@fased/fased 0.1.61 → 0.1.64

package/dist/gateway/server-http.js

@@ -6,35 +6,41 @@ import { retryAsync } from "../infra/retry.js";
 import { safeEqualSecret } from "../security/secret-equal.js";
 import { isPrivateOrLoopbackAddress, isTrustedProxyAddress, resolveClientIp } from "./net.js";
 import { callGatewayScoped } from "./call.js";
-import { resolveWalletRuntimeConfig } from "../wallet/wallet-runtime-config.js";
+import { LEGACY_EMBEDDED_KEYSTORE_MIGRATION_MESSAGE, LegacyEmbeddedKeystoreMigrationRequiredError } from "../wallet/legacy-embedded-keystore.js";
+import { resolveLocalSignerSocketPath, resolveWalletRuntimeConfig } from "../wallet/wallet-runtime-config.js";
 import { WALLET_PROVIDER_IDS, checkNamedWalletDeletionSafety, deleteNamedWallet, normalizeWalletUserRole, readWalletProviderRegistry, resolveWalletSelection, resolveWalletUserRole, setAgentWalletAssignment, setDefaultWallet, setNamedWalletRole, setWalletProviderEnabled, upsertNamedWallet } from "../wallet/wallet-provider-registry.js";
 import { resolveAgentPublicOrigin, resolveFederationBaseUrl, resolveFederationBondWalletId, resolveFederationHandle } from "../federation/runtime.js";
 import { isValidSolanaAddress } from "../wallet/solana-address.js";
 import { fetchSolanaMintInfoViaRpc, fetchSolanaNativeBalanceViaRpc, fetchSolanaTokenBalanceViaRpc, fetchSolanaWalletAssetsViaRpc, invalidateSolanaAssetRpcCaches, summarizeSolanaAssetRpcMetrics } from "../wallet/solana-assets.js";
 import { tryResolveSatRuntimeIds } from "../config/sat-runtime-ids.js";
-import { resolveWalletPolicyConfig, resolveWalletRecurringTransferPolicy, upsertWalletPolicyConfig } from "../wallet/wallet-policy.js";
+import { commitWalletPolicyConfigUpdate, prepareWalletPolicyConfigUpdate, resolveWalletPolicyConfig, resolveWalletRecurringTransferPolicy } from "../wallet/wallet-policy.js";
 import { incrementWalletObservabilityCounter, readWalletObservabilitySnapshot } from "../wallet/wallet-observability.js";
 import { buildWalletProviderCapabilityMatrix, providerSupportsChainOperation } from "../wallet/wallet-provider-capabilities.js";
+import { walletDiagnosticErrorMessage } from "../wallet/wallet-redaction.js";
+import { LocalSocketSignerAdapter } from "../wallet/providers/local-socket-signer-adapter.js";
 import { deleteWalletProviderSecret, readWalletProviderSecretStatus, readWalletRpcSecretStatus, saveWalletProviderSecret } from "../wallet/wallet-secrets-store.js";
 import { createWalletProviderAdapter, resolveScopedRpcUrlForWallet, resolveWalletProviderId } from "../wallet/wallet-provider-resolver.js";
-import { beginWalletApprovalAssertion, beginWalletPasskeyRegistration, consumeWalletApprovalGrant, createWalletApprovalChallenge, finishWalletApprovalAssertion, finishWalletPasskeyRegistration, listWalletPasskeys, readWalletApprovalAuthSnapshot, removeWalletPasskey, resolveWalletApprovalAuthMode, resolveWalletApprovalChallengeTtlSeconds, resolveWalletApprovalGrantTtlSeconds } from "../wallet/wallet-approval-auth.js";
 import { appendWalletAuditEntry, readWalletAuditEntries } from "../wallet/wallet-audit-log.js";
-import { activateWalletCustodyUnlockSession, enrollWalletCustodyDevice, listSplitKeyWalletCustodyStatuses, lockWalletCustodyUnlockSessions, readWalletCustodyStatus, recoverWalletCustodyCeremony, refreshWalletCustodyUnlockSession, revokeWalletCustodyDevice } from "../wallet/wallet-custody.js";
 import { simulateWalletPolicy } from "../wallet/wallet-policy-simulation.js";
-import { approveWalletSendRequest, createOrExecuteWalletSend, listWalletSendApprovalRequests, rejectWalletSendRequest, sanitizeWalletSendApprovalPayload, sanitizeWalletSendApprovalRequest } from "../wallet/wallet-send-approvals.js";
+import { approveWalletSendRequest, createOrExecuteWalletSend, getWalletSendApprovalRequest, listWalletSendApprovalRequests, markWalletSendRequestBroadcastUnknown, markWalletSendRequestExecutedExternally, rejectWalletSendRequest, sanitizeWalletSendApprovalPayload, sanitizeWalletSendApprovalRequest, signerReviewBindingMatchesWalletApprovalPayload, signerReviewMatchesWalletApprovalPayload } from "../wallet/wallet-send-approvals.js";
 import { searchSolanaTokens } from "../wallet/solana-token-resolver.js";
 import { normalizeCanvasScopedUrl } from "./canvas-capability.js";
 import { A2UI_PATH, CANVAS_HOST_PATH, CANVAS_WS_PATH, handleA2uiHttpRequest } from "../canvas-host/a2ui.js";
 import { resolveFederationBondWallet } from "../wallet/solana-bond-signing.js";
-import { createAndSubmitFederationBondProof, loadPersistedFederationBondProof } from "../federation/auto-connect.js";
+import { createAndSubmitFederationBondProof, loadPersistedFederationBondProof, submitFederationBondProof } from "../federation/auto-connect.js";
+import { beginWalletApprovalAssertion, beginWalletPasskeyRegistration, consumeWalletApprovalGrant, createWalletApprovalChallenge, finishWalletApprovalAssertion, finishWalletPasskeyRegistration, listWalletPasskeys, readWalletApprovalAuthSnapshot, removeWalletPasskey, resolveWalletApprovalAuthMode, resolveWalletApprovalChallengeTtlSeconds, resolveWalletApprovalGrantTtlSeconds } from "../wallet/wallet-approval-auth.js";
 import { readWalletStatusSnapshot } from "../wallet/wallet-status.js";
-import { inspectSatBondPosition, inspectSatBondStakingDistributor, inspectSatBondStakingPosition, inspectSatBondTierPolicy, inspectSatChainSlot, invalidateSatReadCaches } from "../extensions/sat-mining/src/rpc-read.js";
-import { submitSatCancelBondUnlock, submitSatClaimBondStakingRewards, submitSatFinalizeBondUnlock, submitSatIncreaseBondPosition, submitSatInitBondStakingDistributor, submitSatOpenBondPosition, submitSatRequestBondUnlock, submitSatSyncBondStakingPosition, submitSatSyncBondStakingRewards } from "../extensions/sat-mining/src/solana-submit.js";
+import { inspectSatBondPosition, inspectSatBondStakingDistributor, inspectSatBondStakingPosition, inspectSatChainSlot, invalidateSatReadCaches } from "../extensions/sat-mining/src/rpc-read.js";
+import { digestSatSubmissionIntent } from "../extensions/sat-mining/src/submission-ledger.js";
+import { runWithSatSubmissionWorkflow, submitSatCancelBondUnlock, submitSatClaimBondStakingRewards, submitSatFinalizeBondUnlock, submitSatIncreaseBondPosition, submitSatOpenBondPosition, submitSatRequestBondUnlock, submitSatSyncBondStakingPosition, submitSatSyncBondStakingRewards } from "../extensions/sat-mining/src/solana-submit.js";
 import { resolveAgentAvatar } from "../agents/identity-avatar.js";
+import { resolveNativeSignerWalletId } from "../wallet/native-signer-wallet-id.js";
 import { listWalletInboundEvents, pollWalletInboundEvents, reconcileWalletInboundEvents, recordWalletInboundWebhookEvent } from "../wallet/wallet-inbound-events.js";
-import { disableWalletCustodyForWallet, initializeWalletCustodyForWallet, walletSetupCommand } from "../commands/wallet.js";
+import { walletSetupCommand } from "../commands/wallet.js";
 import { getDiagnosticStabilitySnapshot } from "../logging/diagnostic-stability.js";
 import { resolveManagedFederationPublicUrl } from "../managed/federation.js";
+import { LocalSignerPolicyAdminRequiredError, buildLocalSignerPolicyTightening, localSignerPolicyState } from "../wallet/local-socket-signer-policy.js";
+import { executeWalletStandardReview, prepareWalletStandardReview, readWalletStandardReviewTxHash } from "../wallet/wallet-standard-review.js";
 import { createA2aHandler } from "./a2a-http.js";
 import { CONTROL_UI_BOOT_CHECK_PATH, resolveControlUiBootCheck } from "./control-ui-boot-check.js";
 import { normalizePublicHost, resolveControlUiPublicHost } from "./control-ui-login.js";
@@ -48,10 +54,10 @@ import { sendGatewayAuthFailure, setDefaultSecurityHeaders } from "./http-common
 import { getBearerToken, getHeader } from "./http-utils.js";
 import { handleOpenAiHttpRequest } from "./openai-http.js";
 import { buildGatewayProbePayload } from "./probe-payload.js";
-import { canonicalizePathVariant } from "./security-path.js";
+import { canonicalizePathVariant, isPathProtectedByPrefixes } from "./security-path.js";
 import { handleToolsInvokeHttpRequest } from "./tools-invoke-http.js";
-import { authorizeGatewayConnect, isLocalDirectRequest } from "./auth.js";
-import fs from "node:fs";
+import { authorizeGatewayConnect, isDirectLoopbackRequest, isLocalDirectRequest } from "./auth.js";
+import syncFs from "node:fs";
 import path from "node:path";
 import { createServer } from "node:http";
 import { createServer as createServer$1 } from "node:https";
@@ -60,6 +66,8 @@ import { createServer as createServer$1 } from "node:https";
 const HOOK_AUTH_FAILURE_LIMIT = 20;
 const HOOK_AUTH_FAILURE_WINDOW_MS = 6e4;
 const HOOK_AUTH_FAILURE_TRACK_MAX = 2048;
+const FEDERATION_HTTP_ROUTE_PREFIXES = ["/api/federation"];
+const SIGNED_FEDERATION_INBOUND_ROUTES = new Set(["/api/federation/marketplace/orders", "/api/federation/marketplace/deliveries"]);
 const CONTROL_UI_SETTINGS_STORAGE_KEY = "fased.control.settings.v1";
 const CONTROL_UI_TOKEN_LOCAL_STORAGE_KEY = "fased.control.token.local.v1";
 const CONTROL_UI_TOKEN_SESSION_STORAGE_KEY = "fased.control.token.session.v1";
@@ -575,7 +583,7 @@ function parseWalletSettingsPatchInput(input) {
 	return {
 		walletId: toOptionalString(payload.walletId),
 		policyTemplate,
-		providerId: payload.providerId === "embedded-keystore" || payload.providerId === "local-socket-signer" || payload.providerId === "alchemy" || payload.providerId === "turnkey" || payload.providerId === "privy" ? payload.providerId : undefined,
+		providerId: payload.providerId === "local-socket-signer" || payload.providerId === "alchemy" || payload.providerId === "turnkey" || payload.providerId === "wallet-standard" ? payload.providerId : undefined,
 		executionMode: payload.executionMode === "manual" || payload.executionMode === "autonomous" ? payload.executionMode : undefined,
 		approvalAuthMode: payload.approvalAuthMode === "none" || payload.approvalAuthMode === "webauthn" ? payload.approvalAuthMode : undefined,
 		approvalChallengeTtlSeconds: toOptionalInt(payload.approvalChallengeTtlSeconds),
@@ -612,14 +620,56 @@ function resolveProviderCredentialStatus(params) {
 	const env = params.env ?? process.env;
 	return readWalletProviderSecretStatus(params.providerId, env);
 }
-function hasTurnkeySigningStampConfigured(env = process.env) {
+function hasTurnkeyPolicyCredentialsConfigured(env = process.env) {
 	const status = readWalletProviderSecretStatus("turnkey", env);
-	if (status.fields.includes("stamp") || status.fields.includes("xStamp") || status.fields.includes("x_stamp") || status.fields.includes("apiStamp")) {
-		return true;
+	const configuredFields = new Set(status.fields);
+	const hasApiPublicKey = configuredFields.has("apiPublicKey") || Boolean(String(env.FASED_WALLET_TURNKEY_API_PUBLIC_KEY ?? "").trim());
+	const hasApiPrivateKey = configuredFields.has("apiPrivateKey") || Boolean(String(env.FASED_WALLET_TURNKEY_API_PRIVATE_KEY ?? "").trim());
+	const hasOrganizationId = configuredFields.has("organizationId") || Boolean(String(env.FASED_WALLET_TURNKEY_ORGANIZATION_ID ?? "").trim());
+	const hasPolicyId = configuredFields.has("policyId") || Boolean(String(env.FASED_WALLET_TURNKEY_POLICY_ID ?? "").trim());
+	const hasRpcUrl = configuredFields.has("rpcUrl") || Boolean(String(env.FASED_WALLET_TURNKEY_RPC_URL ?? "").trim()) || Boolean(String(env.FASED_WALLET_SOLANA_RPC_URL ?? "").trim());
+	return hasApiPublicKey && hasApiPrivateKey && hasOrganizationId && hasPolicyId && hasRpcUrl;
+}
+async function readWalletSettingsSignerPolicy(params) {
+	const walletId = params.walletId?.trim();
+	if (!walletId) {
+		return undefined;
+	}
+	const effectiveEnv = {
+		...params.env,
+		...params.cfg.env?.vars
+	};
+	const wallet = readWalletProviderRegistry(effectiveEnv).wallets.find((entry) => entry.id === walletId);
+	if (wallet?.providerId !== "local-socket-signer") {
+		return undefined;
+	}
+	try {
+		const signerWalletId = resolveNativeSignerWalletId(wallet);
+		const policy = params.acknowledged?.walletId === signerWalletId ? params.acknowledged : await new LocalSocketSignerAdapter(resolveLocalSignerSocketPath(effectiveEnv)).getSignerPolicy(signerWalletId);
+		const state = localSignerPolicyState(policy);
+		return {
+			state,
+			walletId: policy.walletId,
+			role: policy.role,
+			version: policy.version,
+			hash: policy.hash,
+			operations: [...policy.operations],
+			programs: [...policy.programs],
+			assets: policy.assets.map((asset) => ({
+				...asset,
+				destinations: [...asset.destinations]
+			})),
+			...state === "locked" ? { guidance: "Signer policy is deny-all. Install an owner-reviewed policy through the native signer control socket; the Gateway can only tighten it." } : {}
+		};
+	} catch {
+		return {
+			state: "unavailable",
+			walletId,
+			guidance: "Signer policy could not be verified. No policy change will be shown as saved until the signer returns its exact durable version and hash."
