diff --git a/Cargo.lock b/Cargo.lock
index e36cb9f2c..958cd7339 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6521,6 +6521,7 @@ dependencies = [
  "sage-api-macro",
  "sage-config",
  "serde",
+ "serde_json",
  "specta",
  "tauri-specta",
  "utoipa",
@@ -6534,6 +6535,7 @@ dependencies = [
  "indexmap 2.12.1",
  "proc-macro2",
  "quote",
+ "serde",
  "serde_json",
  "syn 2.0.111",
 ]
@@ -6552,6 +6554,8 @@ dependencies = [
  "reqwest 0.12.24",
  "sage",
  "sage-api",
+ "sage-keychain",
+ "sage-password-gate",
  "serde",
  "serde_json",
  "serde_path_to_error",
@@ -6664,6 +6668,23 @@ dependencies = [
  "thiserror 1.0.69",
 ]
 
+[[package]]
+name = "sage-password-gate"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "bip39",
+ "sage",
+ "sage-api",
+ "sage-keychain",
+ "serde",
+ "specta",
+ "tauri",
+ "tauri-specta",
+ "tokio",
+ "uuid",
+]
+
 [[package]]
 name = "sage-rpc"
 version = "0.13.0"
@@ -6706,6 +6727,7 @@ dependencies = [
  "sage-api-macro",
  "sage-apps",
  "sage-config",
+ "sage-password-gate",
  "sage-rpc",
  "sage-wallet",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index 8322c24b7..445834ae8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -57,6 +57,7 @@ sage-wallet = { path = "./crates/sage-wallet" }
 sage-assets = { path = "./crates/sage-assets" }
 sage-apps = { path = "./crates/sage-apps" }
 sage-rpc = { path = "./crates/sage-rpc" }
+sage-password-gate = { path = "./crates/sage-password-gate" }
 
 # Serialization
 serde = "1.0.204"
diff --git a/builtin-apps/src/system/apps/bridge-approval/src/App.tsx b/builtin-apps/src/system/apps/bridge-approval/src/App.tsx
index 013e6b811..8df7a32ae 100644
--- a/builtin-apps/src/system/apps/bridge-approval/src/App.tsx
+++ b/builtin-apps/src/system/apps/bridge-approval/src/App.tsx
@@ -74,6 +74,11 @@ export function App() {
   const [loaded, setLoaded] = useState(false);
   const [now, setNow] = useState(() => Date.now());
   const [error, setError] = useState<string | null>(null);
+  const [password, setPassword] = useState('');
+  const [passwordError, setPasswordError] = useState<string | null>(null);
+  // Set when the host tells us an approval needs a password that its queued
+  // hint did not predict, so the field appears even on a stale view.
+  const [passwordForced, setPasswordForced] = useState(false);
 
   async function refreshActiveRuntime() {
     const active = await sage.runtimeManager.getActiveTaskbarRuntime();
@@ -148,24 +153,63 @@ export function App() {
     ? formatCountdown(activeApproval.expiresAtMs, now)
     : null;
 
+  // Never carry a typed password across approvals.
   useEffect(() => {
     setExpanded(false);
     setError(null);
+    setPassword('');
+    setPasswordError(null);
+    setPasswordForced(false);
   }, [activeApproval?.approvalId]);
 
+  const needsPassword =
+    (activeApproval?.requiresPassword ?? false) || passwordForced;
+
   async function resolve(approved: boolean) {
     if (!activeApproval || working) return;
+    if (approved && needsPassword && password.length === 0) return;
 
     setWorking(true);
     setError(null);
 
     try {
-      await sage.bridgeApprovals.resolve({
+      const result = await sage.bridgeApprovals.resolve({
         approvalId: activeApproval.approvalId,
         approved,
         reason: approved ? null : 'User denied the request',
+        password: approved && needsPassword ? password : null,
       });
 
+      switch (result.kind) {
+        case 'wrongPassword':
+          // The approval is still queued; keep the card up for another try.
+          setPassword('');
+          setPasswordError(
+            result.attemptsRemaining === 1
+              ? 'Incorrect password. 1 attempt remaining.'
+              : `Incorrect password. ${result.attemptsRemaining} attempts remaining.`,
+          );
+          break;
+
+        case 'passwordRequired':
+          // The queued hint was stale — this wallet is protected after all.
+          setPasswordForced(true);
+          setPassword('');
+          setPasswordError('This wallet requires its password.');
+          break;
+
+        case 'tooManyAttempts':
+          setPassword('');
+          setPasswordError(null);
+          setError('Too many incorrect password attempts. Request rejected.');
+          break;
+
+        case 'resolved':
+          setPassword('');
+          setPasswordError(null);
+          break;
+      }
+
       setApprovals(await sage.bridgeApprovals.listPending());
     } catch (err) {
       setError(err instanceof Error ? err.message : String(err));
@@ -240,7 +284,7 @@ export function App() {
 
             <button
               type='button'
-              disabled={working}
+              disabled={working || (needsPassword && password.length === 0)}
               onClick={() => void resolve(true)}
               className='rounded-md bg-primary px-3 py-1.5 text-sm font-medium text-primary-foreground hover:opacity-90 disabled:opacity-50'
             >
@@ -270,6 +314,42 @@ export function App() {
           expanded={expanded}
         />
 
+        {needsPassword ? (
+          <div className='space-y-1.5'>
+            <label
+              htmlFor='approval-password'
+              className='text-xs font-medium uppercase tracking-wide text-muted-foreground'
+            >
+              Wallet password
+            </label>
+
+            <input
+              id='approval-password'
+              type='password'
+              autoFocus
+              autoComplete='off'
+              spellCheck={false}
+              value={password}
+              disabled={working}
+              onChange={(event) => {
+                setPassword(event.target.value);
+                setPasswordError(null);
+              }}
+              onKeyDown={(event) => {
+                if (event.key === 'Enter' && password.length > 0) {
+                  void resolve(true);
+                }
+              }}
+              className='w-full rounded-md border border-border bg-background px-3 py-2 text-sm disabled:opacity-50'
+              placeholder='Required to sign with this wallet'
+            />
+
+            {passwordError ? (
+              <div className='text-xs text-destructive'>{passwordError}</div>
+            ) : null}
+          </div>
+        ) : null}
+
         {error ? (
           <div className='rounded-lg border border-destructive/40 bg-destructive/10 p-2 text-sm text-destructive'>
             {error}
diff --git a/crates/sage-api/Cargo.toml b/crates/sage-api/Cargo.toml
index fa59b04e5..044c24954 100644
--- a/crates/sage-api/Cargo.toml
+++ b/crates/sage-api/Cargo.toml
@@ -25,3 +25,6 @@ serde = { workspace = true, features = ["derive"] }
 tauri-specta = { workspace = true, features = ["derive"], optional = true }
 specta = { workspace = true, features = ["derive", "bigdecimal"], optional = true }
 utoipa = { workspace = true, optional = true }
+
+[dev-dependencies]
+serde_json = { workspace = true }
diff --git a/crates/sage-api/endpoints.json b/crates/sage-api/endpoints.json
index 7dab2065a..83a65eb23 100644
--- a/crates/sage-api/endpoints.json
+++ b/crates/sage-api/endpoints.json
@@ -102,5 +102,6 @@
   "is_asset_owned": true,
   "change_password": false,
   "reconcile_key_protection": false,
+  "reconcile_drifted_key_protection": false,
   "get_xch_usd_price": true
 }
diff --git a/crates/sage-api/macro/Cargo.toml b/crates/sage-api/macro/Cargo.toml
index a34e0f891..9936eb8fb 100644
--- a/crates/sage-api/macro/Cargo.toml
+++ b/crates/sage-api/macro/Cargo.toml
@@ -20,6 +20,7 @@ proc-macro = true
 [dependencies]
 quote = { workspace = true }
 convert_case = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 indexmap = { workspace = true, features = ["serde"] }
 proc-macro2 = { workspace = true }
diff --git a/crates/sage-api/macro/src/lib.rs b/crates/sage-api/macro/src/lib.rs
index 0528c32db..db0efb7c7 100644
--- a/crates/sage-api/macro/src/lib.rs
+++ b/crates/sage-api/macro/src/lib.rs
@@ -80,18 +80,41 @@ fn generate(input: &TokenStream, tauri: bool) -> TokenStream {
         endpoints.extend(tauri_endpoints);
     }
 
+    // How the host-layer password gate treats each endpoint. Endpoints absent
+    // from this map take no password at all. `sage-api`'s drift tests keep the
+    // manifest in sync with the request types and with how each endpoint's
+    // implementation consumes the password.
+    let gating: std::collections::BTreeMap<String, GateMode> =
+        serde_json::from_str(include_str!("../../password-gating.json"))
+            .expect("Invalid password gating file");
+
     let mut output = proc_macro2::TokenStream::new();
 
     for token in input.clone() {
-        convert(token, &endpoints, None, &mut output);
+        convert(token, &endpoints, &gating, None, &mut output);
     }
 
     output.into()
 }
 
+/// How the host-layer password gate treats an endpoint.
+#[derive(Clone, Copy, PartialEq, Eq, serde::Deserialize)]
+#[serde(rename_all = "snake_case")]
+enum GateMode {
+    /// Prompt on every call, verifying against the active wallet.
+    Always,
+    /// Prompt only when `req.auto_submit` is set.
+    AutoSubmit,
+    /// Prompt on every call, verifying against `req.fingerprint`.
+    Fingerprint,
+}
+
+type Gating<'a> = &'a std::collections::BTreeMap<String, GateMode>;
+
 fn convert(
     tree: TokenTree,
     endpoints: &IndexMap<String, bool>,
+    gating: Gating<'_>,
     endpoint: Option<&str>,
     output: &mut proc_macro2::TokenStream,
 ) {
@@ -115,6 +138,38 @@ fn convert(
                 if is_async {
                     output.extend(quote!(.await));
                 }
+            } else if ident == "maybe_unlock" {
+                match gating.get(endpoint) {
+                    Some(GateMode::Fingerprint) => {
+                        output.extend(quote!(
+                            req.password = sage_password_gate::resolve_for_fingerprint(&app_handle, state.inner(), gate.inner(), req.fingerprint).await?;
+                        ));
+                    }
+                    Some(GateMode::Always) => {
+                        output.extend(quote!(
+                            req.password = sage_password_gate::resolve(&app_handle, state.inner(), gate.inner()).await?;
+                        ));
+                    }
+                    Some(GateMode::AutoSubmit) => {
+                        // Without `auto_submit` the endpoint only builds the
+                        // transaction for the confirmation dialog and never
+                        // touches the key, so prompting here would ask twice.
+                        // The `else` keeps the host layer the sole source of
+                        // the password: every gated command overwrites whatever
+                        // the caller sent, on both branches.
+                        output.extend(quote!(if req.auto_submit {
+                            req.password = sage_password_gate::resolve(
+                                &app_handle,
+                                state.inner(),
+                                gate.inner(),
+                            )
+                            .await?;
+                        } else {
+                            req.password = None;
+                        }));
+                    }
+                    None => {}
+                }
             } else if ident.is_case(Case::Snake) {
                 let ident = proc_macro2::Ident::new(
                     &ident.replace("endpoint", &endpoint.to_case(Case::Snake)),
@@ -152,14 +207,14 @@ fn convert(
             if repeat {
                 for endpoint in endpoints.keys() {
                     for tree in stream.clone() {
-                        convert(tree, endpoints, Some(endpoint), output);
+                        convert(tree, endpoints, gating, Some(endpoint), output);
                     }
                 }
             } else {
                 let mut inner = proc_macro2::TokenStream::new();
 
                 for tree in stream {
-                    convert(tree, endpoints, endpoint, &mut inner);
+                    convert(tree, endpoints, gating, endpoint, &mut inner);
                 }
 
