identity::id.eq(settings.old_operator_id))
+            .set(schema::operator_identity::public_key.eq(&settings.new_pubkey))
+            .execute(&mut conn)
+            .await?;
+
+        // Drop the stale Shamir share; finalize_rekey stores a fresh one.
+        diesel::delete(schema::operator::table)
+            .filter(schema::operator::id.eq(Some(settings.old_operator_id)))
+            .execute(&mut conn)
+            .await?;
+
+        drop(conn);
+
+        self.start_rekey().await
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{CoordinatorState, Error, VaultCoordinator};
+    use crate::{
+        actors::{GlobalActors, vault::Vault},
+        db::{self, models::OperatorIdentityId, proposal::replace_operator, schema},
+    };
+
+    use diesel::{ExpressionMethods as _, QueryDsl as _, dsl::insert_into};
+    use diesel_async::RunQueryDsl;
+    use kameo::actor::Spawn as _;
+    use std::collections::HashMap;
+
+    /// An approved `ReplaceOperator` that arrives while another ceremony is running must
+    /// change nothing. Swapping the public key and deleting the share are only safe because a
+    /// re-key follows and hands the operator a share for the new key; when `start_rekey`
+    /// refuses, the operator would otherwise be left holding a key with no share, and the
+    /// caller does nothing with the error but log it.
+    #[tokio::test]
+    async fn a_refused_rekey_leaves_the_operator_untouched() {
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let old_key = rand::random::<[u8; 32]>().to_vec();
+        let operator_id: OperatorIdentityId = insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(&old_key))
+            .returning(schema::operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        insert_into(schema::operator::table)
+            .values((
+                schema::operator::id.eq(Some(operator_id)),
+                schema::operator::share.eq(vec![1u8; 32]),
+                schema::operator::share_nonce.eq(vec![2u8; 24]),
+                schema::operator::share_salt.eq(vec![3u8; 32]),
+            ))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        drop(conn);
+
+        let vault = Vault::spawn(
+            Vault::new(pool.clone(), GlobalActors::spawn_message_bus())
+                .await
+                .unwrap(),
+        );
+        let mut coordinator = VaultCoordinator::new(pool.clone(), vault);
+        coordinator.state = CoordinatorState::Rekeying {
+            ordinary_count: 2,
+            recovery_count: 0,
+            passphrases: HashMap::new(),
+            recovery_passphrases: HashMap::new(),
+        };
+
+        let result = coordinator
+            .replace_operator(&replace_operator::Settings {
+                old_operator_id: operator_id,
+                new_pubkey: vec![9u8; 32],
+            })
+            .await;
+        assert!(
+            matches!(result, Err(Error::AlreadyBootstrapping)),
+            "a busy coordinator must refuse the replacement, got {result:?}"
+        );
+
+        let mut conn = pool.get().await.unwrap();
+        let stored_key: Vec<u8> = schema::operator_identity::table
+            .find(operator_id)
+            .select(schema::operator_identity::public_key)
+            .first(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(
+            stored_key, old_key,
+            "the public key must not be swapped when no re-key can follow"
+        );
+
+        let shares: i64 = schema::operator::table
+            .filter(schema::operator::id.eq(Some(operator_id)))
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(shares, 1, "the operator's share must not be destroyed");
+    }
+}
--- a/server/crates/arbiter-server/src/crypto/encryption/v1.rs
+++ b/server/crates/arbiter-server/src/crypto/encryption/v1.rs
@@ -61,12 +61,12 @@ mod tests {
    #[test]
    fn derive_seal_key_deterministic() {
        static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
-        let password2 = SafeCell::new(PASSWORD.to_vec());
+        let mut password = SafeCell::new(PASSWORD.to_vec());
+        let mut password2 = SafeCell::new(PASSWORD.to_vec());
        let salt = generate_salt();

-        let mut key1 = derive_key(password, &salt);
-        let mut key2 = derive_key(password2, &salt);
+        let mut key1 = derive_key(&mut password, &salt);
+        let mut key2 = derive_key(&mut password2, &salt);

        let key1_reader = key1.0.read();
        let key2_reader = key2.0.read();
@@ -77,10 +77,10 @@ mod tests {
    #[test]
    fn successful_derive() {
        static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
+        let mut password = SafeCell::new(PASSWORD.to_vec());
        let salt = generate_salt();

-        let mut key = derive_key(password, &salt);
+        let mut key = derive_key(&mut password, &salt);
        let key_reader = key.0.read();

        assert_ne!(key_reader.as_slice(), &[0u8; 32][..]);
--- a/server/crates/arbiter-server/src/crypto/governance.rs
+++ b/server/crates/arbiter-server/src/crypto/governance.rs
@@ -0,0 +1,99 @@
+//! Canonical encoding and verification of governance vote signatures (§3.3).
+
+use crate::db::models::ProposalId;
+use arbiter_crypto::authn::{self, SigningContext};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
+pub enum VerifyError {
+    #[error("Malformed operator public key")]
+    PublicKey,
+    #[error("Malformed vote signature")]
+    Signature,
+    #[error("Signature does not match this vote")]
+    Mismatch,
+}
+
+/// Canonical bytes an operator signs when voting: `proposal_id` as i64 big-endian,
+/// followed by the approve flag as one byte.
+///
+/// The flag is part of the message on purpose: without it an approval could be
+/// replayed as a rejection of the same proposal.
+#[must_use]
+pub fn vote_message(proposal_id: ProposalId, approve: bool) -> Vec<u8> {
+    let mut message = Vec::with_capacity(9);
+    message.extend_from_slice(&i64::from(proposal_id.to_raw()).to_be_bytes());
+    message.push(u8::from(approve));
+    message
+}
+
+/// Verifies a vote signature against an operator's stored public key.
+pub fn verify_vote(
+    public_key: &[u8],
+    proposal_id: ProposalId,
+    approve: bool,
+    signature: &[u8],
+) -> Result<(), VerifyError> {
+    let public_key = authn::PublicKey::try_from(public_key).map_err(|()| VerifyError::PublicKey)?;
+    let signature = authn::Signature::try_from(signature).map_err(|()| VerifyError::Signature)?;
+
+    if public_key.verify_message(
+        &vote_message(proposal_id, approve),
+        SigningContext::GovernanceVote,
+        &signature,
+    ) {
+        Ok(())
+    } else {
+        Err(VerifyError::Mismatch)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{VerifyError, verify_vote, vote_message};
+    use crate::db::models::ProposalId;
+    use arbiter_crypto::authn::{SigningContext, SigningKey};
+
+    #[test]
+    fn vote_message_is_the_id_then_the_approve_flag() {
+        let message = vote_message(ProposalId::from_raw(0x0102), true);
+        assert_eq!(message, vec![0, 0, 0, 0, 0, 0, 1, 2, 1]);
+    }
+
+    #[test]
+    fn verify_vote_accepts_a_matching_signature() {
+        let key = SigningKey::generate();
+        let id = ProposalId::from_raw(42);
+        let signature = key
+            .sign_message(&vote_message(id, true), SigningContext::GovernanceVote)
+            .unwrap();
+
+        verify_vote(
+            &key.public_key().to_bytes(),
+            id,
+            true,
+            &signature.to_bytes(),
+        )
+        .expect("a signature over this exact vote must verify");
+    }
+
+    /// The decisive one: an approval must not verify as a rejection of the same
+    /// proposal, or a captured vote could be replayed with its meaning flipped.
+    #[test]
+    fn verify_vote_rejects_a_flipped_approve_flag() {
+        let key = SigningKey::generate();
+        let id = ProposalId::from_raw(42);
+        let signature = key
+            .sign_message(&vote_message(id, true), SigningContext::GovernanceVote)
+            .unwrap();
+
+        assert!(matches!(
+            verify_vote(
+                &key.public_key().to_bytes(),
+                id,
+                false,
+                &signature.to_bytes()
+            ),
+            Err(VerifyError::Mismatch)
+        ));
+    }
+}
--- a/server/crates/arbiter-server/src/crypto/integrity/v1.rs
+++ b/server/crates/arbiter-server/src/crypto/integrity/v1.rs
@@ -2,7 +2,7 @@ use crate::{
    actors::vault::{self, GetState, SignIntegrity, Vault, VerifyIntegrity},
    db::{
        self,
-        models::{IntegrityEnvelope, NewIntegrityEnvelope},
+        models::{IntegrityEnvelope, NewIntegrityEnvelope, RootKeyHistoryId},
        schema::integrity_envelope,
    },
 };
@@ -109,11 +109,7 @@ pub async fn sign_entity<E: Integrable>(
    entity: &E,
    entity_id: impl IntoId,
 ) -> Result<(), Error> {
-    let payload_hash = payload_hash(&entity);
-
-    let entity_id = entity_id.into_id();
-
-    let mac_input = build_mac_input(E::KIND, &entity_id, E::VERSION, &payload_hash);
+    let (entity_id, mac_input) = envelope_input::<E>(entity, entity_id);

    let (key_version, mac) =
        vault
@@ -124,6 +120,31 @@ pub async fn sign_entity<E: Integrable>(
                _ => Error::VaultSend,
            })?;

+    store_envelope::<E>(conn, entity_id, key_version, mac)
+        .await
+        .map_err(db::DatabaseError::from)?;
+
+    Ok(())
+}
+
+/// The entity id and the bytes the root key covers, as a pair.
+///
+/// Split out of [`sign_entity`] so the `Vault` actor can build an envelope from inside a
+/// message handler, where asking itself for a signature would deadlock.
+pub fn envelope_input<E: Integrable>(entity: &E, entity_id: impl IntoId) -> (Vec<u8>, Vec<u8>) {
+    let payload_hash = payload_hash(entity);
+    let entity_id = entity_id.into_id();
+    let mac_input = build_mac_input(E::KIND, &entity_id, E::VERSION, &payload_hash);
+    (entity_id, mac_input)
+}
+
+/// Stores the integrity envelope for one entity, replacing any envelope it already has.
+pub async fn store_envelope<E: Integrable>(
+    conn: &mut impl AsyncConnection<Backend = Sqlite>,
+    entity_id: Vec<u8>,
+    key_version: RootKeyHistoryId,
+    mac: Vec<u8>,
+) -> Result<(), diesel::result::Error> {
    insert_into(integrity_envelope::table)
        .values(NewIntegrityEnvelope {
            entity_kind: E::KIND.to_owned(),
@@ -143,8 +164,7 @@ pub async fn sign_entity<E: Integrable>(
            integrity_envelope::mac.eq(mac),
        ))
        .execute(conn)
-        .await
-        .map_err(db::DatabaseError::from)?;
+        .await?;

    Ok(())
 }
@@ -215,8 +235,6 @@ mod tests {
        },
        db::{self, schema},
    };
-    use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-
    use super::{Error, Integrable, sign_entity, verify_entity};
    #[derive(Clone, arbiter_macros::Hashable)]
    struct DummyEntity {
@@ -235,7 +253,7 @@ mod tests {
        );
        actor
            .ask(Bootstrap {
-                seal_key_raw: SafeCell::new(b"integrity-test-seal-key".to_vec()),
+                seal_key: crate::crypto::KeyCell::from([0u8; 32]),
            })
            .await
            .unwrap();
--- a/server/crates/arbiter-server/src/crypto/mod.rs
+++ b/server/crates/arbiter-server/src/crypto/mod.rs
@@ -1,5 +1,5 @@
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
-use encryption::v1::{Nonce, Salt};
+use encryption::v1::Nonce;

 use argon2::{Algorithm, Argon2};
 use chacha20poly1305::{
@@ -12,7 +12,9 @@ use rand::{
 };

 pub mod encryption;
+pub mod governance;
 pub mod integrity;
+pub mod shamir;

 pub struct KeyCell(pub SafeCell<Key>);
 impl From<SafeCell<Key>> for KeyCell {
@@ -20,6 +22,15 @@ impl From<SafeCell<Key>> for KeyCell {
        Self(value)
    }
 }
+impl From<[u8; 32]> for KeyCell {
+    fn from(bytes: [u8; 32]) -> Self {
+        let cell = SafeCell::new_inline_default(|key: &mut Key| {
+            key.copy_from_slice(&bytes);
+        });
+        Self(cell)
+    }
+}
+
 impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {
    type Error = ();

@@ -28,7 +39,7 @@ impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {
        if value.len() != size_of::<Key>() {
            return Err(());
        }
-        let cell = SafeCell::new_inline(|cell_write: &mut Key| {
+        let cell = SafeCell::new_inline_default(|cell_write: &mut Key| {
            cell_write.copy_from_slice(&value);
        });
        Ok(Self(cell))
@@ -37,7 +48,7 @@ impl TryFrom<SafeCell<Vec<u8>>> for KeyCell {

 impl KeyCell {
    pub fn new_secure_random() -> Self {
-        let key = SafeCell::new_inline(|key_buffer: &mut Key| {
+        let key = SafeCell::new_inline_default(|key_buffer: &mut Key| {
            let mut rng = StdRng::try_from_rng(&mut SysRng)
                .expect("Rng failure is unrecoverable and should panic");
            rng.fill_bytes(key_buffer);
@@ -94,7 +105,7 @@ impl KeyCell {
 }

 /// Derive a fixed-length key from the password using Argon2id, which is designed for password hashing and key derivation.
-pub fn derive_key(mut password: SafeCell<Vec<u8>>, salt: &Salt) -> KeyCell {
+pub fn derive_key(password: &mut SafeCell<Vec<u8>>, salt: &[u8]) -> KeyCell {
    let params = {
        #[cfg(debug_assertions)]
        {
@@ -132,10 +143,10 @@ mod tests {
    #[test]
    fn encrypt_decrypt() {
        static PASSWORD: &[u8] = b"password";
-        let password = SafeCell::new(PASSWORD.to_vec());
+        let mut password = SafeCell::new(PASSWORD.to_vec());
        let salt = generate_salt();

-        let mut key = derive_key(password, &salt);
+        let mut key = derive_key(&mut password, &salt);
        let nonce = Nonce(*b"unique nonce 123 1231233"); // 24 bytes for XChaCha20Poly1305
        let associated_data = b"associated data";
        let mut buffer = b"secret data".to_vec();
--- a/server/crates/arbiter-server/src/crypto/shamir.rs
+++ b/server/crates/arbiter-server/src/crypto/shamir.rs
@@ -0,0 +1,60 @@
+use vsss_rs::Gf256;
+
+#[derive(Debug, thiserror::Error)]
+pub enum ShamirError {
+    #[error("Failed to split key: {0}")]
+    Split(String),
+    #[error("Failed to combine shares: {0}")]
+    Combine(String),
+}
+
+/// Split `key` into `total` shares where any `threshold` shares can reconstruct it.
+/// Each returned Vec<u8> is a share with format [`identifier_byte`, `value_bytes`...].
+pub fn split_key(
+    threshold: usize,
+    total: usize,
+    key: &[u8; 32],
+    rng: impl rand_core::RngCore + rand_core::CryptoRng,
+) -> Result<Vec<Vec<u8>>, ShamirError> {
+    Gf256::split_array(threshold, total, key.as_slice(), rng)
+        .map_err(|e| ShamirError::Split(format!("{e:?}")))
+}
+
+/// Returns the minimum number of shares required to reconstruct the secret
+/// for a committee of `n` operators, or `None` for an empty committee.
+#[must_use]
+pub const fn shamir_threshold(n: usize) -> Option<usize> {
+    match n {
+        0 => None,
+        1 => Some(1),
+        2 => Some(2),
+        n => Some(n / 2 + 1),
+    }
+}
+
+/// Reconstruct the secret from `threshold` or more shares.
+pub fn combine_shares(shares: &[Vec<u8>]) -> Result<[u8; 32], ShamirError> {
+    let bytes = Gf256::combine_array(shares)
+        .map_err(|e| ShamirError::Combine(format!("{e:?}")))?;
+    <[u8; 32]>::try_from(bytes.as_slice())
+        .map_err(|_| ShamirError::Combine("unexpected reconstructed key length".to_owned()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::shamir_threshold;
+
+    #[test]
+    fn empty_committee_has_no_threshold() {
+        assert_eq!(shamir_threshold(0), None);
+    }
+
+    #[test]
+    fn threshold_follows_the_ordinary_quorum() {
+        // ARCHITECTURE.md §3.1/§3.4: 1 decides alone, 2 need consensus, N needs N/2 + 1.
+        assert_eq!(shamir_threshold(1), Some(1));
+        assert_eq!(shamir_threshold(2), Some(2));
+        assert_eq!(shamir_threshold(3), Some(2));
+        assert_eq!(shamir_threshold(4), Some(3));
+    }
+}
--- a/server/crates/arbiter-server/src/db/functions.rs
+++ b/server/crates/arbiter-server/src/db/functions.rs
@@ -0,0 +1,12 @@
+//! Typed bindings for the SQLite scalar functions used in Diesel expressions.
+
+use diesel::sql_types::Text;
+
+diesel::define_sql_function! {
+    /// SQLite `unixepoch(modifier)` -- seconds since the Unix epoch.
+    ///
+    /// Declared so timestamp comparisons are built by the query DSL instead of by
+    /// `format!`-ing a SQL fragment: the argument becomes a bind parameter and the
+    /// result type is checked against the column it is compared with.
+    fn unixepoch(modifier: Text) -> Integer;
+}
--- a/server/crates/arbiter-server/src/db/mod.rs
+++ b/server/crates/arbiter-server/src/db/mod.rs
@@ -8,7 +8,10 @@ use diesel_migrations::{EmbeddedMigrations, MigrationHarness, embed_migrations};
 use thiserror::Error;
 use tracing::info;

+pub mod functions;
 pub mod models;
+pub mod proposal;
+pub mod recovery;
 pub mod schema;

 pub type DatabaseConnection = SyncConnectionWrapper<SqliteConnection>;
@@ -56,25 +59,39 @@ fn database_path() -> Result<std::path::PathBuf, DatabaseSetupError> {
    Ok(db_path)
 }

+/// The pragmas `SQLite` scopes to one connection. They are defined once and run on every
+/// connection that reaches the database -- the migration connection below and each pooled
+/// connection in `create_pool` -- because a value set on one connection is invisible to the
+/// next, and every real write happens on a pooled one.
+const CONNECTION_PRAGMAS: &str = "
+    -- sleep if the database is busy; this corresponds to up to 9 seconds sleeping time.
+    -- see https://fractaledmind.github.io/2023/09/07/enhancing-rails-sqlite-fine-tuning/
+    PRAGMA busy_timeout = 9000;
+    -- fsync only in critical moments
+    PRAGMA synchronous = NORMAL;
+    -- write WAL changes back every 1000 pages, for an in average 1MB WAL file.
+    -- May affect readers if number is increased
+    PRAGMA wal_autocheckpoint = 1000;
+    -- sqlite foreign keys are disabled by default, enable them for safety
+    PRAGMA foreign_keys = ON;
+    -- overwrite freed pages instead of leaving encrypted shares, nonces and salts
+    -- readable in the file
+    PRAGMA secure_delete = ON;
+";
+
 #[tracing::instrument(level = "info", skip(conn))]
 fn db_config(conn: &mut SqliteConnection) -> Result<(), diesel::result::Error> {
-    // fsync only in critical moments
-    conn.batch_execute("PRAGMA synchronous = NORMAL;")?;
-    // write WAL changes back every 1000 pages, for an in average 1MB WAL file.
-    // May affect readers if number is increased
-    conn.batch_execute("PRAGMA wal_autocheckpoint = 1000;")?;
+    conn.batch_execute(CONNECTION_PRAGMAS)?;
+
+    // The rest belong to the database file rather than the connection, so the one-shot
+    // migration connection is the right and only place for them.
+
    // free some space by truncating possibly massive WAL files from the last run
    conn.batch_execute("PRAGMA wal_checkpoint(TRUNCATE);")?;

-    // sqlite foreign keys are disabled by default, enable them for safety
-    conn.batch_execute("PRAGMA foreign_keys = ON;")?;
-
    // better space reclamation
    conn.batch_execute("PRAGMA auto_vacuum = FULL;")?;

-    // secure delete, overwrite deleted content with zeros to prevent recovery
-    conn.batch_execute("PRAGMA secure_delete = ON;")?;
-
    Ok(())
 }

@@ -98,12 +115,17 @@ fn initialize_database(url: &str) -> Result<(), DatabaseSetupError> {
 /// # Panics
 /// Panics if the database path is not valid UTF-8.
 pub async fn create_pool(url: Option<&str>) -> Result<DatabasePool, DatabaseSetupError> {
-    let database_url = url.map(String::from).unwrap_or(
-        database_path()?
+    // Matched rather than `unwrap_or`, whose argument is evaluated even when `url` is `Some`:
+    // `database_path` resolves the real home directory and creates `~/.arbiter` as a side
+    // effect, so an eager call reaches the developer's home from every test that passes an
+    // explicit temp path, and fails outright wherever no home directory is writable.
+    let database_url = match url {
+        Some(url) => url.to_owned(),
+        None => database_path()?
            .to_str()
            .expect("database path is not valid UTF-8")
            .to_owned(),
-    );
+    };

    initialize_database(&database_url)?;

@@ -112,13 +134,13 @@ pub async fn create_pool(url: Option<&str>) -> Result<DatabasePool, DatabaseSetu
        Box::pin(async move {
            let mut conn = DatabaseConnection::establish(url).await?;

-            // see https://fractaledmind.github.io/2023/09/07/enhancing-rails-sqlite-fine-tuning/
-            // sleep if the database is busy, this corresponds to up to 9 seconds sleeping time.
-            conn.batch_execute("PRAGMA busy_timeout = 9000;")
+            // better write-concurrency; a property of the file, but harmless to reassert
+            conn.batch_execute("PRAGMA journal_mode = WAL;")
                .await
                .map_err(diesel::ConnectionError::CouldntSetupConfiguration)?;
-            // better write-concurrency
-            conn.batch_execute("PRAGMA journal_mode = WAL;")
+            // The migration connection setting these is not enough: SQLite scopes them to
+            // one connection, and every real query runs on a pooled one.
+            conn.batch_execute(CONNECTION_PRAGMAS)
                .await
                .map_err(diesel::ConnectionError::CouldntSetupConfiguration)?;

@@ -154,3 +176,83 @@ pub async fn create_test_pool() -> DatabasePool {
        .await
        .expect("Failed to create test database pool")
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use diesel::{
+        ExpressionMethods as _,
+        dsl::insert_into,
+        result::{DatabaseErrorKind, Error as DieselError},
+    };
+    use diesel_async::RunQueryDsl;
+
+    /// `operator.id` references `operator_identity(id)`. Without `PRAGMA foreign_keys = ON`
+    /// on the pooled connection, SQLite accepts a share row for an operator that does not exist.
+    #[tokio::test]
+    async fn pooled_connections_enforce_foreign_keys() {
+        let pool = create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let result = insert_into(schema::operator::table)
+            .values((
+                schema::operator::id.eq(4242),
+                schema::operator::share.eq(vec![0u8; 32]),
+                schema::operator::share_nonce.eq(vec![0u8; 24]),
+                schema::operator::share_salt.eq(vec![0u8; 32]),
+            ))
+            .execute(&mut conn)
+            .await;
+
+        // Specifically a foreign-key violation, not any error: a `NOT NULL` failure or a
+        // renamed column would also make `result.is_err()` true without proving the pragma
+        // is what rejected the insert.
+        assert!(
+            matches!(
+                result,
+                Err(DieselError::DatabaseError(
+                    DatabaseErrorKind::ForeignKeyViolation,
+                    _
+                ))
+            ),
+            "expected a foreign-key violation for a dangling operator_identity reference, got {result:?}"
+        );
+    }
+
+    #[derive(diesel::QueryableByName)]
+    struct PragmaValue {
+        #[diesel(sql_type = diesel::sql_types::Integer)]
+        value: i32,
+    }
+
+    async fn pragma(conn: &mut DatabaseConnection, name: &str) -> i32 {
+        diesel::sql_query(format!("select {name} as value from pragma_{name}()"))
+            .get_result::<PragmaValue>(conn)
+            .await
+            .unwrap()
+            .value
+    }
+
+    /// `foreign_keys` had to be repeated on the pooled connection because `SQLite` scopes it
+    /// there; its siblings in `CONNECTION_PRAGMAS` are scoped the same way and were being
+    /// left behind on the migration connection. `secure_delete` is the one that matters in a
+    /// key-custody database: off by default, it leaves freed pages holding encrypted shares,
+    /// nonces and salts readable in the file.
+    #[tokio::test]
+    async fn pooled_connections_carry_the_shared_pragmas() {
+        let pool = create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        assert_eq!(
+            pragma(&mut conn, "secure_delete").await,
+            1,
+            "freed pages must be overwritten on the connection that does the writing"
+        );
+        assert_eq!(
+            pragma(&mut conn, "synchronous").await,
+            1,
+            "synchronous must be NORMAL (1), not the default FULL (2)"
+        );
+        assert_eq!(pragma(&mut conn, "foreign_keys").await, 1);
+    }
+}
--- a/server/crates/arbiter-server/src/db/models.rs
+++ b/server/crates/arbiter-server/src/db/models.rs
@@ -9,16 +9,18 @@ use crate::db::schema::{
    integrity_envelope, root_key_history, tls_history,
 };

+use crate::db::proposal::ProposalKindTag;
 use diesel::{prelude::*, sqlite::Sqlite};
 use restructed::Models;

 pub mod types {
    use chrono::{DateTime, Utc};
    use diesel::{
+        backend::Backend,
        deserialize::{FromSql, FromSqlRow},
        expression::AsExpression,
        serialize::{IsNull, ToSql},
-        sql_types::Integer,
+        sql_types::{Integer, Text},
        sqlite::{Sqlite, SqliteType},
    };

@@ -61,7 +63,7 @@ pub mod types {

    impl FromSql<Integer, Sqlite> for SqliteTimestamp {
        fn from_sql(
-            mut bytes: <Sqlite as diesel::backend::Backend>::RawValue<'_>,
+            mut bytes: <Sqlite as Backend>::RawValue<'_>,
        ) -> diesel::deserialize::Result<Self> {
            let Some(SqliteType::Long) = bytes.value_type() else {
                return Err(format!(
@@ -141,6 +143,42 @@ pub mod types {
    declare_id!(TlsHistoryId);
    declare_id!(EvmWalletId);
    declare_id!(ClientId);
+    declare_id!(ProposalId);
+    declare_id!(RecoveryOperatorIdentityId);
+
+    #[derive(Debug, Clone, PartialEq, Eq, AsExpression, FromSqlRow)]
+    #[diesel(sql_type = Text)]
+    pub enum ProposalStatus {
+        Pending,
+        Approved,
+        Rejected,
+    }
+
+    impl ToSql<Text, Sqlite> for ProposalStatus {
+        fn to_sql<'b>(
+            &'b self,
+            out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
+        ) -> diesel::serialize::Result {
+            let s: &str = match self {
+                Self::Pending => "pending",
+                Self::Approved => "approved",
+                Self::Rejected => "rejected",
+            };
+            <str as ToSql<Text, Sqlite>>::to_sql(s, out)
+        }
+    }
+
+    impl FromSql<Text, Sqlite> for ProposalStatus {
+        fn from_sql(bytes: <Sqlite as Backend>::RawValue<'_>) -> diesel::deserialize::Result<Self> {
+            let s = <String as FromSql<Text, Sqlite>>::from_sql(bytes)?;
+            match s.as_str() {
+                "pending" => Ok(Self::Pending),
+                "approved" => Ok(Self::Approved),
+                "rejected" => Ok(Self::Rejected),
+                other => Err(format!("Unknown proposal status: {other}").into()),
+            }
+        }
+    }
 }
 pub use types::*;

@@ -225,19 +263,22 @@ pub struct EvmWallet {
 #[view(
    NewEvmWalletAccess,
    derive(Insertable),
-    omit(id, created_at),
+    omit(id, created_at, revoked_at),
    attributes_with = "deriveless"
 )]
 #[view(
    CoreEvmWalletAccess,
    derive(Insertable),
-    omit(created_at),
+    omit(created_at, revoked_at),
    attributes_with = "deriveless"
 )]
 pub struct EvmWalletAccess {
    pub id: i32,
    pub wallet_id: EvmWalletId,
    pub client_id: i32,
+    // Grants, transaction logs, and persistent-grant proposals reference this row
+    // `on delete restrict`, so revocation cannot delete it -- it marks it revoked instead.
+    pub revoked_at: Option<SqliteTimestamp>,
    pub created_at: SqliteTimestamp,
 }