+		};
 	}
-	return Boolean(String(env.FASED_WALLET_TURNKEY_STAMP ?? "").trim());
 }
-function buildWalletSettingsPayload(cfg, walletId, env = process.env) {
+async function buildWalletSettingsPayload(cfg, walletId, env = process.env, acknowledgedSignerPolicy) {
 	const runtimeWallet = resolveWalletRuntimeConfig(cfg, env);
 	const wallet = resolveWalletPolicyConfig(cfg, env, walletId);
 	const providerId = resolveWalletProviderId(cfg, env);
@@ -634,13 +684,19 @@ function buildWalletSettingsPayload(cfg, walletId, env = process.env) {
 		wallet,
 		env
 	});
+	const signerPolicy = await readWalletSettingsSignerPolicy({
+		cfg,
+		walletId,
+		env,
+		acknowledged: acknowledgedSignerPolicy
+	});
 	return {
 		managedMode: isManagedGatewayMode(env),
 		provider: {
 			id: providerId,
-			operationsImplemented: providerAdapter.capabilities.supportsPrepare && providerAdapter.capabilities.supportsSend,
+			operationsImplemented: providerAdapter.capabilities.supportsPrepare && providerAdapter.capabilities.supportsSend || providerCapabilities.signing.interactiveSend,
 			supportedChains: providerAdapter.capabilities.supportedChains,
-			requiresCredentials: providerId !== "embedded-keystore",
+			requiresCredentials: providerCapabilities.requiresCredentials,
 			capabilities: providerCapabilities
 		},
 		runtime: {
@@ -678,6 +734,7 @@ function buildWalletSettingsPayload(cfg, walletId, env = process.env) {
 				walletId
 			})
 		},
+		...signerPolicy ? { signerPolicy } : {},
 		toolAccess: {
 			mode: wallet.toolAccess.mode,
 			allowAgents: wallet.toolAccess.allowAgents
@@ -693,6 +750,7 @@ function parseWalletProviderId(value) {
 		case "local-socket-signer":
 		case "alchemy":
 		case "turnkey":
+		case "wallet-standard":
 		case "privy": return value;
 		default: return null;
 	}
@@ -813,7 +871,7 @@ function resolveWalletRpcUrlFromEnv(env, _chain, walletId) {
 	const perWalletKey = suffix ? `FASED_WALLET_SOLANA_RPC_URL__${suffix}` : "";
 	const perChainKey = "FASED_WALLET_SOLANA_RPC_URL";
 	const scopedOrChain = (perWalletKey ? String(env[perWalletKey] ?? "").trim() : "") || String(env[perChainKey] ?? "").trim();
-	return scopedOrChain || String(env.FASED_WALLET_EMBEDDED_KEYSTORE_RPC_URL ?? "").trim();
+	return scopedOrChain || String(env.FASED_WALLET_RPC_URL ?? "").trim();
 }
 function inferLocalSignerCreateChain(params) {
 	if (params.payloadChain === "solana") {
@@ -835,13 +893,6 @@ const silentWalletSetupRuntime = {
 		throw new Error(`wallet setup exited with code ${code}`);
 	}
 };
-function listSplitKeyWalletsBlockingPasskeyRemoval(cfg, env = process.env) {
-	return listSplitKeyWalletCustodyStatuses({
-		wallet: resolveWalletRuntimeConfig(cfg, env),
-		cfg,
-		env
-	});
-}
 const walletGatewayRpcStartedAt = new Date().toISOString();
 const walletGatewayRpcMetrics = new Map();
 function recordWalletGatewayRpcMethod(method, outcome) {
@@ -878,11 +929,6 @@ function summarizeWalletGatewayRpcMetrics() {
 		})).toSorted((left, right) => left.method.localeCompare(right.method))
 	};
 }
-function formatSplitKeyPasskeyBlockMessage(splitKeyWallets) {
-	const walletList = splitKeyWallets.map((entry) => entry.target.walletId).filter(Boolean).slice(0, 4).join(", ");
-	const suffix = walletList.length > 0 ? ` Split-key wallet${splitKeyWallets.length === 1 ? "" : "s"}: ${walletList}.` : "";
-	return `Cannot remove the last Wallet Control Passkey while wallet security is enabled. Disable wallet security on every secured wallet before removing this passkey.${suffix}`;
-}
 async function fetchSolanaLamportsViaRpc(params) {
 	const rpcUrl = String(params.rpcUrl ?? "").trim();
 	const address = String(params.address ?? "").trim();
@@ -998,6 +1044,12 @@ async function buildWalletProviderPayload(params) {
 			providerId,
 			supportedChains: [],
 			integrationMode: "native",
+			signingLocation: "unavailable",
+			signing: {
+				transaction: false,
+				message: false,
+				interactiveSend: false
+			},
 			operations: {
 				createWallet: false,
 				receiveAddress: false,
@@ -1015,7 +1067,7 @@ async function buildWalletProviderPayload(params) {
 				prepare: false,
 				send: false
 			} },
-			requiresCredentials: providerId !== "embedded-keystore",
+			requiresCredentials: providerId !== "local-socket-signer" && providerId !== "wallet-standard",
 			requiresRpcSecret: false
 		};
 		let health = {
@@ -1029,8 +1081,8 @@ async function buildWalletProviderPayload(params) {
 				env,
 				providerIdOverride: providerId
 			});
-			operationsImplemented = adapter.capabilities.supportsPrepare && adapter.capabilities.supportsSend;
 			capabilities = buildWalletProviderCapabilityMatrix(adapter);
+			operationsImplemented = providerId === "local-socket-signer" || adapter.capabilities.supportsPrepare && adapter.capabilities.supportsSend || capabilities.signing.interactiveSend;
 			const healthResult = await withWalletProbeTimeout(adapter.health(), probeTimeoutMs, `provider.health:${providerId}`);
 			health = {
 				ok: healthResult.ok,
@@ -1049,7 +1101,7 @@ async function buildWalletProviderPayload(params) {
 		});
 		return {
 			id: providerId,
-			enabled: registry.providers[providerId]?.enabled ?? providerId === "embedded-keystore",
+			enabled: registry.providers[providerId]?.enabled ?? false,
 			label: registry.providers[providerId]?.label,
 			isDefault: providerId === defaultProviderId,
 			operationsImplemented,
@@ -1309,9 +1361,17 @@ function parseFederationBondMutationInput(input) {
 		walletId: typeof body.walletId === "string" ? body.walletId.trim() || undefined : undefined,
 		amountSat: typeof body.amountSat === "string" ? body.amountSat.trim() || undefined : undefined,
 		tier: body.tier === "basic-bond" || body.tier === "operator-bond" ? body.tier : undefined,
-		autoSubmitProof: typeof body.autoSubmitProof === "boolean" ? body.autoSubmitProof : undefined
+		autoSubmitProof: typeof body.autoSubmitProof === "boolean" ? body.autoSubmitProof : undefined,
+		idempotencyKey: typeof body.idempotencyKey === "string" ? body.idempotencyKey.trim() || undefined : undefined
 	};
 }
+function normalizeFederationBondIdempotencyKey(value) {
+	const normalized = value.trim();
+	if (!normalized || normalized.length > 160 || /[^\x20-\x7e]/u.test(normalized)) {
+		throw new Error("idempotency key must contain 1-160 printable characters");
+	}
+	return normalized;
+}
 function validateFederationBondVaultWallet(cfg, walletId) {
 	const registry = readWalletProviderRegistry(process.env);
 	const wallet = registry.wallets.find((entry) => entry.id === walletId);
@@ -1502,19 +1562,6 @@ function parseSatAmountToRawNumber(amountSatInput) {
 		safeInteger: Number(raw)
 	};
 }
-function parseSatRawToSafeNumber(rawInput) {
-	const raw = BigInt(rawInput || "0");
-	if (raw <= 0n) {
-		throw new Error("amountRaw must be greater than zero");
-	}
-	if (raw > BigInt(Number.MAX_SAFE_INTEGER)) {
-		throw new Error("amountRaw is too large for the current gateway bond action path");
-	}
-	return {
-		amountRaw: raw.toString(),
-		safeInteger: Number(raw)
-	};
-}
 async function runFederationBondProof(params) {
 	const bondView = params.liveBond ?? await resolveFederationBondWallet({
 		env: process.env,
@@ -1524,6 +1571,17 @@ async function runFederationBondProof(params) {
 	if (!bondView || bondView.statusLabel !== "active") {
 		throw new Error("active SAT bond not found for proof submission");
 	}
+	const pendingProof = await loadPersistedFederationBondProof(process.env);
+	if (pendingProof && pendingProof.walletId === params.walletId && pendingProof.bondId === bondView.address && pendingProof.bondAmountRaw === bondView.amountRaw && pendingProof.bondTier === bondView.tierLabel && Date.parse(pendingProof.expiresAt) > Date.now()) {
+		if (pendingProof.verifiedAt) {
+			return { proof: pendingProof };
+		}
+		return await submitFederationBondProof({
+			env: process.env,
+			cfg: params.cfg,
+			proof: pendingProof
+		});
+	}
 	return await createAndSubmitFederationBondProof({
 		env: process.env,
 		cfg: params.cfg,
@@ -2102,7 +2160,7 @@ async function readLocalFederationStatus(env = process.env, fetchImpl = fetch) {
 	const sourcePath = path.join(resolveStateDir(env), "federation", "access-token.json");
 	const managed = (env.FASED_GATEWAY_MODE ?? "").trim().toLowerCase() === "managed";
 	const configured = resolveConfiguredFederationStatus(env);
-	if (!fs.existsSync(sourcePath)) {
+	if (!syncFs.existsSync(sourcePath)) {
 		return {
 			managed,
 			sourcePath,
@@ -2114,7 +2172,7 @@ async function readLocalFederationStatus(env = process.env, fetchImpl = fetch) {
 	}
 	let rawText = "";
 	try {
-		rawText = fs.readFileSync(sourcePath, "utf-8");
+		rawText = syncFs.readFileSync(sourcePath, "utf-8");
 	} catch {
 		return {
 			managed,
@@ -2163,7 +2221,7 @@ async function readLocalFederationStatus(env = process.env, fetchImpl = fetch) {
 	const lifecycle = Number.isFinite(expiresAtMs) ? expiresAtMs > Date.now() ? "active" : "expired" : "invalid";
 	let fileUpdatedAt;
 	try {
-		fileUpdatedAt = fs.statSync(sourcePath).mtime.toISOString();
+		fileUpdatedAt = syncFs.statSync(sourcePath).mtime.toISOString();
 	} catch {
 		fileUpdatedAt = undefined;
 	}
@@ -2318,6 +2376,7 @@ async function readLocalFederationStatus(env = process.env, fetchImpl = fetch) {
 					totalActiveStakeRaw: liveBondStakingDistributor?.totalActiveStakeRaw,
 					rewardIndexFp: liveBondStakingDistributor?.rewardIndexFp,
 					observedRewardVaultRaw: liveBondStakingDistributor?.observedRewardVaultRaw,
+					unallocatedRewardRaw: liveBondStakingDistributor?.unallocatedRewardRaw,
 					rewardVaultBalanceRaw: liveBondStakingDistributor?.rewardVaultBalanceRaw,
 					lastSyncedSlot: liveBondStakingDistributor?.lastSyncedSlot,
 					mintMatchesRuntime: liveBondStakingDistributor?.mintMatchesRuntime,
@@ -2386,6 +2445,9 @@ async function readLocalFederationStatus(env = process.env, fetchImpl = fetch) {
 function isCanvasPath(pathname) {
 	return pathname === A2UI_PATH || pathname.startsWith(`${A2UI_PATH}/`) || pathname === CANVAS_HOST_PATH || pathname.startsWith(`${CANVAS_HOST_PATH}/`) || pathname === CANVAS_WS_PATH;
 }
+function isSignedFederationInboundRequest(req) {
+	return req.method === "POST" && SIGNED_FEDERATION_INBOUND_ROUTES.has(req.url ?? "");
+}
 function hasAuthorizedWsClientForIp(clients, clientIp) {
 	for (const client of clients) {
 		if (client.clientIp && client.clientIp === clientIp) {
@@ -2999,8 +3061,10 @@ function createGatewayHttpServer(opts) {
 				});
 			};
 			const isRemoteHost = host ? !isLocalHostName(host) : true;
+			const tailscaleProxyConfigured = resolvedAuth.allowTailscale || (configSnapshot.gateway?.tailscale?.mode ?? "off") !== "off";
+			const directLocalRequest = !tailscaleProxyConfigured && isDirectLoopbackRequest(req, trustedProxies);
 			const ensureWalletApiAuthorized = async () => {
-				if (!isRemoteHost) {
+				if (directLocalRequest) {
 					return true;
 				}
 				let authorized = false;
@@ -3387,8 +3451,7 @@ function createGatewayHttpServer(opts) {
 					});
 					return;
 				}
-				const isRemoteHost = host ? !isLocalHostName(host) : true;
-				if (isRemoteHost) {
+				if (!directLocalRequest) {
 					let authorized = false;
 					const bearer = getBearerToken(req);
 					if (controlUiLogin && host) {
@@ -3542,6 +3605,21 @@ function createGatewayHttpServer(opts) {
 					return;
 				}
 				const parsed = parseFederationBondMutationInput(body.value);
+				const headerIdempotencyKey = Array.isArray(req.headers["idempotency-key"]) ? req.headers["idempotency-key"][0] : req.headers["idempotency-key"];
+				let idempotencyKey;
+				try {
+					idempotencyKey = normalizeFederationBondIdempotencyKey(parsed.idempotencyKey ?? (typeof headerIdempotencyKey === "string" && headerIdempotencyKey.trim() ? headerIdempotencyKey : `derived:${digestSatSubmissionIntent(body.value)}`));
+				} catch (error) {
+					sendLoginResponse(400, {
+						ok: false,
+						error: {
+							code: "invalid_idempotency_key",
+							message: error instanceof Error ? error.message : String(error)
+						}
+					});
+					return;
+				}
+				const runBondSubmission = async (step, task) => await runWithSatSubmissionWorkflow(`http:${requestPath}:${idempotencyKey}:${step}`, task);
 				const cfg = loadConfig();
 				const walletId = parsed.walletId ?? resolveFederationBondDefaultWalletId(cfg);
 				if (!walletId) {
@@ -3585,8 +3663,8 @@ function createGatewayHttpServer(opts) {
 							return;
 						}
 						try {
-							await retrySolanaRateLimit("sync bond staking rewards", async () => await submitSatSyncBondStakingRewards(bondCfg));
-							await retrySolanaRateLimit("sync bond staking position", async () => await submitSatSyncBondStakingPosition(bondCfg));
+							await retrySolanaRateLimit("sync bond staking rewards", async () => await runBondSubmission("sync-staking-rewards", async () => await submitSatSyncBondStakingRewards(bondCfg)));
+							await retrySolanaRateLimit("sync bond staking position", async () => await runBondSubmission("sync-staking-position", async () => await submitSatSyncBondStakingPosition(bondCfg)));
 							invalidateSatReadCaches({ preserveStable: true });
 						} catch (error) {
 							const message = error instanceof Error ? error.message : String(error);
@@ -3597,7 +3675,7 @@ function createGatewayHttpServer(opts) {
 					if (requestPath === "/api/federation/bond/open") {
 						const amountSat = parsed.amountSat ?? resolveDefaultBondAmountSat(parsed.tier);
 						const amount = parseSatAmountToRawNumber(amountSat);
-						tx = await submitSatOpenBondPosition(bondCfg, { amountRaw: amount.safeInteger });
+						tx = await runBondSubmission("open", async () => await submitSatOpenBondPosition(bondCfg, { amountRaw: amount.safeInteger }));