                 output.extend(proc_macro2::TokenStream::from(TokenStream::from(
diff --git a/crates/sage-api/password-gating.json b/crates/sage-api/password-gating.json
new file mode 100644
index 000000000..13ef6b4a2
--- /dev/null
+++ b/crates/sage-api/password-gating.json
@@ -0,0 +1,34 @@
+{
+  "add_nft_uri": "auto_submit",
+  "assign_nfts_to_did": "auto_submit",
+  "auto_combine_cat": "auto_submit",
+  "auto_combine_xch": "auto_submit",
+  "bulk_mint_nfts": "auto_submit",
+  "bulk_send_cat": "auto_submit",
+  "bulk_send_xch": "auto_submit",
+  "cancel_offer": "auto_submit",
+  "cancel_offers": "auto_submit",
+  "combine": "auto_submit",
+  "create_did": "auto_submit",
+  "create_transaction": "auto_submit",
+  "delete_key": "fingerprint",
+  "exercise_options": "auto_submit",
+  "finalize_clawback": "auto_submit",
+  "get_secret_key": "fingerprint",
+  "increase_derivation_index": "always",
+  "issue_cat": "auto_submit",
+  "make_offer": "always",
+  "mint_option": "auto_submit",
+  "multi_send": "auto_submit",
+  "normalize_dids": "auto_submit",
+  "send_cat": "auto_submit",
+  "send_xch": "auto_submit",
+  "sign_coin_spends": "always",
+  "sign_message_by_address": "always",
+  "sign_message_with_public_key": "always",
+  "split": "auto_submit",
+  "take_offer": "always",
+  "transfer_dids": "auto_submit",
+  "transfer_nfts": "auto_submit",
+  "transfer_options": "auto_submit"
+}
diff --git a/crates/sage-api/src/lib.rs b/crates/sage-api/src/lib.rs
index 3bacc7ae4..3124b94be 100644
--- a/crates/sage-api/src/lib.rs
+++ b/crates/sage-api/src/lib.rs
@@ -17,3 +17,404 @@ pub use openapi_metadata::*;
 // Re-export the openapi attribute macro
 #[cfg(feature = "openapi")]
 pub use sage_api_macro::openapi as openapi_attr;
+
+#[cfg(test)]
+mod password_gate_drift {
+    use std::collections::{BTreeMap, BTreeSet};
+
+    /// The three ways the host-layer gate can treat an endpoint. Mirrors the
+    /// enum the macro deserialises `password-gating.json` into.
+    #[derive(Clone, Copy, PartialEq, Eq, Debug)]
+    enum GateMode {
+        /// Prompt every call, verifying against the active wallet.
+        Always,
+        /// Prompt only when `req.auto_submit` is set. These endpoints build a
+        /// transaction for confirmation first and touch no secret until the
+        /// caller asks for it to be signed and submitted.
+        AutoSubmit,
+        /// Prompt every call, verifying against `req.fingerprint` rather than
+        /// the active wallet.
+        Fingerprint,
+    }
+
+    /// Reads the single gating manifest, rejecting any mode string the macro
+    /// would not understand.
+    fn gate_modes() -> BTreeMap<String, GateMode> {
+        let raw: BTreeMap<String, String> =
+            serde_json::from_str(include_str!("../password-gating.json")).unwrap();
+
+        raw.into_iter()
+            .map(|(endpoint, mode)| {
+                let mode = match mode.as_str() {
+                    "always" => GateMode::Always,
+                    "auto_submit" => GateMode::AutoSubmit,
+                    "fingerprint" => GateMode::Fingerprint,
+                    other => panic!(
+                        "password-gating.json: unknown mode {other:?} for {endpoint:?}; \
+                         expected \"always\", \"auto_submit\", or \"fingerprint\"",
+                    ),
+                };
+                (endpoint, mode)
+            })
+            .collect()
+    }
+
+    fn endpoints_with_mode(mode: GateMode) -> BTreeSet<String> {
+        gate_modes()
+            .into_iter()
+            .filter(|(_, actual)| *actual == mode)
+            .map(|(endpoint, _)| endpoint)
+            .collect()
+    }
+
+    /// Reads every request source file so the scanners below see the same
+    /// text the macro's JSON manifest is supposed to describe.
+    fn request_sources() -> Vec<String> {
+        let requests_dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src/requests");
+        read_rust_sources(&requests_dir, 6)
+    }
+
+    /// Reads the `sage` crate's endpoint implementations. The gate lives in the
+    /// Tauri host layer, but the mode each endpoint needs is a property of how
+    /// its implementation consumes the password, so the invariant can only be
+    /// checked against that source.
+    fn endpoint_implementation_sources() -> Vec<String> {
+        let endpoints_dir =
+            std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../sage/src/endpoints");
+        read_rust_sources(&endpoints_dir, 4)
+    }
+
+    fn read_rust_sources(dir: &std::path::Path, minimum: usize) -> Vec<String> {
+        let entries = std::fs::read_dir(dir)
+            .unwrap_or_else(|error| panic!("failed to read sources at {dir:?}: {error}"));
+
+        let mut sources = Vec::new();
+        for entry in entries {
+            let entry = entry.unwrap();
+            let path = entry.path();
+            if path.extension().and_then(|extension| extension.to_str()) == Some("rs") {
+                sources.push(
+                    std::fs::read_to_string(&path)
+                        .unwrap_or_else(|error| panic!("failed to read {path:?}: {error}")),
+                );
+            }
+        }
+
+        assert!(
+            sources.len() >= minimum,
+            "expected at least {minimum} Rust source files under {dir:?}, found {}",
+            sources.len(),
+        );
+
+        sources
+    }
+
+    /// The manifest's keys must match, exactly, the request types carrying a
+    /// `password` field. If this fails you either added a signing endpoint
+    /// without gating it (a security hole) or gated one that takes no
+    /// password (a spurious prompt).
+    #[test]
+    fn gating_map_matches_request_types_with_password_field() {
+        let gated: BTreeSet<String> = gate_modes().into_keys().collect();
+
+        let mut discovered = BTreeSet::new();
+        for source in &request_sources() {
+            discovered.extend(password_structs(source).into_keys());
+        }
+
+        assert_eq!(
+            gated,
+            discovered,
+            "password-gating.json is out of sync with the request types.\n\
+             Only in password-gating.json: {:?}\n\
+             Only in request types: {:?}",
+            gated.difference(&discovered).collect::<Vec<_>>(),
+            discovered.difference(&gated).collect::<Vec<_>>(),
+        );
+    }
+
+    /// The `fingerprint` mode must match, exactly, the gated request types that
+    /// carry a `fingerprint` field. If this fails the macro either prompts for
+    /// the active wallet while acting on a named one (wrong password handed to
+    /// the keychain, and a hard failure when logged out), or reads a
+    /// `req.fingerprint` that does not exist (a compile error).
+    #[test]
+    fn fingerprint_mode_matches_request_types_with_fingerprint_field() {
+        let fingerprint_gated = endpoints_with_mode(GateMode::Fingerprint);
+
+        let mut discovered = BTreeSet::new();
+        for source in &request_sources() {
+            for (name, has_fingerprint) in password_structs(source) {
+                if has_fingerprint {
+                    discovered.insert(name);
+                }
+            }
+        }
+
+        assert_eq!(
+            fingerprint_gated,
+            discovered,
+            "the \"fingerprint\" entries in password-gating.json are out of sync with the \
+             request types.\n\
+             Only in password-gating.json: {:?}\n\
+             Only in request types: {:?}",
+            fingerprint_gated
+                .difference(&discovered)
+                .collect::<Vec<_>>(),
+            discovered
+                .difference(&fingerprint_gated)
+                .collect::<Vec<_>>(),
+        );
+    }
+
+    /// `auto_submit` mode expands to `if req.auto_submit { ... }`, so the field
+    /// has to exist. Without this check a mis-filed endpoint is a compile error
+    /// in generated code, which points at the macro rather than the manifest.
+    #[test]
+    fn auto_submit_mode_entries_have_an_auto_submit_field() {
+        let auto_submit = endpoints_with_mode(GateMode::AutoSubmit);
+
+        let mut discovered = BTreeSet::new();
+        for source in &request_sources() {
+            for (name, _) in password_structs(source) {
+                if struct_has_auto_submit(source, &name) {
+                    discovered.insert(name);
+                }
+            }
+        }
+
+        let missing: Vec<_> = auto_submit.difference(&discovered).collect();
+        assert!(
+            missing.is_empty(),
+            "these endpoints are marked \"auto_submit\" in password-gating.json but their \
+             request types have no `auto_submit` field: {missing:?}",
+        );
+    }
+
+    /// The mode has to match how the endpoint actually consumes the password.
+    /// An endpoint that reaches the keychain directly (`extract_secrets`, or
+    /// `self.sign`) needs the password on every call; one that only forwards it
+    /// to `Sage::transact`/`transact_with` uses it solely when `auto_submit` is
+    /// set, and prompting unconditionally there means asking the user for a
+    /// password that gets discarded -- once to build the transaction, and again
+    /// after they confirm it.
+    #[test]
+    fn gate_modes_match_how_endpoints_consume_the_password() {
+        let sources = endpoint_implementation_sources();
+
+        for (endpoint, mode) in gate_modes() {
+            let Some(body) = endpoint_body(&sources, &endpoint) else {
+                panic!("no `fn {endpoint}` found in the sage crate's endpoint implementations");
+            };
+
+            let signs_directly = body.contains("extract_secrets") || body.contains("self.sign(");
+            let expected_conditional = !signs_directly;
+            let marked_conditional = mode == GateMode::AutoSubmit;
+
+            assert_eq!(
+                marked_conditional,
+                expected_conditional,
+                "password-gating.json marks `{endpoint}` as {mode:?}, but its implementation \
+                 {}. Endpoints that reach a secret directly must be \"always\" (or \
+                 \"fingerprint\"); endpoints that only forward the password to \
+                 `transact`/`transact_with` must be \"auto_submit\".",
+                if signs_directly {
+                    "reaches the keychain on every call"
+                } else {
+                    "only uses the password when `auto_submit` is set"
+                },
+            );
+        }
+    }
+
+    /// Extracts the body of `fn <endpoint>(` from the endpoint implementations,
+    /// up to the closing brace at method indentation.
+    fn endpoint_body(sources: &[String], endpoint: &str) -> Option<String> {
+        let needle = format!("fn {endpoint}(");
+
+        for source in sources {
+            let lines: Vec<&str> = source.lines().collect();
+            let Some(start) = lines.iter().position(|line| {
+                let trimmed = line.trim_start();
+                (trimmed.starts_with("pub fn ")
+                    || trimmed.starts_with("pub async fn ")
+                    || trimmed.starts_with("pub(crate) fn ")
+                    || trimmed.starts_with("pub(crate) async fn "))
+                    && trimmed.contains(&needle)
+            }) else {
+                continue;
+            };
+
+            let mut body = String::new();
+            for line in &lines[start..] {
+                body.push_str(line);
+                body.push('\n');
+                if *line == "    }" {
+                    break;
+                }
+            }
+            return Some(body);
+        }
+
+        None
+    }
+
+    /// Deny-by-default over secret consumption. The other tests keep the
+    /// manifest consistent with itself and with the request types; this one
+    /// catches the endpoint that never opted in at all. An endpoint written
+    /// without a `password` field and without a manifest entry matches none
+    /// of them, gets no `maybe_unlock` injection, works against unprotected
+    /// wallets (which is what development tests against), and fails with an
+    /// un-prompted "Incorrect password" on protected ones. So: every endpoint
+    /// implementation that reaches a wallet secret — a keychain extraction, a
+    /// direct signing call, or the transact helpers that sign on submit —
+    /// must appear in the manifest.
+    #[test]
+    fn every_secret_reaching_endpoint_is_gated() {
+        let gated: BTreeSet<String> = gate_modes().into_keys().collect();
+
+        // The transact helpers are the signing primitives themselves, not
+        // endpoints; the gate lives in their callers, which is exactly what
+        // this test verifies.
+        let non_endpoint_helpers = ["transact", "transact_with"];
+
+        let mut ungated = Vec::new();
+        for source in &endpoint_implementation_sources() {
+            for (name, body) in endpoint_bodies(source) {
+                if non_endpoint_helpers.contains(&name.as_str()) {
+                    continue;
+                }
+                let reaches_secret = body.contains("extract_secrets")
+                    || body.contains("self.sign(")
+                    || body.contains("self.transact(")
+                    || body.contains("self.transact_with(");
+
+                if reaches_secret && !gated.contains(&name) {
+                    ungated.push(name);
+                }
+            }
+        }
+
+        assert!(
+            ungated.is_empty(),
+            "these endpoint implementations reach a wallet secret but are not listed in \
+             password-gating.json, so the host-layer gate never prompts for them: {ungated:?}. \
+             Add each to the manifest (and a `password` field to its request type).",
+        );
+    }
+
+    /// Every `pub fn` / `pub async fn` in the endpoint sources, as
+    /// `(snake_case name, body)` pairs. Bodies end at the closing brace at
+    /// method indentation, mirroring [`endpoint_body`].
+    fn endpoint_bodies(source: &str) -> Vec<(String, String)> {
+        let lines: Vec<&str> = source.lines().collect();
+        let mut found = Vec::new();
+
+        for (start, line) in lines.iter().enumerate() {
+            let trimmed = line.trim_start();
+            let Some(rest) = trimmed
+                .strip_prefix("pub fn ")
+                .or_else(|| trimmed.strip_prefix("pub async fn "))
+                .or_else(|| trimmed.strip_prefix("pub(crate) fn "))
+                .or_else(|| trimmed.strip_prefix("pub(crate) async fn "))
+            else {
+                continue;
+            };
+            let Some(name) = rest.split('(').next() else {
+                continue;
+            };
+
+            let mut body = String::new();
+            for line in &lines[start..] {
+                body.push_str(line);
+                body.push('\n');
+                if *line == "    }" {
+                    break;
+                }
+            }
+
+            found.push((name.trim().to_string(), body));
+        }
+
+        found
+    }
+
+    /// Whether the `pub struct` for a `snake_case` endpoint name carries a
+    /// `pub auto_submit: bool` field.
+    fn struct_has_auto_submit(source: &str, endpoint: &str) -> bool {
+        let pascal: String = endpoint
+            .split('_')
+            .map(|word| {
+                let mut characters = word.chars();
+                match characters.next() {
+                    Some(first) => first.to_uppercase().collect::<String>() + characters.as_str(),
+                    None => String::new(),
+                }
+            })
+            .collect();
+
+        let header = format!("pub struct {pascal} {{");
+        let lines: Vec<&str> = source.lines().collect();
+        let Some(start) = lines.iter().position(|line| line.trim_end() == header) else {
+            return false;
+        };
+
+        lines[start + 1..]
+            .iter()
+            .take_while(|line| **line != "}")
+            .any(|line| line.trim() == "pub auto_submit: bool,")
+    }
+
+    /// Scans Rust source for `pub struct Name {` blocks containing a
+    /// `pub password: Option<String>` field, returning `snake_case` names
+    /// mapped to whether the same struct also carries a `fingerprint` field.
+    fn password_structs(source: &str) -> BTreeMap<String, bool> {
+        let mut found = BTreeMap::new();
+        let lines: Vec<&str> = source.lines().collect();
+        let mut index = 0;
+
+        while index < lines.len() {
+            let line = lines[index].trim_end();
+            let Some(rest) = line.strip_prefix("pub struct ") else {
+                index += 1;
+                continue;
+            };
+            let Some(name) = rest.strip_suffix(" {") else {
+                index += 1;
+                continue;
+            };
+
+            let mut cursor = index + 1;
+            let mut has_password = false;
+            let mut has_fingerprint = false;
+            while cursor < lines.len() && lines[cursor] != "}" {
+                let field = lines[cursor].trim();
+                if field == "pub password: Option<String>," {
+                    has_password = true;
+                }
+                if field == "pub fingerprint: u32," {
+                    has_fingerprint = true;
+                }
+                cursor += 1;
+            }
+
+            if has_password {
+                found.insert(to_snake_case(name), has_fingerprint);
+            }
+            index = cursor + 1;
+        }
+
+        found
+    }
+
+    fn to_snake_case(name: &str) -> String {
+        let mut out = String::new();
+        for (position, character) in name.char_indices() {
+            if character.is_uppercase() && position != 0 {
+                out.push('_');
+            }
+            out.extend(character.to_lowercase());
+        }
+        out
+    }
+}
diff --git a/crates/sage-api/src/requests/keys.rs b/crates/sage-api/src/requests/keys.rs
index e9686ea4d..65af5d9c4 100644
--- a/crates/sage-api/src/requests/keys.rs
+++ b/crates/sage-api/src/requests/keys.rs
@@ -580,3 +580,30 @@ pub struct DeleteUserTheme {
 #[cfg_attr(feature = "tauri", derive(specta::Type))]
 #[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 pub struct DeleteUserThemeResponse {}
+
+/// Re-derive the password-protection flag for every wallet that could be
+/// drifted *false* — i.e. flagged unprotected but holding a secret key
+#[cfg_attr(
+    feature = "openapi",
+    crate::openapi_attr(
+        tag = "Authentication & Keys",
+        description = "Re-derive the stored password-protection flag for every wallet whose flag says unprotected but which holds a secret key. This is the drift direction that fails open, so it is the one worth probing on demand."
+    )
+)]
+#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
+#[cfg_attr(feature = "tauri", derive(specta::Type))]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+pub struct ReconcileDriftedKeyProtection {}
+
+/// Response with the number of wallets whose flag was corrected
+#[cfg_attr(
+    feature = "openapi",
+    crate::openapi_attr(tag = "Authentication & Keys")
+)]
+#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
+#[cfg_attr(feature = "tauri", derive(specta::Type))]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+pub struct ReconcileDriftedKeyProtectionResponse {
+    /// How many wallets had a drifted flag corrected
+    pub corrected: u32,
+}
diff --git a/crates/sage-api/src/types/error_kind.rs b/crates/sage-api/src/types/error_kind.rs
index 0de13113b..fb526648e 100644
--- a/crates/sage-api/src/types/error_kind.rs
+++ b/crates/sage-api/src/types/error_kind.rs
@@ -9,6 +9,9 @@ pub enum ErrorKind {
     NotFound,
     Unauthorized,
     IncorrectPassword,
+    PasswordCancelled,
+    TooManyPasswordAttempts,
+    PasswordPromptTimedOut,
     Internal,
     DatabaseMigration,
     Nfc,
diff --git a/crates/sage-apps/Cargo.toml b/crates/sage-apps/Cargo.toml
index d084526e9..aa121b910 100644
--- a/crates/sage-apps/Cargo.toml
+++ b/crates/sage-apps/Cargo.toml
@@ -9,6 +9,8 @@ workspace = true
 [dependencies]
 sage = { workspace = true }
 sage-api = { workspace = true, features = ["tauri"] }
+sage-keychain = { workspace = true }
+sage-password-gate = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 specta = { workspace = true, features = ["derive", "function", "url"] }
diff --git a/crates/sage-apps/src/bridge/bridge_request.rs b/crates/sage-apps/src/bridge/bridge_request.rs
index c5ab79991..53ae7e13f 100644
--- a/crates/sage-apps/src/bridge/bridge_request.rs
+++ b/crates/sage-apps/src/bridge/bridge_request.rs
@@ -1,16 +1,17 @@
+use sage_password_gate::{MAX_ATTEMPTS, TOO_MANY_ATTEMPTS_REASON};
 use tauri::{AppHandle, Manager, State, Webview};
 