@@ -285,6 +326,7 @@ pub struct Operator {
    pub id: OperatorId,
    pub share: Vec<u8>,
    pub share_nonce: Vec<u8>,
+    pub share_salt: Vec<u8>,
    pub created_at: SqliteTimestamp,
    pub updated_at: SqliteTimestamp,
 }
@@ -437,3 +479,58 @@ pub struct IntegrityEnvelope {
    pub signed_at: SqliteTimestamp,
    pub created_at: SqliteTimestamp,
 }
+
+#[derive(Debug, Queryable, Selectable, Identifiable)]
+#[diesel(table_name = schema::proposal, check_for_backend(Sqlite))]
+pub struct Proposal {
+    pub id: ProposalId,
+    pub kind: ProposalKindTag,
+    pub initiator_id: OperatorIdentityId,
+    pub created_at: SqliteTimestamp,
+    pub expires_at: SqliteTimestamp,
+    pub status: ProposalStatus,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = schema::proposal, check_for_backend(Sqlite))]
+pub struct NewProposal {
+    pub kind: ProposalKindTag,
+    pub initiator_id: OperatorIdentityId,
+    // status defaults to 'pending' at the DB layer
+    pub expires_at: SqliteTimestamp,
+}
+
+#[derive(Debug, Queryable, Selectable, Identifiable)]
+#[diesel(table_name = schema::proposal_vote, check_for_backend(Sqlite))]
+pub struct ProposalVote {
+    pub id: i32,
+    pub proposal_id: ProposalId,
+    pub operator_id: OperatorIdentityId,
+    pub approve: bool,
+    pub signature: Vec<u8>,
+    pub voted_at: SqliteTimestamp,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = schema::proposal_vote, check_for_backend(Sqlite))]
+pub struct NewProposalVote {
+    pub proposal_id: ProposalId,
+    pub operator_id: OperatorIdentityId,
+    pub approve: bool,
+    pub signature: Vec<u8>,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = schema::recovery_proposal_vote, check_for_backend(Sqlite))]
+pub struct NewRecoveryProposalVote {
+    pub proposal_id: ProposalId,
+    pub recovery_operator_id: RecoveryOperatorIdentityId,
+    pub approve: bool,
+    pub signature: Vec<u8>,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = schema::recovery_wakeup_request, check_for_backend(Sqlite))]
+pub struct NewRecoveryWakeupRequest {
+    pub requested_by: OperatorIdentityId,
+}
--- a/server/crates/arbiter-server/src/db/proposal/approve_sdk_client.rs
+++ b/server/crates/arbiter-server/src/db/proposal/approve_sdk_client.rs
@@ -0,0 +1,48 @@
+//! Approving an SDK client so it may authenticate against the vault.
+
+use super::{Proposal, ProposalKindTag};
+use crate::db::{
+    DatabaseConnection, models::ProposalId, schema::proposal_approve_sdk_client as table,
+};
+use diesel::{
+    ExpressionMethods as _, Insertable, QueryDsl as _, QueryResult, Queryable, Selectable,
+    SelectableHelper as _, sqlite::Sqlite,
+};
+use diesel_async::RunQueryDsl as _;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Queryable, Selectable, Insertable)]
+#[diesel(table_name = table, check_for_backend(Sqlite))]
+pub struct Settings {
+    pub client_id: i32,
+}
+
+pub struct ApproveSdkClient;
+
+impl Proposal for ApproveSdkClient {
+    const KIND: ProposalKindTag = ProposalKindTag::ApproveSdkClient;
+
+    type Settings = Settings;
+
+    async fn insert(
+        proposal_id: ProposalId,
+        settings: &Self::Settings,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<()> {
+        diesel::insert_into(table::table)
+            .values((table::proposal_id.eq(proposal_id), settings))
+            .execute(conn)
+            .await
+            .map(drop)
+    }
+
+    async fn load(
+        proposal_id: ProposalId,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<Self::Settings> {
+        table::table
+            .find(proposal_id)
+            .select(Settings::as_select())
+            .first(conn)
+            .await
+    }
+}
--- a/server/crates/arbiter-server/src/db/proposal/grant_wallet_access.rs
+++ b/server/crates/arbiter-server/src/db/proposal/grant_wallet_access.rs
@@ -0,0 +1,49 @@
+//! Granting an SDK client visibility of a wallet.
+
+use super::{Proposal, ProposalKindTag};
+use crate::db::{
+    DatabaseConnection, models::ProposalId, schema::proposal_grant_wallet_access as table,
+};
+use diesel::{
+    ExpressionMethods as _, Insertable, QueryDsl as _, QueryResult, Queryable, Selectable,
+    SelectableHelper as _, sqlite::Sqlite,
+};
+use diesel_async::RunQueryDsl as _;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Queryable, Selectable, Insertable)]
+#[diesel(table_name = table, check_for_backend(Sqlite))]
+pub struct Settings {
+    pub wallet_id: i32,
+    pub client_id: i32,
+}
+
+pub struct GrantWalletAccess;
+
+impl Proposal for GrantWalletAccess {
+    const KIND: ProposalKindTag = ProposalKindTag::GrantWalletAccess;
+
+    type Settings = Settings;
+
+    async fn insert(
+        proposal_id: ProposalId,
+        settings: &Self::Settings,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<()> {
+        diesel::insert_into(table::table)
+            .values((table::proposal_id.eq(proposal_id), settings))
+            .execute(conn)
+            .await
+            .map(drop)
+    }
+
+    async fn load(
+        proposal_id: ProposalId,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<Self::Settings> {
+        table::table
+            .find(proposal_id)
+            .select(Settings::as_select())
+            .first(conn)
+            .await
+    }
+}
--- a/server/crates/arbiter-server/src/db/proposal/mod.rs
+++ b/server/crates/arbiter-server/src/db/proposal/mod.rs
@@ -0,0 +1,249 @@
+//! Governed actions and the parameters they carry.
+//!
+//! Laid out the way [`crate::evm::policies::Policy`] is: a unit type per kind, its
+//! parameters as an associated `Settings`, and the persistence for those parameters
+//! implemented next to them. Everything downstream is generic over [`Proposal`], so a
+//! new kind is a new module plus one arm in each dispatcher -- nothing else in the
+//! codebase has to learn about it.
+
+use crate::db::{DatabaseConnection, models::ProposalId};
+use diesel::{
+    QueryResult,
+    backend::Backend,
+    deserialize::{FromSql, FromSqlRow},
+    expression::AsExpression,
+    serialize::ToSql,
+    sql_types::Text,
+    sqlite::Sqlite,
+};
+use strum::{Display, EnumDiscriminants, EnumString, IntoStaticStr};
+
+pub mod approve_sdk_client;
+pub mod grant_wallet_access;
+pub mod one_off_transaction;
+pub mod persistent_grant;
+pub mod replace_operator;
+pub mod trigger_rekey;
+
+pub use approve_sdk_client::ApproveSdkClient;
+pub use grant_wallet_access::GrantWalletAccess;
+pub use one_off_transaction::OneOffTransaction;
+pub use persistent_grant::PersistentGrant;
+pub use replace_operator::ReplaceOperator;
+pub use trigger_rekey::TriggerRekey;
+
+/// A governed action that owns the child table holding its parameters.
+pub trait Proposal: Sized {
+    /// The value stored in `proposal.kind` for this action.
+    const KIND: ProposalKindTag;
+
+    /// Parameters the action is voted on with.
+    type Settings: Send + Sync + 'static;
+
+    /// Writes the child row carrying `settings`.
+    fn insert(
+        proposal_id: ProposalId,
+        settings: &Self::Settings,
+        conn: &mut DatabaseConnection,
+    ) -> impl Future<Output = QueryResult<()>> + Send;
+
+    /// Reads the child row back. A missing row surfaces as [`diesel::result::Error::NotFound`],
+    /// which is what a proposal without its parameters is.
+    fn load(
+        proposal_id: ProposalId,
+        conn: &mut DatabaseConnection,
+    ) -> impl Future<Output = QueryResult<Self::Settings>> + Send;
+}
+
+/// Parameters of a proposal, in the one shape that can cross the actor boundary.
+///
+/// Every variant holds the `Settings` of the matching [`Proposal`] implementation, so
+/// the two cannot drift.
+#[derive(Debug, Clone, EnumDiscriminants)]
+#[strum_discriminants(
+    name(ProposalKindTag),
+    vis(pub),
+    derive(Display, EnumString, IntoStaticStr, AsExpression, FromSqlRow),
+    diesel(sql_type = Text),
+    strum(serialize_all = "snake_case")
+)]
+pub enum ProposalKind {
+    ApproveSdkClient(approve_sdk_client::Settings),
+    GrantWalletAccess(grant_wallet_access::Settings),
+    ReplaceOperator(replace_operator::Settings),
+    TriggerRekey,
+    ApprovePersistentGrant(Box<persistent_grant::Settings>),
+    ApproveOneOffTransaction(Box<one_off_transaction::Settings>),
+}
+
+impl ProposalKindTag {
+    /// Key-rotation proposals require every operator to approve (§3.3).
+    #[must_use]
+    pub const fn requires_full_quorum(self) -> bool {
+        matches!(self, Self::ReplaceOperator | Self::TriggerRekey)
+    }
+
+    /// §3.5: recovery operators weigh in on operator replacement and nothing else.
+    #[must_use]
+    pub const fn recovery_may_vote(self) -> bool {
+        matches!(self, Self::ReplaceOperator)
+    }
+}
+
+/// Pins every implementation to the variant it is dispatched from. Without this a
+/// mistyped `KIND` would compile and only show up as a proposal stored under the
+/// wrong `proposal.kind`.
+const _: () = {
+    assert!(
+        matches!(ApproveSdkClient::KIND, ProposalKindTag::ApproveSdkClient),
+        "ApproveSdkClient::KIND must be ProposalKindTag::ApproveSdkClient"
+    );
+    assert!(
+        matches!(GrantWalletAccess::KIND, ProposalKindTag::GrantWalletAccess),
+        "GrantWalletAccess::KIND must be ProposalKindTag::GrantWalletAccess"
+    );
+    assert!(
+        matches!(ReplaceOperator::KIND, ProposalKindTag::ReplaceOperator),
+        "ReplaceOperator::KIND must be ProposalKindTag::ReplaceOperator"
+    );
+    assert!(
+        matches!(TriggerRekey::KIND, ProposalKindTag::TriggerRekey),
+        "TriggerRekey::KIND must be ProposalKindTag::TriggerRekey"
+    );
+    assert!(
+        matches!(
+            PersistentGrant::KIND,
+            ProposalKindTag::ApprovePersistentGrant
+        ),
+        "PersistentGrant::KIND must be ProposalKindTag::ApprovePersistentGrant"
+    );
+    assert!(
+        matches!(
+            OneOffTransaction::KIND,
+            ProposalKindTag::ApproveOneOffTransaction
+        ),
+        "OneOffTransaction::KIND must be ProposalKindTag::ApproveOneOffTransaction"
+    );
+};
+
+/// Writes the child row carrying this proposal's parameters.
+///
+/// The only place the create path has to know every kind; each arm hands straight off
+/// to the implementation that owns the table.
+pub async fn insert_kind(
+    conn: &mut DatabaseConnection,
+    proposal_id: ProposalId,
+    kind: &ProposalKind,
+) -> QueryResult<()> {
+    match kind {
+        ProposalKind::ApproveSdkClient(s) => ApproveSdkClient::insert(proposal_id, s, conn).await,
+        ProposalKind::GrantWalletAccess(s) => GrantWalletAccess::insert(proposal_id, s, conn).await,
+        ProposalKind::ReplaceOperator(s) => ReplaceOperator::insert(proposal_id, s, conn).await,
+        ProposalKind::TriggerRekey => TriggerRekey::insert(proposal_id, &(), conn).await,
+        ProposalKind::ApprovePersistentGrant(s) => {
+            PersistentGrant::insert(proposal_id, s, conn).await
+        }
+        ProposalKind::ApproveOneOffTransaction(s) => {
+            OneOffTransaction::insert(proposal_id, s, conn).await
+        }
+    }
+}
+
+/// Reads the parameters back for a `proposal.kind` that is only known at runtime.
+pub async fn load_kind(
+    conn: &mut DatabaseConnection,
+    proposal_id: ProposalId,
+    tag: ProposalKindTag,
+) -> QueryResult<ProposalKind> {
+    Ok(match tag {
+        ProposalKindTag::ApproveSdkClient => {
+            ProposalKind::ApproveSdkClient(ApproveSdkClient::load(proposal_id, conn).await?)
+        }
+        ProposalKindTag::GrantWalletAccess => {
+            ProposalKind::GrantWalletAccess(GrantWalletAccess::load(proposal_id, conn).await?)
+        }
+        ProposalKindTag::ReplaceOperator => {
+            ProposalKind::ReplaceOperator(ReplaceOperator::load(proposal_id, conn).await?)
+        }
+        ProposalKindTag::TriggerRekey => {
+            TriggerRekey::load(proposal_id, conn).await?;
+            ProposalKind::TriggerRekey
+        }
+        ProposalKindTag::ApprovePersistentGrant => ProposalKind::ApprovePersistentGrant(Box::new(
+            PersistentGrant::load(proposal_id, conn).await?,
+        )),
+        ProposalKindTag::ApproveOneOffTransaction => ProposalKind::ApproveOneOffTransaction(
+            Box::new(OneOffTransaction::load(proposal_id, conn).await?),
+        ),
+    })
+}
+
+impl ToSql<Text, Sqlite> for ProposalKindTag {
+    fn to_sql<'b>(
+        &'b self,
+        out: &mut diesel::serialize::Output<'b, '_, Sqlite>,
+    ) -> diesel::serialize::Result {
+        <str as ToSql<Text, Sqlite>>::to_sql(<&'static str>::from(*self), out)
+    }
+}
+
+impl FromSql<Text, Sqlite> for ProposalKindTag {
+    fn from_sql(bytes: <Sqlite as Backend>::RawValue<'_>) -> diesel::deserialize::Result<Self> {
+        let s = <String as FromSql<Text, Sqlite>>::from_sql(bytes)?;
+        s.parse()
+            .map_err(|_| format!("Unknown proposal kind: {s}").into())
+    }
+}
+
+/// SQLite has no unsigned integers; the column is `BigInt`, so a value that does not
+/// round-trip is a corrupt row rather than something to silently wrap.
+pub(crate) fn as_i64(value: u64) -> QueryResult<i64> {
+    i64::try_from(value).map_err(|_| diesel::result::Error::SerializationError(Box::new(Overflow)))
+}
+
+pub(crate) fn as_u64(value: i64) -> QueryResult<u64> {
+    u64::try_from(value)
+        .map_err(|_| diesel::result::Error::DeserializationError(Box::new(Overflow)))
+}
+
+pub(crate) fn fixed_bytes<const N: usize>(
+    bytes: &[u8],
+    column: &'static str,
+) -> QueryResult<[u8; N]> {
+    <[u8; N]>::try_from(bytes)
+        .map_err(|_| diesel::result::Error::DeserializationError(Box::new(WrongLength(column))))
+}
+
+/// Reads a fixed-width column into an array, labelling failures with the column it came
+/// from.
+///
+/// The label is taken from the field itself, so renaming a column cannot leave a stale
+/// name behind in the error -- which is the whole reason this is a macro and not a
+/// second argument.
+///
+/// - `fixed!(row.column)` for a `Vec<u8>` field
+/// - `fixed!(opt row.column)` for a `Option<Vec<u8>>` one
+/// - `fixed!(binding)` for a local
+macro_rules! fixed {
+    (opt $src:ident.$field:ident) => {
+        $src.$field
+            .as_deref()
+            .map(|value| $crate::db::proposal::fixed_bytes(value, stringify!($field)))
+            .transpose()
+    };
+    ($src:ident.$field:ident) => {
+        $crate::db::proposal::fixed_bytes(&$src.$field, stringify!($field))
+    };
+    ($binding:ident) => {
+        $crate::db::proposal::fixed_bytes(&$binding, stringify!($binding))
+    };
+}
+pub(crate) use fixed;
+
+#[derive(Debug, thiserror::Error)]
+#[error("value does not fit a SQLite integer")]
+struct Overflow;
+
+#[derive(Debug, thiserror::Error)]
+#[error("column {0} has the wrong byte length")]
+struct WrongLength(&'static str);
--- a/server/crates/arbiter-server/src/db/proposal/one_off_transaction.rs
+++ b/server/crates/arbiter-server/src/db/proposal/one_off_transaction.rs
@@ -0,0 +1,138 @@
+//! Signing a single EIP-1559 transaction.
+
+use super::{Proposal, ProposalKindTag, as_i64, as_u64, fixed};
+use crate::db::{
+    DatabaseConnection,
+    models::ProposalId,
+    schema::{proposal_one_off_transaction, proposal_one_off_transaction_result},
+};
+use diesel::{
+    Insertable, QueryDsl as _, QueryResult, Queryable, Selectable, SelectableHelper as _,
+    sqlite::Sqlite,
+};
+use diesel_async::RunQueryDsl as _;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Settings {
+    pub client_id: i32,
+    pub wallet_address: [u8; 20],
+    pub chain_id: u64,
+    pub nonce: u64,
+    pub gas_limit: u64,
+    pub max_fee_per_gas: u128,
+    pub max_priority_fee_per_gas: u128,
+    pub to: [u8; 20],
+    pub value: [u8; 32],
+    pub input: Vec<u8>,
+}
+
+#[derive(Debug, Queryable, Selectable, Insertable)]
+#[diesel(table_name = proposal_one_off_transaction, check_for_backend(Sqlite))]
+struct Row {
+    proposal_id: ProposalId,
+    client_id: i32,
+    wallet_address: Vec<u8>,
+    chain_id: i64,
+    nonce: i64,
+    gas_limit: i64,
+    max_fee_per_gas: Vec<u8>,
+    max_priority_fee_per_gas: Vec<u8>,
+    to_address: Vec<u8>,
+    value: Vec<u8>,
+    input: Vec<u8>,
+}
+
+impl Row {
+    fn new(proposal_id: ProposalId, settings: &Settings) -> QueryResult<Self> {
+        Ok(Self {
+            proposal_id,
+            client_id: settings.client_id,
+            wallet_address: settings.wallet_address.to_vec(),
+            chain_id: as_i64(settings.chain_id)?,
+            nonce: as_i64(settings.nonce)?,
+            gas_limit: as_i64(settings.gas_limit)?,
+            max_fee_per_gas: settings.max_fee_per_gas.to_be_bytes().to_vec(),
+            max_priority_fee_per_gas: settings.max_priority_fee_per_gas.to_be_bytes().to_vec(),
+            to_address: settings.to.to_vec(),
+            value: settings.value.to_vec(),
+            input: settings.input.clone(),
+        })
+    }
+
+    fn into_settings(self) -> QueryResult<Settings> {
+        Ok(Settings {
+            client_id: self.client_id,
+            wallet_address: fixed!(self.wallet_address)?,
+            chain_id: as_u64(self.chain_id)?,
+            nonce: as_u64(self.nonce)?,
+            gas_limit: as_u64(self.gas_limit)?,
+            max_fee_per_gas: u128::from_be_bytes(fixed!(self.max_fee_per_gas)?),
+            max_priority_fee_per_gas: u128::from_be_bytes(fixed!(self.max_priority_fee_per_gas)?),
+            to: fixed!(self.to_address)?,
+            value: fixed!(self.value)?,
+            input: self.input,
+        })
+    }
+}
+
+pub struct OneOffTransaction;
+
+impl Proposal for OneOffTransaction {
+    const KIND: ProposalKindTag = ProposalKindTag::ApproveOneOffTransaction;
+
+    type Settings = Settings;
+
+    async fn insert(
+        proposal_id: ProposalId,
+        settings: &Self::Settings,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<()> {
+        diesel::insert_into(proposal_one_off_transaction::table)
+            .values(&Row::new(proposal_id, settings)?)
+            .execute(conn)
+            .await
+            .map(drop)
+    }
+
+    async fn load(
+        proposal_id: ProposalId,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<Self::Settings> {
+        let row: Row = proposal_one_off_transaction::table
+            .find(proposal_id)
+            .select(Row::as_select())
+            .first(conn)
+            .await?;
+
+        row.into_settings()
+    }
+}
+
+/// The signature the vault produced for an approved transaction.
+#[derive(Debug, Insertable)]
+#[diesel(table_name = proposal_one_off_transaction_result, check_for_backend(Sqlite))]
+struct SignatureRow {
+    proposal_id: ProposalId,
+    r: Vec<u8>,
+    s: Vec<u8>,
+    y_parity: i32,
+}
+
+/// Records the signature produced for an approved transaction, by component, so what
+/// came back is as readable as what was signed.
+pub async fn store_signature(
+    proposal_id: ProposalId,
+    signature: &alloy::signers::Signature,
+    conn: &mut DatabaseConnection,
+) -> QueryResult<()> {
+    diesel::insert_into(proposal_one_off_transaction_result::table)
+        .values(&SignatureRow {
+            proposal_id,
+            r: signature.r().to_be_bytes::<32>().to_vec(),
+            s: signature.s().to_be_bytes::<32>().to_vec(),
+            y_parity: i32::from(signature.v()),
+        })
+        .execute(conn)
+        .await
+        .map(drop)
+}
--- a/server/crates/arbiter-server/src/db/proposal/persistent_grant.rs
+++ b/server/crates/arbiter-server/src/db/proposal/persistent_grant.rs
@@ -0,0 +1,271 @@
+//! Creating a standing EVM grant.
+use super::{Proposal, ProposalKindTag, as_i64, as_u64, fixed};
+use crate::db::{
+    DatabaseConnection,
+    models::ProposalId,
+    schema::{
+        proposal_persistent_grant, proposal_persistent_grant_ether,
+        proposal_persistent_grant_ether_target, proposal_persistent_grant_token,
+        proposal_persistent_grant_token_limit,
+    },
+};
+use diesel::{
+    ExpressionMethods as _, Insertable, OptionalExtension as _, QueryDsl as _, QueryResult,
+    Queryable, Selectable, SelectableHelper as _, sqlite::Sqlite,
+};
+use diesel_async::RunQueryDsl as _;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Settings {
+    pub wallet_access_id: i32,
+    pub chain_id: u64,
+    pub valid_from_secs: Option<i64>,
+    pub valid_until_secs: Option<i64>,
+    pub max_gas_fee_per_gas: Option<[u8; 32]>,
+    pub max_priority_fee_per_gas: Option<[u8; 32]>,
+    pub rate_limit: Option<RateLimit>,
+    pub specific: Specific,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct RateLimit {
+    pub count: u32,
+    pub window_secs: i64,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct VolumeLimit {
+    pub max_volume: [u8; 32],
+    pub window_secs: i64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Specific {
+    EtherTransfer {
+        targets: Vec<[u8; 20]>,
+        limit: VolumeLimit,
+    },
+    TokenTransfer {
+        token_contract: [u8; 20],
+        receiver: Option<[u8; 20]>,
+        volume_limits: Vec<VolumeLimit>,
+    },
+}
+
+/// Shared settings, mirroring `evm_basic_grant`.
+#[derive(Debug, Queryable, Selectable, Insertable)]
+#[diesel(table_name = proposal_persistent_grant, check_for_backend(Sqlite))]
+struct BaseRow {
+    proposal_id: ProposalId,
+    wallet_access_id: i32,
+    chain_id: i64,
+    valid_from: Option<i64>,
+    valid_until: Option<i64>,
+    max_gas_fee_per_gas: Option<Vec<u8>>,
+    max_priority_fee_per_gas: Option<Vec<u8>>,
+    rate_limit_count: Option<i32>,
+    rate_limit_window_secs: Option<i64>,
+}
+
+#[derive(Debug, Queryable, Selectable, Insertable)]
+#[diesel(table_name = proposal_persistent_grant_ether, check_for_backend(Sqlite))]
+struct EtherRow {
+    proposal_id: ProposalId,
+    window_secs: i64,
+    max_volume: Vec<u8>,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = proposal_persistent_grant_ether_target, check_for_backend(Sqlite))]
+struct NewEtherTarget {
+    proposal_id: ProposalId,
+    address: Vec<u8>,
+}
+
+#[derive(Debug, Queryable, Selectable, Insertable)]
+#[diesel(table_name = proposal_persistent_grant_token, check_for_backend(Sqlite))]
+struct TokenRow {
+    proposal_id: ProposalId,
+    token_contract: Vec<u8>,
+    receiver: Option<Vec<u8>>,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = proposal_persistent_grant_token_limit, check_for_backend(Sqlite))]
+struct NewTokenLimit {
+    proposal_id: ProposalId,
+    window_secs: i64,
+    max_volume: Vec<u8>,
+}
+
+impl BaseRow {
+    fn new(proposal_id: ProposalId, settings: &Settings) -> QueryResult<Self> {
+        Ok(Self {
+            proposal_id,
+            wallet_access_id: settings.wallet_access_id,
+            chain_id: as_i64(settings.chain_id)?,
+            valid_from: settings.valid_from_secs,
+            valid_until: settings.valid_until_secs,
+            max_gas_fee_per_gas: settings.max_gas_fee_per_gas.map(|v| v.to_vec()),
+            max_priority_fee_per_gas: settings.max_priority_fee_per_gas.map(|v| v.to_vec()),
+            // SQLite stores integers signed; a rate-limit count is a `u32`, so it
+            // round-trips through the bit pattern rather than a fallible range check.
+            rate_limit_count: settings.rate_limit.map(|r| r.count.cast_signed()),
+            rate_limit_window_secs: settings.rate_limit.map(|r| r.window_secs),
+        })
+    }
+
+    fn into_settings(self, specific: Specific) -> QueryResult<Settings> {
+        Ok(Settings {
+            wallet_access_id: self.wallet_access_id,
+            chain_id: as_u64(self.chain_id)?,
+            valid_from_secs: self.valid_from,
+            valid_until_secs: self.valid_until,
+            max_gas_fee_per_gas: fixed!(opt self.max_gas_fee_per_gas)?,
+            max_priority_fee_per_gas: fixed!(opt self.max_priority_fee_per_gas)?,
+            rate_limit: self.rate_limit_count.zip(self.rate_limit_window_secs).map(
+                |(count, window_secs)| RateLimit {
+                    count: count.cast_unsigned(),
+                    window_secs,
+                },
+            ),
+            specific,
+        })
+    }
+}
+
+pub struct PersistentGrant;
+
+impl Proposal for PersistentGrant {
+    const KIND: ProposalKindTag = ProposalKindTag::ApprovePersistentGrant;
+
+    type Settings = Settings;
+
+    async fn insert(
+        proposal_id: ProposalId,
+        settings: &Self::Settings,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<()> {
+        diesel::insert_into(proposal_persistent_grant::table)
+            .values(&BaseRow::new(proposal_id, settings)?)
+            .execute(conn)
+            .await?;
+
+        match &settings.specific {
+            Specific::EtherTransfer { targets, limit } => {
+                diesel::insert_into(proposal_persistent_grant_ether::table)
+                    .values(&EtherRow {
+                        proposal_id,
+                        window_secs: limit.window_secs,
+                        max_volume: limit.max_volume.to_vec(),
+                    })
+                    .execute(conn)
+                    .await?;
+
+                // Row at a time: SQLite has no multi-row VALUES clause in diesel-async.
+                for address in targets {
+                    diesel::insert_into(proposal_persistent_grant_ether_target::table)
+                        .values(&NewEtherTarget {
+                            proposal_id,
+                            address: address.to_vec(),
+                        })
+                        .execute(conn)
+                        .await?;
+                }
+            }
+            Specific::TokenTransfer {
+                token_contract,
+                receiver,
+                volume_limits,
+            } => {
+                diesel::insert_into(proposal_persistent_grant_token::table)
+                    .values(&TokenRow {
+                        proposal_id,
+                        token_contract: token_contract.to_vec(),
+                        receiver: receiver.map(|r| r.to_vec()),
+                    })
+                    .execute(conn)
+                    .await?;
+
+                for limit in volume_limits {
+                    diesel::insert_into(proposal_persistent_grant_token_limit::table)
+                        .values(&NewTokenLimit {
+                            proposal_id,
+                            window_secs: limit.window_secs,
+                            max_volume: limit.max_volume.to_vec(),
+                        })
+                        .execute(conn)
+                        .await?;
+                }
+            }
+        }
+        Ok(())
+    }
+
+    async fn load(
+        proposal_id: ProposalId,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<Self::Settings> {
+        let base: BaseRow = proposal_persistent_grant::table
+            .find(proposal_id)
+            .select(BaseRow::as_select())
+            .first(conn)
+            .await?;
+
+        let ether: Option<EtherRow> = proposal_persistent_grant_ether::table
+            .find(proposal_id)
+            .select(EtherRow::as_select())
+            .first(conn)
+            .await
+            .optional()?;
+
+        let specific = if let Some(ether) = ether {
+            let addresses: Vec<Vec<u8>> = proposal_persistent_grant_ether_target::table
+                .filter(proposal_persistent_grant_ether_target::proposal_id.eq(proposal_id))
+                .select(proposal_persistent_grant_ether_target::address)
+                .load(conn)
+                .await?;
+            let targets = addresses
+                .iter()
+                .map(|address| fixed!(address))
+                .collect::<QueryResult<Vec<_>>>()?;
+            Specific::EtherTransfer {
+                targets,
+                limit: VolumeLimit {
+                    max_volume: fixed!(ether.max_volume)?,
+                    window_secs: ether.window_secs,
+                },
+            }
+        } else {
+            let token: TokenRow = proposal_persistent_grant_token::table
+                .find(proposal_id)
+                .select(TokenRow::as_select())
+                .first(conn)
+                .await?;
+            let rows: Vec<(i64, Vec<u8>)> = proposal_persistent_grant_token_limit::table
+                .filter(proposal_persistent_grant_token_limit::proposal_id.eq(proposal_id))
+                .select((
+                    proposal_persistent_grant_token_limit::window_secs,
+                    proposal_persistent_grant_token_limit::max_volume,
+                ))
+                .load(conn)
+                .await?;
+            let volume_limits = rows
+                .into_iter()
+                .map(|(window_secs, max_volume)| {
+                    Ok(VolumeLimit {
+                        max_volume: fixed!(max_volume)?,
+                        window_secs,
+                    })
+                })
+                .collect::<QueryResult<Vec<_>>>()?;
+            Specific::TokenTransfer {
+                token_contract: fixed!(token.token_contract)?,
+                receiver: fixed!(opt token.receiver)?,
+                volume_limits,
+            }
+        };
+
+        base.into_settings(specific)
+    }
+}
--- a/server/crates/arbiter-server/src/db/proposal/replace_operator.rs
+++ b/server/crates/arbiter-server/src/db/proposal/replace_operator.rs
@@ -0,0 +1,51 @@
+//! Replacing an operator's key, which also triggers a Shamir re-key (§3.3).
+
+use super::{Proposal, ProposalKindTag};
+use crate::db::{
+    DatabaseConnection,
+    models::{OperatorIdentityId, ProposalId},
+    schema::proposal_replace_operator as table,
+};
+use diesel::{
+    ExpressionMethods as _, Insertable, QueryDsl as _, QueryResult, Queryable, Selectable,
+    SelectableHelper as _, sqlite::Sqlite,
+};
+use diesel_async::RunQueryDsl as _;
+
+#[derive(Debug, Clone, PartialEq, Eq, Queryable, Selectable, Insertable)]
+#[diesel(table_name = table, check_for_backend(Sqlite))]
+pub struct Settings {
+    pub old_operator_id: OperatorIdentityId,
+    pub new_pubkey: Vec<u8>,
+}
+
+pub struct ReplaceOperator;
+
+impl Proposal for ReplaceOperator {
+    const KIND: ProposalKindTag = ProposalKindTag::ReplaceOperator;
+
+    type Settings = Settings;
+
+    async fn insert(
+        proposal_id: ProposalId,
+        settings: &Self::Settings,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<()> {
+        diesel::insert_into(table::table)
+            .values((table::proposal_id.eq(proposal_id), settings))
+            .execute(conn)
+            .await
+            .map(drop)
+    }
+
+    async fn load(
+        proposal_id: ProposalId,
+        conn: &mut DatabaseConnection,
+    ) -> QueryResult<Self::Settings> {
+        table::table
+            .find(proposal_id)
+            .select(Settings::as_select())
+            .first(conn)
+            .await
+    }
+}
--- a/server/crates/arbiter-server/src/db/proposal/trigger_rekey.rs
+++ b/server/crates/arbiter-server/src/db/proposal/trigger_rekey.rs
@@ -0,0 +1,28 @@
+//! A Shamir re-key over the current operator set (§3.3).
+
+use super::{Proposal, ProposalKindTag};
+use crate::db::{DatabaseConnection, models::ProposalId};
+use diesel::QueryResult;
+
+pub struct TriggerRekey;
+
+impl Proposal for TriggerRekey {
+    const KIND: ProposalKindTag = ProposalKindTag::TriggerRekey;
+
+    type Settings = ();
+
+    async fn insert(
+        _proposal_id: ProposalId,
+        _settings: &Self::Settings,
+        _conn: &mut DatabaseConnection,
+    ) -> QueryResult<()> {
+        Ok(())
+    }
+
+    async fn load(
+        _proposal_id: ProposalId,
+        _conn: &mut DatabaseConnection,
+    ) -> QueryResult<Self::Settings> {
+        Ok(())
+    }
+}
--- a/server/crates/arbiter-server/src/db/recovery.rs
+++ b/server/crates/arbiter-server/src/db/recovery.rs
@@ -0,0 +1,102 @@
+//! Whether the recovery committee is awake.
+//!
+//! §3.6: a wake-up request opens a dispute window; recovery powers only become active once
+//! that window has elapsed without cancellation. Both the proposal manager (for voting) and
+//! the vault coordinator (for unsealing) gate on this, so the rule lives in one place.
+
+use crate::db::{functions::unixepoch, schema};
+
+use diesel::{
+    ExpressionMethods as _, QueryDsl as _,
+    dsl::{exists, select},
+};
+use diesel_async::RunQueryDsl;
+
+/// Recovery operators stay asleep for this long after a wake-up is requested, so the other
+/// operators have time to dispute it (§3.6).
+pub const WAKEUP_DELAY_SECS: i32 = 14 * 24 * 60 * 60;
+
+/// True when an uncancelled wake-up request is older than the dispute window.
+pub async fn is_active(
+    conn: &mut crate::db::DatabaseConnection,
+) -> Result<bool, diesel::result::Error> {
+    select(exists(
+        schema::recovery_wakeup_request::table
+            .filter(schema::recovery_wakeup_request::cancelled_at.is_null())
+            .filter(
+                schema::recovery_wakeup_request::requested_at
+                    .le(unixepoch("now") - WAKEUP_DELAY_SECS),
+            ),
+    ))
+    .get_result(conn)
+    .await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{WAKEUP_DELAY_SECS, is_active};
+    use crate::db::{self, schema};
+
+    use diesel::{ExpressionMethods as _, insert_into};
+    use diesel_async::RunQueryDsl;
+
+    /// `recovery_wakeup_request.requested_by` references `operator_identity(id)`, and pooled
+    /// connections enforce foreign keys, so every wake-up row needs a real identity behind it.
+    async fn insert_operator(pool: &db::DatabasePool) -> i32 {
+        let mut conn = pool.get().await.unwrap();
+        insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(vec![7u8; 32]))
+            .returning(schema::operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    }
+
+    /// Pins `.filter(requested_at.le(...))`: a wake-up requested moments ago must not be
+    /// active yet, even though nothing has cancelled it. Deleting that filter turns this
+    /// assertion false without touching any other test in the suite.
+    #[tokio::test]
+    async fn a_recent_wakeup_is_not_yet_active() {
+        let pool = db::create_test_pool().await;
+        let operator_id = insert_operator(&pool).await;
+        let mut conn = pool.get().await.unwrap();
+
+        diesel::sql_query(format!(
+            "INSERT INTO recovery_wakeup_request (requested_by, requested_at) \
+             VALUES ({operator_id}, unixepoch('now'))"
+        ))
+        .execute(&mut conn)
+        .await
+        .unwrap();
+
+        assert!(
+            !is_active(&mut conn).await.unwrap(),
+            "a wake-up requested moments ago must still be asleep"
+        );
+    }
+
+    /// Pins `.filter(cancelled_at.is_null())`: a cancelled wake-up must not count towards
+    /// activity even once its original request has outlived the dispute window. Deleting
+    /// that filter turns this assertion false without touching any other test in the suite.
+    #[tokio::test]
+    async fn a_cancelled_wakeup_is_not_active_even_past_the_window() {
+        let pool = db::create_test_pool().await;
+        let operator_id = insert_operator(&pool).await;
+        let mut conn = pool.get().await.unwrap();
+
+        diesel::sql_query(format!(
+            "INSERT INTO recovery_wakeup_request \
+             (requested_by, requested_at, cancelled_by, cancelled_at) \
+             VALUES ({operator_id}, unixepoch('now') - {WAKEUP_DELAY_SECS} - 1, \
+             {operator_id}, unixepoch('now'))"
+        ))
+        .execute(&mut conn)
+        .await
+        .unwrap();
+
+        assert!(
+            !is_active(&mut conn).await.unwrap(),
+            "a cancelled wake-up must not activate recovery even past the window"
+        );
+    }
+}
--- a/server/crates/arbiter-server/src/db/schema.rs
+++ b/server/crates/arbiter-server/src/db/schema.rs
@@ -17,6 +17,7 @@ diesel::table! {
        id -> Integer,
        root_key_id -> Nullable<Integer>,
        tls_id -> Nullable<Integer>,
+        shamir_threshold -> Nullable<Integer>,
    }
 }