 						invalidateSatReadCaches({ preserveStable: true });
 						liveBond = await readBond();
 						if (liveBond?.statusLabel === "active") {
@@ -3605,18 +3683,18 @@ function createGatewayHttpServer(opts) {
 							liveBond = await readBond();
 						}
 						if ((parsed.autoSubmitProof ?? true) && liveBond?.statusLabel === "active") {
-							const proof = await tryRunFederationBondProof({
+							const proof = await runBondSubmission("refresh-proof", async () => await tryRunFederationBondProof({
 								cfg,
 								walletId,
 								liveBond
-							});
+							}));
 							proofSubmitted = proof.submitted;
 							proofWarning = appendActionWarning(proofWarning, proof.warning ?? "");
 						}
 					} else if (requestPath === "/api/federation/bond/increase") {
 						const amountSat = parsed.amountSat ?? "1";
 						const amount = parseSatAmountToRawNumber(amountSat);
-						tx = await submitSatIncreaseBondPosition(bondCfg, { amountRaw: amount.safeInteger });
+						tx = await runBondSubmission("increase", async () => await submitSatIncreaseBondPosition(bondCfg, { amountRaw: amount.safeInteger }));
 						invalidateSatReadCaches({ preserveStable: true });
 						liveBond = await readBond();
 						if (liveBond?.statusLabel === "active") {
@@ -3624,22 +3702,22 @@ function createGatewayHttpServer(opts) {
 							liveBond = await readBond();
 						}
 						if ((parsed.autoSubmitProof ?? true) && liveBond?.statusLabel === "active") {
-							const proof = await tryRunFederationBondProof({
+							const proof = await runBondSubmission("refresh-proof", async () => await tryRunFederationBondProof({
 								cfg,
 								walletId,
 								liveBond
-							});
+							}));
 							proofSubmitted = proof.submitted;
 							proofWarning = appendActionWarning(proofWarning, proof.warning ?? "");
 						}
 					} else if (requestPath === "/api/federation/bond/request-unlock") {
-						tx = await submitSatRequestBondUnlock(bondCfg);
+						tx = await runBondSubmission("request-unlock", async () => await submitSatRequestBondUnlock(bondCfg));
 						invalidateSatReadCaches({ preserveStable: true });
 						liveBond = await readBond();
 						await syncBondStakingPositionForAction();
 						liveBond = await readBond();
 					} else if (requestPath === "/api/federation/bond/cancel-unlock") {
-						tx = await submitSatCancelBondUnlock(bondCfg);
+						tx = await runBondSubmission("cancel-unlock", async () => await submitSatCancelBondUnlock(bondCfg));
 						invalidateSatReadCaches({ preserveStable: true });
 						liveBond = await readBond();
 						if (liveBond?.statusLabel === "active") {
@@ -3653,32 +3731,25 @@ function createGatewayHttpServer(opts) {
 								throw new Error(`bond unlock is not ready yet: current slot ${currentSlot}, unlock available at ${liveBond.unlockAvailableAtSlot}`);
 							}
 						}
-						tx = await submitSatFinalizeBondUnlock(bondCfg);
+						tx = await runBondSubmission("finalize-unlock", async () => await submitSatFinalizeBondUnlock(bondCfg));
 						invalidateSatReadCaches({ preserveStable: true });
 						liveBond = await readBond();
 						await syncBondStakingPositionForAction();
 						liveBond = await readBond();
 					} else if (requestPath === "/api/federation/bond/prove") {
 						liveBond = await readBond();
-						await runFederationBondProof({
+						await runBondSubmission("proof", async () => await runFederationBondProof({
 							cfg,
 							walletId,
 							liveBond
-						});
+						}));
 						proofSubmitted = true;
 						liveBond = await readBond();
 					} else if (requestPath === "/api/federation/bond/staking/init") {
-						const policy = await inspectSatBondTierPolicy(bondCfg).catch(() => null);
-						const amount = parsed.amountSat ? parseSatAmountToRawNumber(parsed.amountSat) : policy?.operatorMinRaw ? parseSatRawToSafeNumber(policy.operatorMinRaw) : parseSatAmountToRawNumber(resolveDefaultBondAmountSat("operator-bond"));
-						if (!Number.isSafeInteger(amount.safeInteger) || amount.safeInteger <= 0) {
-							throw new Error("staking distributor minimum could not be resolved from bond policy");
-						}
-						tx = await submitSatInitBondStakingDistributor(bondCfg, { minStakeRaw: amount.safeInteger });
-						invalidateSatReadCaches({ preserveStable: true });
-						liveBond = await readBond();
+						throw new Error("SAT bond staking distributor initialization is a protocol-genesis operation; use the approved token/sat operator workflow");
 					} else if (requestPath === "/api/federation/bond/staking/sync") {
-						tx = await retrySolanaRateLimit("sync bond staking rewards", async () => await submitSatSyncBondStakingRewards(bondCfg));
-						await retrySolanaRateLimit("sync bond staking position", async () => await submitSatSyncBondStakingPosition(bondCfg));
+						tx = await retrySolanaRateLimit("sync bond staking rewards", async () => await runBondSubmission("sync-staking-rewards", async () => await submitSatSyncBondStakingRewards(bondCfg)));
+						await retrySolanaRateLimit("sync bond staking position", async () => await runBondSubmission("sync-staking-position", async () => await submitSatSyncBondStakingPosition(bondCfg)));
 						invalidateSatReadCaches({ preserveStable: true });
 						liveBond = await readBond();
 					} else if (requestPath === "/api/federation/bond/staking/claim") {
@@ -3688,7 +3759,7 @@ function createGatewayHttpServer(opts) {
 						const estimatedClaimRaw = estimateBondStakingClaimRaw(stakingPositionBeforeClaim, stakingDistributorBeforeClaim);
 						if (isPositiveSatRawAmount(estimatedClaimRaw)) {
 							stakingClaimedRaw = estimatedClaimRaw;
-							tx = await retrySolanaRateLimit("claim bond staking rewards", async () => await submitSatClaimBondStakingRewards(bondCfg));
+							tx = await retrySolanaRateLimit("claim bond staking rewards", async () => await runBondSubmission("claim-staking-rewards", async () => await submitSatClaimBondStakingRewards(bondCfg)));
 						} else {
 							proofWarning = "No claimable distributor SAT after sync.";
 						}
@@ -3769,7 +3840,7 @@ function createGatewayHttpServer(opts) {
 					const selectedWalletId = parsedUrl.searchParams.get("walletId")?.trim() || undefined;
 					sendLoginResponse(200, {
 						ok: true,
-						settings: buildWalletSettingsPayload(cfg, selectedWalletId, process.env)
+						settings: await buildWalletSettingsPayload(cfg, selectedWalletId, process.env)
 					});
 					return;
 				}
@@ -3788,6 +3859,27 @@ function createGatewayHttpServer(opts) {
 						});
 						return;
 					}
+					const settingsPayload = body.value ?? {};
+					if (settingsPayload.providerId === "embedded-keystore") {
+						sendLoginResponse(409, {
+							ok: false,
+							error: {
+								code: "wallet_legacy_embedded_keystore_migration_required",
+								message: LEGACY_EMBEDDED_KEYSTORE_MIGRATION_MESSAGE
+							}
+						});
+						return;
+					}
+					if (settingsPayload.providerId === "privy") {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "provider_unavailable",
+								message: "Privy wallet creation and signing are unavailable."
+							}
+						});
+						return;
+					}
 					const patch = parseWalletSettingsPatchInput(body.value);
 					if (!isManagedGatewayMode(process.env) && !isWalletPolicyPatch(patch)) {
 						sendLoginResponse(400, {
@@ -3820,19 +3912,6 @@ function createGatewayHttpServer(opts) {
 					const currentWallet = resolveWalletRuntimeConfig(currentCfg, process.env);
 					const targetProviderId = patch.providerId ?? currentProviderId;
 					const switchingToAutonomous = patch.executionMode === "autonomous" && currentWallet.execution.mode !== "autonomous";
-					if (patch.approvalAuthMode === "none") {
-						const splitKeyWallets = listSplitKeyWalletsBlockingPasskeyRemoval(currentCfg, process.env);
-						if (splitKeyWallets.length > 0) {
-							sendLoginResponse(409, {
-								ok: false,
-								error: {
-									code: "wallet_passkey_required_by_split_key",
-									message: formatSplitKeyPasskeyBlockMessage(splitKeyWallets)
-								}
-							});
-							return;
-						}
-					}
 					if (patch.executionMode === "autonomous" && targetProviderId !== "local-socket-signer") {
 						sendLoginResponse(400, {
 							ok: false,
@@ -3843,12 +3922,12 @@ function createGatewayHttpServer(opts) {
 						});
 						return;
 					}
-					if (patch.providerId === "turnkey" && !hasTurnkeySigningStampConfigured(process.env)) {
+					if (patch.providerId === "turnkey" && !hasTurnkeyPolicyCredentialsConfigured(process.env)) {
 						sendLoginResponse(400, {
 							ok: false,
 							error: {
 								code: "provider_prerequisite_missing",
-								message: "turnkey cannot be set as default provider until signing stamp is configured (set FASED_WALLET_TURNKEY_STAMP or provider credential `stamp`)"
+								message: "turnkey cannot be set as default until its dedicated API key, organization, policy, and Solana RPC are configured"
 							}
 						});
 						return;
@@ -3859,6 +3938,158 @@ function createGatewayHttpServer(opts) {
 					})) {
 						return;
 					}
+					const effectiveEnv = {
+						...process.env,
+						...currentCfg.env?.vars
+					};
+					const registry = readWalletProviderRegistry(effectiveEnv);
+					const selectedRegistryWallet = selectedWalletId ? registry.wallets.find((wallet) => wallet.id === selectedWalletId) : undefined;
+					if (hasScopedPolicyPatch && !selectedWalletId && currentProviderId === "local-socket-signer") {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "wallet_id_required",
+								message: "Signer-backed policy changes require an explicit walletId so one immutable signer policy can acknowledge the change."
+							}
+						});
+						return;
+					}
+					let preparedScopedPolicy;
+					if (selectedWalletId && hasScopedPolicyPatch) {
+						try {
+							preparedScopedPolicy = prepareWalletPolicyConfigUpdate({
+								cfg: currentCfg,
+								env: effectiveEnv,
+								walletId: selectedWalletId,
+								patch: {
+									template: patch.policyTemplate,
+									capsEnabled: patch.capsEnabled,
+									directSigning: patch.directSigning,
+									skillsEnabled: patch.skillsEnabled,
+									solanaAllowPrograms: patch.solanaAllowPrograms,
+									solanaMaxPerTx: patch.solanaMaxPerTx,
+									solanaMaxDaily: patch.solanaMaxDaily,
+									solanaTokenCaps: patch.solanaTokenCaps,
+									recurringTransfer: patch.recurringTransfer
+								}
+							});
+						} catch (err) {
+							sendLoginResponse(400, {
+								ok: false,
+								error: {
+									code: "invalid_wallet_settings",
+									message: err instanceof Error ? err.message : String(err)
+								}
+							});
+							return;
+						}
+					}
+					let acknowledgedSignerPolicy;
+					if (preparedScopedPolicy && selectedRegistryWallet?.providerId === "local-socket-signer") {
+						try {
+							const scopedWalletId = resolveNativeSignerWalletId(selectedRegistryWallet);
+							const signer = new LocalSocketSignerAdapter(resolveLocalSignerSocketPath(effectiveEnv));
+							const currentSignerPolicy = await signer.getSignerPolicy(scopedWalletId);
+							const currentGatewayPolicy = resolveWalletPolicyConfig(currentCfg, effectiveEnv, scopedWalletId).policy;
+							const candidate = buildLocalSignerPolicyTightening({
+								current: currentSignerPolicy,
+								expectedRole: preparedScopedPolicy.role,
+								gatewayPolicy: {
+									capsEnabled: currentGatewayPolicy.capsEnabled,
+									directSigning: currentGatewayPolicy.directSigning,
+									skillsEnabled: currentGatewayPolicy.skillsEnabled,
+									solana: {
+										allowPrograms: currentGatewayPolicy.solana.allowPrograms,
+										maxPerTx: currentGatewayPolicy.solana.caps.maxPerTx.toString(),
+										maxDaily: currentGatewayPolicy.solana.caps.maxDaily.toString(),
+										tokenCaps: Object.fromEntries(Object.entries(currentGatewayPolicy.solana.tokenCaps).map(([mint, cap]) => [mint, {
+											maxPerTx: cap.maxPerTx.toString(),
+											maxDaily: cap.maxDaily.toString()
+										}]))
+									}
+								},
+								patch,
+								hosting: String(effectiveEnv.FASED_HOST_PROFILE ?? "").trim().toLowerCase() === "hosting"
+							});
+							acknowledgedSignerPolicy = await signer.tightenSignerPolicy({
+								walletId: scopedWalletId,
+								expectedVersion: currentSignerPolicy.version,
+								policy: candidate
+							});
+						} catch (err) {
+							const message = err instanceof Error ? err.message : String(err);
+							if (err instanceof LocalSignerPolicyAdminRequiredError) {
+								sendLoginResponse(409, {
+									ok: false,
+									error: {
+										code: err.code,
+										message
+									}
+								});
+								return;
+							}
+							if (/version conflict/i.test(message)) {
+								sendLoginResponse(409, {
+									ok: false,
+									error: {
+										code: "signer_policy_conflict",
+										message: "Signer policy changed concurrently. Reload the wallet policy and review the new version/hash before retrying."
+									}
+								});
+								return;
+							}
+							if (/cannot (?:add|alter|raise)|policy expansion/i.test(message)) {
+								sendLoginResponse(409, {
+									ok: false,
+									error: {
+										code: "signer_policy_admin_required",
+										message: `${message} Policy expansion or role changes require the native signer control socket and an authenticated host administrator; the Gateway cannot perform them.`
+									}
+								});
+								return;
+							}
+							sendLoginResponse(502, {
+								ok: false,
+								error: {
+									code: "signer_policy_unavailable",
+									message: "Signer policy acknowledgement failed. No wallet policy settings or metadata were saved."