 use crate::{
     AppState, AppsHostState, BridgeApprovalsChangedEvent, BridgeCapability, BridgeContext,
     BridgeMethod, BridgeMethodCapability, BridgeOrigin, BridgeRegistry, BridgeRegistryKind,
-    BridgeTools, PendingBridgeApproval, ResolveBridgeApprovalArgs, RustBridgeApprovalBody,
-    RustBridgeApprovalRequest, RustBridgeInvokeResult, RustBridgeRequest, RustBridgeResponse,
-    SharedSageApp, SystemBridgeCapability, UserBridgeCapability, assert_bridge_origin,
-    emit_bridge_response_to_app, emit_system_runtime_event_to_listeners,
-    ensure_app_is_enabled_for_scope, ensure_approval_expiry_loop, get_system_capability_definition,
-    get_user_capability_definition, list_pending_approvals, resolve_app,
-    start_bridge_approval_runtime, sync_bridge_approval_runtime, take_pending_approval,
-    unix_timestamp_ms, write_pending_approval,
+    BridgeTools, PendingBridgeApproval, ResolveBridgeApprovalArgs, ResolveBridgeApprovalResult,
+    RustBridgeApprovalBody, RustBridgeApprovalRequest, RustBridgeInvokeResult, RustBridgeRequest,
+    RustBridgeResponse, SharedSageApp, SystemBridgeCapability, UserBridgeCapability,
+    assert_bridge_origin, emit_bridge_response_to_app, emit_system_runtime_event_to_listeners,
+    ensure_app_is_enabled_for_scope, ensure_approval_expiry_loop, extend_approval_for_password,
+    get_system_capability_definition, get_user_capability_definition, list_pending_approvals,
+    peek_pending_approval, record_password_attempt, resolve_app, start_bridge_approval_runtime,
+    sync_bridge_approval_runtime, take_pending_approval, unix_timestamp_ms, write_pending_approval,
 };
 
 pub(crate) async fn process(
@@ -43,6 +44,7 @@ pub(crate) async fn process(
         BridgeRegistryKind::User,
         &request,
         false,
+        None,
     )
     .await
 }
@@ -76,6 +78,7 @@ pub(crate) async fn process_system(
         BridgeRegistryKind::System,
         &request,
         false,
+        None,
     )
     .await
 }
@@ -85,60 +88,233 @@ pub(crate) async fn process_after_approval(
     app_state: &State<'_, AppState>,
     apps_state: &State<'_, AppsHostState>,
     args: ResolveBridgeApprovalArgs,
-) -> Result<(), String> {
-    let pending = take_pending_approval(apps_state, &args.approval_id)
+) -> Result<ResolveBridgeApprovalResult, String> {
+    // Peeked, not taken: an approval whose password is wrong has to stay queued
+    // so the user can try again in the card they are already looking at.
+    let pending = peek_pending_approval(apps_state, &args.approval_id)
         .await
         .ok_or_else(|| format!("No pending approval with id {}", args.approval_id))?;
 
-    sync_bridge_approval_runtime(app_handle, apps_state).await?;
-
-    let approvals_changed_event =
-        BridgeApprovalsChangedEvent::new_from_list(list_pending_approvals(apps_state).await);
-
-    emit_system_runtime_event_to_listeners(app_handle, apps_state, approvals_changed_event).await;
-
-    let app = resolve_app(app_handle, &pending.app_id)
-        .await
-        .map_err(|err| format!("Failed to resolve app: {err}"))?;
-
-    let origin =
-        assert_bridge_origin(app_handle, &app.with_app(SharedSageApp::webview_label)).await?;
-
-    let invoke_result = if !args.approved {
-        RustBridgeInvokeResult::error(
-            &pending.request.id,
+    // Every rejection that does not depend on the password comes first, so the
+    // user is never asked to type one into an approval that was already doomed.
+    let rejection = if !args.approved {
+        Some((
             "user_denied",
             args.reason
+                .clone()
                 .unwrap_or_else(|| "User denied the request".to_string()),
-        )
+        ))
     } else if unix_timestamp_ms() as u64 > pending.expires_at_ms {
-        RustBridgeInvokeResult::error(
-            &pending.request.id,
+        Some((
             "approval_timeout",
             "Approval expired before it was resolved".to_string(),
-        )
+        ))
     } else if wallet_binding_violated(app_state, &pending).await {
-        RustBridgeInvokeResult::error(
-            &pending.request.id,
+        Some((
             "wallet_changed",
             "Active wallet changed since the approval was requested".to_string(),
-        )
+        ))
     } else {
-        process_shared(
+        None
+    };
+
+    if let Some((code, message)) = rejection {
+        return consume_and_respond(
             app_handle,
-            app_state,
-            &origin,
-            pending.registry_kind,
-            &pending.request,
-            true,
+            apps_state,
+            &args.approval_id,
+            &pending,
+            RustBridgeInvokeResult::error(&pending.request.id, code, message),
         )
-        .await?
+        .await;
+    }
+
+    // Only an approval that reaches a wallet secret *and* targets a protected
+    // wallet needs a password; everything else resolves with `None`.
+    let password = if approval_needs_password(app_state, &pending.approval.body).await {
+        // `GetSecretKey` names its own fingerprint, which need not be the active
+        // wallet; verifying the active wallet's password there would check the
+        // wrong key.
+        let fingerprint = match approval_password_fingerprint(&pending.approval.body) {
+            Some(fingerprint) => fingerprint,
+            None => active_wallet_fingerprint(app_state)
+                .await
+                .ok_or_else(|| "No wallet is logged in".to_string())?,
+        };
+
+        // The card renders its password field from a hint captured when the
+        // approval was queued. If that hint was stale, this is where the card
+        // finds out it has to ask
+        let Some(candidate) = args.password.as_deref().filter(|it| !it.is_empty()) else {
+            if extend_approval_for_password(apps_state, &args.approval_id).await {
+                let approvals_changed_event = BridgeApprovalsChangedEvent::new_from_list(
+                    list_pending_approvals(apps_state).await,
+                );
+                emit_system_runtime_event_to_listeners(
+                    app_handle,
+                    apps_state,
+                    approvals_changed_event,
+                )
+                .await;
+            }
+            return Ok(ResolveBridgeApprovalResult::PasswordRequired);
+        };
+
+        if verify_wallet_password(app_state, fingerprint, candidate).await? {
+            Some(candidate.to_string())
+        } else {
+            let attempts_used = record_password_attempt(apps_state, &args.approval_id)
+                .await
+                .ok_or_else(|| format!("No pending approval with id {}", args.approval_id))?;
+
+            return match password_attempt_outcome(attempts_used) {
+                // Retryable: the approval stays queued and the app keeps waiting.
+                PasswordAttempt::Retry { attempts_remaining } => {
+                    Ok(ResolveBridgeApprovalResult::WrongPassword { attempts_remaining })
+                }
+                PasswordAttempt::Exhausted => {
+                    consume_and_respond(
+                        app_handle,
+                        apps_state,
+                        &args.approval_id,
+                        &pending,
+                        RustBridgeInvokeResult::error(
+                            &pending.request.id,
+                            "unauthorized",
+                            TOO_MANY_ATTEMPTS_REASON.to_string(),
+                        ),
+                    )
+                    .await?;
+
+                    Ok(ResolveBridgeApprovalResult::TooManyAttempts)
+                }
+            };
+        }
+    } else {
+        None
     };
 