@@ -135,6 +136,7 @@ diesel::table! {
        id -> Integer,
        wallet_id -> Integer,
        client_id -> Integer,
+        revoked_at -> Nullable<Integer>,
        created_at -> Integer,
    }
 }
@@ -157,6 +159,7 @@ diesel::table! {
        id -> Nullable<Integer>,
        share -> Binary,
        share_nonce -> Binary,
+        share_salt -> Binary,
        created_at -> Integer,
        updated_at -> Integer,
    }
@@ -171,6 +174,165 @@ diesel::table! {
    }
 }

+diesel::table! {
+    proposal (id) {
+        id -> Integer,
+        kind -> Text,
+        initiator_id -> Integer,
+        created_at -> Integer,
+        expires_at -> Integer,
+        status -> Text,
+    }
+}
+
+diesel::table! {
+    proposal_approve_sdk_client (proposal_id) {
+        proposal_id -> Integer,
+        client_id -> Integer,
+    }
+}
+
+diesel::table! {
+    proposal_grant_wallet_access (proposal_id) {
+        proposal_id -> Integer,
+        wallet_id -> Integer,
+        client_id -> Integer,
+    }
+}
+
+diesel::table! {
+    proposal_replace_operator (proposal_id) {
+        proposal_id -> Integer,
+        old_operator_id -> Integer,
+        new_pubkey -> Binary,
+    }
+}
+
+diesel::table! {
+    proposal_one_off_transaction (proposal_id) {
+        proposal_id -> Integer,
+        client_id -> Integer,
+        wallet_address -> Binary,
+        chain_id -> BigInt,
+        nonce -> BigInt,
+        gas_limit -> BigInt,
+        max_fee_per_gas -> Binary,
+        max_priority_fee_per_gas -> Binary,
+        to_address -> Binary,
+        value -> Binary,
+        input -> Binary,
+    }
+}
+
+diesel::table! {
+    proposal_persistent_grant (proposal_id) {
+        proposal_id -> Integer,
+        wallet_access_id -> Integer,
+        chain_id -> BigInt,
+        valid_from -> Nullable<BigInt>,
+        valid_until -> Nullable<BigInt>,
+        max_gas_fee_per_gas -> Nullable<Binary>,
+        max_priority_fee_per_gas -> Nullable<Binary>,
+        rate_limit_count -> Nullable<Integer>,
+        rate_limit_window_secs -> Nullable<BigInt>,
+    }
+}
+
+diesel::table! {
+    proposal_persistent_grant_ether (proposal_id) {
+        proposal_id -> Integer,
+        window_secs -> BigInt,
+        max_volume -> Binary,
+    }
+}
+
+diesel::table! {
+    proposal_persistent_grant_ether_target (id) {
+        id -> Integer,
+        proposal_id -> Integer,
+        address -> Binary,
+    }
+}
+
+diesel::table! {
+    proposal_persistent_grant_token (proposal_id) {
+        proposal_id -> Integer,
+        token_contract -> Binary,
+        receiver -> Nullable<Binary>,
+    }
+}
+
+diesel::table! {
+    proposal_persistent_grant_token_limit (id) {
+        id -> Integer,
+        proposal_id -> Integer,
+        window_secs -> BigInt,
+        max_volume -> Binary,
+    }
+}
+
+diesel::table! {
+    proposal_one_off_transaction_result (proposal_id) {
+        proposal_id -> Integer,
+        r -> Binary,
+        s -> Binary,
+        y_parity -> Integer,
+        created_at -> Integer,
+    }
+}
+
+diesel::table! {
+    recovery_operator (id) {
+        id -> Integer,
+        share -> Binary,
+        share_nonce -> Binary,
+        share_salt -> Binary,
+        created_at -> Integer,
+        updated_at -> Integer,
+    }
+}
+
+diesel::table! {
+    recovery_operator_identity (id) {
+        id -> Integer,
+        public_key -> Binary,
+        created_at -> Integer,
+        updated_at -> Integer,
+    }
+}
+
+diesel::table! {
+    recovery_wakeup_request (id) {
+        id -> Integer,
+        requested_by -> Integer,
+        requested_at -> Integer,
+        cancelled_by -> Nullable<Integer>,
+        cancelled_at -> Nullable<Integer>,
+    }
+}
+
+diesel::table! {
+    recovery_proposal_vote (id) {
+        id -> Integer,
+        proposal_id -> Integer,
+        recovery_operator_id -> Integer,
+        approve -> Bool,
+        signature -> Binary,
+        voted_at -> Integer,
+    }
+}
+
+diesel::table! {
+    proposal_vote (id) {
+        id -> Integer,
+        proposal_id -> Integer,
+        operator_id -> Integer,
+        approve -> Bool,
+        signature -> Binary,
+        voted_at -> Integer,
+    }
+}
+
 diesel::table! {
    program_client (id) {
        id -> Integer,
@@ -224,9 +386,38 @@ diesel::joinable!(evm_wallet_access -> evm_wallet (wallet_id));
 diesel::joinable!(evm_wallet_access -> program_client (client_id));
 diesel::joinable!(operator -> operator_identity (id));
 diesel::joinable!(program_client -> client_metadata (metadata_id));
+diesel::joinable!(proposal -> operator_identity (initiator_id));
+diesel::joinable!(proposal_one_off_transaction_result -> proposal_one_off_transaction (proposal_id));
+diesel::joinable!(proposal_approve_sdk_client -> proposal (proposal_id));
+diesel::joinable!(proposal_grant_wallet_access -> proposal (proposal_id));
+diesel::joinable!(proposal_replace_operator -> proposal (proposal_id));
+diesel::joinable!(proposal_one_off_transaction -> proposal (proposal_id));
+diesel::joinable!(proposal_persistent_grant -> proposal (proposal_id));
+diesel::joinable!(proposal_persistent_grant_ether -> proposal_persistent_grant (proposal_id));
+diesel::joinable!(proposal_persistent_grant_token -> proposal_persistent_grant (proposal_id));
+diesel::joinable!(proposal_vote -> proposal (proposal_id));
+diesel::joinable!(proposal_vote -> operator_identity (operator_id));
+diesel::joinable!(recovery_operator -> recovery_operator_identity (id));
+diesel::joinable!(recovery_proposal_vote -> proposal (proposal_id));
+diesel::joinable!(recovery_proposal_vote -> recovery_operator_identity (recovery_operator_id));
+diesel::joinable!(recovery_wakeup_request -> operator_identity (requested_by));

 diesel::allow_tables_to_appear_in_same_query!(
    aead_encrypted,
+    proposal_one_off_transaction_result,
+    proposal_approve_sdk_client,
+    proposal_grant_wallet_access,
+    proposal_replace_operator,
+    proposal_one_off_transaction,
+    proposal_persistent_grant,
+    proposal_persistent_grant_ether,
+    proposal_persistent_grant_ether_target,
+    proposal_persistent_grant_token,
+    proposal_persistent_grant_token_limit,
+    recovery_operator,
+    recovery_operator_identity,
+    recovery_wakeup_request,
+    recovery_proposal_vote,
    arbiter_settings,
    client_metadata,
    client_metadata_history,
@@ -244,6 +435,8 @@ diesel::allow_tables_to_appear_in_same_query!(
    operator,
    operator_identity,
    program_client,
+    proposal,
+    proposal_vote,
    root_key_history,
    tls_history,
 );
--- a/server/crates/arbiter-server/src/evm/mod.rs
+++ b/server/crates/arbiter-server/src/evm/mod.rs
@@ -352,16 +352,17 @@ impl Engine {
 mod tests {
    use alloy::primitives::{Address, Bytes, U256, address};
    use chrono::{Duration, Utc};
-    use diesel::{SelectableHelper, insert_into};
+    use diesel::{ExpressionMethods as _, SelectableHelper, insert_into};
    use diesel_async::RunQueryDsl;
    use rstest::rstest;

    use crate::db::{
-        self, DatabaseConnection,
+        self, DatabaseConnection, models,
        models::{
            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
            SqliteTimestamp,
        },
+        schema,
        schema::{evm_basic_grant, evm_transaction_log},
    };
    use crate::evm::policies::{
@@ -380,6 +381,7 @@ mod tests {
                id: WALLET_ACCESS_ID,
                wallet_id: EvmWalletId::from_raw(5),
                client_id: 20,
+                revoked_at: None,
                created_at: SqliteTimestamp(Utc::now()),
            },
            chain: CHAIN_ID,
@@ -403,10 +405,85 @@ mod tests {
        }
    }

+    /// Creates the parent chain a fresh `evm_wallet_access` row needs under foreign-key
+    /// enforcement (a root key, an aead-encrypted secret, a wallet, and a client) and
+    /// returns the new access row's id.
+    async fn seed_wallet_access(conn: &mut DatabaseConnection) -> i32 {
+        let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
+            .values(&models::NewRootKeyHistory {
+                ciphertext: vec![0u8; 32],
+                tag: vec![0u8; 16],
+                root_key_encryption_nonce: vec![0u8; 24],
+                data_encryption_nonce: vec![0u8; 24],
+                schema_version: 1,
+                salt: vec![0u8; 16],
+            })
+            .returning(schema::root_key_history::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let aead_id: i32 = insert_into(schema::aead_encrypted::table)
+            .values(&models::NewAeadEncrypted {
+                ciphertext: vec![0u8; 32],
+                tag: vec![0u8; 16],
+                current_nonce: vec![0u8; 24],
+                schema_version: 1,
+                associated_root_key_id: root_key_id,
+                created_at: Utc::now().into(),
+            })
+            .returning(schema::aead_encrypted::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let wallet_id: EvmWalletId = insert_into(schema::evm_wallet::table)
+            .values((
+                schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
+                schema::evm_wallet::aead_encrypted_id.eq(aead_id),
+            ))
+            .returning(schema::evm_wallet::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let metadata_id: i32 = insert_into(schema::client_metadata::table)
+            .values(schema::client_metadata::name.eq("test"))
+            .returning(schema::client_metadata::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let client_id: i32 = insert_into(schema::program_client::table)
+            .values((
+                schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
+                schema::program_client::metadata_id.eq(metadata_id),
+            ))
+            .returning(schema::program_client::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        insert_into(schema::evm_wallet_access::table)
+            .values((
+                schema::evm_wallet_access::wallet_id.eq(wallet_id),
+                schema::evm_wallet_access::client_id.eq(client_id),
+            ))
+            .returning(schema::evm_wallet_access::id)
+            .get_result(conn)
+            .await
+            .unwrap()
+    }
+
    async fn insert_basic_grant(
        conn: &mut DatabaseConnection,
        shared: &SharedGrantSettings,
    ) -> EvmBasicGrant {
+        // The seeded id deliberately wins over `shared.wallet_access_id`: every other field
+        // below is read from `shared`, but a caller-supplied access id would almost never
+        // reference a row that actually exists under foreign-key enforcement.
+        let wallet_access_id = seed_wallet_access(conn).await;
+
        #[expect(
            clippy::cast_possible_truncation,
            clippy::cast_possible_wrap,
@@ -415,7 +492,7 @@ mod tests {
        )]
        insert_into(evm_basic_grant::table)
            .values(NewEvmBasicGrant {
-                wallet_access_id: shared.wallet_access_id,
+                wallet_access_id,
                chain_id: shared.chain.into(),
                valid_from: shared.valid_from.map(SqliteTimestamp),
                valid_until: shared.valid_until.map(SqliteTimestamp),
@@ -579,7 +656,7 @@ mod tests {
        insert_into(evm_transaction_log::table)
            .values(NewEvmTransactionLog {
                grant_id: basic_grant.id,
-                wallet_access_id: WALLET_ACCESS_ID,
+                wallet_access_id: basic_grant.wallet_access_id,
                chain_id: CHAIN_ID.into(),
                eth_value: super::utils::u256_to_bytes(U256::ZERO).to_vec(),
                signed_at: SqliteTimestamp(Utc::now()),
--- a/server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
+++ b/server/crates/arbiter-server/src/evm/policies/ether_transfer/tests.rs
@@ -1,11 +1,12 @@
 use super::{EtherTransfer, Settings};
 use crate::{
    db::{
-        self, DatabaseConnection,
+        self, DatabaseConnection, models,
        models::{
            EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, NewEvmTransactionLog,
            SqliteTimestamp,
        },
+        schema,
        schema::{evm_basic_grant, evm_transaction_log},
    },
    evm::{
@@ -19,7 +20,7 @@ use crate::{

 use alloy::primitives::{Address, Bytes, U256, address};
 use chrono::{Duration, Utc};
-use diesel::{SelectableHelper, insert_into};
+use diesel::{ExpressionMethods as _, SelectableHelper, insert_into};
 use diesel_async::RunQueryDsl;

 const WALLET_ACCESS_ID: i32 = 1;
@@ -34,6 +35,7 @@ fn ctx(to: Address, value: U256) -> EvalContext {
            id: WALLET_ACCESS_ID,
            wallet_id: EvmWalletId::from_raw(10),
            client_id: 20,
+            revoked_at: None,
            created_at: SqliteTimestamp(Utc::now()),
        },
        chain: CHAIN_ID,
@@ -45,10 +47,82 @@ fn ctx(to: Address, value: U256) -> EvalContext {
    }
 }

+/// Creates the parent chain a fresh `evm_wallet_access` row needs under foreign-key
+/// enforcement (a root key, an aead-encrypted secret, a wallet, and a client) and returns
+/// the new access row's id.
+async fn seed_wallet_access(conn: &mut DatabaseConnection) -> i32 {
+    let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
+        .values(&models::NewRootKeyHistory {
+            ciphertext: vec![0u8; 32],
+            tag: vec![0u8; 16],
+            root_key_encryption_nonce: vec![0u8; 24],
+            data_encryption_nonce: vec![0u8; 24],
+            schema_version: 1,
+            salt: vec![0u8; 16],
+        })
+        .returning(schema::root_key_history::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let aead_id: i32 = insert_into(schema::aead_encrypted::table)
+        .values(&models::NewAeadEncrypted {
+            ciphertext: vec![0u8; 32],
+            tag: vec![0u8; 16],
+            current_nonce: vec![0u8; 24],
+            schema_version: 1,
+            associated_root_key_id: root_key_id,
+            created_at: Utc::now().into(),
+        })
+        .returning(schema::aead_encrypted::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let wallet_id: EvmWalletId = insert_into(schema::evm_wallet::table)
+        .values((
+            schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
+            schema::evm_wallet::aead_encrypted_id.eq(aead_id),
+        ))
+        .returning(schema::evm_wallet::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let metadata_id: i32 = insert_into(schema::client_metadata::table)
+        .values(schema::client_metadata::name.eq("test"))
+        .returning(schema::client_metadata::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let client_id: i32 = insert_into(schema::program_client::table)
+        .values((
+            schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
+            schema::program_client::metadata_id.eq(metadata_id),
+        ))
+        .returning(schema::program_client::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    insert_into(schema::evm_wallet_access::table)
+        .values((
+            schema::evm_wallet_access::wallet_id.eq(wallet_id),
+            schema::evm_wallet_access::client_id.eq(client_id),
+        ))
+        .returning(schema::evm_wallet_access::id)
+        .get_result(conn)
+        .await
+        .unwrap()
+}
+
 async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicGrant {
+    let wallet_access_id = seed_wallet_access(conn).await;
+
    insert_into(evm_basic_grant::table)
        .values(NewEvmBasicGrant {
-            wallet_access_id: WALLET_ACCESS_ID,
+            wallet_access_id,
            chain_id: CHAIN_ID.into(),
            valid_from: None,
            valid_until: None,
@@ -161,7 +235,7 @@ async fn evaluate_passes_when_volume_within_limit() {
    insert_into(evm_transaction_log::table)
        .values(NewEvmTransactionLog {
            grant_id,
-            wallet_access_id: WALLET_ACCESS_ID,
+            wallet_access_id: basic.wallet_access_id,
            chain_id: CHAIN_ID.into(),
            eth_value: utils::u256_to_bytes(U256::from(500u64)).to_vec(),
            signed_at: SqliteTimestamp(Utc::now()),
@@ -203,7 +277,7 @@ async fn evaluate_rejects_volume_over_limit() {
    insert_into(evm_transaction_log::table)
        .values(NewEvmTransactionLog {
            grant_id,
-            wallet_access_id: WALLET_ACCESS_ID,
+            wallet_access_id: basic.wallet_access_id,
            chain_id: CHAIN_ID.into(),
            eth_value: utils::u256_to_bytes(U256::from(1_000u64)).to_vec(),
            signed_at: SqliteTimestamp(Utc::now()),
@@ -246,7 +320,7 @@ async fn evaluate_passes_at_exactly_volume_limit() {
    insert_into(evm_transaction_log::table)
        .values(NewEvmTransactionLog {
            grant_id,
-            wallet_access_id: WALLET_ACCESS_ID,
+            wallet_access_id: basic.wallet_access_id,
            chain_id: CHAIN_ID.into(),
            eth_value: utils::u256_to_bytes(U256::from(900u64)).to_vec(),
            signed_at: SqliteTimestamp(Utc::now()),
--- a/server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
+++ b/server/crates/arbiter-server/src/evm/policies/token_transfers/tests.rs
@@ -1,8 +1,9 @@
 use super::{Settings, TokenTransfer};
 use crate::{
    db::{
-        self, DatabaseConnection,
+        self, DatabaseConnection, models,
        models::{EvmBasicGrant, EvmWalletAccess, EvmWalletId, NewEvmBasicGrant, SqliteTimestamp},
+        schema,
        schema::evm_basic_grant,
    },
    evm::{
@@ -20,7 +21,7 @@ use alloy::{
    sol_types::SolCall,
 };
 use chrono::{Duration, Utc};
-use diesel::{SelectableHelper, insert_into};
+use diesel::{ExpressionMethods as _, SelectableHelper, insert_into};
 use diesel_async::RunQueryDsl;

 // DAI on Ethereum mainnet — present in the static token registry
@@ -47,6 +48,7 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
            id: WALLET_ACCESS_ID,
            wallet_id: EvmWalletId::from_raw(10),
            client_id: 20,
+            revoked_at: None,
            created_at: SqliteTimestamp(Utc::now()),
        },
        chain: CHAIN_ID,
@@ -58,10 +60,82 @@ fn ctx(to: Address, calldata: Bytes) -> EvalContext {
    }
 }

+/// Creates the parent chain a fresh `evm_wallet_access` row needs under foreign-key
+/// enforcement (a root key, an aead-encrypted secret, a wallet, and a client) and returns
+/// the new access row's id.
+async fn seed_wallet_access(conn: &mut DatabaseConnection) -> i32 {
+    let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
+        .values(&models::NewRootKeyHistory {
+            ciphertext: vec![0u8; 32],
+            tag: vec![0u8; 16],
+            root_key_encryption_nonce: vec![0u8; 24],
+            data_encryption_nonce: vec![0u8; 24],
+            schema_version: 1,
+            salt: vec![0u8; 16],
+        })
+        .returning(schema::root_key_history::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let aead_id: i32 = insert_into(schema::aead_encrypted::table)
+        .values(&models::NewAeadEncrypted {
+            ciphertext: vec![0u8; 32],
+            tag: vec![0u8; 16],
+            current_nonce: vec![0u8; 24],
+            schema_version: 1,
+            associated_root_key_id: root_key_id,
+            created_at: Utc::now().into(),
+        })
+        .returning(schema::aead_encrypted::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let wallet_id: EvmWalletId = insert_into(schema::evm_wallet::table)
+        .values((
+            schema::evm_wallet::address.eq(rand::random::<[u8; 20]>().to_vec()),
+            schema::evm_wallet::aead_encrypted_id.eq(aead_id),
+        ))
+        .returning(schema::evm_wallet::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let metadata_id: i32 = insert_into(schema::client_metadata::table)
+        .values(schema::client_metadata::name.eq("test"))
+        .returning(schema::client_metadata::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    let client_id: i32 = insert_into(schema::program_client::table)
+        .values((
+            schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
+            schema::program_client::metadata_id.eq(metadata_id),
+        ))
+        .returning(schema::program_client::id)
+        .get_result(conn)
+        .await
+        .unwrap();
+
+    insert_into(schema::evm_wallet_access::table)
+        .values((
+            schema::evm_wallet_access::wallet_id.eq(wallet_id),
+            schema::evm_wallet_access::client_id.eq(client_id),
+        ))
+        .returning(schema::evm_wallet_access::id)
+        .get_result(conn)
+        .await
+        .unwrap()
+}
+
 async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicGrant {
+    let wallet_access_id = seed_wallet_access(conn).await;
+
    insert_into(evm_basic_grant::table)
        .values(NewEvmBasicGrant {
-            wallet_access_id: WALLET_ACCESS_ID,
+            wallet_access_id,
            chain_id: CHAIN_ID.into(),
            valid_from: None,
            valid_until: None,
@@ -77,6 +151,27 @@ async fn insert_basic(conn: &mut DatabaseConnection, revoked: bool) -> EvmBasicG
        .unwrap()
 }

+/// `evm_token_transfer_log.log_id` references the shared `evm_transaction_log` table, so
+/// tests recording a token transfer need a real row there to point at.
+async fn insert_transaction_log(
+    conn: &mut DatabaseConnection,
+    basic: &EvmBasicGrant,
+    eth_value: U256,
+) -> i32 {
+    insert_into(schema::evm_transaction_log::table)
+        .values(models::NewEvmTransactionLog {
+            grant_id: basic.id,
+            wallet_access_id: basic.wallet_access_id,
+            chain_id: CHAIN_ID.into(),
+            eth_value: utils::u256_to_bytes(eth_value).to_vec(),
+            signed_at: SqliteTimestamp(Utc::now()),
+        })
+        .returning(schema::evm_transaction_log::id)
+        .get_result(conn)
+        .await
+        .unwrap()
+}
+
 fn make_settings(target: Option<Address>, max_volume: Option<u64>) -> Settings {
    Settings {
        token_contract: DAI,
@@ -241,10 +336,11 @@ async fn evaluate_passes_volume_at_exact_limit() {
        .unwrap();

    // Record a past transfer of 900, with current transfer 100 => exactly 1000 limit
-    insert_into(db::schema::evm_token_transfer_log::table)
-        .values(db::models::NewEvmTokenTransferLog {
+    let log_id = insert_transaction_log(&mut conn, &basic, U256::from(900u64)).await;
+    insert_into(schema::evm_token_transfer_log::table)
+        .values(models::NewEvmTokenTransferLog {
            grant_id,
-            log_id: 0,
+            log_id,
            chain_id: CHAIN_ID.into(),
            token_contract: DAI.to_vec(),
            recipient_address: RECIPIENT.to_vec(),
@@ -285,10 +381,11 @@ async fn evaluate_rejects_volume_over_limit() {
        .await
        .unwrap();