+								}
+							});
+							return;
+						}
+					}
+					if (acknowledgedSignerPolicy && selectedRegistryWallet) {
+						try {
+							const latestRegistryWallet = readWalletProviderRegistry(effectiveEnv).wallets.find((wallet) => wallet.id === selectedRegistryWallet.id);
+							if (latestRegistryWallet?.providerId !== "local-socket-signer") {
+								throw new Error("signer-backed wallet registry entry changed concurrently");
+							}
+							upsertNamedWallet({
+								walletId: latestRegistryWallet.id,
+								name: latestRegistryWallet.name,
+								providerId: latestRegistryWallet.providerId,
+								addresses: latestRegistryWallet.addresses,
+								metadata: {
+									...latestRegistryWallet.metadata,
+									role: acknowledgedSignerPolicy.role,
+									purpose: acknowledgedSignerPolicy.role,
+									policyState: localSignerPolicyState(acknowledgedSignerPolicy),
+									policyVersion: acknowledgedSignerPolicy.version,
+									policyHash: acknowledgedSignerPolicy.hash
+								},
+								env: effectiveEnv
+							});
+						} catch (err) {
+							sendLoginResponse(409, {
+								ok: false,
+								error: {
+									code: "signer_policy_metadata_conflict",
+									message: `The signer acknowledged policy version ${acknowledgedSignerPolicy.version} (${acknowledgedSignerPolicy.hash}), but its wallet metadata could not be recorded: ` + `${err instanceof Error ? err.message : String(err)}. No app policy settings were saved; reload before retrying.`
+								}
+							});
+							return;
+						}
+					}
 					let nextCfg = currentCfg;
 					if (hasGlobalConfigPatch) {
 						const updated = await updateWalletConfig({
@@ -3938,30 +4169,15 @@ function createGatewayHttpServer(opts) {
 						}
 						nextCfg = updated.cfg;
 					}
-					if (selectedWalletId && hasScopedPolicyPatch) {
+					if (preparedScopedPolicy) {
 						try {
-							upsertWalletPolicyConfig({
-								cfg: nextCfg,
-								env: process.env,
-								walletId: selectedWalletId,
-								patch: {
-									template: patch.policyTemplate,
-									capsEnabled: patch.capsEnabled,
-									directSigning: patch.directSigning,
-									skillsEnabled: patch.skillsEnabled,
-									solanaAllowPrograms: patch.solanaAllowPrograms,
-									solanaMaxPerTx: patch.solanaMaxPerTx,
-									solanaMaxDaily: patch.solanaMaxDaily,
-									solanaTokenCaps: patch.solanaTokenCaps,
-									recurringTransfer: patch.recurringTransfer
-								}
-							});
+							commitWalletPolicyConfigUpdate(preparedScopedPolicy, effectiveEnv);
 						} catch (err) {
-							sendLoginResponse(400, {
+							sendLoginResponse(409, {
 								ok: false,
 								error: {
-									code: "invalid_wallet_settings",
-									message: String(err)
+									code: "wallet_policy_conflict",
+									message: err instanceof Error ? err.message : String(err)
 								}
 							});
 							return;
@@ -3981,7 +4197,7 @@ function createGatewayHttpServer(opts) {
 					}
 					sendLoginResponse(200, {
 						ok: true,
-						settings: buildWalletSettingsPayload(nextCfg, selectedWalletId, process.env)
+						settings: await buildWalletSettingsPayload(nextCfg, selectedWalletId, effectiveEnv, acknowledgedSignerPolicy)
 					});
 					return;
 				}
@@ -4079,7 +4295,37 @@ function createGatewayHttpServer(opts) {
 						});
 						return;
 					}
+					if (body.value != null && (typeof body.value !== "object" || Array.isArray(body.value))) {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "invalid_request",
+								message: "signer-reviewed approval body must be a JSON object"
+							}
+						});
+						return;
+					}
 					const payload = body.value ?? {};
+					if (payload.providerId === "embedded-keystore") {
+						sendLoginResponse(409, {
+							ok: false,
+							error: {
+								code: "wallet_legacy_embedded_keystore_migration_required",
+								message: LEGACY_EMBEDDED_KEYSTORE_MIGRATION_MESSAGE
+							}
+						});
+						return;
+					}
+					if (payload.providerId === "privy") {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "provider_unavailable",
+								message: "Privy wallet creation and signing are unavailable."
+							}
+						});
+						return;
+					}
 					const providerId = parseWalletProviderId(payload.providerId);
 					if (!providerId) {
 						sendLoginResponse(400, {
@@ -4100,12 +4346,12 @@ function createGatewayHttpServer(opts) {
 						});
 					}
 					if (payload.setDefault === true) {
-						if (providerId === "turnkey" && !hasTurnkeySigningStampConfigured(process.env)) {
+						if (providerId === "turnkey" && !hasTurnkeyPolicyCredentialsConfigured(process.env)) {
 							sendLoginResponse(400, {
 								ok: false,
 								error: {
 									code: "provider_prerequisite_missing",
-									message: "turnkey cannot be set as default provider until signing stamp is configured (set FASED_WALLET_TURNKEY_STAMP or provider credential `stamp`)"
+									message: "turnkey cannot be set as default until its dedicated API key, organization, policy, and Solana RPC are configured"
 								}
 							});
 							return;
@@ -4166,7 +4412,7 @@ function createGatewayHttpServer(opts) {
 						return {
 							...wallet,
 							readiness: {
-								keystore: true,
+								keystore: wallet.providerId !== "embedded-keystore" && wallet.providerId !== "privy",
 								rpc: Boolean(solanaRpc)
 							}
 						};
@@ -4203,6 +4449,26 @@ function createGatewayHttpServer(opts) {
 						return;
 					}
 					const payload = body.value ?? {};
+					if (payload.providerId === "embedded-keystore") {
+						sendLoginResponse(409, {
+							ok: false,
+							error: {
+								code: "wallet_legacy_embedded_keystore_migration_required",
+								message: LEGACY_EMBEDDED_KEYSTORE_MIGRATION_MESSAGE
+							}
+						});
+						return;
+					}
+					if (payload.providerId === "privy") {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "provider_unavailable",
+								message: "Privy wallet creation and signing are unavailable."
+							}
+						});
+						return;
+					}
 					const cfg = loadConfig();
 					const walletCfg = resolveWalletRuntimeConfig(cfg, process.env);
 					const providerId = parseWalletProviderId(payload.providerId) ?? resolveWalletProviderId(cfg, process.env);
@@ -4242,54 +4508,42 @@ function createGatewayHttpServer(opts) {
 						});
 						return;
 					}
-					if (providerId === "local-socket-signer") {
-						if (!requestedWalletId) {
+					if (providerId === "wallet-standard") {
+						const address = typeof payload.address === "string" ? payload.address.trim() : "";
+						if (!address || !isValidSolanaAddress(address)) {
 							sendLoginResponse(400, {
 								ok: false,
 								error: {
-									code: "invalid_request",
-									message: "walletId is required when creating a local signer wallet"
+									code: "invalid_solana_address",
+									message: "a valid browser-selected Solana account is required"
 								}
 							});
 							return;
 						}
-						const chain = inferLocalSignerCreateChain({
-							payloadChain: payload.chain,
-							walletId: requestedWalletId,
-							walletName,
-							runtimeChains: walletCfg.chains
-						});
-						if (!chain) {
+						if (requestedRole && requestedRole !== "vault") {
 							sendLoginResponse(400, {
 								ok: false,
 								error: {
-									code: "invalid_request",
-									message: "chain is required for local signer wallet creation; use chain=solana"
+									code: "invalid_wallet_role",
+									message: "Wallet Standard accounts are supported as reviewed Vault wallets only"
 								}
 							});
 							return;
 						}
 						try {
-							const effectiveEnv = {
-								...process.env,
-								...cfg.env?.vars
-							};
-							await walletSetupCommand(silentWalletSetupRuntime, {
-								mode: "local-signer-create",
-								chain,
-								walletId: requestedWalletId,
-								walletName,
-								rpcUrl: resolveWalletRpcUrlFromEnv(effectiveEnv, chain, requestedWalletId),
-								role: requestedRole,
-								nonInteractive: true,
-								noSignerHints: true,
-								noDoctor: true
+							const wallet = upsertNamedWallet({
+								walletId: requestedWalletId || undefined,
+								name: walletName,
+								providerId,
+								addresses: { solana: address },
+								metadata: {
+									role: "vault",
+									purpose: "vault",
+									browserSigner: true,
+									selfHosted: false
+								},
+								env: process.env
 							});
-							const registry = readWalletProviderRegistry(process.env);
-							const wallet = registry.wallets.find((entry) => entry.id === requestedWalletId);
-							if (!wallet) {
-								throw new Error("local signer wallet was created but not registered");
-							}
 							appendWalletAuditEntry({
 								action: "wallet_named_created",
 								actor: "control-ui",
@@ -4305,9 +4559,83 @@ function createGatewayHttpServer(opts) {
 								ok: true,
 								wallet
 							});
-							return;
 						} catch (err) {
-							sendLoginResponse(502, {
+							sendLoginResponse(400, {
+								ok: false,
+								error: {
+									code: "invalid_request",
+									message: err instanceof Error ? err.message : String(err)
+								}
+							});
+						}
+						return;
+					}
+					if (providerId === "local-socket-signer") {
+						if (!requestedWalletId) {
+							sendLoginResponse(400, {
+								ok: false,
+								error: {
+									code: "invalid_request",
+									message: "walletId is required when creating a local signer wallet"
+								}
+							});
+							return;
+						}
+						const chain = inferLocalSignerCreateChain({
+							payloadChain: payload.chain,
+							walletId: requestedWalletId,
+							walletName,
+							runtimeChains: walletCfg.chains
+						});
+						if (!chain) {
+							sendLoginResponse(400, {
+								ok: false,
+								error: {
+									code: "invalid_request",
+									message: "chain is required for local signer wallet creation; use chain=solana"
+								}
+							});
+							return;
+						}
+						try {
+							const effectiveEnv = {
+								...process.env,
+								...cfg.env?.vars
+							};
+							await walletSetupCommand(silentWalletSetupRuntime, {
+								mode: "local-signer-create",
+								chain,
+								walletId: requestedWalletId,
+								walletName,
+								rpcUrl: resolveWalletRpcUrlFromEnv(effectiveEnv, chain, requestedWalletId),
+								role: requestedRole,
+								nonInteractive: true,
+								noSignerHints: true,
+								noDoctor: true
+							});
+							const registry = readWalletProviderRegistry(process.env);
+							const wallet = registry.wallets.find((entry) => entry.id === requestedWalletId);
+							if (!wallet) {
+								throw new Error("local signer wallet was created but not registered");
+							}
+							appendWalletAuditEntry({
+								action: "wallet_named_created",
+								actor: "control-ui",
+								details: {
+									walletId: wallet.id,
+									walletName: wallet.name,
+									providerId: wallet.providerId,
+									addresses: wallet.addresses
+								},
+								env: process.env
+							});
+							sendLoginResponse(200, {
+								ok: true,
+								wallet
+							});
+							return;
+						} catch (err) {
+							sendLoginResponse(502, {
 								ok: false,
 								error: {
 									code: "wallet_provider_error",
@@ -4465,6 +4793,35 @@ function createGatewayHttpServer(opts) {
 						return;
 					}
 					if (requestedRole) {
+						if (existing.providerId === "local-socket-signer") {
+							try {
+								const cfg = loadConfig();
+								const effectiveEnv = {
+									...process.env,
+									...cfg.env?.vars
+								};
+								const signerPolicy = await new LocalSocketSignerAdapter(resolveLocalSignerSocketPath(effectiveEnv)).getSignerPolicy(resolveNativeSignerWalletId(existing));
+								if (signerPolicy.role !== requestedRole) {
+									sendLoginResponse(409, {
+										ok: false,
+										error: {
+											code: "signer_wallet_role_immutable",
+											message: `The native signer owns this wallet as role=${signerPolicy.role}; the Gateway cannot change it to ${requestedRole}. ` + "Create a new signer-owned wallet with the required locked role through Local onboarding or an authenticated Hosting administrator session."
+										}
+									});
+									return;
+								}
+							} catch {
+								sendLoginResponse(502, {
+									ok: false,
+									error: {
+										code: "signer_policy_unavailable",
+										message: "The native signer role could not be verified, so wallet role metadata was not changed."
+									}
+								});
+								return;
+							}
+						}
 						const currentRole = resolveWalletUserRole(existing) ?? (registry.defaultWalletId === walletId ? "agent" : undefined);
 						if (currentRole && currentRole !== requestedRole) {
 							sendLoginResponse(409, {
@@ -4559,7 +4916,7 @@ function createGatewayHttpServer(opts) {
 							ok: false,
 							error: {
 								code: "wallet_requires_onboarding_delete",
-								message: "self-hosted wallets must be deleted from onboarding so keystore files and mining attachments are cleaned up safely"
+								message: "signer-owned wallets must be removed through the native signer/onboarding flow so signer state and mining attachments are handled safely"
 							}
 						});
 						return;
@@ -4830,7 +5187,37 @@ function createGatewayHttpServer(opts) {
 						return;
 					}
 					const payload = body.value ?? {};
+					if (payload.providerId === "embedded-keystore") {
+						sendLoginResponse(409, {
+							ok: false,
+							error: {
+								code: "wallet_legacy_embedded_keystore_migration_required",
+								message: LEGACY_EMBEDDED_KEYSTORE_MIGRATION_MESSAGE
+							}
+						});
+						return;
+					}
+					if (payload.providerId === "privy") {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "provider_unavailable",
+								message: "Privy wallet creation and signing are unavailable."
