smlang generates a public state enum whose variants contain ChallengeContext,
requiring the type itself to be fully public. Also tightens the wildcard arm
in client auth to an exhaustive match.

@@ -8,6 +8,7 @@ use rand::RngExt;
 
 pub static CLIENT_CONTEXT: &[u8] = b"arbiter_client";
 pub static OPERATOR_CONTEXT: &[u8] = b"arbiter_operator";
+pub static GOVERNANCE_CONTEXT: &[u8] = b"arbiter_governance_vote";

@@ -92,1 +93,4 @@
     }
+
+    #[must_use]
+    pub fn verify_message(&self, message: &[u8], context: &[u8], signature: &Signature) -> bool {

@@ -56,6 +56,7 @@ create table if not exists operator (
 
     share blob not null,
     share_nonce blob not null,
+    share_salt blob not null default (randomblob(32)),

@@ -218,0 +220,4 @@
+create table if not exists proposal (
+    id           integer not null primary key,
+    kind         text    not null,
+    payload      blob    not null,

@@ -218,0 +224,4 @@
+    initiator_id integer not null references operator_identity(id) on delete restrict,
+    created_at   integer not null default(unixepoch('now')),
+    expires_at   integer not null,
+    status       text    not null default 'pending'

@@ -218,0 +241,4 @@
+
+create table if not exists proposal_result (
+    proposal_id integer not null primary key references proposal(id) on delete cascade,
+    data        blob    not null,

@@ -0,0 +35,4 @@
+}
+
+#[derive(Debug, Clone)]
+pub enum ProposalKind {

@@ -0,0 +43,4 @@
+        wallet_id: i32,
+        client_id: i32,
+    },
+    ApproveServerUpdate,

@@ -0,0 +48,4 @@
+        old_operator_id: i32,
+        new_pubkey: Vec<u8>,
+    },
+    UpdateShamirParameters {

@@ -0,0 +61,4 @@
+
+impl ProposalKind {
+    pub const fn tag(&self) -> ProposalKindTag {
+        match self {

@@ -0,0 +76,4 @@
+        self.tag().into()
+    }
+
+    pub fn encode_payload(&self) -> Vec<u8> {

@@ -0,0 +174,4 @@
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum VoteOutcome {
+    Pending,
+    QuorumApproved,

@@ -0,0 +195,4 @@
+    #[error("Database query error: {0}")]
+    DatabaseQuery(#[from] diesel::result::Error),
+    #[error("Execution failed: {0}")]
+    ExecutionFailed(String),

@@ -0,0 +209,4 @@
+#[derive(Debug)]
+pub struct ProposalSummary {
+    pub id: i32,
+    pub kind: String,

@@ -0,0 +219,4 @@
+pub struct ProposalManager {
+    pub(crate) db: db::DatabasePool,
+    pub(crate) vault: ActorRef<Vault>,
+    pub(crate) evm: ActorRef<EvmActor>,

@@ -0,0 +271,4 @@
+    ) -> Result<i32, Error> {
+        let ttl = ttl_secs.unwrap_or(DEFAULT_TTL_SECS);
+        let expires_at = SqliteTimestamp::from(Utc::now() + chrono::Duration::seconds(ttl));
+

@@ -0,0 +290,4 @@
+    }
+
+    #[message]
+    pub async fn query_pending(&mut self, operator_id: i32) -> Vec<ProposalSummary> {

@@ -0,0 +303,4 @@
+            return vec![];
+        };
+
+        let voted_ids: Vec<i32> = schema::proposal_vote::table

@@ -0,0 +320,4 @@
+
+        let mut summaries = Vec::with_capacity(proposals.len());
+        for p in proposals {
+            let approve_count: i64 = schema::proposal_vote::table

@@ -0,0 +392,4 @@
+            })?;
+
+        // Check for duplicate vote before status check so AlreadyVoted takes priority
+        let existing: i64 = schema::proposal_vote::table

@@ -0,0 +421,4 @@
+            .map_err(|()| Error::InvalidSignature)?;
+
+        // Canonical vote message: proposal_id (i64 big-endian) || approve (u8)
+        let mut vote_msg = Vec::with_capacity(9);

@@ -0,0 +531,4 @@
+    /// §3.6: Any ordinary operator may request recovery wake-up.
+    /// Fails if a wake-up is already pending or active.
+    #[message]
+    pub async fn request_recovery_wakeup(&mut self, operator_id: i32) -> Result<(), Error> {

@@ -0,0 +548,4 @@
+    /// §3.6: Any ordinary operator may cancel a pending wake-up request.
+    /// Fails if there is no uncancelled request.
+    #[message]
+    pub async fn cancel_recovery_wakeup(&mut self, operator_id: i32) -> Result<(), Error> {

@@ -0,0 +609,4 @@
+            return Err(Error::ProposalNotPending);
+        }
+
+        let pubkey_bytes: Vec<u8> = schema::recovery_operator_identity::table

@@ -0,0 +715,4 @@
+                schema::recovery_wakeup_request::requested_at.le(diesel::dsl::sql::<
+                    diesel::sql_types::Integer,
+                >(&format!(
+                    "unixepoch('now') - {}",

@@ -0,0 +727,4 @@
+
+    /// Returns true when there is any uncancelled wakeup request (pending or active).
+    async fn has_uncancelled_wakeup(conn: &mut db::DatabaseConnection) -> Result<bool, Error> {
+        let count: i64 = schema::recovery_wakeup_request::table

@@ -0,0 +735,4 @@
+        Ok(count > 0)
+    }
+
+    async fn execute_proposal(&self, proposal: &Proposal) -> Result<(), Error> {