+    // Committed: the approval is consumed whatever the wallet method returns.
+    // The take is the commit point, and it must actually win: the expiry loop
+    // (or a concurrent resolve of the same id) can remove the approval during
+    // the password verify above, and executing on the peeked copy after that
+    // would broadcast a transaction the app was already told timed out — or
+    // execute it twice.
+    if take_pending_approval(apps_state, &args.approval_id)
+        .await
+        .is_none()
+    {
+        return Err(format!(
+            "Approval {} was already resolved or expired",
+            args.approval_id
+        ));
+    }
+    finish_approval(app_handle, apps_state).await?;
+
+    let origin = bridge_origin_for(app_handle, &pending).await?;
+
+    // The password, when one was needed, was verified above and is handed
+    // straight to the wallet method. It never enters the approval record and
+    // never crosses back into an app runtime.
+    let invoke_result = process_shared(
+        app_handle,
+        app_state,
+        &origin,
+        pending.registry_kind,
+        &pending.request,
+        true,
+        password,
+    )
+    .await?;
+
+    emit_bridge_response_to_app(app_handle, &origin.app, &invoke_result.try_into()?).await?;
+
+    Ok(ResolveBridgeApprovalResult::Resolved)
+}
+
+/// Drops the approval from the queue and hands `invoke_result` back to the app.
+async fn consume_and_respond(
+    app_handle: &AppHandle,
+    apps_state: &State<'_, AppsHostState>,
+    approval_id: &str,
+    pending: &PendingBridgeApproval,
+    invoke_result: RustBridgeInvokeResult,
+) -> Result<ResolveBridgeApprovalResult, String> {
+    // If the expiry loop (or a concurrent resolve) consumed the approval
+    // first, the app already received a response for this request id; sending
+    // another would contradict it.
+    if take_pending_approval(apps_state, approval_id)
+        .await
+        .is_none()
+    {
+        return Err(format!(
+            "Approval {approval_id} was already resolved or expired"
+        ));
+    }
+    finish_approval(app_handle, apps_state).await?;
+
+    let origin = bridge_origin_for(app_handle, pending).await?;
     emit_bridge_response_to_app(app_handle, &origin.app, &invoke_result.try_into()?).await?;
+
+    Ok(ResolveBridgeApprovalResult::Resolved)
+}
+
+/// Re-syncs the approval runtime and tells listeners the queue changed. Runs
+/// once an approval has actually left the queue.
+async fn finish_approval(
+    app_handle: &AppHandle,
+    apps_state: &State<'_, AppsHostState>,
+) -> Result<(), String> {
+    sync_bridge_approval_runtime(app_handle, apps_state).await?;
+
+    let approvals_changed_event =
+        BridgeApprovalsChangedEvent::new_from_list(list_pending_approvals(apps_state).await);
+
+    emit_system_runtime_event_to_listeners(app_handle, apps_state, approvals_changed_event).await;
+
     Ok(())
 }
 
+async fn bridge_origin_for(
+    app_handle: &AppHandle,
+    pending: &PendingBridgeApproval,
+) -> Result<BridgeOrigin, String> {
+    let app = resolve_app(app_handle, &pending.app_id)
+        .await
+        .map_err(|err| format!("Failed to resolve app: {err}"))?;
+
+    assert_bridge_origin(app_handle, &app.with_app(SharedSageApp::webview_label)).await
+}
+
+/// Whether `password` unlocks `fingerprint`. Takes the Sage lock only for the
+/// probe and never holds it across an await.
+async fn verify_wallet_password(
+    app_state: &State<'_, AppState>,
+    fingerprint: u32,
+    password: &str,
+) -> Result<bool, String> {
+    let sage = app_state.lock().await;
+
+    sage.verify_password(fingerprint, password)
+        .map_err(|err| err.to_string())
+}
+
+/// What a wrong password means, given how many attempts have now been spent.
+/// Shares `MAX_ATTEMPTS` with the native prompt so both paths give the user the
+/// same number of tries.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum PasswordAttempt {
+    Retry { attempts_remaining: u8 },
+    Exhausted,
+}
+
+fn password_attempt_outcome(attempts_used: u8) -> PasswordAttempt {
+    match MAX_ATTEMPTS.saturating_sub(attempts_used) {
+        0 => PasswordAttempt::Exhausted,
+        attempts_remaining => PasswordAttempt::Retry { attempts_remaining },
+    }
+}
+
 async fn process_shared(
     app_handle: &AppHandle,
     app_state: &State<'_, AppState>,
@@ -146,6 +322,7 @@ async fn process_shared(
     registry_kind: BridgeRegistryKind,
     request: &RustBridgeRequest,
     approved: bool,
+    password: Option<String>,
 ) -> Result<RustBridgeInvokeResult, String> {
     let registry = BridgeRegistry::new(registry_kind);
 
@@ -175,18 +352,25 @@ async fn process_shared(
 
     if approved {
         let response =
-            execute_bridge_request(app_handle, app_state, origin, registry, request).await;
+            execute_bridge_request(app_handle, app_state, origin, registry, request, password)
+                .await;
 
         return Ok(response.into());
     }
 
+    let password_protected = active_wallet_password_protected(app_state).await;
+
     match method
         .prepare_approval(
-            BridgeContext { app },
+            BridgeContext {
+                app,
+                password_protected,
+            },
             BridgeTools {
                 app_handle,
                 app_state,
                 host_state: &app_handle.state::<AppsHostState>(),
+                password: None,
             },
             request,
         )
@@ -206,7 +390,8 @@ async fn process_shared(
         }
         Ok(None) => {
             let response =
-                execute_bridge_request(app_handle, app_state, origin, registry, request).await;
+                execute_bridge_request(app_handle, app_state, origin, registry, request, password)
+                    .await;
 
             Ok(response.into())
         }
@@ -224,19 +409,26 @@ async fn execute_bridge_request(
     origin: &BridgeOrigin,
     registry: BridgeRegistry,
     request: &RustBridgeRequest,
+    password: Option<String>,
 ) -> RustBridgeResponse {
     let method = match assert_method(&registry, request) {
         Ok(method) => method,
         Err(response) => return response,
     };
 
+    let password_protected = active_wallet_password_protected(app_state).await;
+
     let result = method
         .handle(
-            BridgeContext { app: &origin.app },
+            BridgeContext {
+                app: &origin.app,
+                password_protected,
+            },
             BridgeTools {
                 app_handle,
                 app_state,
                 host_state: &app_handle.state::<AppsHostState>(),
+                password,
             },
             request,
         )
@@ -264,6 +456,80 @@ async fn active_wallet_fingerprint(app_state: &State<'_, AppState>) -> Option<u3
         .ok()
 }
 
+/// Whether the active wallet is password-protected, per its entry in
+/// `sage.wallet_config.wallets`. Deliberately not `Keychain::is_password_protected`:
+/// that runs an Argon2 decrypt probe on every call, which is far too
+/// expensive for a check made on every bridge request.
+async fn active_wallet_password_protected(app_state: &State<'_, AppState>) -> bool {
+    app_state
+        .lock()
+        .await
+        .wallet_config()
+        .is_some_and(|wallet| wallet.password_protected)
+}
+
+/// Whether `fingerprint`'s wallet is password-protected, per its entry in
+/// `sage.wallet_config.wallets`. Unlike [`active_wallet_password_protected`]
+/// this needs no wallet to be logged in.
+async fn wallet_password_protected(app_state: &State<'_, AppState>, fingerprint: u32) -> bool {
+    app_state
+        .lock()
+        .await
+        .is_password_protected_flag(fingerprint)
+}
+
+/// Whether this approval must collect a master password: it reaches a wallet
+/// secret *and* the wallet it targets is protected.
+async fn approval_needs_password(
+    app_state: &State<'_, AppState>,
+    body: &RustBridgeApprovalBody,
+) -> bool {
+    if !approval_requires_password(body) {
+        return false;
+    }
+
+    match approval_password_fingerprint(body) {
+        Some(fingerprint) => wallet_password_protected(app_state, fingerprint).await,
+        None => active_wallet_password_protected(app_state).await,
+    }
+}
+
+/// The wallet the password gate must target for this approval.
+///
+/// `None` means "the active wallet". `GetSecretKey` names its own fingerprint,
+/// which need not be the active wallet, so prompting for and verifying the
+/// active wallet's password there would hand the keychain the wrong secret.
+fn approval_password_fingerprint(body: &RustBridgeApprovalBody) -> Option<u32> {
+    match *body {
+        RustBridgeApprovalBody::GetSecretKey { fingerprint } => Some(fingerprint),
+
+        RustBridgeApprovalBody::SendXch { .. }
+        | RustBridgeApprovalBody::SignCoinSpends { .. }
+        | RustBridgeApprovalBody::SignMessage { .. }
+        | RustBridgeApprovalBody::CapabilityGrant { .. }
+        | RustBridgeApprovalBody::NetworkWhitelistGrant { .. } => None,
+    }
+}
+
+/// Whether resuming this approval needs the master-key password.
+///
+/// Only bodies whose handler reaches a wallet secret are gated. Capability and
+/// network-whitelist grants touch no secret, so prompting for them would ask
+/// the user for nothing and would fail outright when no wallet is active.
+/// Listed exhaustively on purpose: a new approval body must opt into the
+/// prompt deliberately rather than inherit one from a catch-all arm.
+fn approval_requires_password(body: &RustBridgeApprovalBody) -> bool {
+    match *body {
+        RustBridgeApprovalBody::GetSecretKey { .. }
+        | RustBridgeApprovalBody::SendXch { .. }
+        | RustBridgeApprovalBody::SignCoinSpends { .. }
+        | RustBridgeApprovalBody::SignMessage { .. } => true,
+
+        RustBridgeApprovalBody::CapabilityGrant { .. }
+        | RustBridgeApprovalBody::NetworkWhitelistGrant { .. } => false,
+    }
+}
+
 async fn wallet_binding_violated(
     app_state: &State<'_, AppState>,
     pending: &PendingBridgeApproval,
@@ -296,6 +562,7 @@ async fn request_approval(
 ) -> Result<(), String> {
     let apps_state = app_handle.state::<AppsHostState>();
     let approved_fingerprint = active_wallet_fingerprint(app_state).await;
+    let requires_password = approval_needs_password(app_state, &approval.body).await;
 
     write_pending_approval(
         &apps_state,
@@ -304,6 +571,7 @@ async fn request_approval(
         &approval,
         request,
         approved_fingerprint,
+        requires_password,
     )
     .await;
 
@@ -451,3 +719,175 @@ fn assert_bridge_version(request: &RustBridgeRequest) -> Result<(), RustBridgeIn
 