+							}
+						});
+						return;
+					}
 					const providerId = resolveProviderFromInput(payload.providerId) ?? configuredProviderId;
+					if (providerId !== "alchemy" && providerId !== "turnkey") {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "provider_credentials_not_accepted",
+								message: `${providerId} does not accept Gateway-held provider credentials.`
+							}
+						});
+						return;
+					}
 					let credentials = {};
 					if (providerId === "alchemy") {
 						const apiKey = toOptionalString(payload.apiKey);
@@ -4884,24 +5271,33 @@ function createGatewayHttpServer(opts) {
 							return;
 						}
 						if (providerId === "turnkey") {
-							if (typeof credentials.apiPublicKey !== "string" || typeof credentials.apiPrivateKey !== "string") {
+							const allowedTurnkeyFields = new Set([
+								"apiPublicKey",
+								"apiPrivateKey",
+								"organizationId",
+								"policyId",
+								"baseUrl",
+								"rpcUrl",
+								"defaultSolanaAddress",
+								"providerWalletId"
+							]);
+							const unsupportedField = Object.keys(credentials).find((field) => !allowedTurnkeyFields.has(field));
+							if (unsupportedField) {
 								sendLoginResponse(400, {
 									ok: false,
 									error: {
 										code: "invalid_request",
-										message: "turnkey credentials must include apiPublicKey and apiPrivateKey"
+										message: `unsupported turnkey credential field: ${unsupportedField}`
 									}
 								});
 								return;
 							}
-						}
-						if (providerId === "privy") {
-							if (typeof credentials.appId !== "string" || typeof credentials.appSecret !== "string") {
+							if (typeof credentials.apiPublicKey !== "string" || typeof credentials.apiPrivateKey !== "string" || typeof credentials.organizationId !== "string" || typeof credentials.policyId !== "string" || typeof credentials.rpcUrl !== "string") {
 								sendLoginResponse(400, {
 									ok: false,
 									error: {
 										code: "invalid_request",
-										message: "privy credentials must include appId and appSecret"
+										message: "turnkey credentials must include apiPublicKey, apiPrivateKey, organizationId, policyId, and rpcUrl"
 									}
 								});
 								return;
@@ -4986,20 +5382,20 @@ function createGatewayHttpServer(opts) {
 					checks.push({
 						id: "wallet.rpc.configured",
 						ok: true,
-						message: providerId === "embedded-keystore" ? "embedded-keystore may require provider-specific RPC configuration (separate RPC secret endpoint removed)" : `${providerId} uses provider-managed APIs; separate RPC secret is optional`
+						message: `${providerId} uses signer/provider-owned network configuration`
 					});
 				}
 				checks.push({
 					id: "wallet.provider.credentials",
-					ok: providerId === "embedded-keystore" ? true : providerSecret.configured,
-					message: providerId === "embedded-keystore" ? "embedded-keystore uses local encrypted keystore (provider API credentials not required)" : providerSecret.configured ? `${providerId} provider credentials configured` : `${providerId} provider credentials are missing`
+					ok: providerId === "local-socket-signer" || providerId === "wallet-standard" || providerSecret.configured,
+					message: providerId === "local-socket-signer" || providerId === "wallet-standard" ? `${providerId} does not use Gateway-held provider credentials` : providerSecret.configured ? `${providerId} provider credentials configured` : `${providerId} provider credentials are missing`
 				});
 				if (providerId === "turnkey") {
-					const hasTurnkeyStamp = providerSecret.fields.includes("stamp") || providerSecret.fields.includes("xStamp") || providerSecret.fields.includes("x_stamp") || providerSecret.fields.includes("apiStamp") || Boolean(String(process.env.FASED_WALLET_TURNKEY_STAMP ?? "").trim());
+					const hasTurnkeyPolicyCredentials = hasTurnkeyPolicyCredentialsConfigured(process.env);
 					checks.push({
-						id: "wallet.provider.turnkey.signing_prereq",
-						ok: hasTurnkeyStamp,
-						message: hasTurnkeyStamp ? "turnkey signing stamp configured" : "turnkey signing stamp missing: create/prepare/send are hard-blocked until stamp is configured"
+						id: "wallet.provider.turnkey.policy_credentials",
+						ok: hasTurnkeyPolicyCredentials,
+						message: hasTurnkeyPolicyCredentials ? "turnkey dedicated API credential, organization, policy, and Solana RPC are configured" : "turnkey requires a dedicated API user covered by a restrictive organization policy, plus organizationId, policyId, and rpcUrl"
 					});
 				}
 				try {
@@ -5083,8 +5479,7 @@ function createGatewayHttpServer(opts) {
 				let snapshot = await readWalletStatusSnapshot({
 					config: cfg,
 					env: effectiveEnv,
-					walletId: selectedWalletId,
-					approvalHost: host
+					walletId: selectedWalletId
 				});
 				if (configuredProviderId === "local-socket-signer" && !snapshot.service.healthy) {
 					try {
@@ -5093,8 +5488,7 @@ function createGatewayHttpServer(opts) {
 						snapshot = await readWalletStatusSnapshot({
 							config: cfg,
 							env: effectiveEnv,
-							walletId: selectedWalletId,
-							approvalHost: host
+							walletId: selectedWalletId
 						});
 					} catch {}
 				}
@@ -5105,11 +5499,11 @@ function createGatewayHttpServer(opts) {
 					if (configuredProviderId === "turnkey" || configuredProviderId === "privy" || configuredProviderId === "alchemy") {
 						return "hosted-provider";
 					}
-					return "embedded-in-process";
+					return "local-native-signer";
 				})();
 				const providerSummary = {
 					id: configuredProviderId,
-					label: configuredProviderId === "embedded-keystore" ? "Self-hosted wallet" : configuredProviderId === "local-socket-signer" ? "Local signer socket" : configuredProviderId === "turnkey" ? "Turnkey" : configuredProviderId === "privy" ? "Privy" : configuredProviderId === "alchemy" ? "Alchemy" : configuredProviderId,
+					label: configuredProviderId === "local-socket-signer" ? "Local signer socket" : configuredProviderId === "turnkey" ? "Turnkey" : configuredProviderId === "privy" ? "Privy" : configuredProviderId === "alchemy" ? "Alchemy" : configuredProviderId,
 					category: activeSignerMode === "hosted-provider" ? "hosted-provider" : activeSignerMode === "local-native-signer" ? "local-signer" : "embedded",
 					signerMode: activeSignerMode
 				};
@@ -5157,7 +5551,7 @@ function createGatewayHttpServer(opts) {
 						health: readiness.keystore ? "ok" : "degraded"
 					};
 				});
-				if (configuredProviderId === "embedded-keystore" || configuredProviderId === "local-socket-signer") {
+				if (configuredProviderId === "local-socket-signer") {
 					statusPayload.providerAuthMode = snapshot.authMode;
 					statusPayload.providerAuthSource = snapshot.authSource;
 					statusPayload.providerAuthDetails = snapshot.authBootstrap ? {
@@ -5200,20 +5594,8 @@ function createGatewayHttpServer(opts) {
 				};
 				const doctor = await collectWalletSignerDoctorReport(effectiveEnv, { config: cfg });
 				const registry = readWalletProviderRegistry(effectiveEnv);
-				const parseWalletIds = (prefix, _chain) => {
-					const ids = new Set(["default"]);
-					for (const [key, value] of Object.entries(effectiveEnv)) {
-						if (!key.startsWith(prefix)) {
-							continue;
-						}
-						if (typeof value !== "string" || !value.trim()) {
-							continue;
-						}
-						const id = key.slice(prefix.length).trim().toLowerCase();
-						if (id) {
-							ids.add(id);
-						}
-					}
+				const parseWalletIds = (_chain) => {
+					const ids = new Set();
 					for (const wallet of registry.wallets) {
 						const hasChain = wallet.addresses?.solana;
 						if (hasChain && wallet.id.trim()) {
@@ -5249,7 +5631,7 @@ function createGatewayHttpServer(opts) {
 						running: doctor.checks.find((c) => c.check === "socket.health")?.ok ?? false,
 						checks: doctor.checks
 					},
-					chainWallets: { solana: buildChainEntries("solana", parseWalletIds("FASED_WALLET_SOLANA_KEYSTORE_PATH__", "solana")) }
+					chainWallets: { solana: buildChainEntries("solana", parseWalletIds("solana")) }
 				});
 				return;
 			}
@@ -5918,7 +6300,7 @@ function createGatewayHttpServer(opts) {
 				}
 				let result;
 				try {
-					result = await callSatMiningGateway("sat.bootstrapRegistryReserve", {});
+					result = await callSatMiningGateway("sat.topUpRegistryReserve", { targetBalanceLamports: 0 });
 				} catch (error) {
 					sendSatMiningGatewayError(error);
 					return;
@@ -6450,7 +6832,7 @@ function createGatewayHttpServer(opts) {
 				});
 				return;
 			}
-			if (requestPath === "/api/wallet/custody/status") {
+			if (requestPath === "/api/wallet/approval-auth/status") {
 				if (req.method !== "GET") {
 					res.statusCode = 405;
 					res.setHeader("Allow", "GET");
@@ -6467,29 +6849,23 @@ function createGatewayHttpServer(opts) {
 					return;
 				}
 				const cfg = loadConfig();
-				const walletCfg = resolveWalletRuntimeConfig(cfg, process.env);
-				const walletId = parsedUrl.searchParams.get("walletId")?.trim() || undefined;
 				sendLoginResponse(200, {
 					ok: true,
-					custody: readWalletCustodyStatus({
-						wallet: walletCfg,
-						env: process.env,
-						cfg,
-						walletId,
-						approvalHost: host
-					})
+					status: readWalletApprovalAuthSnapshot(process.env, cfg),
+					challengeTtlSeconds: resolveWalletApprovalChallengeTtlSeconds(process.env, cfg),
+					grantTtlSeconds: resolveWalletApprovalGrantTtlSeconds(process.env, cfg)
 				});
 				return;
 			}
-			if (requestPath === "/api/wallet/custody/init") {
-				if (req.method !== "POST") {
+			if (requestPath === "/api/wallet/approval-auth/passkeys") {
+				if (req.method !== "GET") {
 					res.statusCode = 405;
-					res.setHeader("Allow", "POST");
+					res.setHeader("Allow", "GET");
 					sendLoginResponse(405, {
 						ok: false,
 						error: {
 							code: "method_not_allowed",
-							message: "method must be POST"
+							message: "method must be GET"
 						}
 					});
 					return;
@@ -6497,84 +6873,94 @@ function createGatewayHttpServer(opts) {
 				if (!await ensureWalletApiAuthorized()) {
 					return;
 				}
-				const body = await readJsonBody(req, 64 * 1024);
-				if (!body.ok) {
-					sendLoginResponse(400, {
+				const cfg = loadConfig();
+				sendLoginResponse(200, {
+					ok: true,
+					passkeys: listWalletPasskeys(process.env, cfg)
+				});
+				return;
+			}
+			if (requestPath.startsWith("/api/wallet/approval-auth/passkeys/") && !requestPath.startsWith("/api/wallet/approval-auth/passkeys/register/")) {
+				if (req.method !== "DELETE") {
+					res.statusCode = 405;
+					res.setHeader("Allow", "DELETE");
+					sendLoginResponse(405, {
 						ok: false,
 						error: {
-							code: "invalid_request",
-							message: body.error
+							code: "method_not_allowed",
+							message: "method must be DELETE"
 						}
 					});
 					return;
 				}
-				const approvalToken = String(getHeader(req, "x-wallet-approval-token") ?? "").trim();
-				const walletId = (typeof body.value?.walletId === "string" ? String(body.value.walletId).trim() : "") || undefined;
+				if (!await ensureWalletApiAuthorized()) {
+					return;
+				}
+				const credentialId = decodeURIComponent(requestPath.slice("/api/wallet/approval-auth/passkeys/".length)).trim();
 				const cfg = loadConfig();
-				const consumed = consumeWalletApprovalGrant({
-					host,
-					operation: "wallet.custody-init",
-					token: approvalToken,
+				if (!ensureWalletApprovalAuthorized({
+					operation: "wallet.passkey-remove",
+					cfg
+				})) {
+					return;
+				}
+				const passkeys = listWalletPasskeys(process.env, cfg);
+				const removingExistingPasskey = passkeys.some((passkey) => passkey.id === credentialId);
+				const result = removeWalletPasskey({
+					credentialId,
 					env: process.env,
 					cfg
 				});
-				if (!consumed.ok) {
-					sendLoginResponse(401, {
+				if (!result.ok) {
+					sendLoginResponse(400, {
 						ok: false,
 						error: {
-							code: consumed.code ?? "approval_token_required",
-							message: consumed.message ?? "passkey approval token is required"
+							code: result.code,
+							message: result.message
 						}
 					});
 					return;
 				}
-				try {
-					const initialized = await initializeWalletCustodyForWallet({
+				let snapshotCfg = cfg;
+				if (removingExistingPasskey && passkeys.length <= 1) {
+					const updated = await updateWalletConfig({
 						env: process.env,
-						cfg,
-						walletId
-					});
-					const walletCfg = resolveWalletRuntimeConfig(cfg, process.env);
-					appendWalletAuditEntry({
-						action: "custody_initialized",
-						actor: "control-ui",
-						details: {
-							walletId: initialized.walletId,
-							role: initialized.role,
-							migratedKeystores: initialized.migratedKeystores.length,
-							signerRestarted: initialized.signerRestarted,
-							signerRestartError: initialized.signerRestartError
-						},
-						env: process.env
-					});
-					sendLoginResponse(200, {
-						ok: true,
-						walletId: initialized.walletId,
-						role: initialized.role,
-						deviceShare: initialized.deviceShare,
-						recoveryShare: initialized.recoveryShare,
-						signerRestarted: initialized.signerRestarted,
-						signerRestartError: initialized.signerRestartError,
-						custody: readWalletCustodyStatus({
-							wallet: walletCfg,
-							env: process.env,
-							cfg,
-							walletId: initialized.walletId,
-							approvalHost: host
-						})
-					});
-				} catch (err) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: "wallet_custody_init_failed",
-							message: err instanceof Error ? err.message : String(err)
+						mutate: (nextCfg) => {
+							nextCfg.wallet = nextCfg.wallet ?? {};
+							nextCfg.wallet.approvalAuth = nextCfg.wallet.approvalAuth ?? {};
+							nextCfg.wallet.approvalAuth.mode = "none";
 						}
 					});
+					if (!updated.ok) {
+						sendLoginResponse(500, {
+							ok: false,
+							error: {
+								code: "wallet_passkey_config_update_failed",
+								message: updated.message
+							}
+						});
+						return;
+					}
+					snapshotCfg = updated.cfg;
 				}
+				appendWalletAuditEntry({
+					action: "passkey_removed",
+					actor: "control-ui",
+					details: {
+						passkeyId: result.passkey.id,
+						label: result.passkey.label,
+						approvalAuthMode: removingExistingPasskey && passkeys.length <= 1 ? "none" : undefined
+					},
+					env: process.env
+				});
+				sendLoginResponse(200, {
+					ok: true,
+					passkey: result.passkey,
+					snapshot: removingExistingPasskey && passkeys.length <= 1 ? readWalletApprovalAuthSnapshot(process.env, snapshotCfg) : result.snapshot
+				});
 				return;
 			}
-			if (requestPath === "/api/wallet/custody/recover") {
+			if (requestPath === "/api/wallet/approval-auth/passkeys/register/options") {
 				if (req.method !== "POST") {
 					res.statusCode = 405;
 					res.setHeader("Allow", "POST");
@@ -6601,786 +6987,21 @@ function createGatewayHttpServer(opts) {
 					});
 					return;
 				}
-				const approvalToken = String(getHeader(req, "x-wallet-approval-token") ?? "").trim();
-				const walletId = (typeof body.value?.walletId === "string" ? String(body.value.walletId).trim() : "") || undefined;
-				const recoveryShare = (typeof body.value?.recoveryShare === "string" ? String(body.value.recoveryShare).trim() : "") || undefined;
+				const payloadRaw = body.value ?? {};
+				const label = typeof payloadRaw.label === "string" ? payloadRaw.label.trim() || undefined : undefined;
 				const cfg = loadConfig();
-				const consumed = consumeWalletApprovalGrant({