-    insert_into(db::schema::evm_token_transfer_log::table)
-        .values(db::models::NewEvmTokenTransferLog {
+    let log_id = insert_transaction_log(&mut conn, &basic, U256::from(1_000u64)).await;
+    insert_into(schema::evm_token_transfer_log::table)
+        .values(models::NewEvmTokenTransferLog {
            grant_id,
-            log_id: 0,
+            log_id,
            chain_id: CHAIN_ID.into(),
            token_contract: DAI.to_vec(),
            recipient_address: RECIPIENT.to_vec(),
--- a/server/crates/arbiter-server/src/evm/safe_signer.rs
+++ b/server/crates/arbiter-server/src/evm/safe_signer.rs
@@ -44,7 +44,7 @@ impl std::fmt::Debug for SafeSigner {
 /// Returns the protected key bytes and the derived Ethereum address.
 pub fn generate(rng: &mut impl rand::Rng) -> (SafeCell<[u8; 32]>, Address) {
    loop {
-        let mut cell = SafeCell::new_inline(|w: &mut [u8; 32]| {
+        let mut cell = SafeCell::new_inline_default(|w: &mut [u8; 32]| {
            rng.fill_bytes(w);
        });

--- a/server/crates/arbiter-server/src/grpc/operator.rs
+++ b/server/crates/arbiter-server/src/grpc/operator.rs
@@ -19,6 +19,7 @@ use tracing::{error, info, warn};

 mod auth;
 mod evm;
+mod governance;
 mod inbound;
 mod outbound;
 mod sdk_client;
@@ -115,6 +116,7 @@ async fn dispatch_inner(
            warn!("Unsupported post-auth operator auth request");
            Err(Status::invalid_argument("Unsupported operator request"))
        }
+        OperatorRequestPayload::Governance(req) => governance::dispatch(actor, req).await,
    }
 }

@@ -127,14 +129,23 @@ pub async fn start(
    let (oob_sender, oob_receiver) = mpsc::channel(16);
    let oob_adapter = OutOfBandAdapter(oob_sender);

-    let actor = {
+    let started = {
        let transport = auth::AuthTransportAdapter::new(&mut bi, &mut request_tracker);
-        match crate::peers::operator::start(&mut conn, transport, Box::new(oob_adapter)).await {
-            Ok(actor) => actor,
-            Err(e) => {
-                warn!(error = ?e, "Operator connection failed");
-                return;
-            }
+        crate::peers::operator::start(&mut conn, transport, Box::new(oob_adapter)).await
+    };
+
+    let actor = match started {
+        Ok(actor) => actor,
+        // §3.5: a recovery operator is turned away from the session rather than failing. Say so
+        // on the stream, so it does not look like the server dropped the connection.
+        Err(e @ crate::peers::operator::Error::RecoveryOperatorHasNoSession) => {
+            info!("Recovery operator connection closed after the vault gate");
+            let _ = bi.send(Err(Status::permission_denied(e.to_string()))).await;
+            return;
+        }
+        Err(e) => {
+            warn!(error = ?e, "Operator connection failed");
+            return;
        }
    };

--- a/server/crates/arbiter-server/src/grpc/operator/governance.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/governance.rs
@@ -0,0 +1,256 @@
+use crate::{
+    actors::proposal_manager::{Error as ProposalError, VoteOutcome},
+    db::models::{OperatorIdentityId, ProposalId},
+    db::proposal::{
+        ProposalKind, approve_sdk_client, grant_wallet_access, one_off_transaction,
+        persistent_grant, replace_operator,
+    },
+    peers::operator::{
+        OperatorSession,
+        session::handlers::{HandleCastVote, HandleCreateProposal, HandleQueryPending},
+    },
+};
+use arbiter_proto::proto::operator::{
+    governance::{
+        self as proto_gov, CreateProposalRequest, QueryPendingRequest, QueryPendingResponse,
+        VoteOutcome as ProtoVoteOutcome, create_proposal_request::Kind as ProtoKind,
+        request::Payload as GovRequestPayload, response::Payload as GovResponsePayload,
+    },
+    operator_response::Payload as OperatorResponsePayload,
+};
+use kameo::actor::ActorRef;
+use tonic::Status;
+use tracing::warn;
+
+const fn wrap(payload: GovResponsePayload) -> OperatorResponsePayload {
+    OperatorResponsePayload::Governance(proto_gov::Response {
+        payload: Some(payload),
+    })
+}
+
+pub(super) async fn dispatch(
+    actor: &ActorRef<OperatorSession>,
+    req: proto_gov::Request,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let Some(payload) = req.payload else {
+        return Err(Status::invalid_argument(
+            "Missing governance request payload",
+        ));
+    };
+
+    match payload {
+        GovRequestPayload::Create(req) => handle_create(actor, req).await,
+        GovRequestPayload::Vote(req) => handle_vote(actor, req).await,
+        GovRequestPayload::Query(QueryPendingRequest {}) => handle_query(actor).await,
+    }
+}
+
+async fn handle_create(
+    actor: &ActorRef<OperatorSession>,
+    req: CreateProposalRequest,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let kind = match req.kind {
+        Some(ProtoKind::ApproveSdkClient(p)) => {
+            ProposalKind::ApproveSdkClient(approve_sdk_client::Settings {
+                client_id: p.client_id,
+            })
+        }
+        Some(ProtoKind::GrantWalletAccess(p)) => {
+            ProposalKind::GrantWalletAccess(grant_wallet_access::Settings {
+                wallet_id: p.wallet_id,
+                client_id: p.client_id,
+            })
+        }
+        Some(ProtoKind::ReplaceOperator(p)) => {
+            ProposalKind::ReplaceOperator(replace_operator::Settings {
+                old_operator_id: OperatorIdentityId::from_raw(p.old_operator_id),
+                new_pubkey: p.new_pubkey,
+            })
+        }
+        Some(ProtoKind::TriggerRekey(())) => ProposalKind::TriggerRekey,
+        Some(ProtoKind::ApprovePersistentGrant(p)) => {
+            ProposalKind::ApprovePersistentGrant(Box::new(parse_persistent_grant(p)?))
+        }
+        Some(ProtoKind::ApproveOneOffTransaction(p)) => {
+            ProposalKind::ApproveOneOffTransaction(Box::new(parse_one_off_transaction(p)?))
+        }
+        None => return Err(Status::invalid_argument("Missing proposal kind")),
+    };
+    let proposal_id = actor
+        .ask(HandleCreateProposal {
+            kind,
+            ttl_secs: req.ttl_secs,
+        })
+        .await
+        .map_err(|e| {
+            warn!(?e, "create_proposal failed");
+            Status::internal("Failed to create proposal")
+        })?;
+
+    Ok(Some(wrap(GovResponsePayload::Created(
+        proto_gov::CreateProposalResponse {
+            proposal_id: proposal_id.to_raw(),
+        },
+    ))))
+}
+
+/// Validates the grant where the request enters, so a malformed one is refused before
+/// any operator votes on it instead of failing after quorum.
+fn parse_persistent_grant(
+    p: proto_gov::ApprovePersistentGrantPayload,
+) -> Result<persistent_grant::Settings, Status> {
+    use proto_gov::approve_persistent_grant_payload::Specific;
+
+    let volume =
+        |l: proto_gov::VolumeLimitProto| -> Result<persistent_grant::VolumeLimit, Status> {
+            Ok(persistent_grant::VolumeLimit {
+                max_volume: fixed(&l.max_volume, "max_volume must be 32 bytes")?,
+                window_secs: l.window_secs,
+            })
+        };
+
+    let specific = match p.specific {
+        Some(Specific::EtherTransfer(spec)) => {
+            let targets = spec
+                .targets
+                .iter()
+                .map(|target| fixed(target, "ether transfer target must be 20 bytes"))
+                .collect::<Result<Vec<_>, _>>()?;
+            let limit = spec
+                .limit
+                .ok_or_else(|| Status::invalid_argument("missing ether transfer limit"))?;
+            persistent_grant::Specific::EtherTransfer {
+                targets,
+                limit: volume(limit)?,
+            }
+        }
+        Some(Specific::TokenTransfer(spec)) => {
+            let volume_limits = spec
+                .volume_limits
+                .into_iter()
+                .map(volume)
+                .collect::<Result<Vec<_>, _>>()?;
+            persistent_grant::Specific::TokenTransfer {
+                token_contract: fixed(&spec.token_contract, "token_contract must be 20 bytes")?,
+                receiver: spec
+                    .target
+                    .map(|t| fixed(&t, "token transfer target must be 20 bytes"))
+                    .transpose()?,
+                volume_limits,
+            }
+        }
+        None => return Err(Status::invalid_argument("missing grant specific")),
+    };
+
+    Ok(persistent_grant::Settings {
+        wallet_access_id: p.wallet_access_id,
+        chain_id: p.chain_id,
+        valid_from_secs: p.valid_from_secs,
+        valid_until_secs: p.valid_until_secs,
+        max_gas_fee_per_gas: p
+            .max_gas_fee_per_gas
+            .map(|v| fixed(&v, "max_gas_fee_per_gas must be 32 bytes"))
+            .transpose()?,
+        max_priority_fee_per_gas: p
+            .max_priority_fee_per_gas
+            .map(|v| fixed(&v, "max_priority_fee_per_gas must be 32 bytes"))
+            .transpose()?,
+        rate_limit: p.rate_limit.map(|r| persistent_grant::RateLimit {
+            count: r.count,
+            window_secs: r.window_secs,
+        }),
+        specific,
+    })
+}
+
+fn fixed<const N: usize>(bytes: &[u8], message: &'static str) -> Result<[u8; N], Status> {
+    <[u8; N]>::try_from(bytes).map_err(|_| Status::invalid_argument(message))
+}
+
+/// Validates the transaction where the request enters, so a malformed one is refused
+/// before any operator votes on it instead of failing after quorum.
+fn parse_one_off_transaction(
+    p: proto_gov::ApproveOneOffTransactionPayload,
+) -> Result<one_off_transaction::Settings, Status> {
+    Ok(one_off_transaction::Settings {
+        client_id: p.client_id,
+        wallet_address: fixed(&p.wallet_address, "wallet_address must be 20 bytes")?,
+        chain_id: p.chain_id,
+        nonce: p.nonce,
+        gas_limit: p.gas_limit,
+        max_fee_per_gas: u128::from_be_bytes(fixed(
+            &p.max_fee_per_gas,
+            "max_fee_per_gas must be 16 bytes",
+        )?),
+        max_priority_fee_per_gas: u128::from_be_bytes(fixed(
+            &p.max_priority_fee_per_gas,
+            "max_priority_fee_per_gas must be 16 bytes",
+        )?),
+        to: fixed(&p.to, "to must be 20 bytes")?,
+        value: fixed(&p.value, "value must be 32 bytes")?,
+        input: p.input,
+    })
+}
+
+async fn handle_vote(
+    actor: &ActorRef<OperatorSession>,
+    req: proto_gov::CastVoteRequest,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let result = actor
+        .ask(HandleCastVote {
+            proposal_id: ProposalId::from_raw(req.proposal_id),
+            approve: req.approve,
+            signature: req.signature,
+        })
+        .await;
+
+    let outcome = match result {
+        Ok(VoteOutcome::Pending) => ProtoVoteOutcome::Pending,
+        Ok(VoteOutcome::Approved) => ProtoVoteOutcome::Approved,
+        Ok(VoteOutcome::Rejected) => ProtoVoteOutcome::Rejected,
+        Err(kameo::error::SendError::HandlerError(ProposalError::AlreadyVoted)) => {
+            return Err(Status::invalid_argument("Already voted on this proposal"));
+        }
+        Err(kameo::error::SendError::HandlerError(ProposalError::InvalidSignature)) => {
+            return Err(Status::invalid_argument("Invalid vote signature"));
+        }
+        Err(kameo::error::SendError::HandlerError(ProposalError::ProposalNotFound)) => {
+            return Err(Status::not_found("Proposal not found"));
+        }
+        Err(kameo::error::SendError::HandlerError(ProposalError::Unavailable)) => {
+            return Err(Status::unavailable("Proposal manager is unavailable"));
+        }
+        Err(e) => {
+            warn!(?e, "cast_vote failed");
+            return Err(Status::internal("Failed to cast vote"));
+        }
+    };
+
+    Ok(Some(wrap(GovResponsePayload::Voted(
+        proto_gov::VoteResponse {
+            outcome: outcome.into(),
+        },
+    ))))
+}
+
+async fn handle_query(
+    actor: &ActorRef<OperatorSession>,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    let summaries = actor.ask(HandleQueryPending {}).await.unwrap_or_default();
+
+    let proposals = summaries
+        .into_iter()
+        .map(|s| proto_gov::ProposalSummary {
+            id: s.id.to_raw(),
+            kind: <&'static str>::from(s.kind).to_owned(),
+            initiator_id: s.initiator_id.to_raw(),
+            expires_at: s.expires_at.0.timestamp(),
+            approve_count: s.approve_count,
+            reject_count: s.reject_count,
+        })
+        .collect();
+
+    Ok(Some(wrap(GovResponsePayload::Pending(
+        QueryPendingResponse { proposals },
+    ))))
+}
--- a/server/crates/arbiter-server/src/grpc/operator/vault.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault.rs
@@ -1,19 +1,30 @@
 use crate::{
    actors::vault::VaultState,
-    peers::operator::{OperatorSession, session::handlers::HandleQueryVaultState},
-};
-use arbiter_proto::{
-    proto::shared::VaultState as ProtoVaultState,
-    proto::operator::{
-        operator_response::Payload as OperatorResponsePayload,
-        vault::{
-            self as proto_vault, request::Payload as VaultRequestPayload,
-            response::Payload as VaultResponsePayload,
+    peers::operator::{
+        OperatorSession,
+        session::{
+            Error as SessionError,
+            handlers::{
+                HandleContributeRecoveryRekeyPassphrase, HandleContributeRekeyPassphrase,
+                HandleQueryVaultState,
+            },
        },
    },
 };
+use arbiter_proto::{
+    proto::operator::{
+        operator_response::Payload as OperatorResponsePayload,
+        vault::{
+            self as proto_vault,
+            rekey::{self as proto_rekey, RekeyResult as ProtoRekeyResult},
+            request::Payload as VaultRequestPayload,
+            response::Payload as VaultResponsePayload,
+        },
+    },
+    proto::shared::VaultState as ProtoVaultState,
+};

-use kameo::actor::ActorRef;
+use kameo::{actor::ActorRef, error::SendError};
 use tonic::Status;
 use tracing::warn;

@@ -33,6 +44,7 @@ pub(super) async fn dispatch(

    match payload {
        VaultRequestPayload::QueryState(()) => handle_query_vault_state(actor).await,
+        VaultRequestPayload::Rekey(req) => handle_rekey(actor, req).await,
        VaultRequestPayload::Unseal(_) | VaultRequestPayload::Bootstrap(_) => {
            Err(Status::permission_denied(
                "Vault is already unsealed; unseal/bootstrap not permitted in session",
@@ -41,6 +53,58 @@ pub(super) async fn dispatch(
    }
 }

+/// A re-key share belongs to exactly one role (§3.3), so a contribution from the wrong one is a
+/// policy answer and must not reach the peer as an opaque `internal`.
+fn rekey_status<M>(err: SendError<M, SessionError>, context: &'static str) -> Status {
+    match err {
+        SendError::HandlerError(err @ SessionError::RoleNotPermitted) => {
+            Status::permission_denied(err.to_string())
+        }
+        err => {
+            warn!(?err, "{context}");
+            Status::internal(context)
+        }
+    }
+}
+
+async fn handle_rekey(
+    actor: &ActorRef<OperatorSession>,
+    req: proto_rekey::Request,
+) -> Result<Option<OperatorResponsePayload>, Status> {
+    use arbiter_proto::proto::operator::vault::rekey::request::Payload as RekeyPayload;
+
+    let payload = req
+        .payload
+        .ok_or_else(|| Status::invalid_argument("Missing rekey payload"))?;
+
+    let done: bool = match payload {
+        RekeyPayload::ContributePassphrase(cp) => actor
+            .ask(HandleContributeRekeyPassphrase {
+                passphrase: cp.passphrase,
+            })
+            .await
+            .map_err(|e| rekey_status(e, "Rekey contribution failed"))?,
+        RekeyPayload::ContributeRecoveryPassphrase(crp) => actor
+            .ask(HandleContributeRecoveryRekeyPassphrase {
+                passphrase: crp.passphrase,
+            })
+            .await
+            .map_err(|e| rekey_status(e, "Rekey recovery contribution failed"))?,
+    };
+
+    let proto_result = if done {
+        ProtoRekeyResult::Success
+    } else {
+        ProtoRekeyResult::AwaitingContributions
+    };
+
+    Ok(Some(wrap_vault_response(VaultResponsePayload::Rekey(
+        proto_rekey::Response {
+            result: proto_result.into(),
+        },
+    ))))
+}
+
 async fn handle_query_vault_state(
    actor: &ActorRef<OperatorSession>,
 ) -> Result<Option<OperatorResponsePayload>, Status> {
--- a/server/crates/arbiter-server/src/grpc/operator/vault_gate/inbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault_gate/inbound.rs
@@ -1,14 +1,17 @@
 use crate::{
    grpc::{Convert, TryConvert},
    peers::operator::vault_gate::{
-        self as vault_gate, HandleBootstrapEncryptedKey, HandleHandshake, HandleUnsealEncryptedKey,
+        self as vault_gate, HandleBootstrapEncryptedKey, HandleContributeBootstrapPassphrase,
+        HandleContributeRecoveryBootstrapPassphrase, HandleContributeRecoveryUnsealPassphrase,
+        HandleContributeUnsealPassphrase, HandleDeclareCommittee, HandleHandshake,
+        HandleUnsealEncryptedKey,
    },
 };
 use arbiter_proto::proto::operator::{
    operator_request::Payload as OperatorRequestPayload,
    vault::{
        self as proto_vault,
-        bootstrap::{self as proto_bootstrap},
+        bootstrap::{self as proto_bootstrap, request::Payload as BootstrapRequestPayload},
        request::Payload as VaultRequestPayload,
        unseal::{self as proto_unseal, request::Payload as UnsealRequestPayload},
    },
@@ -50,6 +53,9 @@ impl TryConvert for VaultRequestPayload {
            Self::QueryState(()) => Ok(vault_gate::Inbound::HandleVaultState),
            Self::Unseal(req) => req.try_convert(),
            Self::Bootstrap(req) => req.try_convert(),
+            Self::Rekey(_) => Err(Status::permission_denied(
+                "Rekey requires an authenticated session",
+            )),
        }
    }
 }
@@ -73,6 +79,20 @@ impl TryConvert for UnsealRequestPayload {
        match self {
            Self::Start(start) => start.try_convert(),
            Self::EncryptedKey(key) => Ok(key.convert()),
+            Self::ContributePassphrase(cp) => Ok(
+                vault_gate::Inbound::HandleContributeUnsealPassphrase(
+                    HandleContributeUnsealPassphrase {
+                        passphrase: cp.passphrase,
+                    },
+                ),
+            ),
+            Self::ContributeRecoveryPassphrase(crp) => Ok(
+                vault_gate::Inbound::HandleContributeRecoveryUnsealPassphrase(
+                    HandleContributeRecoveryUnsealPassphrase {
+                        passphrase: crp.passphrase,
+                    },
+                ),
+            ),
        }
    }
 }
@@ -107,12 +127,43 @@ impl TryConvert for proto_bootstrap::Request {
    type Error = Status;

    fn try_convert(self) -> Result<vault_gate::Inbound, Status> {
-        self.encrypted_key
-            .ok_or_else(|| Status::invalid_argument("Missing bootstrap encrypted key"))?
+        self.payload
+            .ok_or_else(|| Status::invalid_argument("Missing bootstrap payload"))?
            .try_convert()
    }
 }

+impl TryConvert for BootstrapRequestPayload {
+    type Output = vault_gate::Inbound;
+    type Error = Status;
+
+    fn try_convert(self) -> Result<vault_gate::Inbound, Status> {
+        match self {
+            Self::EncryptedKey(key) => key.try_convert(),
+            Self::DeclareCommittee(dc) => Ok(
+                vault_gate::Inbound::HandleDeclareCommittee(HandleDeclareCommittee {
+                    count: dc.count as usize,
+                    recovery_count: dc.recovery_count as usize,
+                }),
+            ),
+            Self::ContributePassphrase(cp) => Ok(
+                vault_gate::Inbound::HandleContributeBootstrapPassphrase(
+                    HandleContributeBootstrapPassphrase {
+                        passphrase: cp.passphrase,
+                    },
+                ),
+            ),
+            Self::ContributeRecoveryPassphrase(crp) => Ok(
+                vault_gate::Inbound::HandleContributeRecoveryBootstrapPassphrase(
+                    HandleContributeRecoveryBootstrapPassphrase {
+                        passphrase: crp.passphrase,
+                    },
+                ),
+            ),
+        }
+    }
+}
+
 impl TryConvert for proto_bootstrap::BootstrapEncryptedKey {
    type Output = vault_gate::Inbound;
    type Error = Status;
--- a/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
@@ -4,7 +4,6 @@ use crate::{
    peers::operator::vault_gate::{self as vault_gate},
 };
 use arbiter_proto::proto::{
-    shared::VaultState as ProtoVaultState,
    operator::{
        operator_response::Payload as OperatorResponsePayload,
        vault::{
@@ -17,6 +16,7 @@ use arbiter_proto::proto::{
            },
        },
    },
+    shared::VaultState as ProtoVaultState,
 };

 use tonic::Status;
@@ -103,6 +103,9 @@ impl TryConvert for vault_gate::Outbound {
                    Err(vault_gate::Error::AlreadyBootstrapped) => {
                        ProtoBootstrapResult::AlreadyBootstrapped
                    }
+                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
+                        return Err(Status::permission_denied(err.to_string()));
+                    }
                    Err(err) => {
                        warn!(?err, "bootstrap failed");
                        return Err(Status::internal("Failed to bootstrap vault"));
@@ -110,6 +113,85 @@ impl TryConvert for vault_gate::Outbound {
                };
                Ok(wrap_bootstrap_response(proto_result))
            }
+            Self::HandleDeclareCommittee(result) => {
+                let proto_result = match result {
+                    Ok(()) => ProtoBootstrapResult::Success,
+                    // A role refusal is a policy answer, not a server fault, so it leaves the
+                    // gate as `PERMISSION_DENIED` rather than as an opaque `internal`.
+                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
+                        return Err(Status::permission_denied(err.to_string()));
+                    }
+                    Err(err) => {
+                        warn!(?err, "declare committee failed");
+                        return Err(Status::internal("Failed to declare committee"));
+                    }
+                };
+                Ok(wrap_bootstrap_response(proto_result))
+            }
+            Self::HandleContributeBootstrapPassphrase(result) => {
+                let proto_result = match result {
+                    Ok(true) => ProtoBootstrapResult::Success,
+                    Ok(false) => ProtoBootstrapResult::AwaitingContributions,
+                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
+                        return Err(Status::permission_denied(err.to_string()));
+                    }
+                    Err(err) => {
+                        warn!(?err, "contribute bootstrap passphrase failed");
+                        return Err(Status::internal("Failed to contribute bootstrap passphrase"));
+                    }
+                };
+                Ok(wrap_bootstrap_response(proto_result))
+            }
+            Self::HandleContributeRecoveryBootstrapPassphrase(result) => {
+                let proto_result = match result {
+                    Ok(true) => ProtoBootstrapResult::Success,
+                    Ok(false) => ProtoBootstrapResult::AwaitingContributions,
+                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
+                        return Err(Status::permission_denied(err.to_string()));
+                    }
+                    Err(err) => {
+                        warn!(?err, "contribute recovery bootstrap passphrase failed");
+                        return Err(Status::internal(
+                            "Failed to contribute recovery bootstrap passphrase",
+                        ));
+                    }
+                };
+                Ok(wrap_bootstrap_response(proto_result))
+            }
+            Self::HandleContributeUnsealPassphrase(result) => {
+                let proto_result = match result {
+                    Ok(true) => ProtoUnsealResult::Success,
+                    Ok(false) => ProtoUnsealResult::AwaitingContributions,
+                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
+                        return Err(Status::permission_denied(err.to_string()));
+                    }
+                    Err(err) => {
+                        warn!(?err, "contribute unseal passphrase failed");
+                        return Err(Status::internal("Failed to contribute unseal passphrase"));
+                    }
+                };
+                Ok(wrap_unseal_response(UnsealResponsePayload::Result(
+                    proto_result.into(),
+                )))
+            }
+            Self::HandleContributeRecoveryUnsealPassphrase(result) => {
+                let proto_result = match result {
+                    Ok(true) => ProtoUnsealResult::Success,
+                    Ok(false) => ProtoUnsealResult::AwaitingContributions,
+                    Err(err @ vault_gate::Error::RoleNotPermitted) => {
+                        return Err(Status::permission_denied(err.to_string()));
+                    }
+                    Err(err) => {
+                        warn!(?err, "contribute recovery unseal passphrase failed");
+                        return Err(Status::internal(
+                            "Failed to contribute recovery unseal passphrase",
+                        ));
+                    }
+                };
+                Ok(wrap_unseal_response(UnsealResponsePayload::Result(
+                    proto_result.into(),
+                )))
+            }
        }
    }
 }
--- a/server/crates/arbiter-server/src/peers/client/auth.rs
+++ b/server/crates/arbiter-server/src/peers/client/auth.rs
@@ -12,7 +12,7 @@ use crate::{
        schema::program_client,
    },
 };
-use arbiter_crypto::authn::{self, AuthChallenge, CLIENT_CONTEXT};
+use arbiter_crypto::authn::{self, AuthChallenge, SigningContext};
 use arbiter_proto::{
    ClientMetadata,
    transport::{Bi, expect_message},
@@ -298,7 +298,7 @@ where

    let signature = expect_message(transport, |req: Inbound| match req {
        Inbound::AuthChallengeSolution { signature } => Some(signature),
-        _ => None,
+        Inbound::AuthChallengeRequest { .. } => None,
    })
    .await
    .map_err(|e| {
@@ -306,7 +306,7 @@ where
        Error::Transport
    })?;

-    if !pubkey.verify(&challenge, CLIENT_CONTEXT, &signature) {
+    if !pubkey.verify(&challenge, SigningContext::Client, &signature) {
        error!("Challenge solution verification failed");
        return Err(Error::InvalidChallengeSolution);
    }
--- a/server/crates/arbiter-server/src/peers/operator/auth/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/mod.rs
@@ -1,4 +1,4 @@
-use super::{Credentials, OperatorConnection};
+use super::{AuthenticatedOperator, OperatorConnection};
 use arbiter_crypto::authn::{self, AuthChallenge};
 use arbiter_proto::transport::Bi;

@@ -71,7 +71,7 @@ fn parse_auth_event(payload: Inbound) -> AuthEvents {
 pub async fn authenticate<T>(
    props: &mut OperatorConnection,
    transport: &mut T,
-) -> Result<Credentials, Error>
+) -> Result<AuthenticatedOperator, Error>
 where
    T: Bi<Inbound, Result<Outbound, Error>> + Send + ?Sized,
 {
--- a/server/crates/arbiter-server/src/peers/operator/auth/state.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/state.rs
@@ -1,32 +1,35 @@
 use super::{
-    super::{Credentials, OperatorConnection},
+    super::{AuthenticatedOperator, Credentials, OperatorConnection, RecoveryCredentials},
    Error,
 };
 use crate::{
-    actors::bootstrap::ConsumeToken,
-    db::{DatabasePool, schema::operator_identity},
+    actors::bootstrap::VerifyToken,
+    db::{
+        DatabasePool,
+        schema::{arbiter_settings, operator_identity, recovery_operator_identity},
+    },
    peers::operator::auth::Outbound,
 };
-use arbiter_crypto::authn::{self, AuthChallenge, OPERATOR_CONTEXT};
+use arbiter_crypto::authn::{self, AuthChallenge, SigningContext};
 use arbiter_proto::transport::Bi;

 use diesel::{ExpressionMethods as _, OptionalExtension as _, QueryDsl};
-use diesel_async::RunQueryDsl;
+use diesel_async::{AsyncConnection as _, RunQueryDsl};
 use tracing::error;

-pub(super) struct ChallengeRequest {
-    pub(super) pubkey: authn::PublicKey,
-    pub(super) bootstrap_token: Option<String>,
+pub(crate) struct ChallengeRequest {
+    pub(crate) pubkey: authn::PublicKey,
+    pub(crate) bootstrap_token: Option<String>,
 }

-pub(super) struct ChallengeContext {
-    pub(super) challenge: AuthChallenge,
-    pub(super) pubkey: authn::PublicKey,
-    pub(super) bootstrap_token: Option<String>,
+pub struct ChallengeContext {
+    pub challenge: AuthChallenge,
+    pub pubkey: authn::PublicKey,
+    pub bootstrap_token: Option<String>,
 }

-pub(super) struct ChallengeSolution {
-    pub(super) solution: Vec<u8>,
+pub(crate) struct ChallengeSolution {
+    pub(crate) solution: Vec<u8>,
 }

 smlang::statemachine!(
@@ -34,7 +37,7 @@ smlang::statemachine!(
    custom_error: true,
    transitions: {
        *Init + AuthRequest(ChallengeRequest) / async prepare_challenge = SentChallenge(ChallengeContext),
-        SentChallenge(ChallengeContext) + ReceivedSolution(ChallengeSolution) / async verify_solution = AuthOk(Credentials),
+        SentChallenge(ChallengeContext) + ReceivedSolution(ChallengeSolution) / async verify_solution = AuthOk(AuthenticatedOperator),
    }
 );

@@ -56,6 +59,27 @@ async fn get_client_id(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<O
        })
 }