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::SageNetworkWhitelistEntry;
+
+    /// The user gets `MAX_ATTEMPTS` tries in the approval card, the same budget
+    /// the native prompt gives them, and the count shown must be what is left
+    /// *after* the attempt they just spent.
+    #[test]
+    fn a_wrong_password_reports_the_remaining_attempts() {
+        assert_eq!(
+            password_attempt_outcome(1),
+            PasswordAttempt::Retry {
+                attempts_remaining: MAX_ATTEMPTS - 1
+            }
+        );
+        assert_eq!(
+            password_attempt_outcome(MAX_ATTEMPTS - 1),
+            PasswordAttempt::Retry {
+                attempts_remaining: 1
+            }
+        );
+    }
+
+    #[test]
+    fn spending_the_last_attempt_exhausts_the_approval() {
+        assert_eq!(
+            password_attempt_outcome(MAX_ATTEMPTS),
+            PasswordAttempt::Exhausted
+        );
+    }
+
+    /// A host that somehow over-counts must still fail closed rather than wrap
+    /// around into a fresh budget of retries.
+    #[test]
+    fn over_counting_attempts_stays_exhausted() {
+        assert_eq!(
+            password_attempt_outcome(MAX_ATTEMPTS + 10),
+            PasswordAttempt::Exhausted
+        );
+    }
+
+    /// Only the bodies that reach a wallet secret are gated. Capability and
+    /// network-whitelist grants must never ask for a password: there is nothing
+    /// to unlock, and the prompt would be unanswerable while logged out.
+    #[test]
+    fn only_secret_bearing_bodies_require_a_password() {
+        assert!(approval_requires_password(
+            &RustBridgeApprovalBody::GetSecretKey { fingerprint: 1 }
+        ));
+        assert!(approval_requires_password(
+            &RustBridgeApprovalBody::SignMessage {
+                message: String::new(),
+                public_key: String::new(),
+            }
+        ));
+        assert!(!approval_requires_password(
+            &RustBridgeApprovalBody::NetworkWhitelistGrant {
+                entry: SageNetworkWhitelistEntry::new_unchecked("https", "example.com"),
+                network_id: None,
+            }
+        ));
+    }
+
+    /// Every bridge method that builds one of the password-gated sage-api
+    /// request types must inject the resolved password from `BridgeTools`.
+    /// The handlers each hand-copy `req.password = tools.password...`; a new
+    /// signing method that forgets the line would collect and verify the
+    /// user's password in the approval card and then invoke the endpoint with
+    /// `password: None` — correct password, "Incorrect password" anyway,
+    /// discoverable only at runtime against a protected wallet.
+    #[test]
+    fn gated_bridge_methods_inject_the_resolved_password() {
+        use std::collections::BTreeMap;
+        use std::path::Path;
+
+        let manifest: BTreeMap<String, String> =
+            serde_json::from_str(include_str!("../../../sage-api/password-gating.json")).unwrap();
+
+        let type_names: Vec<String> = manifest.keys().map(|name| to_pascal_case(name)).collect();
+
+        fn to_pascal_case(snake: &str) -> String {
+            snake
+                .split('_')
+                .map(|word| {
+                    let mut characters = word.chars();
+                    match characters.next() {
+                        Some(first) => {
+                            first.to_uppercase().collect::<String>() + characters.as_str()
+                        }
+                        None => String::new(),
+                    }
+                })
+                .collect()
+        }
+
+        /// Whether `token` appears in `source` as a standalone identifier
+        /// (so `SendXch` does not match inside `WalletSendXchParams`).
+        fn contains_token(source: &str, token: &str) -> bool {
+            let is_ident = |c: char| c.is_ascii_alphanumeric() || c == '_';
+            source.match_indices(token).any(|(index, _)| {
+                let before_ok =
+                    index == 0 || !source[..index].chars().next_back().is_some_and(is_ident);
+                let after = index + token.len();
+                let after_ok = !source[after..].chars().next().is_some_and(is_ident);
+                before_ok && after_ok
+            })
+        }
+
+        fn visit(dir: &Path, files: &mut Vec<(std::path::PathBuf, String)>) {
+            for entry in std::fs::read_dir(dir).unwrap() {
+                let path = entry.unwrap().path();
+                if path.is_dir() {
+                    visit(&path, files);
+                } else if path.extension().and_then(|it| it.to_str()) == Some("rs") {
+                    files.push((path.clone(), std::fs::read_to_string(&path).unwrap()));
+                }
+            }
+        }
+
+        let methods_dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("src/bridge/methods");
+        let mut files = Vec::new();
+        visit(&methods_dir, &mut files);
+        assert!(files.len() >= 4, "expected bridge method sources");
+
+        let mut missing = Vec::new();
+        let mut gated_files = 0;
+        for (path, source) in &files {
+            if !type_names.iter().any(|name| contains_token(source, name)) {
+                continue;
+            }
+            gated_files += 1;
+            if !source.contains("tools.password") {
+                missing.push(path.display().to_string());
+            }
+        }
+
+        // The four wallet signing methods must all be caught, or the scan
+        // itself has drifted.
+        assert!(
+            gated_files >= 4,
+            "expected at least 4 bridge method files referencing gated request types, \
+             found {gated_files}",
+        );
+        assert!(
+            missing.is_empty(),
+            "these bridge methods build a password-gated request type but never inject \
+             `tools.password` into it, so the verified password would be dropped: {missing:?}",
+        );
+    }
+
+    /// `GetSecretKey` acts on the wallet named in its body, which need not be
+    /// the active one. Verifying the active wallet's password there would check
+    /// the wrong key entirely.
+    #[test]
+    fn get_secret_key_targets_its_own_fingerprint() {
+        assert_eq!(
+            approval_password_fingerprint(&RustBridgeApprovalBody::GetSecretKey {
+                fingerprint: 1234
+            }),
+            Some(1234)
+        );
+        assert_eq!(
+            approval_password_fingerprint(&RustBridgeApprovalBody::SignMessage {
+                message: String::new(),
+                public_key: String::new(),
+            }),
+            None
+        );
+    }
+}
diff --git a/crates/sage-apps/src/bridge/methods/shared.rs b/crates/sage-apps/src/bridge/methods/shared.rs
index 1d6871b87..a4c62bd98 100644
--- a/crates/sage-apps/src/bridge/methods/shared.rs
+++ b/crates/sage-apps/src/bridge/methods/shared.rs
@@ -46,13 +46,36 @@ pub(crate) enum BridgeMethodCapability {
 #[derive(Debug)]
 pub(crate) struct BridgeContext<'a> {
     pub app: &'a SharedSageApp,
+    /// Whether the currently active wallet is password-protected. Resolved
+    /// once at request time (from `sage.wallet_config`, not an Argon2 probe)
+    /// because `approval_request` is synchronous and cannot reach the async
+    /// app state itself.
+    pub password_protected: bool,
 }
 
-#[derive(Debug)]
 pub(crate) struct BridgeTools<'a> {
     pub app_handle: &'a tauri::AppHandle,
     pub app_state: &'a tauri::State<'a, AppState>,
     pub host_state: &'a tauri::State<'a, AppsHostState>,
+    /// Password resolved by the main-window gate, for methods that sign.
+    /// `None` when the wallet is unprotected or the method does not sign.
+    pub password: Option<String>,
+}
+
+/// Hand-written so the master-key password can never be printed. The whole
+/// point of the gate is keeping that secret out of reach, and a derived
+/// `Debug` would leak it into the logs the moment somebody adds a trace line.
+/// The `Some`/`None` distinction is kept because it is useful for debugging;
+/// the value never is.
+impl std::fmt::Debug for BridgeTools<'_> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("BridgeTools")
+            .field("app_handle", &self.app_handle)
+            .field("app_state", &self.app_state)
+            .field("host_state", &self.host_state)
+            .field("password", &self.password.as_ref().map(|_| "<redacted>"))
+            .finish()
+    }
 }
 
 #[derive(Debug, Clone)]
diff --git a/crates/sage-apps/src/bridge/methods/system/bridge_approvals/list.rs b/crates/sage-apps/src/bridge/methods/system/bridge_approvals/list.rs
index 03c7a6ab0..4e928c43d 100644
--- a/crates/sage-apps/src/bridge/methods/system/bridge_approvals/list.rs
+++ b/crates/sage-apps/src/bridge/methods/system/bridge_approvals/list.rs
@@ -19,6 +19,11 @@ pub(crate) struct PendingBridgeApprovalView {
     pub approval: RustBridgeApprovalRequest,
     pub created_at_ms: u64,
     pub expires_at_ms: u64,
+    /// Whether the card must collect the master password before approving.
+    pub requires_password: bool,
+    /// Incorrect attempts already spent, so a card that reloads mid-retry can
+    /// still show how many tries are left.
+    pub password_attempts: u8,
 }
 
 #[async_trait]
@@ -62,6 +67,8 @@ impl From<PendingBridgeApproval> for PendingBridgeApprovalView {
             approval: approval.approval,
             created_at_ms: approval.created_at_ms,
             expires_at_ms: approval.expires_at_ms,
+            requires_password: approval.requires_password,
+            password_attempts: approval.password_attempts,
         }
     }
 }
diff --git a/crates/sage-apps/src/bridge/methods/system/bridge_approvals/resolve.rs b/crates/sage-apps/src/bridge/methods/system/bridge_approvals/resolve.rs
index b4fe8e491..51966ecc3 100644
--- a/crates/sage-apps/src/bridge/methods/system/bridge_approvals/resolve.rs
+++ b/crates/sage-apps/src/bridge/methods/system/bridge_approvals/resolve.rs
@@ -35,10 +35,11 @@ impl BridgeMethod for BridgeApprovalsResolve {
     ) -> BridgeHandleResult {
         let params: ResolveBridgeApprovalArgs = parse_required_params(self, request)?;
 
-        process_after_approval(tools.app_handle, tools.app_state, tools.host_state, params)
-            .await
-            .map_err(BridgeMethodHandleError::internal_error)?;
+        let result =
+            process_after_approval(tools.app_handle, tools.app_state, tools.host_state, params)
+                .await
+                .map_err(BridgeMethodHandleError::internal_error)?;
 
-        Ok(Box::new(()))
+        Ok(Box::new(result))
     }
 }
diff --git a/crates/sage-apps/src/bridge/methods/user/wallet/get_secret_key.rs b/crates/sage-apps/src/bridge/methods/user/wallet/get_secret_key.rs
index bf04fa1e1..2ae7220c5 100644
--- a/crates/sage-apps/src/bridge/methods/user/wallet/get_secret_key.rs
+++ b/crates/sage-apps/src/bridge/methods/user/wallet/get_secret_key.rs
@@ -42,9 +42,13 @@ impl BridgeMethod for WalletGetSecretKey {
         tools: BridgeTools<'_>,
         request: &RustBridgeRequest,
     ) -> BridgeHandleResult {
-        let params: GetSecretKey = parse_required_params(self, request)?;
+        let mut params: GetSecretKey = parse_required_params(self, request)?;
         require_scoped_fingerprint(&ctx, Some(params.fingerprint))?;
 
+        // The gate in the main window is the only source of a password here;
+        // anything the app sent in its params is discarded.
+        params.password = tools.password.clone();
+
         let sage = tools.app_state.lock().await;
 
         let response = sage.get_secret_key(params).map_err(|err| {
diff --git a/crates/sage-apps/src/bridge/methods/user/wallet/send_xch.rs b/crates/sage-apps/src/bridge/methods/user/wallet/send_xch.rs
index e995de2fe..5cda0eb38 100644
--- a/crates/sage-apps/src/bridge/methods/user/wallet/send_xch.rs
+++ b/crates/sage-apps/src/bridge/methods/user/wallet/send_xch.rs
@@ -12,6 +12,11 @@ use crate::{
 #[derive(Debug, Clone, Copy)]
 pub struct WalletSendXch;
 
+/// Whether this request needs a user approval step.
+fn requires_approval(auto_submit_granted: bool, wallet_protected: bool) -> bool {
+    !auto_submit_granted || wallet_protected
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, Type)]
 #[serde(rename_all = "camelCase")]
 pub struct WalletSendXchParams {
@@ -60,10 +65,11 @@ impl BridgeMethod for WalletSendXch {
         ctx: BridgeContext<'_>,
         request: &RustBridgeRequest,
     ) -> BridgeApprovalRequestResult {
-        if ctx
+        let auto_submit_granted = ctx
             .app
-            .is_capability_granted(UserBridgeCapability::WalletSendXchAutoSubmit.into())
-        {
+            .is_capability_granted(UserBridgeCapability::WalletSendXchAutoSubmit.into());
+
+        if !requires_approval(auto_submit_granted, ctx.password_protected) {
             return Ok(None);
         }
 
@@ -81,7 +87,8 @@ impl BridgeMethod for WalletSendXch {
         request: &RustBridgeRequest,
     ) -> BridgeHandleResult {
         let params: WalletSendXchParams = parse_required_params(self, request)?;
-        let req: SendXch = params.into();
+        let mut req: SendXch = params.into();
+        req.password = tools.password.clone();
 
         let result = tools
             .app_state
@@ -96,3 +103,28 @@ impl BridgeMethod for WalletSendXch {
         Ok(Box::new(result))
     }
 }
+
+#[cfg(test)]
+mod tests {
+    /// A password-protected wallet must always produce an approval, even when
+    /// the app holds `WalletSendXchAutoSubmit`. Silent auto-submit is
+    /// incompatible with password protection: there would be no UI moment in
+    /// which to collect the password.
+    #[test]
+    fn protected_wallet_forces_approval_despite_auto_submit_grant() {
+        assert!(super::requires_approval(
+            /* auto_submit_granted */ true, /* wallet_protected */ true,
+        ));
+    }
+
+    #[test]
+    fn unprotected_wallet_still_honours_auto_submit_grant() {
+        assert!(!super::requires_approval(true, false));
+    }
+
+    #[test]
+    fn without_the_grant_approval_is_always_required() {
+        assert!(super::requires_approval(false, false));
+        assert!(super::requires_approval(false, true));
+    }
+}
diff --git a/crates/sage-apps/src/bridge/methods/user/wallet/sign_coin_spends.rs b/crates/sage-apps/src/bridge/methods/user/wallet/sign_coin_spends.rs
index 4f00b4ef7..893483bed 100644
--- a/crates/sage-apps/src/bridge/methods/user/wallet/sign_coin_spends.rs
+++ b/crates/sage-apps/src/bridge/methods/user/wallet/sign_coin_spends.rs
@@ -279,11 +279,14 @@ impl BridgeMethod for WalletSignCoinSpends {
         let params: WalletSignCoinSpendsParams = parse_required_params(self, request)?;
         validate_params(&params)?;
 
+        let mut req = params.into_request();
+        req.password = tools.password.clone();
+
         let response = tools
             .app_state
             .lock()
             .await
-            .sign_coin_spends(params.into_request())
+            .sign_coin_spends(req)
             .await
             .map_err(|err| {
                 BridgeMethodHandleError::internal_error(format!("{} failed: {err}", self.name()))
diff --git a/crates/sage-apps/src/bridge/methods/user/wallet/sign_message.rs b/crates/sage-apps/src/bridge/methods/user/wallet/sign_message.rs
index 9f0dac2f1..9d2287c41 100644
--- a/crates/sage-apps/src/bridge/methods/user/wallet/sign_message.rs
+++ b/crates/sage-apps/src/bridge/methods/user/wallet/sign_message.rs
@@ -72,11 +72,14 @@ impl BridgeMethod for WalletSignMessage {
         request: &RustBridgeRequest,
     ) -> BridgeHandleResult {
         let params: WalletSignMessageParams = parse_required_params(self, request)?;
+        let mut req: SignMessageWithPublicKey = params.into();
+        req.password = tools.password.clone();
+
         let response = tools
             .app_state
             .lock()
             .await
-            .sign_message_with_public_key(params.into())
+            .sign_message_with_public_key(req)
             .await
             .map_err(|err| {
                 BridgeMethodHandleError::internal_error(format!("{} failed: {err}", self.name()))
diff --git a/crates/sage-apps/src/bridge/state.rs b/crates/sage-apps/src/bridge/state.rs
index 185ece23c..de888ca20 100644
--- a/crates/sage-apps/src/bridge/state.rs
+++ b/crates/sage-apps/src/bridge/state.rs
@@ -14,6 +14,11 @@ use crate::{
 
 const BRIDGE_APPROVAL_TIMEOUT_MS: u64 = 30_000;
 