+				const result = beginWalletPasskeyRegistration({
 					host,
-					operation: "wallet.custody-recover",
-					token: approvalToken,
-					env: process.env,
-					cfg
-				});
-				if (!consumed.ok) {
-					sendLoginResponse(401, {
-						ok: false,
-						error: {
-							code: consumed.code ?? "approval_token_required",
-							message: consumed.message ?? "passkey approval token is required"
-						}
-					});
-					return;
-				}
-				const walletCfg = resolveWalletRuntimeConfig(cfg, process.env);
-				const recovered = recoverWalletCustodyCeremony({
+					label,
 					env: process.env,
-					walletId,
-					recoveryShare,
-					wallet: walletCfg,
 					cfg
 				});
-				if (!recovered.ok) {
+				if (!result.ok) {
 					sendLoginResponse(400, {
 						ok: false,
 						error: {
-							code: recovered.code,
-							message: recovered.message
-						}
-					});
-					return;
-				}
-				const locked = await lockWalletCustodyUnlockSessions({
-					env: process.env,
-					walletId: recovered.walletId
-				});
-				if (!locked.ok) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: locked.code,
-							message: locked.message
-						}
-					});
-					return;
-				}
-				appendWalletAuditEntry({
-					action: "custody_recovered",
-					actor: "control-ui",
-					details: {
-						walletId: recovered.walletId,
-						role: recovered.role
-					},
-					env: process.env
-				});
-				sendLoginResponse(200, {
-					ok: true,
-					walletId: recovered.walletId,
-					role: recovered.role,
-					deviceShare: recovered.deviceShare,
-					recoveryShare: recovered.recoveryShare,
-					custody: readWalletCustodyStatus({
-						wallet: walletCfg,
-						env: process.env,
-						cfg,
-						walletId: recovered.walletId,
-						approvalHost: host
-					})
-				});
-				return;
-			}
-			if (requestPath === "/api/wallet/custody/enroll-device") {
-				if (req.method !== "POST") {
-					res.statusCode = 405;
-					res.setHeader("Allow", "POST");
-					sendLoginResponse(405, {
-						ok: false,
-						error: {
-							code: "method_not_allowed",
-							message: "method must be POST"
-						}
-					});
-					return;
-				}
-				if (!await ensureWalletApiAuthorized()) {
-					return;
-				}
-				const body = await readJsonBody(req, 64 * 1024);
-				if (!body.ok) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: "invalid_request",
-							message: body.error
-						}
-					});
-					return;
-				}
-				const approvalToken = String(getHeader(req, "x-wallet-approval-token") ?? "").trim();
-				const walletId = (typeof body.value?.walletId === "string" ? String(body.value.walletId).trim() : "") || undefined;
-				const deviceShare = String(getHeader(req, "x-wallet-device-share") ?? "").trim() || (typeof body.value?.deviceShare === "string" ? String(body.value.deviceShare).trim() : "") || undefined;
-				const label = (typeof body.value?.label === "string" ? String(body.value.label).trim() : "") || undefined;
-				const cfg = loadConfig();
-				const consumed = consumeWalletApprovalGrant({
-					host,
-					operation: "wallet.custody-enroll-device",
-					token: approvalToken,
-					env: process.env,
-					cfg
-				});
-				if (!consumed.ok) {
-					sendLoginResponse(401, {
-						ok: false,
-						error: {
-							code: consumed.code,
-							message: consumed.message
-						}
-					});
-					return;
-				}
-				const walletCfg = resolveWalletRuntimeConfig(cfg, process.env);
-				const enrolled = enrollWalletCustodyDevice({
-					env: process.env,
-					cfg,
-					wallet: walletCfg,
-					walletId,
-					deviceShare,
-					label
-				});
-				if (!enrolled.ok) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: enrolled.code,
-							message: enrolled.message
-						}
-					});
-					return;
-				}
-				appendWalletAuditEntry({
-					action: "custody_device_enrolled",
-					actor: "control-ui",
-					details: {
-						walletId: enrolled.walletId,
-						role: enrolled.role,
-						deviceId: enrolled.deviceId,
-						label: enrolled.label
-					},
-					env: process.env
-				});
-				sendLoginResponse(200, {
-					ok: true,
-					walletId: enrolled.walletId,
-					role: enrolled.role,
-					deviceId: enrolled.deviceId,
-					label: enrolled.label,
-					deviceShare: enrolled.deviceShare,
-					custody: readWalletCustodyStatus({
-						wallet: walletCfg,
-						env: process.env,
-						cfg,
-						walletId: enrolled.walletId,
-						approvalHost: host
-					})
-				});
-				return;
-			}
-			if (requestPath === "/api/wallet/custody/revoke-device") {
-				if (req.method !== "POST") {
-					res.statusCode = 405;
-					res.setHeader("Allow", "POST");
-					sendLoginResponse(405, {
-						ok: false,
-						error: {
-							code: "method_not_allowed",
-							message: "method must be POST"
-						}
-					});
-					return;
-				}
-				if (!await ensureWalletApiAuthorized()) {
-					return;
-				}
-				const body = await readJsonBody(req, 64 * 1024);
-				if (!body.ok) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: "invalid_request",
-							message: body.error
-						}
-					});
-					return;
-				}
-				const approvalToken = String(getHeader(req, "x-wallet-approval-token") ?? "").trim();
-				const walletId = (typeof body.value?.walletId === "string" ? String(body.value.walletId).trim() : "") || undefined;
-				const deviceId = (typeof body.value?.deviceId === "string" ? String(body.value.deviceId).trim() : "") || undefined;
-				const deviceShare = String(getHeader(req, "x-wallet-device-share") ?? "").trim() || (typeof body.value?.deviceShare === "string" ? String(body.value.deviceShare).trim() : "") || undefined;
-				const cfg = loadConfig();
-				const consumed = consumeWalletApprovalGrant({
-					host,
-					operation: "wallet.custody-revoke-device",
-					token: approvalToken,
-					env: process.env,
-					cfg
-				});
-				if (!consumed.ok) {
-					sendLoginResponse(401, {
-						ok: false,
-						error: {
-							code: consumed.code,
-							message: consumed.message
-						}
-					});
-					return;
-				}
-				const walletCfg = resolveWalletRuntimeConfig(cfg, process.env);
-				const revoked = revokeWalletCustodyDevice({
-					env: process.env,
-					cfg,
-					wallet: walletCfg,
-					walletId,
-					deviceId,
-					deviceShare
-				});
-				if (!revoked.ok) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: revoked.code,
-							message: revoked.message
-						}
-					});
-					return;
-				}
-				appendWalletAuditEntry({
-					action: "custody_device_revoked",
-					actor: "control-ui",
-					details: {
-						walletId: revoked.walletId,
-						role: revoked.role,
-						deviceId: revoked.removedDeviceId,
-						label: revoked.removedDeviceLabel
-					},
-					env: process.env
-				});
-				sendLoginResponse(200, {
-					ok: true,
-					walletId: revoked.walletId,
-					role: revoked.role,
-					removedDeviceId: revoked.removedDeviceId,
-					removedDeviceLabel: revoked.removedDeviceLabel,
-					custody: readWalletCustodyStatus({
-						wallet: walletCfg,
-						env: process.env,
-						cfg,
-						walletId: revoked.walletId,
-						approvalHost: host
-					})
-				});
-				return;
-			}
-			if (requestPath === "/api/wallet/custody/disable") {
-				if (req.method !== "POST") {
-					res.statusCode = 405;
-					res.setHeader("Allow", "POST");
-					sendLoginResponse(405, {
-						ok: false,
-						error: {
-							code: "method_not_allowed",
-							message: "method must be POST"
-						}
-					});
-					return;
-				}
-				if (!await ensureWalletApiAuthorized()) {
-					return;
-				}
-				const body = await readJsonBody(req, 64 * 1024);
-				if (!body.ok) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: "invalid_request",
-							message: body.error
-						}
-					});
-					return;
-				}
-				const approvalToken = String(getHeader(req, "x-wallet-approval-token") ?? "").trim();
-				const walletId = (typeof body.value?.walletId === "string" ? String(body.value.walletId).trim() : "") || undefined;
-				const deviceShare = String(getHeader(req, "x-wallet-device-share") ?? "").trim() || (typeof body.value?.deviceShare === "string" ? String(body.value.deviceShare).trim() : "") || undefined;
-				const recoveryShare = (typeof body.value?.recoveryShare === "string" ? String(body.value.recoveryShare).trim() : "") || undefined;
-				const cfg = loadConfig();
-				const consumed = consumeWalletApprovalGrant({
-					host,
-					operation: "wallet.custody-disable",
-					token: approvalToken,
-					env: process.env,
-					cfg
-				});
-				if (!consumed.ok) {
-					sendLoginResponse(401, {
-						ok: false,
-						error: {
-							code: consumed.code,
-							message: consumed.message
-						}
-					});
-					return;
-				}
-				try {
-					const disabled = await disableWalletCustodyForWallet({
-						env: process.env,
-						cfg,
-						walletId,
-						deviceShare,
-						recoveryShare
-					});
-					const nextCfg = loadConfig();
-					const walletCfg = resolveWalletRuntimeConfig(nextCfg, process.env);
-					appendWalletAuditEntry({
-						action: "custody_disabled",
-						actor: "control-ui",
-						details: {
-							walletId: disabled.walletId,
-							migratedKeystores: disabled.migratedKeystores.length,
-							remainingCustodyWallets: disabled.remainingCustodyWallets,
-							signerRestarted: disabled.signerRestarted,
-							signerRestartError: disabled.signerRestartError
-						},
-						env: process.env
-					});
-					sendLoginResponse(200, {
-						ok: true,
-						walletId: disabled.walletId,
-						migratedKeystores: disabled.migratedKeystores,
-						remainingCustodyWallets: disabled.remainingCustodyWallets,
-						signerRestarted: disabled.signerRestarted,
-						signerRestartError: disabled.signerRestartError,
-						custody: readWalletCustodyStatus({
-							wallet: walletCfg,
-							env: process.env,
-							cfg: nextCfg,
-							walletId: disabled.walletId,
-							approvalHost: host
-						})
-					});
-				} catch (err) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: "wallet_custody_disable_failed",
-							message: err instanceof Error ? err.message : String(err)
-						}
-					});
-				}
-				return;
-			}
-			if (requestPath === "/api/wallet/custody/unlock") {
-				if (req.method !== "POST") {
-					res.statusCode = 405;
-					res.setHeader("Allow", "POST");
-					sendLoginResponse(405, {
-						ok: false,
-						error: {
-							code: "method_not_allowed",
-							message: "method must be POST"
-						}
-					});
-					return;
-				}
-				if (!await ensureWalletApiAuthorized()) {
-					return;
-				}
-				const body = await readJsonBody(req, 64 * 1024);
-				if (!body.ok) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: "invalid_request",
-							message: body.error
-						}
-					});
-					return;
-				}
-				const deviceShare = String(getHeader(req, "x-wallet-device-share") ?? "").trim() || (typeof body.value?.deviceShare === "string" ? String(body.value.deviceShare).trim() : "");
-				const cfg = loadConfig();
-				const walletCfg = resolveWalletRuntimeConfig(cfg, process.env);
-				const approvalToken = String(getHeader(req, "x-wallet-approval-token") ?? "").trim();
-				const walletId = (typeof body.value?.walletId === "string" ? String(body.value.walletId).trim() : "") || undefined;
-				const ttlSecondsRaw = body.value?.ttlSeconds;
-				const ttlSeconds = typeof ttlSecondsRaw === "number" && Number.isFinite(ttlSecondsRaw) ? ttlSecondsRaw : typeof ttlSecondsRaw === "string" && ttlSecondsRaw.trim() ? Number(ttlSecondsRaw) : undefined;
-				const unlocked = await activateWalletCustodyUnlockSession({
-					host,
-					approvalToken,
-					env: process.env,
-					cfg,
-					wallet: walletCfg,
-					walletId,
-					deviceShare,
-					ttlSeconds
-				});
-				if (!unlocked.ok) {
-					const authCodes = new Set([
-						"approval_token_required",
-						"invalid_approval_token",
-						"host_mismatch",
-						"operation_mismatch",
-						"request_mismatch",
-						"wallet_control_passkey_not_ready"
-					]);
-					const status = authCodes.has(unlocked.code) ? 401 : 400;
-					sendLoginResponse(status, {
-						ok: false,
-						error: {
-							code: unlocked.code ?? "wallet_custody_unlock_failed",
-							message: unlocked.message ?? "wallet custody unlock failed"
-						}
-					});
-					return;
-				}
-				appendWalletAuditEntry({
-					action: "custody_unlocked",
-					actor: "control-ui",
-					details: {
-						walletId: unlocked.session.walletId,
-						host: unlocked.session.host,
-						expiresAt: unlocked.session.expiresAt
-					},
-					env: process.env
-				});
-				sendLoginResponse(200, {
-					ok: true,
-					session: {
-						id: unlocked.session.id,
-						host: unlocked.session.host,
-						expiresAt: unlocked.session.expiresAt
-					},
-					custody: readWalletCustodyStatus({
-						wallet: walletCfg,
-						env: process.env,
-						cfg,
-						walletId,
-						approvalHost: host
-					})
-				});
-				return;
-			}
-			if (requestPath === "/api/wallet/custody/refresh") {
-				if (req.method !== "POST") {
-					res.statusCode = 405;
-					res.setHeader("Allow", "POST");
-					sendLoginResponse(405, {
-						ok: false,
-						error: {
-							code: "method_not_allowed",
-							message: "method must be POST"
-						}
-					});
-					return;
-				}
-				if (!await ensureWalletApiAuthorized()) {
-					return;
-				}
-				const body = await readJsonBody(req, 64 * 1024);
-				if (!body.ok) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: "invalid_request",
-							message: body.error
-						}
-					});
-					return;
-				}
-				const deviceShare = String(getHeader(req, "x-wallet-device-share") ?? "").trim() || (typeof body.value?.deviceShare === "string" ? String(body.value.deviceShare).trim() : "");
-				const cfg = loadConfig();
-				const walletCfg = resolveWalletRuntimeConfig(cfg, process.env);
-				const walletId = (typeof body.value?.walletId === "string" ? String(body.value.walletId).trim() : "") || undefined;
-				const ttlSecondsRaw = body.value?.ttlSeconds;
-				const ttlSeconds = typeof ttlSecondsRaw === "number" && Number.isFinite(ttlSecondsRaw) ? ttlSecondsRaw : typeof ttlSecondsRaw === "string" && ttlSecondsRaw.trim() ? Number(ttlSecondsRaw) : undefined;
-				const refreshed = await refreshWalletCustodyUnlockSession({
-					host,
-					env: process.env,
-					cfg,
-					wallet: walletCfg,
-					walletId,
-					deviceShare,
-					ttlSeconds
-				});
-				if (!refreshed.ok) {
-					const authCodes = new Set([
-						"custody_device_share_required",
-						"custody_device_share_mismatch",
-						"custody_unlock_required"
-					]);
-					const status = authCodes.has(refreshed.code) ? 401 : 400;
-					sendLoginResponse(status, {
-						ok: false,
-						error: {
-							code: refreshed.code ?? "wallet_custody_refresh_failed",
-							message: refreshed.message ?? "wallet custody refresh failed"
-						}
-					});
-					return;
-				}
-				sendLoginResponse(200, {
-					ok: true,
-					session: {
-						id: refreshed.session.id,
-						host: refreshed.session.host,
-						expiresAt: refreshed.session.expiresAt
-					},
-					custody: readWalletCustodyStatus({
-						wallet: walletCfg,
-						env: process.env,
-						cfg,
-						walletId: refreshed.session.walletId,
-						approvalHost: host
-					})
-				});
-				return;
-			}
-			if (requestPath === "/api/wallet/custody/lock") {
-				if (req.method !== "POST") {
-					res.statusCode = 405;
-					res.setHeader("Allow", "POST");
-					sendLoginResponse(405, {
-						ok: false,
-						error: {
-							code: "method_not_allowed",
-							message: "method must be POST"
-						}
-					});
-					return;
-				}
-				if (!await ensureWalletApiAuthorized()) {
-					return;
-				}