+async fn get_recovery_operator_id(
+    db: &DatabasePool,
+    pubkey: &authn::PublicKey,
+) -> Result<Option<i32>, Error> {
+    let mut conn = db.get().await.map_err(|e| {
+        error!(error = ?e, "Database pool error");
+        Error::internal("Database unavailable")
+    })?;
+
+    recovery_operator_identity::table
+        .filter(recovery_operator_identity::public_key.eq(pubkey.to_bytes()))
+        .select(recovery_operator_identity::id)
+        .first::<i32>(&mut conn)
+        .await
+        .optional()
+        .map_err(|e| {
+            error!(error = ?e, "Database error");
+            Error::internal("Database operation failed")
+        })
+}
+
 async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i32, Error> {
    let pubkey_bytes = pubkey.to_bytes();
    let mut conn = db.get().await.map_err(|e| {
@@ -63,17 +87,32 @@ async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i3
        Error::internal("Database unavailable")
    })?;

-    let id: i32 = diesel::insert_into(operator_identity::table)
-        .values((operator_identity::public_key.eq(pubkey_bytes),))
-        .returning(operator_identity::id)
-        .get_result(&mut conn)
-        .await
-        .map_err(|e| {
-            error!(error = ?e, "Database error");
-            Error::internal("Database operation failed")
-        })?;
+    conn.transaction(async move |conn| {
+        // The database is authoritative on whether bootstrap has completed: `Vault::bootstrap`
+        // commits `root_key_id` before it publishes `events::Bootstrapped`, and `Bootstrapper`
+        // only learns of that two mailbox hops later. Re-checking it here, in the same
+        // transaction as the insert, closes that window deterministically instead of trusting
+        // a token that verified against `Bootstrapper`'s possibly-stale in-memory state.
+        let already_bootstrapped: bool = arbiter_settings::table
+            .select(arbiter_settings::root_key_id)
+            .first::<Option<i32>>(&mut *conn)
+            .await?
+            .is_some();

-    Ok(id)
+        if already_bootstrapped {
+            error!("Bootstrap token used to register after the vault was already bootstrapped");
+            return Err(Error::InvalidBootstrapToken);
+        }
+
+        let id: i32 = diesel::insert_into(operator_identity::table)
+            .values((operator_identity::public_key.eq(pubkey_bytes),))
+            .returning(operator_identity::id)
+            .get_result(&mut *conn)
+            .await?;
+
+        Ok(id)
+    })
+    .await
 }

 pub(super) struct AuthContext<'a, T: ?Sized> {
@@ -100,12 +139,14 @@ where
            bootstrap_token,
        }: ChallengeRequest,
    ) -> Result<ChallengeContext, Self::Error> {
-        // Verify pubkey is registered (unless bootstrapping)
-        if bootstrap_token.is_none() {
-            let id = get_client_id(&self.conn.db, &pubkey).await?;
-            if id.is_none() {
-                return Err(Error::UnregisteredPublicKey);
-            }
+        // Verify pubkey is registered in either identity table (unless bootstrapping)
+        if bootstrap_token.is_none()
+            && get_client_id(&self.conn.db, &pubkey).await?.is_none()
+            && get_recovery_operator_id(&self.conn.db, &pubkey)
+                .await?
+                .is_none()
+        {
+            return Err(Error::UnregisteredPublicKey);
        }

        let challenge = AuthChallenge::generate(&mut rand::rng());
@@ -127,8 +168,6 @@ where
        })
    }

-    #[allow(missing_docs)]
-    #[allow(clippy::unused_unit)]
    async fn verify_solution(
        &mut self,
        ChallengeContext {
@@ -137,13 +176,13 @@ where
            bootstrap_token,
        }: &ChallengeContext,
        ChallengeSolution { solution }: ChallengeSolution,
-    ) -> Result<Credentials, Self::Error> {
+    ) -> Result<AuthenticatedOperator, Self::Error> {
        let signature = authn::Signature::try_from(solution.as_slice()).map_err(|()| {
            error!("Failed to decode signature in challenge solution");
            Error::InvalidChallengeSolution
        })?;

-        let valid = pubkey.verify(challenge, OPERATOR_CONTEXT, &signature);
+        let valid = pubkey.verify(challenge, SigningContext::Operator, &signature);

        if !valid {
            self.transport
@@ -153,20 +192,21 @@ where
            return Err(Error::InvalidChallengeSolution);
        }

-        // Resolve client id: bootstrap (consume token + register) or lookup
-        let id = match bootstrap_token {
+        // Resolve the peer's role: bootstrap (verify token, then register as an ordinary
+        // operator) or look the key up in whichever identity table holds it.
+        let authenticated = match bootstrap_token {
            Some(token) => {
                let token_ok: bool = self
                    .conn
                    .actors
                    .bootstrapper
-                    .ask(ConsumeToken {
+                    .ask(VerifyToken {
                        token: token.clone(),
                    })
                    .await
                    .map_err(|e| {
-                        error!(?e, "Failed to consume bootstrap token");
-                        Error::internal("Failed to consume bootstrap token")
+                        error!(?e, "Failed to verify bootstrap token");
+                        Error::internal("Failed to verify bootstrap token")
                    })?;

                if !token_ok {
@@ -178,11 +218,59 @@ where
                    return Err(Error::InvalidBootstrapToken);
                }

-                register_key(&self.conn.db, pubkey).await?
+                let id = match register_key(&self.conn.db, pubkey).await {
+                    Ok(id) => id,
+                    // `register_key` refuses a token that verified here but lost the race
+                    // against bootstrap. Reported to the peer exactly like the refusal above,
+                    // so that operator sees a protocol error rather than a handshake that
+                    // stops with nothing on the wire.
+                    Err(Error::InvalidBootstrapToken) => {
+                        self.transport
+                            .send(Err(Error::InvalidBootstrapToken))
+                            .await
+                            .map_err(|_| Error::Transport)?;
+                        return Err(Error::InvalidBootstrapToken);
+                    }
+                    Err(err) => return Err(err),
+                };
+
+                AuthenticatedOperator::Ordinary(Credentials {
+                    id,
+                    pubkey: pubkey.clone(),
+                })
+            }
+            None => {
+                // The tables are searched in this order, so a key registered in both resolves
+                // as `Ordinary` and could never submit its recovery share. Nothing enforces
+                // that the two sets are disjoint: `unique` is per table, and the only writer
+                // today is `register_key` above -- `recovery_operator_identity` has no
+                // registration path yet. Whoever builds one must refuse a key that
+                // `operator_identity` already holds, and vice versa, or §3.5's "separate peer
+                // type" holds only by convention.
+                if let Some(id) = get_client_id(&self.conn.db, pubkey).await? {
+                    AuthenticatedOperator::Ordinary(Credentials {
+                        id,
+                        pubkey: pubkey.clone(),
+                    })
+                } else {
+                    // `prepare_challenge` already found the key in one of the tables, so
+                    // arriving here means it was removed mid-handshake. Reported to the peer
+                    // for the same reason `InvalidBootstrapToken` is above: an operator that
+                    // has sent its solution sees a protocol error rather than a handshake that
+                    // stops with nothing on the wire.
+                    let Some(id) = get_recovery_operator_id(&self.conn.db, pubkey).await? else {
+                        self.transport
+                            .send(Err(Error::UnregisteredPublicKey))
+                            .await
+                            .map_err(|_| Error::Transport)?;
+                        return Err(Error::UnregisteredPublicKey);
+                    };
+                    AuthenticatedOperator::Recovery(RecoveryCredentials {
+                        id,
+                        pubkey: pubkey.clone(),
+                    })
+                }
            }
-            None => get_client_id(&self.conn.db, pubkey)
-                .await?
-                .ok_or(Error::UnregisteredPublicKey)?,
        };

        self.transport
@@ -190,9 +278,6 @@ where
            .await
            .map_err(|_| Error::Transport)?;

-        Ok(Credentials {
-            id,
-            pubkey: pubkey.clone(),
-        })
+        Ok(authenticated)
    }
 }
--- a/server/crates/arbiter-server/src/peers/operator/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/mod.rs
@@ -33,6 +33,26 @@ impl Integrable for Credentials {
    const KIND: &'static str = "operator_credentials";
 }

+/// §3.5: recovery operators are a separate peer type with their own identity table. Their
+/// attestation kind differs from an ordinary operator's so the two id spaces cannot collide.
+#[derive(Debug, Clone, Hashable)]
+pub struct RecoveryCredentials {
+    pub id: i32,
+    pub pubkey: authn::PublicKey,
+}
+
+impl Integrable for RecoveryCredentials {
+    const KIND: &'static str = "recovery_operator_credentials";
+}
+
+/// The outcome of an operator handshake. The variant, not a field, decides what the peer may
+/// do — so no call site can pass an unauthenticated recovery id.
+#[derive(Debug, Clone)]
+pub enum AuthenticatedOperator {
+    Ordinary(Credentials),
+    Recovery(RecoveryCredentials),
+}
+
 // Messages, sent by operator to connection client without having a request
 #[derive(Debug)]
 pub enum OutOfBand {
@@ -62,6 +82,12 @@ pub enum Error {
    Transport,
    #[error("database error: {0}")]
    Database(DatabaseError),
+    /// §3.5: a recovery operator's authority stops at the vault gate. It has no operator
+    /// session, because a session is the whole ordinary-governance surface -- wallets, grants,
+    /// SDK clients, proposals -- which §3.5 puts out of a recovery operator's reach. Named
+    /// rather than folded into `Internal`, so a policy refusal is not logged as a fault.
+    #[error("recovery operators do not have an operator session")]
+    RecoveryOperatorHasNoSession,
    #[error("internal: {0}")]
    Internal(String),
 }
@@ -108,7 +134,7 @@ async fn should_run_gate(vault: &ActorRef<Vault>) -> Result<bool, Error> {
 async fn run_vault_gate<T>(
    props: &OperatorConnection,
    transport: &mut T,
-    auth_creds: Credentials,
+    auth_creds: AuthenticatedOperator,
 ) -> Result<(), Error>
 where
    T: Bi<vault_gate::Inbound, Result<vault_gate::Outbound, vault_gate::Error>> + Send + ?Sized,
@@ -168,18 +194,27 @@ where
    T: Bi<auth::Inbound, Result<auth::Outbound, auth::Error>> + Send,
    T: Bi<vault_gate::Inbound, Result<vault_gate::Outbound, vault_gate::Error>> + Send,
 {
-    let creds = authenticate(props, &mut transport).await?;
+    let authenticated = authenticate(props, &mut transport).await?;

    // should run vault gate only if sealed / unbootstrapped
    if should_run_gate(&props.actors.vault).await? {
-        run_vault_gate(props, &mut transport, creds.clone()).await?;
+        // §3.5 lets a recovery operator take part in unsealing, and the gate is where that
+        // happens, so both roles run it. The gate decides per message which role may send it.
+        run_vault_gate(props, &mut transport, authenticated.clone()).await?;
    }

+    // Past the gate the connection turns into an ordinary operator session, which a recovery
+    // operator may not have.
+    let AuthenticatedOperator::Ordinary(creds) = &authenticated else {
+        return Err(Error::RecoveryOperatorHasNoSession);
+    };
+
    // checking the integrity
-    verify_integrity(&props.db, &props.actors.vault, &creds).await?;
+    verify_integrity(&props.db, &props.actors.vault, creds).await?;

    Ok(OperatorSession::spawn(OperatorSession::new(
        props.clone(),
+        authenticated.clone(),
        oob_sender,
    )))
 }
--- a/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
@@ -1,9 +1,10 @@
 use super::{Error, OperatorSession};
+use crate::db::models::{OperatorIdentityId, ProposalId};
 use crate::{
    actors::{
        evm::{
-            ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
-            SignTransactionError as EvmSignError,
+            ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorDeleteGrant,
+            OperatorListGrants, SignTransactionError as EvmSignError,
        },
        flow_coordinator::client_connect_approval::ClientApprovalAnswer,
        vault::VaultState,
@@ -122,22 +123,23 @@ impl OperatorSession {
    }

    #[message]
-    pub(crate) fn handle_grant_delete(&mut self, grant_id: i32) -> Result<(), GrantMutationError> {
-        // match self
-        //     .props
-        //     .actors
-        //     .evm
-        //     .ask(OperatorDeleteGrant { grant_id })
-        //     .await
-        // {
-        //     Ok(()) => Ok(()),
-        //     Err(err) => {
-        //         error!(?err, "EVM grant delete failed");
-        //         Err(GrantMutationError::Internal)
-        //     }
-        // }
-        let _ = grant_id;
-        todo!()
+    pub(crate) async fn handle_grant_delete(
+        &mut self,
+        grant_id: i32,
+    ) -> Result<(), GrantMutationError> {
+        match self
+            .props
+            .actors
+            .evm
+            .ask(OperatorDeleteGrant { grant_id })
+            .await
+        {
+            Ok(()) => Ok(()),
+            Err(err) => {
+                error!(?err, "EVM grant delete failed");
+                Err(GrantMutationError::Internal)
+            }
+        }
    }

    #[message]
@@ -175,41 +177,27 @@ impl OperatorSession {
        entries: Vec<NewEvmWalletAccess>,
    ) -> Result<(), Error> {
        let mut conn = self.props.db.get().await?;
-        conn.transaction(async |conn| {
-            use crate::db::schema::evm_wallet_access;
-
-            for entry in entries {
-                diesel::insert_into(evm_wallet_access::table)
-                    .values(&entry)
-                    .on_conflict_do_nothing()
-                    .execute(&mut *conn)
-                    .await?;
-            }
-
-            Result::<_, Error>::Ok(())
-        })
-        .await?;
+        grant_wallet_access(&mut conn, entries).await?;
        Ok(())
    }

+    /// A revoke that matched fewer rows than it named did not do what the operator asked:
+    /// the id was never granted, or someone revoked it first. Answering `Ok` there tells the
+    /// operator access is cut off when nothing changed. The rows that did match stay revoked
+    /// -- rolling them back to report the shortfall would leave live access behind.
    #[message]
    pub(crate) async fn handle_revoke_evm_wallet_access(
        &mut self,
        entries: Vec<i32>,
    ) -> Result<(), Error> {
        let mut conn = self.props.db.get().await?;
-        conn.transaction(async |conn| {
-            use crate::db::schema::evm_wallet_access;
-            for entry in entries {
-                diesel::delete(evm_wallet_access::table)
-                    .filter(evm_wallet_access::wallet_id.eq(entry))
-                    .execute(&mut *conn)
-                    .await?;
-            }
-
-            Result::<_, Error>::Ok(())
-        })
-        .await?;
+        let revoked = revoke_wallet_access(&mut conn, &entries).await?;
+        if revoked != entries.len() {
+            return Err(Error::PartialRevoke {
+                requested: entries.len(),
+                revoked,
+            });
+        }
        Ok(())
    }

@@ -217,9 +205,10 @@ impl OperatorSession {
    pub(crate) async fn handle_list_wallet_access(
        &mut self,
    ) -> Result<Vec<EvmWalletAccess>, Error> {
-        let mut conn = self.props.db.get().await?;
        use crate::db::schema::evm_wallet_access;
+        let mut conn = self.props.db.get().await?;
        let access_entries = evm_wallet_access::table
+            .filter(evm_wallet_access::revoked_at.is_null())
            .select(EvmWalletAccess::as_select())
            .load::<_>(&mut conn)
            .await?;
@@ -227,6 +216,81 @@ impl OperatorSession {
    }
 }

+/// Grants access, reviving a previously revoked row rather than leaving it shadowed:
+/// `uniq_wallet_access` is a unique index on `(wallet_id, client_id)`, so a plain insert
+/// would conflict forever on a row that was revoked but never deleted.
+///
+/// Reviving restores visibility and nothing else: [`revoke_wallet_access`] closes the grants
+/// that hung off the access, so a persistent grant takes its own vote again (§3.2).
+pub(crate) async fn grant_wallet_access(
+    conn: &mut crate::db::DatabaseConnection,
+    entries: Vec<NewEvmWalletAccess>,
+) -> Result<(), diesel::result::Error> {
+    use crate::db::{models::SqliteTimestamp, schema::evm_wallet_access};
+
+    conn.transaction(async |conn| {
+        for entry in entries {
+            diesel::insert_into(evm_wallet_access::table)
+                .values(&entry)
+                .on_conflict((evm_wallet_access::wallet_id, evm_wallet_access::client_id))
+                .do_update()
+                .set(evm_wallet_access::revoked_at.eq(None::<SqliteTimestamp>))
+                .execute(&mut *conn)
+                .await?;
+        }
+
+        Ok(())
+    })
+    .await
+}
+
+/// Marks access rows revoked by their own id rather than deleting them, and revokes every
+/// grant that hangs off them. Returns how many access rows this call revoked.
+///
+/// The wire carries `WalletAccessEntry.id` values, so filtering by `wallet_id` here would
+/// revoke every client's access to that wallet. Deleting is not an option: `evm_basic_grant`,
+/// `evm_transaction_log`, and `proposal_persistent_grant` all reference this row
+/// `on delete restrict`, so an access that was ever granted, signed with, or proposed
+/// against can never be deleted -- only marked revoked.
+///
+/// The dependent grants have to go with it. `grant_wallet_access` revives a revoked row by
+/// its id, and grant lookup keys on `wallet_access_id` alone, so leaving the grants live
+/// would make a later re-grant restore every persistent grant the access ever held, with its
+/// original volume and rate limits. §3.2 votes visibility and a persistent grant separately;
+/// a committee that approves visibility must not silently hand back signing authority it did
+/// not vote on. The filter names every requested id, not just the rows this call flipped, so
+/// an access revoked before this fix has its orphaned grants closed too.
+pub(crate) async fn revoke_wallet_access(
+    conn: &mut crate::db::DatabaseConnection,
+    ids: &[i32],
+) -> Result<usize, diesel::result::Error> {
+    use crate::db::{
+        models::SqliteTimestamp,
+        schema::{evm_basic_grant, evm_wallet_access},
+    };
+
+    conn.transaction(async |conn| {
+        let now = SqliteTimestamp::now();
+
+        let revoked = diesel::update(evm_wallet_access::table)
+            .filter(evm_wallet_access::id.eq_any(ids))
+            .filter(evm_wallet_access::revoked_at.is_null())
+            .set(evm_wallet_access::revoked_at.eq(now.clone()))
+            .execute(&mut *conn)
+            .await?;
+
+        diesel::update(evm_basic_grant::table)
+            .filter(evm_basic_grant::wallet_access_id.eq_any(ids))
+            .filter(evm_basic_grant::revoked_at.is_null())
+            .set(evm_basic_grant::revoked_at.eq(now))
+            .execute(&mut *conn)
+            .await?;
+
+        Ok(revoked)
+    })
+    .await
+}
+
 #[messages]
 impl OperatorSession {
    #[message(ctx)]
@@ -278,3 +342,590 @@ impl OperatorSession {
        Ok(clients)
    }
 }
+
+#[messages]
+impl OperatorSession {
+    #[message]
+    pub(crate) async fn handle_create_proposal(
+        &mut self,
+        kind: crate::db::proposal::ProposalKind,
+        ttl_secs: Option<u32>,
+    ) -> Result<ProposalId, Error> {
+        use crate::actors::proposal_manager::CreateProposal;
+        let initiator_id = OperatorIdentityId::from_raw(self.ordinary_id()?);
+        self.props
+            .actors
+            .proposal_manager
+            .ask(CreateProposal { kind, initiator_id, ttl_secs })
+            .await
+            .map_err(|e| {
+                error!(?e, "create_proposal failed");
+                Error::internal("Failed to create proposal")
+            })
+    }
+
+    #[message]
+    pub(crate) async fn handle_cast_vote(
+        &mut self,
+        proposal_id: ProposalId,
+        approve: bool,
+        signature: Vec<u8>,
+    ) -> Result<crate::actors::proposal_manager::VoteOutcome, crate::actors::proposal_manager::Error> {
+        use crate::actors::proposal_manager::CastVote;
+        let operator_id = OperatorIdentityId::from_raw(
+            self.ordinary_id()
+                .map_err(|_| crate::actors::proposal_manager::Error::NotAllowedForRecoveryOperator)?,
+        );
+        self.props
+            .actors
+            .proposal_manager
+            .ask(CastVote { proposal_id, operator_id, approve, signature })
+            .await
+            .map_err(|err| match err {
+                SendError::HandlerError(e) => e,
+                _ => crate::actors::proposal_manager::Error::Unavailable,
+            })
+    }
+
+    #[message]
+    pub(crate) async fn handle_query_pending(
+        &mut self,
+    ) -> Vec<crate::actors::proposal_manager::ProposalSummary> {
+        use crate::actors::proposal_manager::QueryPending;
+        let Ok(id) = self.ordinary_id() else {
+            // The pending list is per ordinary operator; a recovery operator has no view of it.
+            return Vec::new();
+        };
+        let operator_id = OperatorIdentityId::from_raw(id);
+        self.props
+            .actors
+            .proposal_manager
+            .ask(QueryPending { operator_id })
+            .await
+            .unwrap_or_default()
+    }
+}
+
+#[messages]
+impl OperatorSession {
+    #[message]
+    pub(crate) async fn handle_contribute_rekey_passphrase(
+        &mut self,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        use crate::actors::vault_coordinator::ContributeRekey;
+        use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
+
+        let operator_id = self.ordinary_id()?;
+        self.props
+            .actors
+            .vault_coordinator
+            .ask(ContributeRekey {
+                operator_id,
+                passphrase: SafeCell::new(passphrase),
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+
+    /// §3.3: a re-key refreshes every share, recovery shares included, so a recovery operator
+    /// has one to contribute here.
+    ///
+    /// It cannot reach this handler yet: `peers::operator::start` refuses a recovery peer an
+    /// operator session, because a session carries the whole ordinary-governance surface that
+    /// §3.5 keeps out of a recovery operator's hands. Until a recovery-scoped session exists,
+    /// this refuses every caller -- which is the safe direction, and the id it would use comes
+    /// from the handshake either way.
+    #[message]
+    pub(crate) async fn handle_contribute_recovery_rekey_passphrase(
+        &mut self,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        use crate::actors::vault_coordinator::ContributeRecoveryRekey;
+        use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
+
+        let recovery_operator_id = self.recovery_id()?;
+        self.props
+            .actors
+            .vault_coordinator
+            .ask(ContributeRecoveryRekey {
+                recovery_operator_id,
+                passphrase: SafeCell::new(passphrase),
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{grant_wallet_access, revoke_wallet_access};
+    use crate::db::{self, models, schema};
+
+    use diesel::{ExpressionMethods as _, QueryDsl as _, dsl::insert_into};
+    use diesel_async::RunQueryDsl;
+
+    /// Inserts a fresh root key, an aead-encrypted wallet secret, and the wallet itself.
+    /// Returns the wallet's id and its 20-byte address.
+    async fn seed_wallet(conn: &mut db::DatabaseConnection) -> (models::EvmWalletId, Vec<u8>) {
+        let root_key_id: models::RootKeyHistoryId = insert_into(schema::root_key_history::table)
+            .values(&models::NewRootKeyHistory {
+                ciphertext: vec![0u8; 32],
+                tag: vec![0u8; 16],
+                root_key_encryption_nonce: vec![0u8; 24],
+                data_encryption_nonce: vec![0u8; 24],
+                schema_version: 1,
+                salt: vec![0u8; 16],
+            })
+            .returning(schema::root_key_history::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let aead_id: i32 = insert_into(schema::aead_encrypted::table)
+            .values(&models::NewAeadEncrypted {
+                ciphertext: vec![0u8; 32],
+                tag: vec![0u8; 16],
+                current_nonce: vec![0u8; 24],
+                schema_version: 1,
+                associated_root_key_id: root_key_id,
+                created_at: chrono::Utc::now().into(),
+            })
+            .returning(schema::aead_encrypted::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        let address = rand::random::<[u8; 20]>().to_vec();
+        let wallet_id: models::EvmWalletId = insert_into(schema::evm_wallet::table)
+            .values((
+                schema::evm_wallet::address.eq(address.clone()),
+                schema::evm_wallet::aead_encrypted_id.eq(aead_id),
+            ))
+            .returning(schema::evm_wallet::id)
+            .get_result(conn)
+            .await
+            .unwrap();
+
+        (wallet_id, address)
+    }
+
+    async fn seed_client_metadata(conn: &mut db::DatabaseConnection) -> i32 {
+        insert_into(schema::client_metadata::table)
+            .values(schema::client_metadata::name.eq("test"))
+            .returning(schema::client_metadata::id)
+            .get_result(conn)
+            .await
+            .unwrap()
+    }
+
+    /// Inserts a `program_client` row under the given `client_metadata` row, keyed by its
+    /// own random public key.
+    async fn seed_client(conn: &mut db::DatabaseConnection, metadata_id: i32) -> i32 {
+        insert_into(schema::program_client::table)
+            .values((
+                schema::program_client::public_key.eq(rand::random::<[u8; 32]>().to_vec()),
+                schema::program_client::metadata_id.eq(metadata_id),
+            ))
+            .returning(schema::program_client::id)
+            .get_result(conn)
+            .await
+            .unwrap()
+    }
+
+    /// Inserts an access row directly, for fixtures that need one to already exist.
+    /// Production code grants access through [`grant_wallet_access`].
+    async fn insert_wallet_access(
+        conn: &mut db::DatabaseConnection,
+        wallet_id: models::EvmWalletId,
+        client_id: i32,
+    ) -> i32 {
+        insert_into(schema::evm_wallet_access::table)
+            .values((
+                schema::evm_wallet_access::wallet_id.eq(wallet_id),
+                schema::evm_wallet_access::client_id.eq(client_id),
+            ))
+            .returning(schema::evm_wallet_access::id)
+            .get_result(conn)
+            .await
+            .unwrap()
+    }
+
+    /// The grants that grant lookup would treat as live for this access: the exact filter
+    /// `EtherTransfer::try_find_grant` and `TokenTransfer::try_find_grant` apply.
+    async fn live_grants_for(conn: &mut db::DatabaseConnection, access_id: i32) -> Vec<i32> {
+        schema::evm_basic_grant::table
+            .filter(schema::evm_basic_grant::wallet_access_id.eq(access_id))
+            .filter(schema::evm_basic_grant::revoked_at.is_null())
+            .select(schema::evm_basic_grant::id)
+            .load(conn)
+            .await
+            .unwrap()
+    }
+
+    /// Two clients share one wallet. Revoking one access row must leave the other alone,
+    /// and must mark the row revoked rather than deleting it.
+    #[tokio::test]
+    async fn revoking_one_access_leaves_the_other_client_alone() {
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let (wallet_id, _address) = seed_wallet(&mut conn).await;
+        let metadata_id = seed_client_metadata(&mut conn).await;
+        let first_client = seed_client(&mut conn, metadata_id).await;
+        let second_client = seed_client(&mut conn, metadata_id).await;
+
+        let first_access = insert_wallet_access(&mut conn, wallet_id, first_client).await;
+        let _second_access = insert_wallet_access(&mut conn, wallet_id, second_client).await;
+
+        let removed = revoke_wallet_access(&mut conn, &[first_access])
+            .await
+            .unwrap();
+        assert_eq!(removed, 1);
+
+        let active: Vec<i32> = schema::evm_wallet_access::table
+            .filter(schema::evm_wallet_access::revoked_at.is_null())
+            .select(schema::evm_wallet_access::client_id)
+            .load(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(
+            active,
+            vec![second_client],
+            "revoking one access row removed another client's access"
+        );
+
+        let total: i64 = schema::evm_wallet_access::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(
+            total, 2,
+            "revoking an access row must mark it revoked, not delete it"
+        );
+
+        // The count `handle_revoke_evm_wallet_access` answers on: a second revoke of the same
+        // id, like a revoke of an id that never existed, changes nothing and must say so.
+        let again = revoke_wallet_access(&mut conn, &[first_access])
+            .await
+            .unwrap();
+        assert_eq!(again, 0, "an already revoked access must report no rows");
+    }
+
+    /// The bug this round fixes: once an access has been used for a grant, a signed
+    /// transaction, or a proposed persistent grant, three tables reference
+    /// `evm_wallet_access` `on delete restrict`, so deleting the row is no longer possible
+    /// once foreign keys are enforced. Revoking must still succeed by marking it revoked.
+    #[tokio::test]
+    async fn revoking_an_access_with_grant_log_and_proposal_succeeds() {
+        use crate::db::proposal::{Proposal as _, persistent_grant, persistent_grant::PersistentGrant};
+
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let (wallet_id, _address) = seed_wallet(&mut conn).await;
+        let metadata_id = seed_client_metadata(&mut conn).await;
+        let client_id = seed_client(&mut conn, metadata_id).await;
+        let access_id = insert_wallet_access(&mut conn, wallet_id, client_id).await;
+
+        // A grant against this access...
+        let grant_id: i32 = insert_into(schema::evm_basic_grant::table)
+            .values(models::NewEvmBasicGrant {
+                wallet_access_id: access_id,
+                chain_id: 1u64.into(),
+                valid_from: None,
+                valid_until: None,
+                max_gas_fee_per_gas: None,
+                max_priority_fee_per_gas: None,
+                rate_limit_count: None,
+                rate_limit_window_secs: None,
+                revoked_at: None,
+            })
+            .returning(schema::evm_basic_grant::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+
+        // ...a signed transaction against that grant...
+        insert_into(schema::evm_transaction_log::table)
+            .values(models::NewEvmTransactionLog {
+                grant_id,
+                wallet_access_id: access_id,
+                chain_id: 1u64.into(),
+                eth_value: vec![0u8; 32],
+                signed_at: models::SqliteTimestamp(chrono::Utc::now()),
+            })
+            .execute(&mut conn)
+            .await
+            .unwrap();
+
+        // ...and a persistent-grant proposal that named this access before it was voted on.
+        let operator_id: models::OperatorIdentityId =
+            insert_into(schema::operator_identity::table)
+                .values(schema::operator_identity::public_key.eq(rand::random::<[u8; 32]>().to_vec()))
+                .returning(schema::operator_identity::id)
+                .get_result(&mut conn)
+                .await
+                .unwrap();
+        let proposal_id: models::ProposalId = insert_into(schema::proposal::table)
+            .values(&models::NewProposal {
+                kind: db::proposal::ProposalKindTag::ApprovePersistentGrant,
+                initiator_id: operator_id,
+                expires_at: models::SqliteTimestamp(chrono::Utc::now() + chrono::Duration::days(1)),
+            })
+            .returning(schema::proposal::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        PersistentGrant::insert(
+            proposal_id,
+            &persistent_grant::Settings {
+                wallet_access_id: access_id,
+                chain_id: 1,
+                valid_from_secs: None,
+                valid_until_secs: None,
+                max_gas_fee_per_gas: None,
+                max_priority_fee_per_gas: None,
+                rate_limit: None,
+                specific: persistent_grant::Specific::EtherTransfer {
+                    targets: vec![[0u8; 20]],
+                    limit: persistent_grant::VolumeLimit {
+                        max_volume: [0u8; 32],
+                        window_secs: 3600,
+                    },
+                },
+            },
+            &mut conn,
+        )
+        .await
+        .unwrap();
+
+        // Before this round's fix, this would fail with a foreign-key violation.
+        let removed = revoke_wallet_access(&mut conn, &[access_id]).await.unwrap();
+        assert_eq!(removed, 1);
+
+        let revoked_at: Option<models::SqliteTimestamp> = schema::evm_wallet_access::table
+            .find(access_id)
+            .select(schema::evm_wallet_access::revoked_at)
+            .first(&mut conn)
+            .await
+            .unwrap();
+        assert!(
+            revoked_at.is_some(),
+            "the row must be marked revoked, not deleted"
+        );
+    }
+
+    /// A revoked access must no longer resolve through the lookup `shared_analyze_transaction`
+    /// and `client_sign_transaction` share -- otherwise the SDK client keeps signing after
+    /// the operator believes it has been cut off.
+    #[tokio::test]
+    async fn revoked_access_no_longer_authorizes_signing() {
+        use crate::actors::{
+            GlobalActors,
+            evm::{EvmActor, SignTransactionError},
+            vault::Vault,
+        };
+        use alloy::{
+            consensus::TxEip1559,
+            eips::eip2930::AccessList,
+            primitives::{Address, Bytes, TxKind, U256},
+        };
+        use kameo::actor::Spawn as _;
+
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let (wallet_id, address) = seed_wallet(&mut conn).await;
+        let metadata_id = seed_client_metadata(&mut conn).await;
+        let client_id = seed_client(&mut conn, metadata_id).await;
+        let access_id = insert_wallet_access(&mut conn, wallet_id, client_id).await;
+        drop(conn);
+
+        let vault = Vault::spawn(
+            Vault::new(pool.clone(), GlobalActors::spawn_message_bus())
+                .await
+                .unwrap(),
+        );
+        let mut evm_actor = EvmActor::new(vault, pool.clone());
+
+        let transaction = TxEip1559 {
+            chain_id: 1,
+            nonce: 0,
+            gas_limit: 21_000,
+            max_fee_per_gas: 0,
+            max_priority_fee_per_gas: 0,
+            to: TxKind::Call(Address::ZERO),
+            value: U256::ZERO,
+            input: Bytes::new(),
+            access_list: AccessList::default(),
+        };
+        let wallet_address = Address::from_slice(&address);
+
+        // The paired positive case: while the access stands, both lookups resolve it and the
+        // calls fail further along (no grant, sealed vault) rather than at the access filter.
+        // Without this, a filter that rejected every row would pass the assertions below.
+        let live_analyze = evm_actor
+            .shared_analyze_transaction(client_id, wallet_address, transaction.clone())
+            .await;
+        assert!(
+            !matches!(live_analyze, Err(SignTransactionError::WalletNotFound)),
+            "a live access must resolve through shared_analyze_transaction: {live_analyze:?}"
+        );
+        let live_sign = evm_actor
+            .client_sign_transaction(client_id, wallet_address, transaction.clone())
+            .await;
+        assert!(
+            !matches!(live_sign, Err(SignTransactionError::WalletNotFound)),
+            "a live access must resolve through client_sign_transaction: {live_sign:?}"
+        );
+
+        let mut conn = pool.get().await.unwrap();
+        revoke_wallet_access(&mut conn, &[access_id]).await.unwrap();
+        drop(conn);
+
+        // Both lookups resolve access the same way; both must reject the revoked row before
+        // ever touching the vault (neither call bootstraps one).
+        let analyze_result = evm_actor
+            .shared_analyze_transaction(client_id, wallet_address, transaction.clone())
+            .await;
+        assert!(
+            matches!(analyze_result, Err(SignTransactionError::WalletNotFound)),
+            "a revoked access must not authorize shared_analyze_transaction: {analyze_result:?}"
+        );
+
+        let sign_result = evm_actor
+            .client_sign_transaction(client_id, wallet_address, transaction)
+            .await;
+        assert!(
+            matches!(sign_result, Err(SignTransactionError::WalletNotFound)),
+            "a revoked access must not authorize client_sign_transaction: {sign_result:?}"
+        );
+    }
+
+    /// Re-granting a revoked access must restore it rather than silently doing nothing:
+    /// `uniq_wallet_access` is a unique index on `(wallet_id, client_id)`, so a plain insert
+    /// would conflict on the revoked row forever.
+    #[tokio::test]
+    async fn regranting_a_revoked_access_restores_it() {
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let (wallet_id, _address) = seed_wallet(&mut conn).await;
+        let metadata_id = seed_client_metadata(&mut conn).await;
+        let client_id = seed_client(&mut conn, metadata_id).await;
+        let access_id = insert_wallet_access(&mut conn, wallet_id, client_id).await;
+
+        revoke_wallet_access(&mut conn, &[access_id]).await.unwrap();
+
+        grant_wallet_access(
+            &mut conn,
+            vec![models::NewEvmWalletAccess {
+                wallet_id,
+                client_id,
+            }],
+        )
+        .await
+        .unwrap();
+
+        let revoked_at: Option<models::SqliteTimestamp> = schema::evm_wallet_access::table
+            .find(access_id)
+            .select(schema::evm_wallet_access::revoked_at)
+            .first(&mut conn)
+            .await
+            .unwrap();
+        assert!(
+            revoked_at.is_none(),
+            "re-granting a revoked access must clear revoked_at"
+        );
+
+        let total: i64 = schema::evm_wallet_access::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        assert_eq!(
+            total, 1,
+            "re-granting a revoked access must revive the existing row, not add a second one"
+        );
+    }
+
+    /// §3.2 puts wallet visibility and a persistent grant to two separate votes. Reviving a
+    /// revoked access restores visibility, and must restore nothing else: grant lookup keys on
+    /// `wallet_access_id` with `revoked_at is null`, so a grant left open when the access was
+    /// cut off would come back live -- with its original volume and rate limits -- the moment
+    /// the id revives. `EvmActor::grant_wallet_access` executes an approved `GrantWalletAccess`
+    /// proposal, so that would hand signing authority back to a committee that voted only on
+    /// visibility.
+    #[tokio::test]
+    async fn regranting_an_access_does_not_revive_its_grants() {
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.unwrap();
+
+        let (wallet_id, _address) = seed_wallet(&mut conn).await;
+        let metadata_id = seed_client_metadata(&mut conn).await;
+        let client_id = seed_client(&mut conn, metadata_id).await;
+
+        let entry = || models::NewEvmWalletAccess {
+            wallet_id,
+            client_id,
+        };
+        grant_wallet_access(&mut conn, vec![entry()]).await.unwrap();
+        let access_id: i32 = schema::evm_wallet_access::table
+            .filter(schema::evm_wallet_access::wallet_id.eq(wallet_id))
+            .filter(schema::evm_wallet_access::client_id.eq(client_id))
+            .select(schema::evm_wallet_access::id)
+            .first(&mut conn)
+            .await
+            .unwrap();
+
+        // The row every persistent grant hangs off: the specific ether- or token-transfer
+        // rows reference it, so liveness is decided here.
+        let grant_id: i32 = insert_into(schema::evm_basic_grant::table)
+            .values(models::NewEvmBasicGrant {
+                wallet_access_id: access_id,
+                chain_id: 1u64.into(),
+                valid_from: None,
+                valid_until: None,
+                max_gas_fee_per_gas: None,
+                max_priority_fee_per_gas: None,
+                rate_limit_count: None,
+                rate_limit_window_secs: None,
+                revoked_at: None,
+            })
+            .returning(schema::evm_basic_grant::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+
+        assert_eq!(
+            live_grants_for(&mut conn, access_id).await,
+            vec![grant_id],
+            "the seeded grant must start out live, or the assertions below prove nothing"
+        );
+
+        revoke_wallet_access(&mut conn, &[access_id]).await.unwrap();
+        assert!(
+            live_grants_for(&mut conn, access_id).await.is_empty(),
+            "revoking an access must revoke the grants that hang off it"
+        );
+
+        grant_wallet_access(&mut conn, vec![entry()]).await.unwrap();
+
+        let revoked_at: Option<models::SqliteTimestamp> = schema::evm_wallet_access::table
+            .find(access_id)
+            .select(schema::evm_wallet_access::revoked_at)
+            .first(&mut conn)
+            .await
+            .unwrap();
+        assert!(
+            revoked_at.is_none(),
+            "re-granting must restore visibility for the access itself"
+        );
+        assert!(
+            live_grants_for(&mut conn, access_id).await.is_empty(),
+            "re-granting an access must not revive the grants it held before revocation"
+        );
+    }
+}
--- a/server/crates/arbiter-server/src/peers/operator/session/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/mod.rs
@@ -1,4 +1,4 @@
-use super::{OutOfBand, OperatorConnection};
+use super::{AuthenticatedOperator, OutOfBand, OperatorConnection};
 use crate::{
    actors::{
        flow_coordinator::client_connect_approval::ClientApprovalController,
@@ -19,6 +19,17 @@ pub enum Error {
    #[error("State transition failed")]
    State,