+/// Approvals that also need a password get a longer window: 30 seconds is not
+/// enough to read the summary, type a master password, and recover from a typo
+/// or two.
+const BRIDGE_APPROVAL_PASSWORD_TIMEOUT_MS: u64 = 180_000;
+
 #[derive(Debug, Default)]
 pub struct BridgeState {
     pending_approvals: Mutex<BTreeMap<String, PendingBridgeApproval>>,
@@ -27,9 +32,17 @@ pub(crate) async fn write_pending_approval(
     approval: &RustBridgeApprovalRequest,
     request: &RustBridgeRequest,
     approved_fingerprint: Option<u32>,
+    requires_password: bool,
 ) -> String {
     let approval_id = Uuid::new_v4().to_string();
     let now = unix_timestamp_ms() as u64;
+
+    let timeout_ms = if requires_password {
+        BRIDGE_APPROVAL_PASSWORD_TIMEOUT_MS
+    } else {
+        BRIDGE_APPROVAL_TIMEOUT_MS
+    };
+
     let mut pending = apps_state.bridge.pending_approvals.lock().await;
     pending.insert(
         approval_id.clone(),
@@ -40,8 +53,10 @@ pub(crate) async fn write_pending_approval(
             approval: approval.clone(),
             request: request.clone(),
             created_at_ms: now,
-            expires_at_ms: now + BRIDGE_APPROVAL_TIMEOUT_MS,
+            expires_at_ms: now + timeout_ms,
             approved_fingerprint,
+            requires_password,
+            password_attempts: 0,
         },
     );
 
@@ -64,6 +79,55 @@ pub(crate) async fn remove_pending_approval(
     pending.remove(approval_id);
 }
 
+/// Reads a pending approval without consuming it. The password path has to
+/// inspect an approval before it is committed to resolving it, so that a wrong
+/// password can leave the approval queued for another try.
+pub(crate) async fn peek_pending_approval(
+    apps_state: &State<'_, AppsHostState>,
+    approval_id: &str,
+) -> Option<PendingBridgeApproval> {
+    let pending = apps_state.bridge.pending_approvals.lock().await;
+    pending.get(approval_id).cloned()
+}
+
+/// Moves an approval onto the password clock: sets `requires_password` and
+/// extends `expires_at_ms` to the full password window (never shortens it).
+pub(crate) async fn extend_approval_for_password(
+    apps_state: &State<'_, AppsHostState>,
+    approval_id: &str,
+) -> bool {
+    let mut pending = apps_state.bridge.pending_approvals.lock().await;
+    let Some(approval) = pending.get_mut(approval_id) else {
+        return false;
+    };
+
+    let expires_at_ms = unix_timestamp_ms() as u64 + BRIDGE_APPROVAL_PASSWORD_TIMEOUT_MS;
+
+    let mut changed = false;
+    if !approval.requires_password {
+        approval.requires_password = true;
+        changed = true;
+    }
+    if expires_at_ms > approval.expires_at_ms {
+        approval.expires_at_ms = expires_at_ms;
+        changed = true;
+    }
+
+    changed
+}
+
+/// Records one spent password attempt and returns the new total. Returns `None`
+/// if the approval is gone (expired between the prompt and the submission).
+pub(crate) async fn record_password_attempt(
+    apps_state: &State<'_, AppsHostState>,
+    approval_id: &str,
+) -> Option<u8> {
+    let mut pending = apps_state.bridge.pending_approvals.lock().await;
+    let approval = pending.get_mut(approval_id)?;
+    approval.password_attempts = approval.password_attempts.saturating_add(1);
+    Some(approval.password_attempts)
+}
+
 pub(crate) async fn take_pending_approval(
     apps_state: &State<'_, AppsHostState>,
     approval_id: &str,
diff --git a/crates/sage-apps/src/bridge/ts_exports.rs b/crates/sage-apps/src/bridge/ts_exports.rs
index aa63db083..d766ecf09 100644
--- a/crates/sage-apps/src/bridge/ts_exports.rs
+++ b/crates/sage-apps/src/bridge/ts_exports.rs
@@ -22,16 +22,17 @@ use crate::{
     ListedAppsChangedEvent, PendingBridgeApprovalView, PendingUpdateChangedEvent,
     ReadyToStopParams, RequestCapabilityGrantParams, RequestCapabilityGrantResult,
     RequestNetworkWhitelistGrantParams, RequestNetworkWhitelistGrantResult,
-    ResolveBridgeApprovalArgs, RuntimeAckResult, RuntimeManagerActiveTaskbarRuntimeChangedEvent,
-    RuntimeManagerRuntimesChangedEvent, RuntimeTargetParams, RustBridgeInvokeResult,
-    SageAppCapabilityDefinitionView, SageAppWalletScope, SageNetworkPermissionInfo,
-    SandboxStateChangedEvent, SandboxStateView, SetBeforeStopListenerParams,
-    SystemKillRuntimeResult, SystemWalletView, WalletFilterUnlockedCoinsParams,
-    WalletFilterUnlockedCoinsResult, WalletGetAssetBalanceParams, WalletGetAssetBalanceResult,
-    WalletGetAssetCoinsParams, WalletGetAssetCoinsResult, WalletGetPublicKeysParams,
-    WalletGetPublicKeysResult, WalletListWalletsResult, WalletSendTransactionParams,
-    WalletSendTransactionResult, WalletSendXchParams, WalletSignCoinSpendsParams,
-    WalletSignCoinSpendsResult, WalletSignMessageParams, WalletSignMessageResult,
+    ResolveBridgeApprovalArgs, ResolveBridgeApprovalResult, RuntimeAckResult,
+    RuntimeManagerActiveTaskbarRuntimeChangedEvent, RuntimeManagerRuntimesChangedEvent,
+    RuntimeTargetParams, RustBridgeInvokeResult, SageAppCapabilityDefinitionView,
+    SageAppWalletScope, SageNetworkPermissionInfo, SandboxStateChangedEvent, SandboxStateView,
+    SetBeforeStopListenerParams, SystemKillRuntimeResult, SystemWalletView,
+    WalletFilterUnlockedCoinsParams, WalletFilterUnlockedCoinsResult, WalletGetAssetBalanceParams,
+    WalletGetAssetBalanceResult, WalletGetAssetCoinsParams, WalletGetAssetCoinsResult,
+    WalletGetPublicKeysParams, WalletGetPublicKeysResult, WalletListWalletsResult,
+    WalletSendTransactionParams, WalletSendTransactionResult, WalletSendXchParams,
+    WalletSignCoinSpendsParams, WalletSignCoinSpendsResult, WalletSignMessageParams,
+    WalletSignMessageResult,
 };
 
 pub fn export_user_bridge_typescript() -> Result<String, String> {
@@ -136,6 +137,7 @@ pub fn export_system_bridge_typescript() -> Result<String, String> {
     types.register::<FileSystemSelectFileResult>();
 
     types.register::<ResolveBridgeApprovalArgs>();
+    types.register::<ResolveBridgeApprovalResult>();
     types.register::<PendingBridgeApprovalView>();
     types.register::<BridgeApprovalsChangedEvent>();
 
diff --git a/crates/sage-apps/src/bridge/types.rs b/crates/sage-apps/src/bridge/types.rs
index 374220ff6..c69002cc0 100644
--- a/crates/sage-apps/src/bridge/types.rs
+++ b/crates/sage-apps/src/bridge/types.rs
@@ -56,12 +56,52 @@ pub struct RustBridgeErrorPayload {
     pub message: String,
 }
 
-#[derive(Debug, Clone, Deserialize, Type)]
+#[derive(Clone, Deserialize, Type)]
 #[serde(rename_all = "camelCase")]
 pub struct ResolveBridgeApprovalArgs {
     pub approval_id: String,
     pub approved: bool,
     pub reason: Option<String>,
+    /// Master-key password, collected inline by the bridge-approval card when
+    /// the approval targets a password-protected wallet. Never stored, never
+    /// forwarded to an app.
+    #[serde(default)]
+    pub password: Option<String>,
+}
+
+/// Hand-written so the master password can never reach a log line, matching
+/// `BridgeTools`. The `Some`/`None` distinction is kept; the value never is.
+impl std::fmt::Debug for ResolveBridgeApprovalArgs {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ResolveBridgeApprovalArgs")
+            .field("approval_id", &self.approval_id)
+            .field("approved", &self.approved)
+            .field("reason", &self.reason)
+            .field("password", &self.password.as_ref().map(|_| "<redacted>"))
+            .finish()
+    }
+}
+
+/// What `bridgeApprovals.resolve` tells the approval card.
+///
+/// A wrong password is not an error: the approval stays queued so the user can
+/// retry in place, exactly as the native prompt allows. Only when the attempts
+/// run out is the approval consumed and the app's request rejected.
+#[derive(Debug, Clone, Serialize, Type)]
+#[serde(tag = "kind", rename_all = "camelCase")]
+pub enum ResolveBridgeApprovalResult {
+    /// The approval was consumed: approved and executed, denied, or failed.
+    Resolved,
+    /// The approval needs a password and none was supplied. No attempt spent.
+    PasswordRequired,
+    /// Wrong password; the approval is still queued.
+    WrongPassword {
+        #[serde(rename = "attemptsRemaining")]
+        attempts_remaining: u8,
+    },
+    /// Wrong password too many times; the approval is gone and the app's
+    /// request was rejected.
+    TooManyAttempts,
 }
 
 #[derive(Debug, Clone, Serialize, Type)]
@@ -116,6 +156,13 @@ pub(crate) struct PendingBridgeApproval {
     pub created_at_ms: u64,
     pub expires_at_ms: u64,
     pub approved_fingerprint: Option<u32>,
+    /// Whether the approval card should collect a password. A hint captured
+    /// when the approval was queued, not the authority: the gate re-checks at
+    /// resolve time, and a card that guessed wrong is told to ask.
+    pub requires_password: bool,
+    /// Incorrect password attempts spent so far. Counted on the host, so a
+    /// reload of the approval webview cannot reset it.
+    pub password_attempts: u8,
 }
 
 impl RustBridgeInvokeResult {
diff --git a/crates/sage-apps/src/runtime/manager.rs b/crates/sage-apps/src/runtime/manager.rs
index 7d77110e3..60b2952a4 100644
--- a/crates/sage-apps/src/runtime/manager.rs
+++ b/crates/sage-apps/src/runtime/manager.rs
@@ -392,7 +392,7 @@ async fn show_runtime_inner(
     Ok(())
 }
 
-fn hide_runtime_inner(
+pub(crate) fn hide_runtime_inner(
     app_handle: &AppHandle,
     runtime: &SharedRuntime,
     changes: &mut RuntimeChangeSet,
diff --git a/crates/sage-apps/src/runtime/resolve.rs b/crates/sage-apps/src/runtime/resolve.rs
index 5180b8afe..88a2a7f5c 100644
--- a/crates/sage-apps/src/runtime/resolve.rs
+++ b/crates/sage-apps/src/runtime/resolve.rs
@@ -87,11 +87,11 @@ fn is_allowed_app_origin_url(url: &Url, protocol_scheme: &str, origin_id: &str)
 #[cfg(any(target_os = "windows", test))]
 fn is_webview2_mapped_app_origin(url: &Url, protocol_scheme: &str, origin_id: &str) -> bool {
     // WebView2 cannot navigate directly to custom protocols, so Wry maps
-    // `{scheme}://{host}` to `http://{scheme}.{host}` on Windows. Navigation
+    // `{scheme}://{host}` to `https://{scheme}.{host}` on Windows. Navigation
     // callbacks and the current URL expose that mapped URL even though custom
     // protocol requests are converted back before they reach Sage.
     let webview2_host = format!("{protocol_scheme}.{origin_id}");
-    url.scheme() == "http" && url.port().is_none() && url.host_str() == Some(&webview2_host)
+    url.scheme() == "https" && url.port().is_none() && url.host_str() == Some(&webview2_host)
 }
 
 pub fn build_entry_src_for(
@@ -257,7 +257,7 @@ mod tests {
     fn allows_the_webview2_mapped_origin_only_on_windows() {
         assert_eq!(
             is_allowed_app_origin_url(
-                &url("http://sage-system-app.task-manager/index.html"),
+                &url("https://sage-system-app.task-manager/index.html"),
                 "sage-system-app",
                 "task-manager",
             ),
@@ -268,17 +268,17 @@ mod tests {
     #[test]
     fn webview2_mapping_matches_only_the_exact_origin() {
         assert!(is_webview2_mapped_app_origin(
-            &url("http://sage-system-app.task-manager/index.html"),
+            &url("https://sage-system-app.task-manager/index.html"),
             "sage-system-app",
             "task-manager"
         ));
 