-				const body = await readJsonBody(req, 32 * 1024);
-				if (!body.ok) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: "invalid_request",
-							message: body.error
-						}
-					});
-					return;
-				}
-				const cfg = loadConfig();
-				const walletCfg = resolveWalletRuntimeConfig(cfg, process.env);
-				const walletId = (typeof body.value?.walletId === "string" ? String(body.value.walletId).trim() : "") || undefined;
-				const locked = await lockWalletCustodyUnlockSessions({
-					env: process.env,
-					host,
-					walletId
-				});
-				if (!locked.ok) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: locked.code ?? "wallet_custody_lock_failed",
-							message: locked.message ?? "wallet custody lock failed"
-						}
-					});
-					return;
-				}
-				appendWalletAuditEntry({
-					action: "custody_locked",
-					actor: "control-ui",
-					details: {
-						walletId: locked.walletId ?? walletId ?? "default",
-						removed: locked.removed
-					},
-					env: process.env
-				});
-				sendLoginResponse(200, {
-					ok: true,
-					removed: locked.removed,
-					remaining: locked.remaining,
-					custody: readWalletCustodyStatus({
-						wallet: walletCfg,
-						env: process.env,
-						cfg,
-						walletId: locked.walletId ?? walletId,
-						approvalHost: host
-					})
-				});
-				return;
-			}
-			if (requestPath === "/api/wallet/approval-auth/status") {
-				if (req.method !== "GET") {
-					res.statusCode = 405;
-					res.setHeader("Allow", "GET");
-					sendLoginResponse(405, {
-						ok: false,
-						error: {
-							code: "method_not_allowed",
-							message: "method must be GET"
-						}
-					});
-					return;
-				}
-				if (!await ensureWalletApiAuthorized()) {
-					return;
-				}
-				const cfg = loadConfig();
-				sendLoginResponse(200, {
-					ok: true,
-					status: readWalletApprovalAuthSnapshot(process.env, cfg),
-					challengeTtlSeconds: resolveWalletApprovalChallengeTtlSeconds(process.env, cfg),
-					grantTtlSeconds: resolveWalletApprovalGrantTtlSeconds(process.env, cfg)
-				});
-				return;
-			}
-			if (requestPath === "/api/wallet/approval-auth/passkeys") {
-				if (req.method !== "GET") {
-					res.statusCode = 405;
-					res.setHeader("Allow", "GET");
-					sendLoginResponse(405, {
-						ok: false,
-						error: {
-							code: "method_not_allowed",
-							message: "method must be GET"
-						}
-					});
-					return;
-				}
-				if (!await ensureWalletApiAuthorized()) {
-					return;
-				}
-				const cfg = loadConfig();
-				sendLoginResponse(200, {
-					ok: true,
-					passkeys: listWalletPasskeys(process.env, cfg)
-				});
-				return;
-			}
-			if (requestPath.startsWith("/api/wallet/approval-auth/passkeys/") && !requestPath.startsWith("/api/wallet/approval-auth/passkeys/register/")) {
-				if (req.method !== "DELETE") {
-					res.statusCode = 405;
-					res.setHeader("Allow", "DELETE");
-					sendLoginResponse(405, {
-						ok: false,
-						error: {
-							code: "method_not_allowed",
-							message: "method must be DELETE"
-						}
-					});
-					return;
-				}
-				if (!await ensureWalletApiAuthorized()) {
-					return;
-				}
-				const credentialId = decodeURIComponent(requestPath.slice("/api/wallet/approval-auth/passkeys/".length)).trim();
-				const cfg = loadConfig();
-				if (!ensureWalletApprovalAuthorized({
-					operation: "wallet.passkey-remove",
-					cfg
-				})) {
-					return;
-				}
-				const passkeys = listWalletPasskeys(process.env, cfg);
-				const removingExistingPasskey = passkeys.some((passkey) => passkey.id === credentialId);
-				const splitKeyWallets = listSplitKeyWalletsBlockingPasskeyRemoval(cfg, process.env);
-				if (removingExistingPasskey && passkeys.length <= 1 && splitKeyWallets.length > 0) {
-					sendLoginResponse(409, {
-						ok: false,
-						error: {
-							code: "wallet_passkey_required_by_split_key",
-							message: formatSplitKeyPasskeyBlockMessage(splitKeyWallets)
-						}
-					});
-					return;
-				}
-				const result = removeWalletPasskey({
-					credentialId,
-					env: process.env,
-					cfg
-				});
-				if (!result.ok) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: result.code,
-							message: result.message
-						}
-					});
-					return;
-				}
-				let snapshotCfg = cfg;
-				if (removingExistingPasskey && passkeys.length <= 1) {
-					const updated = await updateWalletConfig({
-						env: process.env,
-						mutate: (nextCfg) => {
-							nextCfg.wallet = nextCfg.wallet ?? {};
-							nextCfg.wallet.approvalAuth = nextCfg.wallet.approvalAuth ?? {};
-							nextCfg.wallet.approvalAuth.mode = "none";
-						}
-					});
-					if (!updated.ok) {
-						sendLoginResponse(500, {
-							ok: false,
-							error: {
-								code: "wallet_passkey_config_update_failed",
-								message: updated.message
-							}
-						});
-						return;
-					}
-					snapshotCfg = updated.cfg;
-				}
-				appendWalletAuditEntry({
-					action: "passkey_removed",
-					actor: "control-ui",
-					details: {
-						passkeyId: result.passkey.id,
-						label: result.passkey.label,
-						approvalAuthMode: removingExistingPasskey && passkeys.length <= 1 ? "none" : undefined
-					},
-					env: process.env
-				});
-				sendLoginResponse(200, {
-					ok: true,
-					passkey: result.passkey,
-					snapshot: removingExistingPasskey && passkeys.length <= 1 ? readWalletApprovalAuthSnapshot(process.env, snapshotCfg) : result.snapshot
-				});
-				return;
-			}
-			if (requestPath === "/api/wallet/approval-auth/passkeys/register/options") {
-				if (req.method !== "POST") {
-					res.statusCode = 405;
-					res.setHeader("Allow", "POST");
-					sendLoginResponse(405, {
-						ok: false,
-						error: {
-							code: "method_not_allowed",
-							message: "method must be POST"
-						}
-					});
-					return;
-				}
-				if (!await ensureWalletApiAuthorized()) {
-					return;
-				}
-				const body = await readJsonBody(req, 64 * 1024);
-				if (!body.ok) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: "invalid_request",
-							message: body.error
-						}
-					});
-					return;
-				}
-				const payloadRaw = body.value ?? {};
-				const label = typeof payloadRaw.label === "string" ? payloadRaw.label.trim() || undefined : undefined;
-				const cfg = loadConfig();
-				const result = beginWalletPasskeyRegistration({
-					host,
-					label,
-					env: process.env,
-					cfg
-				});
-				if (!result.ok) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: result.code,
-							message: result.message
+							code: result.code,
+							message: result.message
 						}
 					});
 					return;
@@ -7508,7 +7129,7 @@ function createGatewayHttpServer(opts) {
 					});
 					return;
 				}
-				if (operation !== "wallet.approve" && operation !== "wallet.policy" && operation !== "wallet.settings" && operation !== "wallet.provider-credentials" && operation !== "wallet.passkey-enroll" && operation !== "wallet.passkey-remove" && operation !== "wallet.custody-init" && operation !== "wallet.custody-unlock" && operation !== "wallet.custody-recover" && operation !== "wallet.custody-enroll-device" && operation !== "wallet.custody-revoke-device" && operation !== "wallet.custody-disable" && operation !== "wallet.reset" && operation !== "wallet.rotate" && operation !== "wallet.execution-mode" && operation !== "wallet.send" && operation !== "mining.capital" && operation !== "mining.policy") {
+				if (operation !== "wallet.approve" && operation !== "wallet.policy" && operation !== "wallet.settings" && operation !== "wallet.provider-credentials" && operation !== "wallet.passkey-enroll" && operation !== "wallet.passkey-remove" && operation !== "wallet.reset" && operation !== "wallet.rotate" && operation !== "wallet.execution-mode" && operation !== "wallet.send" && operation !== "mining.capital" && operation !== "mining.policy") {
 					sendLoginResponse(400, {
 						ok: false,
 						error: {
@@ -7642,7 +7263,7 @@ function createGatewayHttpServer(opts) {
 				const payloadRaw = body.value ?? {};
 				const requestId = typeof payloadRaw.requestId === "string" ? payloadRaw.requestId.trim() || undefined : undefined;
 				const operation = typeof payloadRaw.operation === "string" ? payloadRaw.operation.trim() || undefined : undefined;
-				if (operation && operation !== "wallet.approve" && operation !== "wallet.policy" && operation !== "wallet.settings" && operation !== "wallet.provider-credentials" && operation !== "wallet.passkey-enroll" && operation !== "wallet.passkey-remove" && operation !== "wallet.custody-init" && operation !== "wallet.custody-recover" && operation !== "wallet.custody-enroll-device" && operation !== "wallet.custody-revoke-device" && operation !== "wallet.custody-disable" && operation !== "wallet.reset" && operation !== "wallet.rotate" && operation !== "wallet.execution-mode" && operation !== "wallet.send" && operation !== "wallet.custody-unlock" && operation !== "mining.capital" && operation !== "mining.policy") {
+				if (operation && operation !== "wallet.approve" && operation !== "wallet.policy" && operation !== "wallet.settings" && operation !== "wallet.provider-credentials" && operation !== "wallet.passkey-enroll" && operation !== "wallet.passkey-remove" && operation !== "wallet.reset" && operation !== "wallet.rotate" && operation !== "wallet.execution-mode" && operation !== "wallet.send" && operation !== "mining.capital" && operation !== "mining.policy") {
 					sendLoginResponse(400, {
 						ok: false,
 						error: {
@@ -7694,171 +7315,37 @@ function createGatewayHttpServer(opts) {
 				if (!await ensureWalletApiAuthorized()) {
 					return;
 				}
-				const cfg = loadConfig();
-				const walletCfg = resolveWalletRuntimeConfig(cfg, process.env);
-				const parsedUrl = new URL(req.url || "/", "http://localhost");
-				const providerId = parseWalletProviderId(parsedUrl.searchParams.get("providerId")) ?? resolveWalletProviderId(cfg, process.env);
-				if (!walletCfg.enabled) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: "wallet_disabled",
-							message: "wallet is disabled"
-						}
-					});
-					return;
-				}
-				if (!ensureWalletApprovalAuthorized({
-					operation: "wallet.rotate",
-					cfg
-				})) {
-					return;
-				}
-				const provider = createWalletProviderAdapter({
-					cfg,
-					wallet: walletCfg,
-					env: process.env,
-					providerIdOverride: providerId
-				});
-				if (!provider.rotateKeys) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: "provider_operation_not_supported",
-							message: `provider ${provider.id} does not support rotate keys`
-						}
-					});
-					return;
-				}
-				let result;
-				try {
-					result = await provider.rotateKeys();
-				} catch (err) {
-					sendLoginResponse(502, {
-						ok: false,
-						error: {
-							code: "wallet_provider_error",
-							message: String(err)
-						}
-					});
-					return;
-				}
-				appendWalletAuditEntry({
-					action: "rotate_keys",
-					actor: "control-ui",
-					details: {
-						provider: provider.id,
-						providerId,
-						addresses: result.addresses ?? {}
-					},
-					env: process.env
-				});
-				sendLoginResponse(200, {
-					ok: true,
-					result
+				sendLoginResponse(410, {
+					ok: false,
+					error: {
+						code: "gateway_wallet_key_lifecycle_removed",
+						message: "Wallet key rotation is signer/provider-owned. Use `fased-signerd admin wallet reencrypt` as the control-socket owner, or rotate through Turnkey/hardware wallet authority."
+					}
 				});
 				return;
 			}
-			if (requestPath === "/api/wallet/reset") {
-				if (req.method !== "POST") {
-					res.statusCode = 405;
-					res.setHeader("Allow", "POST");
-					sendLoginResponse(405, {
-						ok: false,
-						error: {
-							code: "method_not_allowed",
-							message: "method must be POST"
-						}
-					});
-					return;
-				}
-				if (!await ensureWalletApiAuthorized()) {
-					return;
-				}
-				const body = await readJsonBody(req, 64 * 1024);
-				if (!body.ok) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: "invalid_request",
-							message: body.error
-						}
-					});
-					return;
-				}
-				const confirmText = typeof body.value?.confirmText === "string" ? body.value.confirmText.trim() : "";
-				if (confirmText !== "RESET WALLET") {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: "confirm_text_mismatch",
-							message: "confirmText must equal \"RESET WALLET\""
-						}
-					});
-					return;
-				}
-				const cfg = loadConfig();
-				const walletCfg = resolveWalletRuntimeConfig(cfg, process.env);
-				const parsedUrl = new URL(req.url || "/", "http://localhost");
-				const providerId = parseWalletProviderId(parsedUrl.searchParams.get("providerId")) ?? resolveWalletProviderId(cfg, process.env);
-				if (!walletCfg.enabled) {
-					sendLoginResponse(400, {
-						ok: false,
-						error: {
-							code: "wallet_disabled",
-							message: "wallet is disabled"
-						}
-					});
-					return;
-				}
-				if (!ensureWalletApprovalAuthorized({
-					operation: "wallet.reset",
-					cfg
-				})) {
-					return;
-				}
-				const provider = createWalletProviderAdapter({
-					cfg,
-					wallet: walletCfg,
-					env: process.env,
-					providerIdOverride: providerId
-				});
-				if (!provider.resetKeys) {
-					sendLoginResponse(400, {
+			if (requestPath === "/api/wallet/reset") {
+				if (req.method !== "POST") {
+					res.statusCode = 405;
+					res.setHeader("Allow", "POST");
+					sendLoginResponse(405, {
 						ok: false,
 						error: {
-							code: "provider_operation_not_supported",
-							message: `provider ${provider.id} does not support reset keys`
+							code: "method_not_allowed",
+							message: "method must be POST"
 						}
 					});
 					return;
 				}
-				let result;
-				try {
-					result = await provider.resetKeys();
-				} catch (err) {
-					sendLoginResponse(502, {
-						ok: false,
-						error: {
-							code: "wallet_provider_error",
-							message: String(err)
-						}
-					});
+				if (!await ensureWalletApiAuthorized()) {
 					return;
 				}
-				appendWalletAuditEntry({
-					action: "reset_wallet",
-					actor: "control-ui",
-					details: {
-						provider: provider.id,
-						providerId,
-						addresses: result.addresses ?? {}
-					},
-					env: process.env
-				});
-				sendLoginResponse(200, {
-					ok: true,
-					result
+				sendLoginResponse(410, {
+					ok: false,
+					error: {
+						code: "gateway_wallet_key_lifecycle_removed",
+						message: "Wallet reset is unavailable through the Gateway. Create or import only in the signer/provider/hardware-wallet authority surface."
+					}
 				});
 				return;
 			}
@@ -8127,8 +7614,6 @@ function createGatewayHttpServer(opts) {
 					return;
 				}
 				payload.amount = normalizedAmount.amount;
-				const approvalToken = String(getHeader(req, "x-wallet-approval-token") ?? "").trim();
-				const custodyDeviceShare = String(getHeader(req, "x-wallet-device-share") ?? "").trim();
 				const registrySnapshot = readWalletProviderRegistry(process.env);
 				let walletSelection;
 				try {
@@ -8157,22 +7642,23 @@ function createGatewayHttpServer(opts) {
 					providerIdOverride: selectedProviderId,
 					walletId: walletSelection?.walletId ?? payload.walletId
 				});
-				if (selectedProviderId === "turnkey" && !hasTurnkeySigningStampConfigured(process.env)) {
+				if (selectedProviderId === "turnkey" && !hasTurnkeyPolicyCredentialsConfigured(process.env)) {
 					sendLoginResponse(400, {
 						ok: false,
 						error: {
 							code: "provider_prerequisite_missing",
-							message: "turnkey signing stamp is required before prepare/send. Configure credential `stamp` (or FASED_WALLET_TURNKEY_STAMP)."