+    /// §3.5: the ordinary and recovery roles reach for different handlers here. A refusal is a
+    /// policy answer, so it is named rather than folded into `Internal` beside real faults.
+    #[error("This operator role may not perform that action")]
+    RoleNotPermitted,
+
+    /// Fewer access rows were revoked than the request named. Like `RoleNotPermitted` this is
+    /// an answer about the request, not a fault, so it is named rather than folded into
+    /// `Internal`.
+    #[error("Revoked {revoked} of {requested} wallet access entries")]
+    PartialRevoke { requested: usize, revoked: usize },
+
    #[error("Internal error: {message}")]
    Internal { message: Cow<'static, str> },
 }
@@ -51,6 +62,7 @@ pub struct PendingClientApproval {

 pub struct OperatorSession {
    props: OperatorConnection,
+    credentials: AuthenticatedOperator,
    sender: Box<dyn Sender<OutOfBand>>,

    pending_client_approvals: HashMap<Vec<u8>, PendingClientApproval>,
@@ -59,11 +71,31 @@ pub struct OperatorSession {
 pub mod handlers;

 impl OperatorSession {
-    pub(crate) fn new(props: OperatorConnection, sender: Box<dyn Sender<OutOfBand>>) -> Self {
+    pub(crate) fn new(props: OperatorConnection, credentials: AuthenticatedOperator, sender: Box<dyn Sender<OutOfBand>>) -> Self {
        Self {
            props,
+            credentials,
            sender,
-            pending_client_approvals: Default::default(),
+            pending_client_approvals: HashMap::default(),
+        }
+    }
+
+    /// The id of the ordinary operator on the other end, or a refusal.
+    ///
+    /// Read from the handshake, never from a request body, so a peer cannot act under an id it
+    /// did not authenticate as.
+    const fn ordinary_id(&self) -> Result<i32, Error> {
+        match &self.credentials {
+            AuthenticatedOperator::Ordinary(credentials) => Ok(credentials.id),
+            AuthenticatedOperator::Recovery(_) => Err(Error::RoleNotPermitted),
+        }
+    }
+
+    /// The id of the recovery operator on the other end, or a refusal. See `ordinary_id`.
+    const fn recovery_id(&self) -> Result<i32, Error> {
+        match &self.credentials {
+            AuthenticatedOperator::Recovery(credentials) => Ok(credentials.id),
+            AuthenticatedOperator::Ordinary(_) => Err(Error::RoleNotPermitted),
        }
    }
 }
--- a/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
@@ -1,10 +1,14 @@
-use super::Credentials;
+use super::AuthenticatedOperator;
 use crate::{
    actors::{
        GlobalActors,
        vault::{self, Bootstrap, GetState, TryUnseal, VaultState, events},
+        vault_coordinator::{
+            ContributeBootstrap, ContributeRecoveryBootstrap, ContributeRecoveryUnseal,
+            ContributeUnseal, StartBootstrap,
+        },
    },
-    crypto::integrity::{self},
+    crypto::{KeyCell, integrity::{self}},
    db::DatabasePool,
 };
 use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
@@ -17,6 +21,9 @@ use tokio::sync::oneshot;
 use tracing::{error, info};
 use x25519_dalek::{EphemeralSecret, PublicKey, SharedSecret};

+pub use VaultGateMessage as Inbound;
+pub use VaultGateMessageReply as Outbound;
+
 pub mod state;

 #[derive(Debug, thiserror::Error)]
@@ -29,6 +36,12 @@ pub enum Error {
    #[error("State transition failed")]
    State,

+    /// §3.5: ordinary and recovery operators hold different shares of the same split, so each
+    /// contribution belongs to exactly one of the two roles. A refusal here is a policy answer
+    /// and is kept out of `Internal`, which carries genuine faults.
+    #[error("This operator role may not perform that vault action")]
+    RoleNotPermitted,
+
    #[error("Internal error: {0}")]
    Internal(String),
 }
@@ -43,7 +56,7 @@ pub struct HandshakeResponse {
 }

 pub struct VaultGate {
-    pub auth_creds: Credentials,
+    pub auth_creds: AuthenticatedOperator,
    pub promotion_tx: Option<oneshot::Sender<Result<(), Error>>>,
    pub state: State,
    pub actors: GlobalActors,
@@ -52,7 +65,7 @@ pub struct VaultGate {

 impl VaultGate {
    pub fn new(
-        auth_creds: Credentials,
+        auth_creds: AuthenticatedOperator,
        actors: GlobalActors,
        db: DatabasePool,
        promotion_tx: oneshot::Sender<Result<(), Error>>,
@@ -93,16 +106,33 @@ impl Actor for VaultGate {
 }

 impl VaultGate {
+    /// The id of the ordinary operator on the other end, or a refusal.
+    ///
+    /// The id is read from the handshake rather than from the request body, so a peer cannot
+    /// name an operator it did not authenticate as.
+    const fn ordinary_id(&self) -> Result<i32, Error> {
+        match &self.auth_creds {
+            AuthenticatedOperator::Ordinary(credentials) => Ok(credentials.id),
+            AuthenticatedOperator::Recovery(_) => Err(Error::RoleNotPermitted),
+        }
+    }
+
+    /// The id of the recovery operator on the other end, or a refusal. See `ordinary_id`.
+    const fn recovery_id(&self) -> Result<i32, Error> {
+        match &self.auth_creds {
+            AuthenticatedOperator::Recovery(credentials) => Ok(credentials.id),
+            AuthenticatedOperator::Ordinary(_) => Err(Error::RoleNotPermitted),
+        }
+    }
+
    fn decrypt_key(
        secret: &SharedSecret,
        nonce: &[u8],
        ciphertext: &[u8],
        associated_data: &[u8],
-    ) -> Result<SafeCell<Vec<u8>>, ()> {
+    ) -> Result<KeyCell, ()> {
        let nonce = XNonce::from_slice(nonce);
-
        let cipher = XChaCha20Poly1305::new(secret.as_bytes().into());
-
        let mut key_buffer = SafeCell::new(ciphertext.to_vec());

        let decryption_result = key_buffer.write_inline(|write_handle| {
@@ -110,7 +140,9 @@ impl VaultGate {
        });

        match decryption_result {
-            Ok(()) => Ok(key_buffer),
+            Ok(()) => KeyCell::try_from(key_buffer).map_err(|()| {
+                error!("Decrypted key material has unexpected length");
+            }),
            Err(err) => {
                error!(?err, "Failed to decrypt encrypted key material");
                Err(())
@@ -119,7 +151,7 @@ impl VaultGate {
    }
 }

-#[messages(messages = Inbound, replies = Outbound)]
+#[messages(enum)]
 impl VaultGate {
    #[message]
    pub fn handle_handshake(
@@ -141,6 +173,13 @@ impl VaultGate {
        })
    }

+    /// Deliberately open to both roles, unlike `handle_bootstrap_encrypted_key` below.
+    ///
+    /// Handing over the whole seal key to open a sealed vault is participating in unsealing,
+    /// which §3.5 grants a recovery operator, and the peer has to hold that key already -- it
+    /// gains nothing here it did not bring. Bootstrap is the opposite: it *chooses* the key for
+    /// a vault that has none, which is sole custody of the root key and belongs to no §3.5
+    /// power. The reasoning that admits one does not admit the other.
    #[message]
    pub async fn handle_unseal_encrypted_key(
        &mut self,
@@ -152,17 +191,14 @@ impl VaultGate {
            return Err(Error::State);
        };

-        let Ok(seal_key_buffer) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data)
-        else {
+        let Ok(seal_key) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data) else {
            return Err(Error::InvalidKey);
        };

        match self
            .actors
            .vault
-            .ask(TryUnseal {
-                seal_key_raw: seal_key_buffer,
-            })
+            .ask(TryUnseal { seal_key })
            .await
        {
            Ok(()) => {
@@ -181,6 +217,10 @@ impl VaultGate {
        }
    }

+    /// §3.4/§3.5: bootstrapping picks the root key for a vault that has none, so whoever gets
+    /// here holds sole custody until the committee splits it. That is not one of a recovery
+    /// operator's two powers, and the check comes first because the vault commits before this
+    /// handler could refuse anything afterwards.
    #[message]
    pub async fn handle_bootstrap_encrypted_key(
        &mut self,
@@ -188,21 +228,20 @@ impl VaultGate {
        ciphertext: Vec<u8>,
        associated_data: Vec<u8>,
    ) -> Result<(), Error> {
+        let _ = self.ordinary_id()?;
+
        let State::ReadyForExchange { secret, .. } = &self.state else {
            return Err(Error::State);
        };

-        let Ok(seal_key_buffer) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data)
-        else {
+        let Ok(seal_key) = Self::decrypt_key(secret, &nonce, &ciphertext, &associated_data) else {
            return Err(Error::InvalidKey);
        };

        match self
            .actors
            .vault
-            .ask(Bootstrap {
-                seal_key_raw: seal_key_buffer,
-            })
+            .ask(Bootstrap { seal_key })
            .await
        {
            Ok(()) => {
@@ -234,6 +273,97 @@ impl VaultGate {

        Ok(answer)
    }
+
+    #[message]
+    pub async fn handle_declare_committee(
+        &mut self,
+        count: usize,
+        recovery_count: usize,
+    ) -> Result<(), Error> {
+        let operator_id = self.ordinary_id()?;
+
+        self.actors
+            .vault_coordinator
+            .ask(StartBootstrap {
+                operator_id,
+                declared_count: count,
+                recovery_count,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+
+    #[message]
+    pub async fn handle_contribute_bootstrap_passphrase(
+        &mut self,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        let operator_id = self.ordinary_id()?;
+
+        let passphrase_cell = SafeCell::new(passphrase);
+        self.actors
+            .vault_coordinator
+            .ask(ContributeBootstrap {
+                operator_id,
+                passphrase: passphrase_cell,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+
+    #[message]
+    pub async fn handle_contribute_recovery_bootstrap_passphrase(
+        &mut self,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        let recovery_operator_id = self.recovery_id()?;
+
+        let passphrase_cell = SafeCell::new(passphrase);
+        self.actors
+            .vault_coordinator
+            .ask(ContributeRecoveryBootstrap {
+                recovery_operator_id,
+                passphrase: passphrase_cell,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+
+    #[message]
+    pub async fn handle_contribute_unseal_passphrase(
+        &mut self,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        let operator_id = self.ordinary_id()?;
+
+        let passphrase_cell = SafeCell::new(passphrase);
+        self.actors
+            .vault_coordinator
+            .ask(ContributeUnseal {
+                operator_id,
+                passphrase: passphrase_cell,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
+
+    #[message]
+    pub async fn handle_contribute_recovery_unseal_passphrase(
+        &mut self,
+        passphrase: Vec<u8>,
+    ) -> Result<bool, Error> {
+        let recovery_operator_id = self.recovery_id()?;
+
+        let passphrase_cell = SafeCell::new(passphrase);
+        self.actors
+            .vault_coordinator
+            .ask(ContributeRecoveryUnseal {
+                recovery_operator_id,
+                passphrase: passphrase_cell,
+            })
+            .await
+            .map_err(|_| Error::internal("VaultCoordinator unavailable"))
+    }
 }

 impl Message<events::Bootstrapped> for VaultGate {
@@ -250,13 +380,28 @@ impl Message<events::Bootstrapped> for VaultGate {
                .get()
                .await
                .map_err(|_| Error::internal("DB unavailable"))?;
-            integrity::sign_entity(
-                &mut conn,
-                &self.actors.vault,
-                &self.auth_creds,
-                self.auth_creds.id,
-            )
-            .await
+            // Each role signs under its own `Integrable::KIND`, so the two id spaces cannot
+            // collide in `integrity_envelope`.
+            match &self.auth_creds {
+                AuthenticatedOperator::Ordinary(credentials) => {
+                    integrity::sign_entity(
+                        &mut conn,
+                        &self.actors.vault,
+                        credentials,
+                        credentials.id,
+                    )
+                    .await
+                }
+                AuthenticatedOperator::Recovery(credentials) => {
+                    integrity::sign_entity(
+                        &mut conn,
+                        &self.actors.vault,
+                        credentials,
+                        credentials.id,
+                    )
+                    .await
+                }
+            }
            .map_err(|e| {
                error!(?e, "Failed to sign integrity envelope on bootstrap");
                Error::internal("Integrity sign failed")
--- a/server/crates/arbiter-server/tests/client/auth.rs
+++ b/server/crates/arbiter-server/tests/client/auth.rs
@@ -1,8 +1,5 @@
-use super::common::ChannelTransport;
-use arbiter_crypto::{
-    authn::{self, AuthChallenge, CLIENT_CONTEXT},
-    safecell::{SafeCell, SafeCellHandle as _},
-};
+use super::common::{ChannelTransport, spawn_actors};
+use arbiter_crypto::authn::{self, AuthChallenge, SigningContext};
 use arbiter_proto::{
    ClientMetadata,
    transport::{Receiver, Sender},
@@ -74,7 +71,7 @@ async fn insert_registered_client(
 fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -> authn::Signature {
    let challenge = challenge.format();
    key.signing_key()
-        .sign_deterministic(&challenge, CLIENT_CONTEXT)
+        .sign_deterministic(&challenge, SigningContext::Client.as_bytes())
        .unwrap()
        .into()
 }
@@ -96,11 +93,11 @@ async fn insert_bootstrap_sentinel_operator(db: &db::DatabasePool) {
 async fn spawn_test_actors(db: &db::DatabasePool) -> GlobalActors {
    insert_bootstrap_sentinel_operator(db).await;

-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
--- a/server/crates/arbiter-server/tests/common/mod.rs
+++ b/server/crates/arbiter-server/tests/common/mod.rs
@@ -2,7 +2,6 @@
    dead_code,
    reason = "Common test utilities that may not be used in every test"
 )]
-use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use arbiter_proto::transport::{Bi, Error, Receiver, Sender};
 use arbiter_server::{
    actors::{GlobalActors, vault::Vault},
@@ -19,12 +18,42 @@ pub(crate) async fn bootstrapped_vault(db: &db::DatabasePool) -> Vault {
        .await
        .unwrap();
    actor
-        .bootstrap(SafeCell::new(b"test-seal-key".to_vec()))
+        .bootstrap(arbiter_server::crypto::KeyCell::from([0u8; 32]))
        .await
        .unwrap();
    actor
 }

+/// Spawns a full `GlobalActors` for a test, backing `Bootstrapper`'s token file with a
+/// throwaway temp directory rather than the real `~/.arbiter` -- a test must never be able to
+/// reach, let alone write to, the developer's real bootstrap token file.
+pub(crate) async fn spawn_actors(db: db::DatabasePool) -> GlobalActors {
+    let home = tempfile::tempdir().expect("failed to create a temp home directory for a test");
+    GlobalActors::spawn_in(db, home.path())
+        .await
+        .expect("failed to spawn GlobalActors for a test")
+}
+
+/// Retries `probe` until it yields a value, then returns it.
+///
+/// Effects that travel over the message bus are not visible the moment the publishing call
+/// returns: `Publish` only enqueues to the bus's mailbox, which then delivers to each
+/// subscriber's mailbox in turn. A test observing such an effect waits for it instead of
+/// reading straight after the call that triggered it.
+pub(crate) async fn eventually<T, F, Fut>(what: &str, mut probe: F) -> T
+where
+    F: FnMut() -> Fut,
+    Fut: Future<Output = Option<T>>,
+{
+    for _ in 0..100 {
+        if let Some(value) = probe().await {
+            return value;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(20)).await;
+    }
+    panic!("{what} did not happen within 2s");
+}
+
 pub(crate) async fn root_key_history_id(db: &db::DatabasePool) -> i32 {
    let mut conn = db.get().await.unwrap();
    let id = schema::arbiter_settings::table
--- a/server/crates/arbiter-server/tests/governance.rs
+++ b/server/crates/arbiter-server/tests/governance.rs
--- a/server/crates/arbiter-server/tests/operator/auth.rs
+++ b/server/crates/arbiter-server/tests/operator/auth.rs
@@ -1,14 +1,16 @@
-use super::common::ChannelTransport;
-use arbiter_crypto::{
-    authn::{self, AuthChallenge, OPERATOR_CONTEXT},
-    safecell::{SafeCell, SafeCellHandle as _},
-};
+use super::common::{ChannelTransport, bootstrapped_vault, eventually, spawn_actors};
+use arbiter_crypto::authn::{self, AuthChallenge, SigningContext};
 use arbiter_proto::transport::{Error as TransportError, Receiver, Sender};
 use arbiter_server::{
-    actors::{GlobalActors, bootstrap::GetToken, vault::Bootstrap},
+    actors::{
+        bootstrap::GetToken,
+        vault::{self, Bootstrap},
+    },
    crypto::integrity,
    db::{self, schema},
-    peers::operator::{self, Credentials, OperatorConnection, auth, vault_gate},
+    peers::operator::{
+        self, AuthenticatedOperator, Credentials, OperatorConnection, auth, vault_gate,
+    },
 };

 use async_trait::async_trait;
@@ -27,7 +29,7 @@ fn sign_operator_challenge(
 ) -> authn::Signature {
    let challenge = challenge.format();
    key.signing_key()
-        .sign_deterministic(&challenge, OPERATOR_CONTEXT)
+        .sign_deterministic(&challenge, SigningContext::Operator.as_bytes())
        .unwrap()
        .into()
 }
@@ -153,14 +155,7 @@ impl Sender<auth::Inbound> for StartTestTransport {
 #[test_log::test]
 pub async fn bootstrap_token_auth() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
-    actors
-        .vault
-        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
-        })
-        .await
-        .unwrap();
+    let actors = spawn_actors(db.clone()).await;
    let token = actors.bootstrapper.ask(GetToken).await.unwrap().unwrap();

    let (mut server_transport, mut test_transport) = ChannelTransport::new();
@@ -203,22 +198,156 @@ pub async fn bootstrap_token_auth() {
        .expect("should receive auth result");
    assert!(matches!(response, Ok(auth::Outbound::AuthSuccess)));

-    task.await.unwrap().unwrap();
+    let authenticated = task.await.unwrap().unwrap();

    let mut conn = db.get().await.unwrap();
-    let stored_pubkey: Vec<u8> = schema::operator_identity::table
-        .select(schema::operator_identity::public_key)
-        .first::<Vec<u8>>(&mut conn)
+    let (stored_id, stored_pubkey): (i32, Vec<u8>) = schema::operator_identity::table
+        .select((
+            schema::operator_identity::id,
+            schema::operator_identity::public_key,
+        ))
+        .first::<(i32, Vec<u8>)>(&mut conn)
        .await
        .unwrap();
    assert_eq!(stored_pubkey, verifying_key(&new_key).encode().0.to_vec());
+
+    // A key registered through the bootstrap token is an ordinary operator, carrying the id its
+    // registration wrote. Asserted here because this is the file's only bootstrap-arm check on
+    // what `authenticate` actually returns.
+    match authenticated {
+        AuthenticatedOperator::Ordinary(creds) => assert_eq!(creds.id, stored_id),
+        AuthenticatedOperator::Recovery(creds) => panic!(
+            "expected the ordinary role, got a recovery operator with id {}",
+            creds.id
+        ),
+    }
 }