         for candidate in [
-            "https://sage-system-app.task-manager/index.html",
+            "http://sage-system-app.task-manager/index.html",
             "http://sage-system-app.task-manager.invalid/index.html",
-            "http://sage-system-app.other/index.html",
-            "http://other.task-manager/index.html",
-            "http://sage-system-app.task-manager:444/index.html",
+            "https://sage-system-app.other/index.html",
+            "https://other.task-manager/index.html",
+            "https://sage-system-app.task-manager:444/index.html",
         ] {
             assert!(
                 !is_webview2_mapped_app_origin(&url(candidate), "sage-system-app", "task-manager"),
diff --git a/crates/sage-apps/src/runtime/start.rs b/crates/sage-apps/src/runtime/start.rs
index fd684648e..5439b4ad5 100644
--- a/crates/sage-apps/src/runtime/start.rs
+++ b/crates/sage-apps/src/runtime/start.rs
@@ -195,6 +195,7 @@ async fn create_runtime_for_app(
         webview_label.clone(),
         WebviewUrl::CustomProtocol(build_entry_src(&app, args.query.clone())),
     )
+    .use_https_scheme(cfg!(target_os = "windows"))
     .transparent(!cfg!(target_os = "linux") || !is_modal)
     .on_navigation(move |url| {
         runtime_for_nav.with_runtime(|runtime| is_allowed_app_url(url, &runtime.app()))
diff --git a/crates/sage-apps/src/security/csp.rs b/crates/sage-apps/src/security/csp.rs
index ae95d6de8..36bb66e35 100644
--- a/crates/sage-apps/src/security/csp.rs
+++ b/crates/sage-apps/src/security/csp.rs
@@ -8,6 +8,11 @@ fn csp_source_list(items: &[String]) -> String {
 
 pub fn build_app_csp(app: &SharedSageApp, network_id: &str) -> String {
     let mut connect_sources = BTreeSet::from(["'self'".to_string()]);
+    let mut image_sources = BTreeSet::from([
+        "'self'".to_string(),
+        "blob:".to_string(),
+        "data:".to_string(),
+    ]);
 
     app.with(|app| {
         for entry in app
@@ -15,7 +20,12 @@ pub fn build_app_csp(app: &SharedSageApp, network_id: &str) -> String {
             .network()
             .effective_whitelist_for_network(network_id)
         {
-            connect_sources.insert(entry.as_permission_string());
+            let source = entry.as_permission_string();
+            connect_sources.insert(source.clone());
+
+            if entry.scheme() == "https" {
+                image_sources.insert(source);
+            }
         }
     });
 
@@ -24,11 +34,7 @@ pub fn build_app_csp(app: &SharedSageApp, network_id: &str) -> String {
     let default_src = csp_source_list(&["'self'".to_string()]);
     let font_src = csp_source_list(&["'self'".to_string(), "data:".to_string()]);
     let frame_src = csp_source_list(&["'none'".to_string()]);
-    let img_src = csp_source_list(&[
-        "'self'".to_string(),
-        "data:".to_string(),
-        "blob:".to_string(),
-    ]);
+    let img_src = csp_source_list(&image_sources.into_iter().collect::<Vec<_>>());
     let manifest_src = csp_source_list(&["'none'".to_string()]);
     let media_src = csp_source_list(&[
         "'self'".to_string(),
@@ -105,13 +111,14 @@ mod tests {
 
     fn app_with_network_grants() -> (SharedSageApp, TempDir) {
         let shared = entry("https", "shared.example.com");
+        let shared_websocket = entry("wss", "events.example.com");
         let mainnet = entry("https", "mainnet.example.com");
         let testnet = entry("https", "testnet.example.com");
 