+							message: "turnkey requires a dedicated API user covered by a restrictive organization policy, plus organizationId, policyId, and rpcUrl before prepare/send"
 						}
 					});
 					return;
 				}
 				const selectedProviderCapabilities = buildWalletProviderCapabilityMatrix(selectedProvider);
-				if (!providerSupportsChainOperation({
+				const supportsServerSend = providerSupportsChainOperation({
 					matrix: selectedProviderCapabilities,
 					chain,
 					operation: "send"
-				})) {
+				});
+				if (!supportsServerSend && !selectedProviderCapabilities.signing.interactiveSend) {
 					sendLoginResponse(400, {
 						ok: false,
 						error: {
@@ -8205,9 +7691,6 @@ function createGatewayHttpServer(opts) {
 					config: walletCfg,
 					runtimeConfig: cfg,
 					providerIdOverride: selectedProviderId,
-					approvalToken,
-					approvalHost: host,
-					custodyDeviceShare,
 					env: process.env
 				});
 				if (!created.ok) {
@@ -8216,9 +7699,7 @@ function createGatewayHttpServer(opts) {
 						"invalid_approval_token",
 						"host_mismatch",
 						"operation_mismatch",
-						"request_mismatch",
-						"custody_device_share_required",
-						"custody_device_share_mismatch"
+						"request_mismatch"
 					]);
 					const status = authCodes.has(created.code) ? 401 : 400;
 					sendLoginResponse(status, {
@@ -8309,7 +7790,7 @@ function createGatewayHttpServer(opts) {
 				}
 				const requestId = parts[3] ?? "";
 				const action = parts[4] ?? "";
-				if (!requestId || action !== "approve" && action !== "reject") {
+				if (!requestId || action !== "approve" && action !== "reject" && action !== "execute") {
 					sendLoginResponse(404, {
 						ok: false,
 						error: {
@@ -8319,6 +7800,129 @@ function createGatewayHttpServer(opts) {
 					});
 					return;
 				}
+				if (action === "execute") {
+					const request = getWalletSendApprovalRequest({
+						requestId,
+						env: process.env
+					});
+					if (!request || request.payload.providerId !== "wallet-standard") {
+						sendLoginResponse(404, {
+							ok: false,
+							error: {
+								code: "not_found",
+								message: "hardware-wallet approval not found"
+							}
+						});
+						return;
+					}
+					if (request.status !== "pending" && request.status !== "approved" && request.status !== "executed") {
+						sendLoginResponse(409, {
+							ok: false,
+							error: {
+								code: "invalid_state",
+								message: `hardware-wallet approval is ${request.status}`
+							}
+						});
+						return;
+					}
+					const body = await readJsonBody(req, 256 * 1024);
+					if (!body.ok) {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "invalid_request",
+								message: body.error
+							}
+						});
+						return;
+					}
+					const payload = body.value ?? {};
+					const preparedId = toOptionalString(payload.preparedId);
+					const intentDigest = toOptionalString(payload.intentDigest);
+					const signedTxBase64 = toOptionalString(payload.signedTxBase64);
+					if (!preparedId || !intentDigest || !signedTxBase64) {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "invalid_request",
+								message: "preparedId, intentDigest, and signedTxBase64 are required"
+							}
+						});
+						return;
+					}
+					const cfg = loadConfig();
+					const effectiveEnv = {
+						...process.env,
+						...cfg.env?.vars
+					};
+					const walletId = request.payload.walletId?.trim() || "";
+					const rpcUrl = resolveScopedRpcUrlForWallet({
+						env: effectiveEnv,
+						chains: ["solana"],
+						walletId: walletId || undefined
+					});
+					if (!rpcUrl) {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "wallet_provider_invalid_config",
+								message: "hardware Vault requires a configured Solana RPC URL"
+							}
+						});
+						return;
+					}
+					try {
+						const executed = await executeWalletStandardReview({
+							requestId,
+							preparedId,
+							intentDigest,
+							signedTxBase64,
+							rpcUrl,
+							env: process.env
+						});
+						const updated = await markWalletSendRequestExecutedExternally({
+							requestId,
+							txHash: executed.txHash,
+							signer: executed.signer,
+							actor: "control-ui",
+							env: process.env
+						});
+						sendLoginResponse(200, {
+							ok: true,
+							request: sanitizeWalletSendApprovalRequest(updated),
+							tx: {
+								ok: true,
+								chain: "solana",
+								txHash: executed.txHash,
+								signer: executed.signer,
+								idempotent: executed.idempotent
+							}
+						});
+					} catch (error) {
+						const code = error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : "wallet_provider_error";
+						const message = walletDiagnosticErrorMessage(error);
+						if (code === "wallet_provider_ambiguous") {
+							await markWalletSendRequestBroadcastUnknown({
+								requestId,
+								txHash: readWalletStandardReviewTxHash({
+									requestId,
+									env: process.env
+								}),
+								reason: message,
+								actor: "control-ui",
+								env: process.env
+							});
+						}
+						sendLoginResponse(code === "wallet_provider_ambiguous" ? 409 : 400, {
+							ok: false,
+							error: {
+								code,
+								message
+							}
+						});
+					}
+					return;
+				}
 				if (action === "reject") {
 					const cfg = loadConfig();
 					if (!ensureWalletApprovalAuthorized({
@@ -8364,6 +7968,206 @@ function createGatewayHttpServer(opts) {
 				}
 				const cfg = loadConfig();
 				const walletCfg = resolveWalletRuntimeConfig(cfg, process.env);
+				const pendingRequest = getWalletSendApprovalRequest({
+					requestId,
+					env: process.env
+				});
+				const signerReviewId = pendingRequest?.payload.signerReviewId?.trim() || "";
+				const signerWalletId = pendingRequest?.payload.signerWalletId?.trim() || "";
+				const applicationWalletId = pendingRequest?.payload.walletId?.trim() || "";
+				const isSignerOwnedReview = pendingRequest?.payload.providerId === "local-socket-signer" && Boolean(signerReviewId) && Boolean(signerWalletId) && Boolean(applicationWalletId);
+				if (isSignerOwnedReview) {
+					if (pendingRequest.status !== "pending" && pendingRequest.status !== "expired") {
+						sendLoginResponse(409, {
+							ok: false,
+							error: {
+								code: "invalid_state",
+								message: `signer-reviewed approval is ${pendingRequest.status}`
+							}
+						});
+						return;
+					}
+					const body = await readJsonBody(req, 256 * 1024);
+					if (!body.ok) {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "invalid_request",
+								message: body.error
+							}
+						});
+						return;
+					}
+					const payload = body.value ?? {};
+					const payloadKeys = Object.keys(payload);
+					const provider = createWalletProviderAdapter({
+						cfg,
+						wallet: walletCfg,
+						env: process.env,
+						providerIdOverride: "local-socket-signer",
+						walletId: applicationWalletId
+					});
+					const bindingMatchesApproval = (binding) => signerReviewBindingMatchesWalletApprovalPayload(binding, pendingRequest.payload);
+					if (payloadKeys.length === 0) {
+						if (!provider.getSignerReview || !provider.beginSignerReviewAuthorization) {
+							sendLoginResponse(400, {
+								ok: false,
+								error: {
+									code: "wallet_signer_webauthn_unavailable",
+									message: "local-socket-signer does not expose exact review recovery and signer-owned WebAuthn begin"
+								}
+							});
+							return;
+						}
+						try {
+							const storedReview = await provider.getSignerReview({
+								walletId: signerWalletId,
+								requestId: signerReviewId
+							});
+							if (!signerReviewMatchesWalletApprovalPayload(storedReview, pendingRequest.payload)) {
+								throw new Error("stored signer review does not match the persisted approval");
+							}
+							if (storedReview.state === "signed") {
+								const recovered = await approveWalletSendRequest({
+									requestId,
+									actor: "control-ui",
+									config: walletCfg,
+									env: process.env
+								});
+								if (!recovered.ok) {
+									sendLoginResponse(recovered.code === "wallet_provider_ambiguous" ? 409 : 400, {
+										ok: false,
+										error: {
+											code: recovered.code,
+											message: recovered.message
+										},
+										request: "request" in recovered && recovered.request ? sanitizeWalletSendApprovalRequest(recovered.request) : undefined
+									});
+									return;
+								}
+								sendLoginResponse(200, {
+									ok: true,
+									request: sanitizeWalletSendApprovalRequest(recovered.request),
+									tx: recovered.tx
+								});
+								return;
+							}
+							if (pendingRequest.status === "expired" || Date.parse(pendingRequest.expiresAt) <= Date.now()) {
+								const expired = await approveWalletSendRequest({
+									requestId,
+									actor: "control-ui",
+									config: walletCfg,
+									env: process.env
+								});
+								sendLoginResponse(409, {
+									ok: false,
+									error: {
+										code: expired.ok ? "invalid_state" : expired.code,
+										message: expired.ok ? "expired signer review unexpectedly executed" : expired.message
+									},
+									request: !expired.ok && "request" in expired && expired.request ? sanitizeWalletSendApprovalRequest(expired.request) : undefined
+								});
+								return;
+							}
+							const authorization = await provider.beginSignerReviewAuthorization({
+								walletId: signerWalletId,
+								requestId: signerReviewId
+							});
+							if (!bindingMatchesApproval(authorization.binding)) {
+								throw new Error("signer WebAuthn binding does not match the persisted approval");
+							}
+							sendLoginResponse(200, {
+								ok: true,
+								mode: "signer-webauthn",
+								request: sanitizeWalletSendApprovalRequest(pendingRequest),
+								signerAuthorization: authorization
+							});
+						} catch (error) {
+							const message = walletDiagnosticErrorMessage(error);
+							sendLoginResponse(400, {
+								ok: false,
+								error: {
+									code: message.includes("no signer-owned WebAuthn credential is enrolled") ? "wallet_signer_webauthn_not_enrolled" : "wallet_signer_webauthn_failed",
+									message
+								}
+							});
+						}
+						return;
+					}
+					if (payloadKeys.length !== 1 || payloadKeys[0] !== "signerAuthorization" || !payload.signerAuthorization || typeof payload.signerAuthorization !== "object" || Array.isArray(payload.signerAuthorization)) {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "invalid_request",
+								message: "signer-reviewed approval accepts only signerAuthorization"
+							}
+						});
+						return;
+					}
+					const signerAuthorization = payload.signerAuthorization;
+					if (Object.keys(signerAuthorization).some((key) => key !== "challengeId" && key !== "credential") || typeof signerAuthorization.challengeId !== "string" || !signerAuthorization.challengeId.trim() || !signerAuthorization.credential || typeof signerAuthorization.credential !== "object" || Array.isArray(signerAuthorization.credential)) {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "invalid_request",
+								message: "challengeId and WebAuthn credential are required"
+							}
+						});
+						return;
+					}
+					if (!provider.finishSignerReviewAuthorization) {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "wallet_signer_webauthn_unavailable",
+								message: "local-socket-signer does not expose signer-owned WebAuthn finish"
+							}
+						});
+						return;
+					}
+					try {
+						const finished = await provider.finishSignerReviewAuthorization({
+							walletId: signerWalletId,
+							challengeId: signerAuthorization.challengeId.trim(),
+							credential: signerAuthorization.credential
+						});
+						if (!bindingMatchesApproval(finished.binding)) {
+							throw new Error("completed signer WebAuthn binding does not match the approval");
+						}
+						const approved = await approveWalletSendRequest({
+							requestId,
+							actor: "control-ui",
+							config: walletCfg,
+							reviewAuthorization: finished.authorization,
+							env: process.env
+						});
+						if (!approved.ok) {
+							sendLoginResponse(approved.code === "wallet_provider_ambiguous" ? 409 : 400, {
+								ok: false,
+								error: {
+									code: approved.code,
+									message: approved.message
+								},
+								request: "request" in approved && approved.request ? sanitizeWalletSendApprovalRequest(approved.request) : undefined
+							});
+							return;
+						}
+						sendLoginResponse(200, {
+							ok: true,
+							request: sanitizeWalletSendApprovalRequest(approved.request),
+							tx: approved.tx
+						});
+					} catch (error) {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "wallet_signer_webauthn_failed",
+								message: walletDiagnosticErrorMessage(error)
+							}
+						});
+					}
+					return;
+				}
 				if (!ensureWalletApprovalAuthorized({
 					operation: "wallet.approve",
 					requestId,
@@ -8371,11 +8175,79 @@ function createGatewayHttpServer(opts) {
 				})) {
 					return;
 				}
+				if (pendingRequest?.payload.providerId === "wallet-standard") {
+					if (pendingRequest.status !== "pending") {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "invalid_state",
+								message: `approval request is ${pendingRequest.status}`
+							}
+						});
+						return;
+					}
+					const effectiveEnv = {
+						...process.env,
+						...cfg.env?.vars
+					};
+					const walletId = pendingRequest.payload.walletId?.trim() || "";
+					const registry = readWalletProviderRegistry(effectiveEnv);
+					const selectedWallet = registry.wallets.find((wallet) => wallet.id === walletId);
+					const signerAddress = selectedWallet?.addresses?.solana?.trim() || "";
+					const rpcUrl = resolveScopedRpcUrlForWallet({
+						env: effectiveEnv,
+						chains: ["solana"],
+						walletId: walletId || undefined
+					});
+					if (!selectedWallet || selectedWallet.providerId !== "wallet-standard" || !signerAddress) {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "wallet_provider_invalid_config",
+								message: "hardware Vault account is not registered for this approval"
+							}
+						});
+						return;
+					}
+					if (!rpcUrl) {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: "wallet_provider_invalid_config",
+								message: "hardware Vault requires a configured Solana RPC URL"
+							}
+						});
+						return;
+					}
+					try {
+						const browserReview = await prepareWalletStandardReview({
+							requestId,
+							payload: pendingRequest.payload,
+							signerAddress,
+							rpcUrl,
+							env: process.env
+						});
+						sendLoginResponse(200, {
+							ok: true,
+							mode: "browser",
+							request: sanitizeWalletSendApprovalRequest(pendingRequest),
+							browserReview
+						});
+					} catch (error) {
+						sendLoginResponse(400, {
+							ok: false,
+							error: {
+								code: error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : "wallet_provider_error",
+								message: walletDiagnosticErrorMessage(error)
+							}
+						});
+					}
+					return;
+				}
 				const approved = await approveWalletSendRequest({
 					requestId,
 					actor: "control-ui",
 					config: walletCfg,
-					approvalHost: host,
 					env: process.env
 				});
 				if (!approved.ok) {
@@ -8662,7 +8534,15 @@ function createGatewayHttpServer(opts) {
 			if (await a2aHandler(req, res)) {
 				return;
 			}
-			if (await handleFederationHttpRequest(req, res, {})) {
+			if (isPathProtectedByPrefixes(requestPath, FEDERATION_HTTP_ROUTE_PREFIXES) && !isSignedFederationInboundRequest(req) && !await ensureWalletApiAuthorized()) {
+				return;
+			}
+			if (await handleFederationHttpRequest(req, res, { peerAuthClientIp: resolveClientIp({
+				remoteAddr: req.socket?.remoteAddress ?? "",
+				forwardedFor: getHeader(req, "x-forwarded-for"),
+				realIp: getHeader(req, "x-real-ip"),
+				trustedProxies
+			}) })) {
 				return;
 			}
 			if (await fedifyHandler(req, res)) {
@@ -8684,9 +8564,7 @@ function createGatewayHttpServer(opts) {
 				if (canonicalPluginPath === "/api/channels" || canonicalPluginPath.startsWith("/api/channels/") || rawChannelCandidatePath.startsWith("/api/channels")) {
 					const bearerToken = getBearerToken(req);
 					let pluginAuthOk = false;
-					if (resolvedAuth.mode === "none") {
-						pluginAuthOk = true;
-					} else if (resolvedAuth.mode === "token" && resolvedAuth.token) {
+					if (resolvedAuth.mode === "token" && resolvedAuth.token) {
 						pluginAuthOk = Boolean(bearerToken && safeEqualSecret(resolvedAuth.token, bearerToken));
 					} else if (resolvedAuth.mode === "password" && resolvedAuth.password) {
 						pluginAuthOk = Boolean(bearerToken && safeEqualSecret(resolvedAuth.password, bearerToken));
@@ -8870,13 +8748,14 @@ function createGatewayHttpServer(opts) {
 		} catch (error) {
 			if (!res.headersSent && requestPath.startsWith("/api/")) {
 				const message = error instanceof Error ? error.message : String(error);
-				res.statusCode = 500;
+				const legacyMigrationRequired = error instanceof LegacyEmbeddedKeystoreMigrationRequiredError;
+				res.statusCode = legacyMigrationRequired ? 409 : 500;
 				res.setHeader("Content-Type", "application/json; charset=utf-8");
 				res.setHeader("Cache-Control", "no-store");
 				res.end(JSON.stringify({
 					ok: false,
 					error: {
-						code: "internal_server_error",
+						code: legacyMigrationRequired ? "wallet_legacy_embedded_keystore_migration_required" : "internal_server_error",
 						message: message || "Internal Server Error"
 					}
 				}));