+/// A multi-operator committee must all register with the same bootstrap token before bootstrap
+/// completes, so verifying the token must not consume it. This is the reachability bug fixed by
+/// replacing `consume_token` with `verify_token`.
 #[tokio::test]
 #[test_log::test]
-pub async fn bootstrap_invalid_token_auth() {
+pub async fn bootstrap_token_registers_every_committee_member() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
+    let token = actors.bootstrapper.ask(GetToken).await.unwrap().unwrap();
+
+    for _ in 0..2 {
+        let (mut server_transport, mut test_transport) = ChannelTransport::new();
+        let db_for_task = db.clone();
+        let actors_for_task = actors.clone();
+        let task = tokio::spawn(async move {
+            let mut props = OperatorConnection::new(db_for_task, actors_for_task);
+            auth::authenticate(&mut props, &mut server_transport).await
+        });
+
+        let new_key = MlDsa87::key_gen(&mut rand::rng());
+        test_transport
+            .send(auth::Inbound::AuthChallengeRequest {
+                pubkey: verifying_key(&new_key).into(),
+                bootstrap_token: Some(token.clone()),
+            })
+            .await
+            .unwrap();
+
+        let response = test_transport
+            .recv()
+            .await
+            .expect("should receive challenge");
+        let challenge = match response {
+            Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
+            other => panic!("Expected AuthChallenge, got {other:?}"),
+        };
+
+        let signature = sign_operator_challenge(&new_key, &challenge);
+        test_transport
+            .send(auth::Inbound::AuthChallengeSolution {
+                signature: signature.to_bytes(),
+            })
+            .await
+            .unwrap();
+
+        let response = test_transport
+            .recv()
+            .await
+            .expect("should receive auth result");
+        assert!(matches!(response, Ok(auth::Outbound::AuthSuccess)));
+
+        task.await.unwrap().unwrap();
+    }
+
+    let mut conn = db.get().await.unwrap();
+    let registered: i64 = schema::operator_identity::table
+        .count()
+        .get_result(&mut conn)
+        .await
+        .unwrap();
+    assert_eq!(registered, 2);
+
+    // Bootstrap has not completed: the token must still be valid.
+    assert_eq!(
+        actors.bootstrapper.ask(GetToken).await.unwrap(),
+        Some(token)
+    );
+}
+
+/// `GlobalActors` must subscribe `Bootstrapper` to `events::Bootstrapped` on the message bus.
+/// Without that one registration the token stays valid forever in production, which is the
+/// defect this task exists to fix, and no other test notices: the test below drives the event
+/// handler directly, and the `challenge_auth` family never re-reads the token after
+/// bootstrapping. This one goes the whole way round -- real `Vault::bootstrap`, real bus --
+/// and waits for the effect rather than reading straight after the call, because `Publish`
+/// only enqueues to the bus's mailbox.
+#[tokio::test]
+#[test_log::test]
+pub async fn bootstrapped_event_retires_the_token_through_the_message_bus() {
+    let db = db::create_test_pool().await;
+    let actors = spawn_actors(db.clone()).await;
+
+    assert!(
+        actors.bootstrapper.ask(GetToken).await.unwrap().is_some(),
+        "the token must exist before the vault is bootstrapped"
+    );
+
+    actors
+        .vault
+        .ask(Bootstrap {
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
+        })
+        .await
+        .unwrap();
+
+    eventually("the bootstrap token to be retired", || async {
+        actors
+            .bootstrapper
+            .ask(GetToken)
+            .await
+            .unwrap()
+            .is_none()
+            .then_some(())
+    })
+    .await;
+}
+
+/// Once the vault reports `Bootstrapped`, the token is retired: further registrations must be
+/// rejected even with a token that verified successfully moments earlier.
+#[tokio::test]
+#[test_log::test]
+pub async fn bootstrap_token_rejected_after_bootstrapped_event() {
+    let db = db::create_test_pool().await;
+    let actors = spawn_actors(db.clone()).await;
+    let token = actors.bootstrapper.ask(GetToken).await.unwrap().unwrap();
+
+    // Drive the Bootstrapper's own event handler directly rather than through
+    // `actors.vault.ask(Bootstrap { .. })` + the message bus: bus delivery is fire-and-forget,
+    // so asserting on it would be racy. The handler under test is the same either way.
+    actors
+        .bootstrapper
+        .ask(vault::events::Bootstrapped)
+        .await
+        .unwrap();
+    assert!(actors.bootstrapper.ask(GetToken).await.unwrap().is_none());

    let (mut server_transport, mut test_transport) = ChannelTransport::new();
    let db_for_task = db.clone();
@@ -231,7 +360,7 @@ pub async fn bootstrap_invalid_token_auth() {
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
-            bootstrap_token: Some("invalid_token".to_owned()),
+            bootstrap_token: Some(token),
        })
        .await
        .unwrap();
@@ -267,15 +396,154 @@ pub async fn bootstrap_invalid_token_auth() {
    assert_eq!(count, 0);
 }

+/// `register_key`'s database gate must refuse a registration once `arbiter_settings.root_key_id`
+/// is set, even when `Bootstrapper`'s own in-memory token has not yet been retired -- exactly
+/// the two-mailbox-hop window between `Vault::bootstrap`'s commit and the `Bootstrapped` event
+/// reaching `Bootstrapper` in production. "database bootstrapped, Bootstrapper not yet notified"
+/// is reproduced deterministically by bootstrapping a throwaway `Vault` wired to its own message
+/// bus: it commits `root_key_id` in the same database without ever publishing to the bus
+/// `actors.bootstrapper` is registered on, so `actors.bootstrapper`'s token is left untouched.
+#[tokio::test]
+#[test_log::test]
+pub async fn bootstrap_token_rejected_once_the_database_is_bootstrapped() {
+    let db = db::create_test_pool().await;
+    let actors = spawn_actors(db.clone()).await;
+    let token = actors.bootstrapper.ask(GetToken).await.unwrap().unwrap();
+
+    bootstrapped_vault(&db).await;
+
+    // From Bootstrapper's point of view the token still verifies: it never received an event.
+    assert_eq!(
+        actors.bootstrapper.ask(GetToken).await.unwrap(),
+        Some(token.clone())
+    );
+
+    let (mut server_transport, mut test_transport) = ChannelTransport::new();
+    let db_for_task = db.clone();
+    let task = tokio::spawn(async move {
+        let mut props = OperatorConnection::new(db_for_task, actors);
+        auth::authenticate(&mut props, &mut server_transport).await
+    });
+
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    test_transport
+        .send(auth::Inbound::AuthChallengeRequest {
+            pubkey: verifying_key(&new_key).into(),
+            bootstrap_token: Some(token),
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport
+        .recv()
+        .await
+        .expect("should receive challenge");
+    let challenge = match response {
+        Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
+        other => panic!("Expected AuthChallenge, got {other:?}"),
+    };
+
+    let signature = sign_operator_challenge(&new_key, &challenge);
+    test_transport
+        .send(auth::Inbound::AuthChallengeSolution {
+            signature: signature.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    // The refusal has to reach the peer, not just the task's return value: a registration
+    // refused after the database was bootstrapped must look like the refusal of a token that
+    // never verified, rather than a handshake that stops with nothing on the wire.
+    let refusal = test_transport
+        .recv()
+        .await
+        .expect("the refusal must be sent to the peer");
+    assert!(matches!(refusal, Err(auth::Error::InvalidBootstrapToken)));
+
+    assert!(matches!(
+        task.await.unwrap(),
+        Err(auth::Error::InvalidBootstrapToken)
+    ));
+
+    let mut conn = db.get().await.unwrap();
+    let count: i64 = schema::operator_identity::table
+        .count()
+        .get_result::<i64>(&mut conn)
+        .await
+        .unwrap();
+    assert_eq!(count, 0);
+}
+
+#[tokio::test]
+#[test_log::test]
+pub async fn bootstrap_invalid_token_auth() {
+    let db = db::create_test_pool().await;
+    let actors = spawn_actors(db.clone()).await;
+
+    let (mut server_transport, mut test_transport) = ChannelTransport::new();
+    let db_for_task = db.clone();
+    let task = tokio::spawn(async move {
+        let mut props = OperatorConnection::new(db_for_task, actors);
+        auth::authenticate(&mut props, &mut server_transport).await
+    });
+
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
+    test_transport
+        .send(auth::Inbound::AuthChallengeRequest {
+            pubkey: verifying_key(&new_key).into(),
+            bootstrap_token: Some("invalid_token".to_owned()),
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport
+        .recv()
+        .await
+        .expect("should receive challenge");
+    let challenge = match response {
+        Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
+        other => panic!("Expected AuthChallenge, got {other:?}"),
+    };
+
+    let signature = sign_operator_challenge(&new_key, &challenge);
+    test_transport
+        .send(auth::Inbound::AuthChallengeSolution {
+            signature: signature.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    // The reference behaviour the refusal above has to match: a token that never verified is
+    // reported to the peer. Pinned here so the two refusal paths cannot drift apart again.
+    let refusal = test_transport
+        .recv()
+        .await
+        .expect("the refusal must be sent to the peer");
+    assert!(matches!(refusal, Err(auth::Error::InvalidBootstrapToken)));
+
+    assert!(matches!(
+        task.await.unwrap(),
+        Err(auth::Error::InvalidBootstrapToken)
+    ));
+
+    let mut conn = db.get().await.unwrap();
+    let count: i64 = schema::operator_identity::table
+        .count()
+        .get_result::<i64>(&mut conn)
+        .await
+        .unwrap();
+    assert_eq!(count, 0);
+}
+
 #[tokio::test]
 #[test_log::test]
 pub async fn challenge_auth() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
@@ -356,12 +624,12 @@ pub async fn challenge_auth() {
 #[test_log::test]
 pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;

    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
@@ -430,11 +698,11 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
 #[test_log::test]
 pub async fn challenge_auth_rejects_invalid_signature() {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;
    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(b"test-seal-key".to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from([0u8; 32]),
        })
        .await
        .unwrap();
@@ -506,3 +774,230 @@ pub async fn challenge_auth_rejects_invalid_signature() {
        Err(auth::Error::InvalidChallengeSolution)
    ));
 }
+
+/// §3.5: a recovery operator is a separate peer type. Its key resolves against
+/// `recovery_operator_identity`, and authentication reports the recovery role.
+///
+/// An ordinary operator is registered alongside it so the recovery key is not simply the only
+/// key on file: the handshake has to reach the recovery table while `operator_identity` is
+/// populated. Both tables autoincrement from 1, so the fixture also pushes the authenticating
+/// recovery operator to id 2 -- with one row in each table an id taken from the wrong table
+/// would still read as 1, and only the variant would be under test.
+#[tokio::test]
+#[test_log::test]
+pub async fn recovery_operator_authenticates_with_its_own_identity() {
+    let db = db::create_test_pool().await;
+    let actors = spawn_actors(db.clone()).await;
+
+    let ordinary_key = MlDsa87::key_gen(&mut rand::rng());
+    let other_recovery_key = MlDsa87::key_gen(&mut rand::rng());
+    let recovery_key = MlDsa87::key_gen(&mut rand::rng());
+    let recovery_pubkey_bytes = authn::PublicKey::from(verifying_key(&recovery_key)).to_bytes();
+
+    let recovery_id: i32 = {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::operator_identity::table)
+            .values((schema::operator_identity::public_key
+                .eq(authn::PublicKey::from(verifying_key(&ordinary_key)).to_bytes()),))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        insert_into(schema::recovery_operator_identity::table)
+            .values((schema::recovery_operator_identity::public_key
+                .eq(authn::PublicKey::from(verifying_key(&other_recovery_key)).to_bytes()),))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        insert_into(schema::recovery_operator_identity::table)
+            .values((schema::recovery_operator_identity::public_key.eq(recovery_pubkey_bytes),))
+            .returning(schema::recovery_operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+    assert_eq!(
+        recovery_id, 2,
+        "the fixture must give the authenticating recovery operator an id no ordinary \
+         operator holds, or the id assertion below cannot discriminate"
+    );
+
+    let (mut server_transport, mut test_transport) = ChannelTransport::new();
+    let db_for_task = db.clone();
+    let task = tokio::spawn(async move {
+        let mut props = OperatorConnection::new(db_for_task, actors);
+        auth::authenticate(&mut props, &mut server_transport).await
+    });
+
+    test_transport
+        .send(auth::Inbound::AuthChallengeRequest {
+            pubkey: verifying_key(&recovery_key).into(),
+            bootstrap_token: None,
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport
+        .recv()
+        .await
+        .expect("should receive challenge");
+    let challenge = match response {
+        Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
+        other => panic!("Expected AuthChallenge, got {other:?}"),
+    };
+
+    let signature = sign_operator_challenge(&recovery_key, &challenge);
+    test_transport
+        .send(auth::Inbound::AuthChallengeSolution {
+            signature: signature.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport
+        .recv()
+        .await
+        .expect("should receive auth result");
+    assert!(matches!(response, Ok(auth::Outbound::AuthSuccess)));
+
+    let authenticated = task
+        .await
+        .unwrap()
+        .expect("recovery operator should authenticate");
+    match authenticated {
+        AuthenticatedOperator::Recovery(creds) => assert_eq!(creds.id, recovery_id),
+        AuthenticatedOperator::Ordinary(creds) => panic!(
+            "expected the recovery role, got the ordinary operator with id {}",
+            creds.id
+        ),
+    }
+}
+
+/// A key present in neither identity table is still rejected: accepting a key found in either
+/// table must not degrade into accepting any key at all. Both tables hold a row so the refusal
+/// cannot come from an empty lookup.
+#[tokio::test]
+#[test_log::test]
+pub async fn unknown_key_is_rejected_when_both_tables_are_populated() {
+    let db = db::create_test_pool().await;
+    let actors = spawn_actors(db.clone()).await;
+
+    let ordinary_key = MlDsa87::key_gen(&mut rand::rng());
+    let recovery_key = MlDsa87::key_gen(&mut rand::rng());
+    {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::operator_identity::table)
+            .values((schema::operator_identity::public_key
+                .eq(authn::PublicKey::from(verifying_key(&ordinary_key)).to_bytes()),))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+        insert_into(schema::recovery_operator_identity::table)
+            .values((schema::recovery_operator_identity::public_key
+                .eq(authn::PublicKey::from(verifying_key(&recovery_key)).to_bytes()),))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+    }
+
+    let (mut server_transport, mut test_transport) = ChannelTransport::new();
+    let db_for_task = db.clone();
+    let task = tokio::spawn(async move {
+        let mut props = OperatorConnection::new(db_for_task, actors);
+        auth::authenticate(&mut props, &mut server_transport).await
+    });
+
+    let unknown_key = MlDsa87::key_gen(&mut rand::rng());
+    test_transport
+        .send(auth::Inbound::AuthChallengeRequest {
+            pubkey: verifying_key(&unknown_key).into(),
+            bootstrap_token: None,
+        })
+        .await
+        .unwrap();
+
+    assert!(matches!(
+        task.await.unwrap(),
+        Err(auth::Error::UnregisteredPublicKey)
+    ));
+}
+
+/// `verify_solution` resolves the recovery id only after the peer has sent its solution, so a
+/// recovery row removed between challenge and solution reaches that refusal. It has to be sent
+/// on the transport, like the `InvalidBootstrapToken` refusals in the arm above: an operator
+/// that has answered the challenge sees a protocol error rather than a handshake that stops
+/// with nothing on the wire.
+#[tokio::test]
+#[test_log::test]
+pub async fn recovery_key_removed_mid_handshake_is_refused_on_the_wire() {
+    let db = db::create_test_pool().await;
+    let actors = spawn_actors(db.clone()).await;
+
+    let recovery_key = MlDsa87::key_gen(&mut rand::rng());
+    let recovery_pubkey_bytes = authn::PublicKey::from(verifying_key(&recovery_key)).to_bytes();
+    {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::recovery_operator_identity::table)
+            .values((
+                schema::recovery_operator_identity::public_key.eq(recovery_pubkey_bytes.clone()),
+            ))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+    }
+
+    let (mut server_transport, mut test_transport) = ChannelTransport::new();
+    let db_for_task = db.clone();
+    let task = tokio::spawn(async move {
+        let mut props = OperatorConnection::new(db_for_task, actors);
+        auth::authenticate(&mut props, &mut server_transport).await
+    });
+
+    test_transport
+        .send(auth::Inbound::AuthChallengeRequest {
+            pubkey: verifying_key(&recovery_key).into(),
+            bootstrap_token: None,
+        })
+        .await
+        .unwrap();
+
+    let response = test_transport
+        .recv()
+        .await
+        .expect("should receive challenge");
+    let challenge = match response {
+        Ok(auth::Outbound::AuthChallenge { challenge }) => challenge,
+        other => panic!("Expected AuthChallenge, got {other:?}"),
+    };
+
+    // The challenge has been issued and the solution has not been sent, so the server cannot
+    // have read the table again yet: the row is gone by the time `verify_solution` looks.
+    {
+        let mut conn = db.get().await.unwrap();
+        diesel::delete(
+            schema::recovery_operator_identity::table
+                .filter(schema::recovery_operator_identity::public_key.eq(recovery_pubkey_bytes)),
+        )
+        .execute(&mut conn)
+        .await
+        .unwrap();
+    }
+
+    let signature = sign_operator_challenge(&recovery_key, &challenge);
+    test_transport
+        .send(auth::Inbound::AuthChallengeSolution {
+            signature: signature.to_bytes(),
+        })
+        .await
+        .unwrap();
+
+    let refusal = test_transport
+        .recv()
+        .await
+        .expect("the refusal must be sent to the peer");
+    assert!(matches!(refusal, Err(auth::Error::UnregisteredPublicKey)));
+
+    assert!(matches!(
+        task.await.unwrap(),
+        Err(auth::Error::UnregisteredPublicKey)
+    ));
+}
--- a/server/crates/arbiter-server/tests/operator/unseal.rs
+++ b/server/crates/arbiter-server/tests/operator/unseal.rs
@@ -1,15 +1,10 @@
-use arbiter_crypto::{
-    authn,
-    safecell::{SafeCell, SafeCellHandle as _},
-};
+use super::common::spawn_actors;
+use arbiter_crypto::authn;
 use arbiter_server::{
-    actors::{
-        GlobalActors,
-        vault::{Bootstrap, Seal},
-    },
+    actors::vault::{Bootstrap, Seal},
    db,
    peers::operator::{
-        Credentials,
+        AuthenticatedOperator, Credentials,
        vault_gate::{
            Error as VaultGateError, HandleHandshake, HandleUnsealEncryptedKey, VaultGate,
        },
@@ -22,19 +17,19 @@ use tokio::sync::oneshot;
 use x25519_dalek::{EphemeralSecret, PublicKey};

 async fn setup_sealed_gate(
-    seal_key: &[u8],
+    seal_key: &[u8; 32],
 ) -> (
    db::DatabasePool,
    kameo::actor::ActorRef<VaultGate>,
    oneshot::Receiver<Result<(), VaultGateError>>,
 ) {
    let db = db::create_test_pool().await;
-    let actors = GlobalActors::spawn(db.clone()).await.unwrap();
+    let actors = spawn_actors(db.clone()).await;

    actors
        .vault
        .ask(Bootstrap {
-            seal_key_raw: SafeCell::new(seal_key.to_vec()),
+            seal_key: arbiter_server::crypto::KeyCell::from(*seal_key),
        })
        .await
        .unwrap();
@@ -42,7 +37,7 @@ async fn setup_sealed_gate(

    let (promotion_tx, promotion_rx) = oneshot::channel();
    let pubkey = authn::SigningKey::generate().public_key();
-    let auth_creds = Credentials { id: 1, pubkey };
+    let auth_creds = AuthenticatedOperator::Ordinary(Credentials { id: 1, pubkey });
    let gate = VaultGate::spawn(VaultGate::new(auth_creds, actors, db.clone(), promotion_tx));

    (db, gate, promotion_rx)
@@ -50,7 +45,7 @@ async fn setup_sealed_gate(

 async fn client_dh_encrypt(
    gate: &kameo::actor::ActorRef<VaultGate>,
-    key_to_send: &[u8],
+    key_to_send: &[u8; 32],
 ) -> HandleUnsealEncryptedKey {
    let client_secret = EphemeralSecret::random();
    let client_public = PublicKey::from(&client_secret);
@@ -83,7 +78,7 @@ async fn client_dh_encrypt(
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_success() {
-    let seal_key = b"test-seal-key";
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

    let encrypted_key = client_dh_encrypt(&gate, seal_key).await;
@@ -95,10 +90,10 @@ pub async fn unseal_success() {
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_wrong_seal_key() {
-    let seal_key = b"test-seal-key";
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

-    let encrypted_key = client_dh_encrypt(&gate, b"wrong-key").await;
+    let encrypted_key = client_dh_encrypt(&gate, b"wrong-key-padded-to-32-bytes!!!!").await;

    let response = gate.ask(encrypted_key).await;
    assert!(matches!(
@@ -112,7 +107,7 @@ pub async fn unseal_wrong_seal_key() {
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_corrupted_ciphertext() {
-    let seal_key = b"test-seal-key";
+    let seal_key = b"test-seal-key-padded-to-32bytes!";
    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

    let client_secret = EphemeralSecret::random();
@@ -143,11 +138,11 @@ pub async fn unseal_corrupted_ciphertext() {
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_retry_after_invalid_key() {
-    let seal_key = b"real-seal-key";
+    let seal_key = b"real-seal-key-padded-to-32bytes!";
    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;

    {
-        let encrypted_key = client_dh_encrypt(&gate, b"wrong-key").await;
+        let encrypted_key = client_dh_encrypt(&gate, b"wrong-key-padded-to-32-bytes!!!!").await;

        let response = gate.ask(encrypted_key).await;
        assert!(matches!(
--- a/server/crates/arbiter-server/tests/vault/concurrency.rs
+++ b/server/crates/arbiter-server/tests/vault/concurrency.rs
@@ -166,7 +166,7 @@ async fn decrypt_roundtrip_after_high_concurrency() {
        .await
        .unwrap();
    decryptor
-        .try_unseal(SafeCell::new(b"test-seal-key".to_vec()))
+        .try_unseal(arbiter_server::crypto::KeyCell::from([0u8; 32]))
        .await
        .unwrap();

--- a/server/crates/arbiter-server/tests/vault/lifecycle.rs
+++ b/server/crates/arbiter-server/tests/vault/lifecycle.rs
@@ -1,16 +1,36 @@
 use crate::common;
-use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
+use arbiter_crypto::{
+    authn,
+    safecell::{SafeCell, SafeCellHandle as _},
+};
 use arbiter_server::{
    actors::{
        GlobalActors,
-        vault::{Error, Vault},
+        vault::{Error, GetState, Vault, VaultState},
+        vault_coordinator::{
+            ContributeBootstrap, ContributeRecoveryBootstrap, ContributeRecoveryUnseal,
+            ContributeUnseal, Error as CoordinatorError, StartBootstrap, VaultCoordinator,
+        },
    },
-    crypto::encryption::v1::{Nonce, ROOT_KEY_TAG},
+    crypto::{KeyCell, encryption::v1::{Nonce, ROOT_KEY_TAG}},
    db::{self, models, schema},
+    peers::operator::{
+        AuthenticatedOperator, Credentials, RecoveryCredentials,
+        vault_gate::{
+            Error as VaultGateError, HandleBootstrapEncryptedKey,
+            HandleContributeBootstrapPassphrase, HandleContributeRecoveryBootstrapPassphrase,
+            HandleContributeRecoveryUnsealPassphrase, HandleContributeUnsealPassphrase,
+            HandleDeclareCommittee, HandleHandshake, VaultGate,
+        },
+    },
 };

-use diesel::{QueryDsl, SelectableHelper};
+use chacha20poly1305::{AeadInPlace, XChaCha20Poly1305, XNonce, aead::KeyInit};
+use diesel::{ExpressionMethods, QueryDsl, SelectableHelper, insert_into, sql_query};
 use diesel_async::RunQueryDsl;
+use kameo::actor::Spawn as _;
+use tokio::sync::oneshot;
+use x25519_dalek::{EphemeralSecret, PublicKey};

 #[tokio::test]
 #[test_log::test]
@@ -20,7 +40,7 @@ async fn test_bootstrap() {
        .await
        .unwrap();

-    let seal_key = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key = KeyCell::from([0u8; 32]);
    actor.bootstrap(seal_key).await.unwrap();

    let mut conn = db.get().await.unwrap();
@@ -43,7 +63,7 @@ async fn test_bootstrap_rejects_double() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

-    let seal_key2 = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key2 = KeyCell::from([0u8; 32]);
    let err = actor.bootstrap(seal_key2).await.unwrap_err();
    assert!(matches!(err, Error::AlreadyBootstrapped));
 }
@@ -105,7 +125,7 @@ async fn test_unseal_correct_password() {
    let mut actor = Vault::new(db.clone(), GlobalActors::spawn_message_bus())
        .await
        .unwrap();
-    let seal_key = SafeCell::new(b"test-seal-key".to_vec());
+    let seal_key = KeyCell::from([0u8; 32]);
    actor.try_unseal(seal_key).await.unwrap();

    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
@@ -129,13 +149,674 @@ async fn test_unseal_wrong_then_correct_password() {
        .await
        .unwrap();

-    let bad_key = SafeCell::new(b"wrong-password".to_vec());
+    let bad_key = KeyCell::from([1u8; 32]);
    let err = actor.try_unseal(bad_key).await.unwrap_err();
    assert!(matches!(err, Error::InvalidKey));

-    let good_key = SafeCell::new(b"test-seal-key".to_vec());
+    let good_key = KeyCell::from([0u8; 32]);
    actor.try_unseal(good_key).await.unwrap();

    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
    assert_eq!(*decrypted.read(), plaintext);
 }
+
+#[tokio::test]
+#[test_log::test]
+async fn two_operator_vault_requires_recovery_share() {
+    let db = db::create_test_pool().await;
+    let bus = GlobalActors::spawn_message_bus();
+    let vault_ref = Vault::spawn(Vault::new(db.clone(), bus).await.unwrap());
+    let coordinator = VaultCoordinator::spawn(VaultCoordinator::new(db, vault_ref));
+
+    let err = coordinator
+        .ask(StartBootstrap {
+            operator_id: 1,
+            declared_count: 2,
+            recovery_count: 0,
+        })
+        .await
+        .unwrap_err();
+
+    assert!(
+        matches!(
+            err,
+            kameo::error::SendError::HandlerError(CoordinatorError::TwoOperatorsRequireRecovery)
+        ),
+        "expected TwoOperatorsRequireRecovery, got {err:?}"
+    );
+}
+
+/// §3.4: Bootstrap with 1 ordinary + 1 recovery operator produces a valid 1-of-2 Shamir split.
+/// Both ordinary and recovery shares are stored; the vault can be unsealed with either one.
+#[tokio::test]
+#[test_log::test]
+async fn recovery_share_stored_and_used_for_unseal() {
+    let db = db::create_test_pool().await;
+    let bus = GlobalActors::spawn_message_bus();
+    let vault_ref = Vault::spawn(Vault::new(db.clone(), bus).await.unwrap());
+    let coordinator = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref.clone()));
+
+    // Register one ordinary operator and one recovery operator in the DB
+    let ordinary_id: i32 = {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(vec![1u8; 32]))
+            .returning(schema::operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+    let recovery_id: i32 = {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::recovery_operator_identity::table)
+            .values(schema::recovery_operator_identity::public_key.eq(vec![2u8; 32]))
+            .returning(schema::recovery_operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+
+    // Declare committee: 1 ordinary + 1 recovery
+    coordinator
+        .ask(StartBootstrap {
+            operator_id: ordinary_id,
+            declared_count: 1,
+            recovery_count: 1,
+        })
+        .await
+        .unwrap();
+
+    // Recovery operator contributes first — bootstrap should not finalize yet
+    let done = coordinator
+        .ask(ContributeRecoveryBootstrap {
+            recovery_operator_id: recovery_id,
+            passphrase: SafeCell::new(b"recovery-pass".to_vec()),
+        })
+        .await
+        .unwrap();
+    assert!(!done, "should not finalize with only recovery passphrase");
+
+    // Ordinary operator contributes — now bootstrap finalizes
+    let done = coordinator
+        .ask(ContributeBootstrap {
+            operator_id: ordinary_id,
+            passphrase: SafeCell::new(b"ordinary-pass".to_vec()),
+        })
+        .await
+        .unwrap();
+    assert!(done, "should finalize once all contributors are in");
+
+    // After bootstrap, vault is Unsealed (seal key still in memory).
+    let state = vault_ref.ask(GetState {}).await.unwrap();
+    assert_eq!(state, VaultState::Unsealed);
+
+    // Verify recovery_operator row was created
+    let recovery_share_count: i64 = {
+        let mut conn = db.get().await.unwrap();
+        schema::recovery_operator::table
+            .count()
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+    assert_eq!(recovery_share_count, 1);
+
+    // Simulate restart: drop vault and coordinator, create fresh vault (comes up Sealed).
+    drop(coordinator);
+    drop(vault_ref);
+    let bus2 = GlobalActors::spawn_message_bus();
+    let vault_ref2 = Vault::spawn(Vault::new(db.clone(), bus2).await.unwrap());
+    let state = vault_ref2.ask(GetState {}).await.unwrap();
+    assert_eq!(state, VaultState::Sealed);
+
+    // §3.6: the recovery operator's share only counts once a wake-up request has stood
+    // uncancelled for the full dispute window, so back-date one here before unsealing.
+    {
+        let mut conn = db.get().await.unwrap();
+        sql_query(format!(
+            "INSERT INTO recovery_wakeup_request (requested_by, requested_at) \
+             VALUES ({ordinary_id}, unixepoch('now') - 14*24*3600 - 1)"
+        ))
+        .execute(&mut conn)
+        .await
+        .unwrap();
+    }
+
+    // §3.5: Unseal using ONLY the recovery operator share (threshold = shamir_threshold(1) = 1).
+    let coordinator2 = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref2.clone()));
+    let done = coordinator2
+        .ask(ContributeRecoveryUnseal {
+            recovery_operator_id: recovery_id,
+            passphrase: SafeCell::new(b"recovery-pass".to_vec()),
+        })
+        .await
+        .unwrap();
+    assert!(done, "recovery share alone should satisfy threshold");
+
+    let state = vault_ref2.ask(GetState {}).await.unwrap();
+    assert_eq!(state, VaultState::Unsealed);
+}
+
+/// A committee of zero ordinary operators used to reach `shamir_threshold(0)` and panic,
+/// taking the global coordinator down with it.
+#[tokio::test]
+#[test_log::test]
+async fn empty_committee_is_rejected_without_panicking() {
+    let db = db::create_test_pool().await;
+    let bus = GlobalActors::spawn_message_bus();
+    let vault_ref = Vault::spawn(Vault::new(db.clone(), bus).await.unwrap());
+    let coordinator = VaultCoordinator::spawn(VaultCoordinator::new(db, vault_ref));
+
+    let err = coordinator
+        .ask(StartBootstrap {
+            operator_id: 1,
+            declared_count: 0,
+            recovery_count: 1,
+        })
+        .await
+        .unwrap_err();
+
+    assert!(
+        matches!(
+            err,
+            kameo::error::SendError::HandlerError(CoordinatorError::EmptyCommittee)
+        ),
+        "expected EmptyCommittee, got {err:?}"
+    );
+
+    // The actor must still be alive to serve the next caller.
+    let err = coordinator
+        .ask(StartBootstrap {
+            operator_id: 1,
+            declared_count: 0,
+            recovery_count: 0,
+        })
+        .await
+        .unwrap_err();
+    assert!(matches!(
+        err,
+        kameo::error::SendError::HandlerError(CoordinatorError::EmptyCommittee)
+    ));
+}
+
+/// An approved-but-unfinished operator replacement deletes a share row. The unseal threshold
+/// must still describe the split that is actually stored, not the surviving row count.
+///
+/// Four ordinary operators give a real 3-of-4 `vsss-rs` split (`shamir_threshold(4) == 3`).
+/// Deleting one share row leaves 3 rows, and `shamir_threshold(3) == 2` -- a *different* number
+/// from the recorded threshold. A recount-based unseal would therefore finalize one contribution
+/// early, combine only 2 shares of a 3-of-4 split, and fail to reconstruct the seal key.
+#[tokio::test]
+#[test_log::test]
+async fn unseal_threshold_survives_a_deleted_share_row() {
+    let db = db::create_test_pool().await;
+    let bus = GlobalActors::spawn_message_bus();
+    let vault_ref = Vault::spawn(Vault::new(db.clone(), bus).await.unwrap());
+    let coordinator = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref));
+
+    // Four ordinary operators: threshold is 3-of-4.
+    let mut ids = Vec::new();
+    for n in 1..=4u8 {
+        let mut conn = db.get().await.unwrap();
+        let id: i32 = insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(vec![n; 32]))
+            .returning(schema::operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap();
+        ids.push(id);
+    }
+
+    coordinator
+        .ask(StartBootstrap {
+            operator_id: ids[0],
+            declared_count: 4,
+            recovery_count: 0,
+        })
+        .await
+        .unwrap();
+    for (n, id) in ids.iter().enumerate() {
+        coordinator
+            .ask(ContributeBootstrap {
+                operator_id: *id,
+                passphrase: SafeCell::new(format!("pass-{n}").into_bytes()),
+            })
+            .await
+            .unwrap();
+    }
+
+    let stored: Option<i32> = {
+        let mut conn = db.get().await.unwrap();
+        schema::arbiter_settings::table
+            .select(schema::arbiter_settings::shamir_threshold)
+            .first(&mut conn)
+            .await
+            .unwrap()
+    };
+    assert_eq!(stored, Some(3), "bootstrap must record the split threshold");
+
+    // Simulate the aborted replacement: one share row is gone, leaving 3 of the 4 shares.
+    {
+        let mut conn = db.get().await.unwrap();
+        diesel::delete(schema::operator::table)
+            .filter(schema::operator::id.eq(Some(ids[3])))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+    }
+
+    // Restart and unseal with the three surviving operators' original passphrases.
+    drop(coordinator);
+    let bus2 = GlobalActors::spawn_message_bus();
+    let vault_ref2 = Vault::spawn(Vault::new(db.clone(), bus2).await.unwrap());
+    let coordinator2 = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref2.clone()));
+
+    let done = coordinator2
+        .ask(ContributeUnseal {
+            operator_id: ids[0],
+            passphrase: SafeCell::new(b"pass-0".to_vec()),
+        })
+        .await
+        .unwrap();
+    assert!(!done, "one share must not be enough for a 3-of-4 split");
+
+    let done = coordinator2
+        .ask(ContributeUnseal {
+            operator_id: ids[1],
+            passphrase: SafeCell::new(b"pass-1".to_vec()),
+        })
+        .await
+        .unwrap();
+    assert!(
+        !done,
+        "two shares must not be enough for a 3-of-4 split -- a recount would wrongly finalize here"
+    );
+
+    let done = coordinator2
+        .ask(ContributeUnseal {
+            operator_id: ids[2],
+            passphrase: SafeCell::new(b"pass-2".to_vec()),
+        })
+        .await
+        .unwrap();
+    assert!(done, "three shares must reconstruct a 3-of-4 split");
+    assert_eq!(
+        vault_ref2.ask(GetState {}).await.unwrap(),
+        VaultState::Unsealed
+    );
+}
+
+/// §3.6: recovery operators are asleep by default. Without a wake-up whose 14-day dispute
+/// window has elapsed, their share must not count towards an unseal.
+#[tokio::test]
+#[test_log::test]
+async fn sleeping_recovery_operator_cannot_contribute_to_unseal() {
+    let db = db::create_test_pool().await;
+    let bus = GlobalActors::spawn_message_bus();
+    let vault_ref = Vault::spawn(Vault::new(db.clone(), bus).await.unwrap());
+    let coordinator = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref.clone()));
+
+    let ordinary_id: i32 = {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(vec![1u8; 32]))
+            .returning(schema::operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+    let recovery_id: i32 = {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::recovery_operator_identity::table)
+            .values(schema::recovery_operator_identity::public_key.eq(vec![2u8; 32]))
+            .returning(schema::recovery_operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+
+    coordinator
+        .ask(StartBootstrap {
+            operator_id: ordinary_id,
+            declared_count: 1,
+            recovery_count: 1,
+        })
+        .await
+        .unwrap();
+    coordinator
+        .ask(ContributeRecoveryBootstrap {
+            recovery_operator_id: recovery_id,
+            passphrase: SafeCell::new(b"recovery-pass".to_vec()),
+        })
+        .await
+        .unwrap();
+    coordinator
+        .ask(ContributeBootstrap {
+            operator_id: ordinary_id,
+            passphrase: SafeCell::new(b"ordinary-pass".to_vec()),
+        })
+        .await
+        .unwrap();
+
+    // Restart so the vault comes up Sealed.
+    drop(coordinator);
+    drop(vault_ref);
+    let bus2 = GlobalActors::spawn_message_bus();
+    let vault_ref2 = Vault::spawn(Vault::new(db.clone(), bus2).await.unwrap());
+    let coordinator2 = VaultCoordinator::spawn(VaultCoordinator::new(db.clone(), vault_ref2.clone()));
+
+    let err = coordinator2
+        .ask(ContributeRecoveryUnseal {
+            recovery_operator_id: recovery_id,
+            passphrase: SafeCell::new(b"recovery-pass".to_vec()),
+        })
+        .await
+        .unwrap_err();
+
+    assert!(
+        matches!(
+            err,
+            kameo::error::SendError::HandlerError(CoordinatorError::RecoveryNotActive)
+        ),
+        "expected RecoveryNotActive, got {err:?}"
+    );
+    assert_eq!(
+        vault_ref2.ask(GetState {}).await.unwrap(),
+        VaultState::Sealed,
+        "a sleeping recovery operator unsealed the vault"
+    );
+}
+
+type PromotionRx = oneshot::Receiver<Result<(), VaultGateError>>;
+
+/// One `VaultGate` per authenticated role against a shared `GlobalActors`, which is what
+/// `peers::operator::start` builds for two connected peers.
+struct RoleGates {
+    ordinary: kameo::actor::ActorRef<VaultGate>,
+    recovery: kameo::actor::ActorRef<VaultGate>,
+    ordinary_id: i32,
+    recovery_id: i32,
+    /// Held only so the gates' promotion channels stay open for the fixture's lifetime.
+    _promotions: (PromotionRx, PromotionRx),
+}
+
+/// Registers one ordinary and one recovery identity, then spawns a gate for each.
+async fn spawn_role_gates(db: &db::DatabasePool, actors: &GlobalActors) -> RoleGates {
+    let ordinary_pubkey = authn::SigningKey::generate().public_key();
+    let recovery_pubkey = authn::SigningKey::generate().public_key();
+
+    let ordinary_id: i32 = {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::operator_identity::table)
+            .values(schema::operator_identity::public_key.eq(ordinary_pubkey.to_bytes()))
+            .returning(schema::operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+    let recovery_id: i32 = {
+        let mut conn = db.get().await.unwrap();
+        insert_into(schema::recovery_operator_identity::table)
+            .values(schema::recovery_operator_identity::public_key.eq(recovery_pubkey.to_bytes()))
+            .returning(schema::recovery_operator_identity::id)
+            .get_result(&mut conn)
+            .await
+            .unwrap()
+    };
+
+    let (ordinary_promotion_tx, ordinary_promotion_rx) = oneshot::channel();
+    let ordinary = VaultGate::spawn(VaultGate::new(
+        AuthenticatedOperator::Ordinary(Credentials {
+            id: ordinary_id,
+            pubkey: ordinary_pubkey,
+        }),
+        actors.clone(),
+        db.clone(),
+        ordinary_promotion_tx,
+    ));
+
+    let (recovery_promotion_tx, recovery_promotion_rx) = oneshot::channel();
+    let recovery = VaultGate::spawn(VaultGate::new(
+        AuthenticatedOperator::Recovery(RecoveryCredentials {
+            id: recovery_id,
+            pubkey: recovery_pubkey,
+        }),
+        actors.clone(),
+        db.clone(),
+        recovery_promotion_tx,
+    ));
+
+    RoleGates {
+        ordinary,
+        recovery,
+        ordinary_id,
+        recovery_id,
+        _promotions: (ordinary_promotion_rx, recovery_promotion_rx),
+    }
+}
+
+/// Runs the gate's X25519 handshake and encrypts `seal_key` to the shared secret, producing the
+/// message a peer would send to bootstrap the vault. Mirrors `tests/operator/unseal.rs`'s
+/// `client_dh_encrypt`, which does the same for the unseal side.
+async fn bootstrap_key_for(
+    gate: &kameo::actor::ActorRef<VaultGate>,
+    seal_key: &[u8; 32],
+) -> HandleBootstrapEncryptedKey {
+    let client_secret = EphemeralSecret::random();
+    let client_public = PublicKey::from(&client_secret);
+
+    let response = gate
+        .ask(HandleHandshake {
+            client_pubkey: client_public,
+        })
+        .await
+        .unwrap();
+
+    let shared_secret = client_secret.diffie_hellman(&response.server_pubkey);
+    let cipher = XChaCha20Poly1305::new(shared_secret.as_bytes().into());
+    let nonce = XNonce::from([0u8; 24]);
+    let associated_data = b"bootstrap";
+    let mut ciphertext = seal_key.to_vec();
+    cipher
+        .encrypt_in_place(&nonce, associated_data, &mut ciphertext)
+        .unwrap();
+
+    HandleBootstrapEncryptedKey {
+        nonce: nonce.to_vec(),
+        ciphertext,
+        associated_data: associated_data.to_vec(),
+    }
+}
+
+/// Asserts a gate turned a request down on the peer's role rather than on anything else --
+/// notably not on coordinator state, which is what an unguarded handler would have reported.
+#[track_caller]
+fn assert_role_refused<T: std::fmt::Debug, M>(
+    what: &str,
+    result: Result<T, kameo::error::SendError<M, VaultGateError>>,
+) {
+    match result {
+        Err(kameo::error::SendError::HandlerError(VaultGateError::RoleNotPermitted)) => {}
+        other => panic!("{what}: expected RoleNotPermitted, got {other:?}"),
+    }
+}
+
+/// §3.5: which committee seat a passphrase fills is decided by the handshake, not by the
+/// request, so neither role can spend the other's slot.
+///
+/// Neither request carries an operator id, so the ordinary peer has nothing left to forge; the
+/// point of running the bootstrap to completion afterwards is that its refusal left the
+/// recovery seat empty rather than filling it under a chosen id.
+#[tokio::test]
+#[test_log::test]
+async fn ordinary_operator_cannot_contribute_a_recovery_share() {
+    let db = db::create_test_pool().await;
+    let actors = common::spawn_actors(db.clone()).await;
+    let gates = spawn_role_gates(&db, &actors).await;
+    assert_eq!(
+        gates.ordinary_id, gates.recovery_id,
+        "the two ids must collide for the attestation check at the end to mean anything"
+    );
+
+    gates
+        .ordinary
+        .ask(HandleDeclareCommittee {
+            count: 1,
+            recovery_count: 1,
+        })
+        .await
+        .unwrap();
+
+    assert_role_refused(
+        "an ordinary operator contributed a recovery share",
+        gates
+            .ordinary
+            .ask(HandleContributeRecoveryBootstrapPassphrase {
+                passphrase: b"forged-recovery-pass".to_vec(),
+            })
+            .await,
+    );
+
+    assert_role_refused(
+        "a recovery operator contributed an ordinary share",
+        gates
+            .recovery
+            .ask(HandleContributeBootstrapPassphrase {
+                passphrase: b"forged-ordinary-pass".to_vec(),
+            })
+            .await,
+    );
+
+    // The recovery seat is still empty: had the forged contribution landed, this one would come
+    // back as a duplicate instead of being accepted.
+    let done = gates
+        .recovery
+        .ask(HandleContributeRecoveryBootstrapPassphrase {
+            passphrase: b"recovery-pass".to_vec(),
+        })
+        .await
+        .unwrap();
+    assert!(!done, "the ordinary share is still outstanding");
+
+    let done = gates
+        .ordinary
+        .ask(HandleContributeBootstrapPassphrase {
+            passphrase: b"ordinary-pass".to_vec(),
+        })
+        .await
+        .unwrap();
+    assert!(done, "both seats are filled, so bootstrap must finalize");
+    assert_eq!(
+        actors.vault.ask(GetState {}).await.unwrap(),
+        VaultState::Unsealed
+    );
+
+    // Both peers hold the same id in their own table (asserted above), so only the attestation
+    // kind tells the two envelopes apart. Two rows means the recovery peer signed as itself
+    // rather than overwriting the ordinary operator's attestation.
+    let kinds = common::eventually("both bootstrap attestations are written", || {
+        let db = db.clone();
+        async move {
+            let mut conn = db.get().await.unwrap();
+            let mut kinds: Vec<String> = schema::integrity_envelope::table
+                .select(schema::integrity_envelope::entity_kind)
+                .load(&mut conn)
+                .await
+                .unwrap();
+            kinds.sort();
+            (kinds.len() == 2).then_some(kinds)
+        }
+    })
+    .await;
+    assert_eq!(
+        kinds,
+        vec![
+            "operator_credentials".to_owned(),
+            "recovery_operator_credentials".to_owned(),
+        ]
+    );
+}
+
+/// Every gate action that belongs to one role refuses the other, and refuses it before the
+/// action takes effect.
+///
+/// The vault is left unbootstrapped and the coordinator idle on purpose: an unguarded handler
+/// would reach the vault or the coordinator and come back with `State`, `NotBootstrapping` or
+/// `NotUnsealing`, so `RoleNotPermitted` can only come from the role check itself.
+///
+/// §3.4/§3.5: `HandleBootstrapEncryptedKey` matters most here. It hands the vault a root key of
+/// the peer's choosing, and the window it needs -- an unbootstrapped vault that already holds
+/// recovery identity rows -- is exactly the state committee formation has to pass through.
+#[tokio::test]
+#[test_log::test]
+async fn vault_gate_refuses_the_actions_of_the_other_role() {
+    let db = db::create_test_pool().await;
+    let actors = common::spawn_actors(db.clone()).await;
+    let gates = spawn_role_gates(&db, &actors).await;
+
+    assert_role_refused(
+        "a recovery operator declared the committee",
+        gates
+            .recovery
+            .ask(HandleDeclareCommittee {
+                count: 1,
+                recovery_count: 1,
+            })
+            .await,
+    );
+
+    // A key the vault would have accepted, negotiated through the gate's own handshake -- so
+    // the refusal comes from the role and not from a malformed request.
+    let seized_key = bootstrap_key_for(&gates.recovery, b"recovery-seized-32-byte-seal-key").await;
+    assert_role_refused(
+        "a recovery operator bootstrapped the vault",
+        gates.recovery.ask(seized_key).await,
+    );
+
+    assert_role_refused(
+        "a recovery operator contributed an ordinary bootstrap share",
+        gates
+            .recovery
+            .ask(HandleContributeBootstrapPassphrase {
+                passphrase: b"forged-ordinary-pass".to_vec(),
+            })
+            .await,
+    );
+
+    assert_role_refused(
+        "an ordinary operator contributed a recovery bootstrap share",
+        gates
+            .ordinary
+            .ask(HandleContributeRecoveryBootstrapPassphrase {
+                passphrase: b"forged-recovery-pass".to_vec(),
+            })
+            .await,
+    );
+
+    assert_role_refused(
+        "a recovery operator contributed an ordinary unseal share",
+        gates
+            .recovery
+            .ask(HandleContributeUnsealPassphrase {
+                passphrase: b"forged-ordinary-pass".to_vec(),
+            })
+            .await,
+    );
+
+    assert_role_refused(
+        "an ordinary operator contributed a recovery unseal share",
+        gates
+            .ordinary
+            .ask(HandleContributeRecoveryUnsealPassphrase {
+                passphrase: b"forged-recovery-pass".to_vec(),
+            })
+            .await,
+    );
+
+    // Nothing above took effect: the refusals came before the vault and the coordinator.
+    assert_eq!(
+        actors.vault.ask(GetState {}).await.unwrap(),
+        VaultState::Unbootstrapped,
+        "a refused request still reached the vault"
+    );
+}
--- a/useragent/rust/Cargo.lock
+++ b/useragent/rust/Cargo.lock
Author	SHA1	Message	Date
CleverWild	a80cd39695	fix(mise): migrate from unix only `asdf` backend to a universal one	2026-09-08 16:11:42 +02:00
CleverWild	23183efd0c	fix(evm): revoke dependent grants when wallet access is revoked	2026-09-08 16:11:42 +02:00
CleverWild	8402691514	fix(vault): derive the recovery operator id from the authenticated peer	2026-09-08 16:11:42 +02:00
CleverWild	8d25d6640b	feat(operator): authenticate recovery operators as a distinct peer type	2026-09-08 16:11:42 +02:00
CleverWild	2b02d4a9b1	fix(bootstrap): keep the token valid until the vault is bootstrapped	2026-09-08 16:11:42 +02:00
CleverWild	5ade05d475	fix(vault): require an elapsed wake-up before a recovery share can unseal	2026-09-08 16:11:42 +02:00
CleverWild	e80dc53b0e	fix(vault): read the unseal threshold from the recorded split parameters	2026-09-08 16:11:42 +02:00
CleverWild	e10cc762d6	fix(proposal): count recovery operators only in electorates they can vote in	2026-09-08 16:11:42 +02:00
CleverWild	6e21505a7f	fix(operator): soft-revoke wallet access instead of deleting the row	2026-09-08 16:11:42 +02:00
CleverWild	a37af6bc1c	fix(db): enable foreign key enforcement on pooled connections	2026-09-08 16:11:42 +02:00
CleverWild	5d811f2ee9	fix(evm): reject unrepresentable grant timestamps instead of dropping the bound	2026-09-08 16:11:42 +02:00
CleverWild	5937ae8112	fix(operator): revoke wallet access by access id instead of wallet id	2026-09-08 16:11:42 +02:00
CleverWild	a9bc533129	test(vault): pin attestation validity across a re-key	2026-09-08 16:11:42 +02:00
CleverWild	3907241644	fix(vault): keep the root key row identity across a seal-key re-key	2026-09-08 16:11:42 +02:00
CleverWild	d916997ef3	fix(crypto): return None from shamir_threshold for an empty committee	2026-09-08 16:11:42 +02:00
CleverWild	f32da65467	refactor(proposal): put DB access behind a mockable ProposalStore trait	2026-09-08 16:11:42 +02:00
CleverWild	fa2df36fbe	refactor(proposal): publish approved proposals on the bus instead of executing them	2026-08-27 17:45:13 +02:00
CleverWild	2b2c225b35	chore: normalize line endings to LF	2026-08-27 17:30:20 +02:00
CleverWild	9e9672a1b1	refactor(crypto): extract governance vote message and verification helpers	2026-08-27 16:44:22 +02:00
CleverWild	0d29d0d532	refactor(db): declare unixepoch instead of formatting a SQL fragment	2026-08-27 14:08:48 +02:00
CleverWild	e9496da78c	perf(proposal): replace the per-proposal tally loop with one grouped query	2026-08-27 14:00:14 +02:00
CleverWild	c0546fa17f	refactor(db): use diesel exists() instead of counting rows	2026-08-27 13:50:02 +02:00
CleverWild	71081b6ee7	refactor(proposal): use id newtypes across the governance path	2026-08-27 13:42:14 +02:00
CleverWild	8421a09d9f	refactor(db!: store the one-off transaction signature by component	2026-08-27 12:46:40 +02:00
CleverWild	15b826310b	refactor(db): replace the proposal payload blob with typed child tables	2026-08-27 00:45:35 +02:00
CleverWild	5698d1cfb3	feat(proposal): reject proposals with an excessive TTL	2026-08-26 16:47:12 +02:00
CleverWild	6884a59325	refactor(proposal): type ProposalSummary::kind as ProposalKindTag	2026-08-26 16:32:43 +02:00
CleverWild	b364d95489	refactor(proposal): drop the Quorum prefix from VoteOutcome variants	2026-08-26 15:30:48 +02:00
CleverWild	d64478b301	refactor(proposal): replace UpdateShamirParameters with parameterless TriggerRekey	2026-08-26 15:26:17 +02:00
CleverWild	aa884339f7	refactor(proposal): remove the ApproveServerUpdate proposal kind	2026-08-26 14:53:38 +02:00
CleverWild	180f93c1a7	refactor(proposal): derive ProposalKindTag from ProposalKind with strum	2026-08-26 14:36:41 +02:00
CleverWild	a501283b0c	refactor(crypto): replace byte-slice signing contexts with `SigningContext` enum	2026-08-26 14:08:32 +02:00
CleverWild	f881102f0a	refactor(proposal): drop the expired status, enforce expiry on every vote	2026-08-26 13:01:44 +02:00
CleverWild	f13c1cf9d1	fix(db): require share_salt to be supplied by the daemon	2026-08-26 13:01:44 +02:00
CleverWild	f03997ea56	chore(lints): fix regression caused by rust 1.98.0	2026-08-26 13:01:44 +02:00
CleverWild	957c5096df	chore(deps): bump kameo version	2026-08-26 13:01:44 +02:00
CleverWild	36249129d1	feat(vault)!: implement full Shamir re-key flow and governance execution (§3.3–§3.5) - Add `rekey.proto` with `ContributePassphrase` / `ContributeRecoveryPassphrase` / `RekeyResult` - Wire `rekey` as a 4th vault stream payload in `vault.proto` and gRPC dispatch - Add `RekeyRootKey` message to `Vault` actor: generates new random seal key, re-encrypts root key, writes new `root_key_history` row - Add `StartRekey`, `ContributeRekey`, `ContributeRecoveryRekey` messages to `VaultCoordinator`; `finalize_rekey` uses threshold-1 fast path identical to bootstrap - `execute_replace_operator` now UPDATEs `operator_identity.public_key` in-place (avoids FK constraint violation), deletes stale `operator` share row, then triggers `StartRekey` - `execute_update_shamir_parameters` triggers `StartRekey` instead of warning stub - `ProposalKind::ReplaceOperator` carries `old_operator_id`; encode/decode updated accordingly - `GlobalActors::spawn` extracts `vault_coordinator` before `Ok(Self { … })` so it can be cloned into `ProposalManager::new` - Add `handle_rekey` in session handlers forwarding passphrase contributions to `VaultCoordinator` - Fix test: rename `replace_operator_inserts_identity_row` → `replace_operator_updates_pubkey_and_starts_rekey`, assert count stays 1 and pubkey is updated	2026-08-26 13:01:44 +02:00
CleverWild	3817a080c9	refactor(proposal): replace string kind dispatch with ProposalKindTag enum (strum)	2026-08-26 13:01:44 +02:00
CleverWild	e1d060dd06	feat(vault): add recovery passphrase handling for bootstrap and unseal processes	2026-08-26 13:01:44 +02:00
CleverWild	e121708d28	fix(crypto): handle 1-of-N Shamir split when ordinary_count=1	2026-08-26 13:01:44 +02:00
CleverWild	6e3fa736e0	feat(server): recovery operators with sleeping/wakeup mechanism (§3.5/§3.6)	2026-08-26 13:01:44 +02:00
CleverWild	19a62e7195	feat(server): key-rotation proposals require full quorum (§3.3)	2026-08-26 13:01:44 +02:00
CleverWild	57200cbc50	feat(server): two-operator vault requires at least one recovery share	2026-08-26 13:01:44 +02:00
CleverWild	291ef2e831	refactor(server): typed pubkey len via u32::try_from in ReplaceOperator	2026-08-26 13:01:44 +02:00
CleverWild	d12109c2c9	feat(server): ProposalKind::ApproveOneOffTransaction	2026-08-26 13:01:44 +02:00
CleverWild	277fb3c92d	feat(server): ProposalKind::ApprovePersistentGrant	2026-08-26 13:01:44 +02:00
CleverWild	9e42097683	feat(server): ProposalKind::UpdateShamirParameters	2026-08-26 13:01:44 +02:00
CleverWild	25b86b14e9	feat(server): ProposalKind::ReplaceOperator	2026-08-26 13:01:44 +02:00
CleverWild	ba8748a17b	feat(server): ProposalKind ::GrantWalletAccess and ::ApproveServerUpdate	2026-08-26 13:01:44 +02:00
CleverWild	3e61d807b4	test(server): governance integration tests	2026-08-26 13:01:44 +02:00
CleverWild	e6459aade8	feat(server::grpc): wire governance RPCs through operator session	2026-08-26 13:01:44 +02:00
CleverWild	f16d0a26e2	feat(server): introduce ProposalManager actor with quorum voting logic	2026-08-26 13:01:44 +02:00
CleverWild	074e6501ec	feat(crypto): expose governance signing context and make shamir_threshold pub const	2026-08-26 13:01:44 +02:00
CleverWild	b2632661f8	feat(db): add proposal and proposal_vote tables	2026-08-26 13:01:44 +02:00
CleverWild	966b4c8828	feat(proto): add governance proposal/vote RPC definitions	2026-08-26 13:01:44 +02:00
CleverWild	b6c91c56eb	housekepping: add fixme for start_bootstrap's operator_id	2026-08-26 13:01:44 +02:00
CleverWild	240fd3eb63	refactor(server::crypto): use fixed-size [u8; 32] and KeyCell throughout seal key API	2026-08-26 13:01:44 +02:00
CleverWild	80ba30d430	fix(server::tests): tighten unseal test seal_key params to &[u8; 32]	2026-08-26 13:01:44 +02:00
CleverWild	59cb65f3e1	feat(server::grpc): wire Shamir committee bootstrap and unseal proto messages Adds DeclareCommittee and ContributePassphrase variants to bootstrap.proto, ContributePassphrase to unseal.proto, and AwaitingContributions result codes to both. Implements corresponding inbound converters and outbound reply mappings. VaultGate handlers delegate to VaultCoordinator.	2026-08-26 13:01:44 +02:00
CleverWild	83075e9df7	feat(server): introduce VaultCoordinator for multi-operator Shamir bootstrap/unseal VaultCoordinator collects operator passphrases, splits the seal key into Shamir shares on bootstrap (encrypting each share with the operator's passphrase via Argon2 + XChaCha20-Poly1305), and reconstructs the seal key from threshold shares on unseal. Adds vsss-rs 5.4.0 and rand_core 0.6 dependencies.	2026-08-26 13:01:44 +02:00
CleverWild	fc7f2b1a03	refactor(server::actors::vault): clean up Bootstrap/TryUnseal, remove Bootstrapping state Bootstrap and TryUnseal now accept a SafeCell<Vec<u8>> seal key directly. The Bootstrapping intermediate state is removed — multi-operator coordination is the responsibility of VaultCoordinator, which calls Bootstrap atomically once all shares are collected.	2026-08-26 13:01:44 +02:00
CleverWild	0695ec96a8	feat(server::crypto): add Shamir secret sharing utilities Wraps vsss_rs Gf256::split_array / combine_array into thin split_key / combine_shares helpers. Also widens derive_key salt parameter from &[u8;16] to &[u8] to accommodate the 32-byte share salts.	2026-08-26 13:01:44 +02:00
CleverWild	8159902027	feat(server::db): add share_salt column to operator table Each operator row now stores a 32-byte random salt used to derive the per-operator share encryption key from their passphrase (Argon2 KDF).	2026-08-26 13:01:44 +02:00
CleverWild	928799fa07	feat(server::actors::evm): implement operator_delete_grant Sets revoked_at on the evm_basic_grant row; returns NotFound if the grant does not exist. Wires the handler in OperatorSession replacing the todo!().	2026-08-26 13:01:44 +02:00
CleverWild	3d3a4be806	fix(server::peers::operator::auth): make ChallengeContext pub for smlang state machine smlang generates a public state enum whose variants contain ChallengeContext, requiring the type itself to be fully public. Also tightens the wildcard arm in client auth to an exhaustive match.	2026-08-26 13:01:44 +02:00
Skipper	28b7276e11	WIP: some things	2026-08-26 13:01:44 +02:00
Skipper	f97b8f9424	feat(grpc): governance contract	2026-08-26 13:01:44 +02:00
				`@@ -1 +0,0 @@`
				`{"version":2,"entries":[{"package":"app","rootUri":"../","packageUri":"lib/"}]}`