         let requested = SageRequestedPermissions::new(
             SageRequestedNetworkPermissions::new(
                 [],
-                [shared.clone()],
+                [shared.clone(), shared_websocket.clone()],
                 [
                     (
                         "mainnet".to_string(),
@@ -131,7 +138,7 @@ mod tests {
         let granted = SageGrantedPermissions::new(
             &requested,
             [],
-            [shared],
+            [shared, shared_websocket],
             BTreeMap::from([
                 ("mainnet".to_string(), BTreeSet::from([mainnet])),
                 ("testnet11".to_string(), BTreeSet::from([testnet])),
@@ -176,4 +183,25 @@ mod tests {
         assert!(testnet_csp.contains("https://testnet.example.com"));
         assert!(!testnet_csp.contains("https://mainnet.example.com"));
     }
+
+    #[test]
+    fn csp_img_src_allows_https_sources_for_the_active_network() {
+        let (app, _dir) = app_with_network_grants();
+
+        let mainnet_csp = build_app_csp(&app, "mainnet");
+        let img_src = mainnet_csp
+            .split(';')
+            .map(str::trim)
+            .find_map(|directive| directive.strip_prefix("img-src "))
+            .expect("CSP should contain img-src");
+        let sources = img_src.split_ascii_whitespace().collect::<BTreeSet<_>>();
+
+        assert!(sources.contains("'self'"));
+        assert!(sources.contains("blob:"));
+        assert!(sources.contains("data:"));
+        assert!(sources.contains("https://shared.example.com"));
+        assert!(sources.contains("https://mainnet.example.com"));
+        assert!(!sources.contains("https://testnet.example.com"));
+        assert!(!sources.contains("wss://events.example.com"));
+    }
 }
diff --git a/crates/sage-password-gate/Cargo.toml b/crates/sage-password-gate/Cargo.toml
new file mode 100644
index 000000000..66e1fcc43
--- /dev/null
+++ b/crates/sage-password-gate/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "sage-password-gate"
+version = "0.1.0"
+edition = "2024"
+
+[lints]
+workspace = true
+
+[dependencies]
+sage = { workspace = true }
+sage-api = { workspace = true, features = ["tauri"] }
+sage-keychain = { workspace = true }
+async-trait = "0.1.89"
+serde = { workspace = true, features = ["derive"] }
+specta = { workspace = true }
+tauri = { workspace = true }
+tauri-specta = { workspace = true }
+tokio = { workspace = true, features = ["sync", "time"] }
+uuid = { version = "1.19.0", features = ["v4"] }
+
+[dev-dependencies]
+bip39 = { workspace = true }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread", "sync", "time", "test-util"] }
diff --git a/crates/sage-password-gate/src/lib.rs b/crates/sage-password-gate/src/lib.rs
new file mode 100644
index 000000000..6e81c2022
--- /dev/null
+++ b/crates/sage-password-gate/src/lib.rs
@@ -0,0 +1,309 @@
+mod prompter;
+mod resolve;
+mod types;
+
+use sage_api::ErrorKind;
+
+pub use prompter::{PasswordVerifier, Prompter, SAGE_WEBVIEW_LABEL};
+pub use resolve::{
+    CANCELLED_REASON, MAX_ATTEMPTS, PROMPT_TIMEOUT, TOO_MANY_ATTEMPTS_REASON, resolve_with,
+};
+pub use types::{PasswordAttemptError, PasswordOutcome, PasswordRequest};
+
+/// This crate's error. Structurally identical to `sage-tauri`'s `Error`, so the
+/// host converts with a trivial `From` impl.
+#[derive(Debug, Clone)]
+pub struct Error {
+    pub kind: ErrorKind,
+    pub reason: String,
+}
+
+impl std::fmt::Display for Error {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.reason)
+    }
+}
+
+impl std::error::Error for Error {}
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+use std::collections::HashMap;
+
+use tokio::sync::{Mutex, oneshot};
+
+/// Tracks in-flight password requests awaiting a frontend reply.
+#[derive(Default, Debug)]
+pub struct PasswordGateState {
+    pending: Mutex<HashMap<String, oneshot::Sender<PasswordOutcome>>>,
+}
+
+impl PasswordGateState {
+    pub(crate) async fn register(&self, request_id: String, tx: oneshot::Sender<PasswordOutcome>) {
+        self.pending.lock().await.insert(request_id, tx);
+    }
+
+    pub(crate) async fn cancel(&self, request_id: &str) {
+        self.pending.lock().await.remove(request_id);
+    }
+
+    /// Hands an outcome to the waiting resolve loop. Consumes the entry, so a
+    /// given request id can only be answered once.
+    pub async fn deliver(&self, request_id: &str, outcome: PasswordOutcome) -> Result<()> {
+        let sender = self
+            .pending
+            .lock()
+            .await
+            .remove(request_id)
+            .ok_or_else(|| Error {
+                kind: ErrorKind::NotFound,
+                reason: format!("no pending password request with id {request_id}"),
+            })?;
+
+        sender.send(outcome).map_err(|_| Error {
+            kind: ErrorKind::Internal,
+            reason: "password request was abandoned".to_string(),
+        })
+    }
+
+    /// Waits for `request_id`'s outcome on `rx`, bounded by `PROMPT_TIMEOUT`.
+    /// `request_id` must already be registered (see [`Self::register`]) —
+    /// this only owns the waiting and timeout cleanup, so callers can emit
+    /// the request to the frontend between registering and calling this,
+    /// without risking a race where a reply arrives before registration.
+    ///
+    /// On timeout, removes the pending entry (so the map never leaks a
+    /// request no one will ever answer, e.g. because the `main` webview is
+    /// absent or unresponsive) and returns an `Unauthorized` error so the
+    /// caller does not proceed.
+    pub(crate) async fn await_outcome(
+        &self,
+        request_id: &str,
+        rx: oneshot::Receiver<PasswordOutcome>,
+    ) -> Result<PasswordOutcome> {
+        match tokio::time::timeout(PROMPT_TIMEOUT, rx).await {
+            Ok(Ok(outcome)) => Ok(outcome),
+            Ok(Err(_)) => Err(Error {
+                kind: ErrorKind::Internal,
+                reason: "password request channel closed".to_string(),
+            }),
+            Err(_) => {
+                self.cancel(request_id).await;
+                Err(Error {
+                    kind: ErrorKind::PasswordPromptTimedOut,
+                    reason: "Password prompt timed out".to_string(),
+                })
+            }
+        }
+    }
+}
+
+use std::sync::Arc;
+
+use sage::Sage;
+use tauri::AppHandle;
+
+/// The host's shared Sage handle. Mirrors `sage_tauri::app_state::AppState`.
+pub type SharedSage = Arc<Mutex<Sage>>;
+
+/// Resolves a password for the **active** wallet, prompting the `main` webview.
+///
+/// Use this for endpoints whose request type carries no fingerprint, so the
+/// operation implicitly targets whatever wallet is logged in. Endpoints that
+/// name a fingerprint must use [`resolve_for_fingerprint`] instead, otherwise
+/// the gate verifies the wrong wallet's password (and fails outright when no
+/// wallet is active at all).
+pub async fn resolve(
+    app_handle: &AppHandle,
+    state: &SharedSage,
+    gate: &PasswordGateState,
+) -> Result<Option<String>> {
+    resolve_target(app_handle, state, gate, None).await
+}
+
+/// Resolves a password for an explicitly named wallet.
+///
+/// Unlike [`resolve`] this never touches `Sage::wallet()`, so it works while
+/// logged out (the logged-out wallet list is exactly where `delete_key` and
+/// `get_secret_key` are driven from) and it verifies against the wallet the
+/// caller is actually acting on rather than the active one.
+pub async fn resolve_for_fingerprint(
+    app_handle: &AppHandle,
+    state: &SharedSage,
+    gate: &PasswordGateState,
+    fingerprint: u32,
+) -> Result<Option<String>> {
+    resolve_target(app_handle, state, gate, Some(fingerprint)).await
+}
+
+/// Shared body of [`resolve`] and [`resolve_for_fingerprint`].
+///
+/// Reads the target wallet fingerprint and its stored `password_protected`
+/// flag, then releases the app lock *before* the frontend round-trip. Uses the
+/// cheap config flag rather than `Keychain::is_password_protected`, which runs
+/// an Argon2 decrypt probe on every call.
+///
+/// `target` of `None` means "the active wallet"; only that path needs a wallet
+/// to be logged in, because the `password_protected` lookup searches
+/// `wallet_config.wallets` by fingerprint and is happy without an active one.
+async fn resolve_target(
+    app_handle: &AppHandle,
+    state: &SharedSage,
+    gate: &PasswordGateState,
+    target: Option<u32>,
+) -> Result<Option<String>> {
+    let (fingerprint, requires_password) = {
+        let sage = state.lock().await;
+        let fingerprint = match target {
+            Some(fingerprint) => fingerprint,
+            None => {
+                sage.wallet()
+                    .map_err(|err| Error {
+                        kind: err.kind(),
+                        reason: err.to_string(),
+                    })?
+                    .fingerprint
+            }
+        };
+        let requires_password = sage.is_password_protected_flag(fingerprint);
+        (fingerprint, requires_password)
+    };
+
+    let prompter = prompter::TauriPrompter { app_handle, gate };
+    let verifier = SageVerifier { state };
+    resolve_with(&prompter, &verifier, fingerprint, requires_password).await
+}
+
+/// Verifies a candidate password by taking the Sage lock briefly, then
+/// releasing it before the next prompt. Never holds the lock across an await.
+struct SageVerifier<'a> {
+    state: &'a SharedSage,
+}
+
+#[async_trait::async_trait]
+impl PasswordVerifier for SageVerifier<'_> {
+    async fn verify(&self, fingerprint: u32, password: &str) -> Result<bool> {
+        let sage = self.state.lock().await;
+        sage.verify_password(fingerprint, password)
+            .map_err(|err| Error {
+                kind: err.kind(),
+                reason: err.to_string(),
+            })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn resolving_a_pending_request_delivers_the_outcome() {
+        let gate = PasswordGateState::default();
+        let (tx, rx) = tokio::sync::oneshot::channel();
+        gate.register("req-1".to_string(), tx).await;
+
+        gate.deliver("req-1", PasswordOutcome::NoAuthNeeded)
+            .await
+            .expect("delivery should succeed");
+
+        assert!(matches!(rx.await.unwrap(), PasswordOutcome::NoAuthNeeded));
+    }
+
+    #[tokio::test]
+    async fn delivering_an_unknown_request_id_is_an_error() {
+        let gate = PasswordGateState::default();
+
+        let error = gate
+            .deliver("nope", PasswordOutcome::Cancelled)
+            .await
+            .expect_err("unknown id must error");
+
+        assert!(error.reason.contains("nope"));
+    }
+
+    #[tokio::test]
+    async fn a_request_id_can_only_be_delivered_once() {
+        let gate = PasswordGateState::default();
+        let (tx, _rx) = tokio::sync::oneshot::channel();
+        gate.register("req-2".to_string(), tx).await;
+
+        gate.deliver("req-2", PasswordOutcome::Cancelled)
+            .await
+            .unwrap();
+
+        assert!(
+            gate.deliver("req-2", PasswordOutcome::Cancelled)
+                .await
+                .is_err()
+        );
+    }
+
+    /// The resolve loop reuses one request id across all attempts, so the same
+    /// id is registered again after the previous attempt's entry was consumed.
+    /// There must be no stale-entry collision: the new oneshot has to be the
+    /// one that receives the outcome.
+    #[tokio::test]
+    async fn a_request_id_can_be_registered_again_after_delivery() {
+        let gate = PasswordGateState::default();
+
+        let (first_tx, first_rx) = tokio::sync::oneshot::channel();
+        gate.register("req-retry".to_string(), first_tx).await;
+        gate.deliver(
+            "req-retry",
+            PasswordOutcome::Password {
+                password: "wrong".to_string(),
+            },
+        )
+        .await
+        .unwrap();
+        assert!(matches!(
+            first_rx.await.unwrap(),
+            PasswordOutcome::Password { .. }
+        ));
+
+        let (second_tx, second_rx) = tokio::sync::oneshot::channel();
+        gate.register("req-retry".to_string(), second_tx).await;
+        gate.deliver(
+            "req-retry",
+            PasswordOutcome::Password {
+                password: "right".to_string(),
+            },
+        )
+        .await
+        .expect("the retry must be deliverable under the same id");
+
+        match second_rx.await.unwrap() {
+            PasswordOutcome::Password { password } => assert_eq!(password, "right"),
+            other => panic!("unexpected outcome: {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn a_request_that_is_never_answered_times_out_and_is_cleared() {
+        tokio::time::pause();
+
+        let gate = Arc::new(PasswordGateState::default());
+        let (tx, rx) = tokio::sync::oneshot::channel();
+        gate.register("req-timeout".to_string(), tx).await;
+
+        // Keep the sender alive for the whole wait so the failure is a
+        // genuine timeout, not the channel being dropped.
+        let waiting_gate = gate.clone();
+        let waiter =
+            tokio::spawn(async move { waiting_gate.await_outcome("req-timeout", rx).await });
+
+        tokio::time::advance(PROMPT_TIMEOUT + std::time::Duration::from_secs(1)).await;
+
+        let error = waiter.await.unwrap().expect_err("must time out");
+        assert!(matches!(error.kind, ErrorKind::PasswordPromptTimedOut));
+        assert_eq!(error.reason, "Password prompt timed out");
+
+        // The pending entry must not leak: a late delivery now errors as
+        // unknown, rather than silently succeeding into a dropped receiver.
+        let deliver_error = gate
+            .deliver("req-timeout", PasswordOutcome::Cancelled)
+            .await
+            .expect_err("entry should have been cleared on timeout");
+        assert!(matches!(deliver_error.kind, ErrorKind::NotFound));
+    }
+}
diff --git a/crates/sage-password-gate/src/prompter.rs b/crates/sage-password-gate/src/prompter.rs
new file mode 100644
index 000000000..0444d31a5
--- /dev/null
+++ b/crates/sage-password-gate/src/prompter.rs
@@ -0,0 +1,69 @@
+use async_trait::async_trait;
+
+use super::types::{PasswordOutcome, PasswordRequest};
+use crate::Result;
+
+/// Abstracts the round-trip to the frontend so the resolve loop can be
+/// unit-tested without a running Tauri app.
+#[async_trait]
+pub trait Prompter: Send + Sync {
+    async fn prompt(&self, request: PasswordRequest) -> Result<PasswordOutcome>;
+}
+
+/// Checks a candidate password against the keychain.
+///
+/// This is a trait rather than a borrowed `&Keychain` on purpose. `Keychain`
+/// is not `Clone` and owns a `ChaCha20Rng`; cloning it to escape the app lock
+/// would duplicate an RNG stream, which is a nonce-reuse hazard the moment a
+/// clone ever encrypts. Instead the production implementation takes the Sage
+/// lock briefly for each attempt and drops it before the next prompt, so no
+/// lock is ever held across an await.
+#[async_trait]
+pub trait PasswordVerifier: Send + Sync {
+    /// `Ok(true)` = correct, `Ok(false)` = wrong password,
+    /// `Err` = a genuine failure (not a wrong password).
+    async fn verify(&self, fingerprint: u32, password: &str) -> Result<bool>;
+}
+
+use tauri::AppHandle;
+use tauri_specta::Event;
+
+use super::Error;
+use crate::PasswordGateState;
+use sage_api::ErrorKind;
+
+/// The Sage React webview, and the label every password request is emitted to.
+///
+/// Targeting this label is where the request is *meant* to land, not a
+/// guarantee of where it can land. Tauri resolves an `AnyLabel` target through
+/// `match_any_or_filter`, which short-circuits to true for any listener
+/// registered with `EventTarget::Any`, and `src-tauri/capabilities/apps.json`
+/// grants app webviews `core:event:allow-listen`. An app runtime that listens
+/// for `password-request` will therefore see it. `PasswordRequest` is kept free
+/// of anything sensitive for exactly that reason; the password travels back on
+/// `submit_password_response`, a command app webviews are not granted.
+pub const SAGE_WEBVIEW_LABEL: &str = "main";
+
+pub struct TauriPrompter<'a> {
+    pub app_handle: &'a AppHandle,
+    pub gate: &'a PasswordGateState,
+}
+
+#[async_trait]
+impl Prompter for TauriPrompter<'_> {
+    async fn prompt(&self, request: PasswordRequest) -> Result<PasswordOutcome> {
+        let request_id = request.request_id.clone();
+        let (tx, rx) = tokio::sync::oneshot::channel();
+        self.gate.register(request_id.clone(), tx).await;
+
+        if let Err(err) = request.emit_to(self.app_handle, SAGE_WEBVIEW_LABEL) {
+            self.gate.cancel(&request_id).await;
+            return Err(Error {
+                kind: ErrorKind::Internal,
+                reason: format!("failed to emit password request: {err}"),
+            });
+        }
+
+        self.gate.await_outcome(&request_id, rx).await
+    }
+}
diff --git a/crates/sage-password-gate/src/resolve.rs b/crates/sage-password-gate/src/resolve.rs
new file mode 100644
index 000000000..f51d165bc
--- /dev/null
+++ b/crates/sage-password-gate/src/resolve.rs
@@ -0,0 +1,264 @@
+use std::time::Duration;
+
+use sage_api::ErrorKind;
+
+use super::types::{PasswordAttemptError, PasswordOutcome, PasswordRequest};
+use crate::{Error, PasswordVerifier, Prompter, Result};
+
+/// Maximum password entry attempts before the operation is refused.
+pub const MAX_ATTEMPTS: u8 = 3;
+
+/// Reason string used when the user dismisses the prompt, so the frontend can
+/// distinguish a deliberate cancel from a genuine auth failure and stay silent.
+pub const CANCELLED_REASON: &str = "Password entry cancelled";
+
+/// Reason string used when the user exhausts `MAX_ATTEMPTS`. Shared with the
+/// app-bridge gate so both paths report the failure identically.
+pub const TOO_MANY_ATTEMPTS_REASON: &str = "Too many incorrect password attempts";
+
+/// How long the resolve loop waits for a frontend reply before giving up.
+/// Generous enough that a human typing a password is never cut off, while
+/// still bounding the hang if the `main` webview is absent or unresponsive.
+pub const PROMPT_TIMEOUT: Duration = Duration::from_mins(5);
+
+fn gate_error(kind: ErrorKind, reason: &str) -> Error {
+    Error {
+        kind,
+        reason: reason.to_string(),
+    }
+}
+
+/// Prompts the frontend for a password and verifies it against the keychain,
+/// retrying up to `MAX_ATTEMPTS` times on an incorrect password.
+///
+/// Returns `Ok(None)` when no authentication was required. The caller places
+/// the returned value directly into the request's `password` field.
+///
+/// This runs *before* `app_state.lock()` is taken. Verifying here keeps a wrong
+/// password cheap (one keychain decrypt, no partially built transaction) and
+/// avoids awaiting the frontend while holding the app lock.
+pub async fn resolve_with(
+    prompter: &dyn Prompter,
+    verifier: &dyn PasswordVerifier,
+    fingerprint: u32,
+    requires_password: bool,
+) -> Result<Option<String>> {
+    let mut error: Option<PasswordAttemptError> = None;
+
+    // One id for the whole resolve, not one per attempt: the frontend queues
+    // requests by id and replaces a queued entry on a re-prompt, so a fresh id
+    // per attempt would append the retry behind any concurrent request instead
+    // of resuming the dialog in place. Each attempt registers its own oneshot
+    // under this id, and the previous attempt's entry is always gone by then --
+    // consumed by `deliver`, or removed by the timeout path.
+    let request_id = uuid::Uuid::new_v4().to_string();
+
+    for attempt in 1..=MAX_ATTEMPTS {
+        let request = PasswordRequest {
+            request_id: request_id.clone(),
+            requires_password,
+            attempt,
+            error: error.take(),
+        };
+
+        match prompter.prompt(request).await? {
+            PasswordOutcome::NoAuthNeeded => return Ok(None),
+            PasswordOutcome::Cancelled => {
+                return Err(gate_error(ErrorKind::PasswordCancelled, CANCELLED_REASON));
+            }
+            PasswordOutcome::Password { password } => {
+                if verifier.verify(fingerprint, &password).await? {
+                    return Ok(Some(password));
+                }
+                error = Some(PasswordAttemptError {
+                    attempts_remaining: MAX_ATTEMPTS - attempt,
+                });
+            }
+        }
+    }
+
+    Err(gate_error(
+        ErrorKind::TooManyPasswordAttempts,
+        TOO_MANY_ATTEMPTS_REASON,
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Mutex;
+
+    use async_trait::async_trait;
+    use sage_api::ErrorKind;
+    use sage_keychain::{Keychain, KeychainError};
+
+    use super::*;
+    use crate::types::{PasswordOutcome, PasswordRequest};
+    use crate::{Error, PasswordVerifier, Prompter, Result};
+
+    /// Replays a scripted sequence of outcomes and records what it was asked.
+    struct MockPrompter {
+        scripted: Mutex<Vec<PasswordOutcome>>,
+        seen: Mutex<Vec<PasswordRequest>>,
+    }
+
+    impl MockPrompter {
+        fn new(scripted: Vec<PasswordOutcome>) -> Self {
+            Self {
+                scripted: Mutex::new(scripted.into_iter().rev().collect()),
+                seen: Mutex::new(Vec::new()),
+            }
+        }
+
+        fn seen(&self) -> Vec<PasswordRequest> {
+            self.seen.lock().unwrap().clone()
+        }
+    }
+
+    #[async_trait]
+    impl Prompter for MockPrompter {
+        async fn prompt(&self, request: PasswordRequest) -> Result<PasswordOutcome> {
+            self.seen.lock().unwrap().push(request);
+            Ok(self
+                .scripted
+                .lock()
+                .unwrap()
+                .pop()
+                .expect("prompted more times than scripted"))
+        }
+    }
+
+    /// A verifier backed by a real keychain holding one mnemonic key
+    /// encrypted with `password`.
+    struct KeychainVerifier {
+        keychain: Keychain,
+    }
+
+    #[async_trait]
+    impl PasswordVerifier for KeychainVerifier {
+        async fn verify(&self, fingerprint: u32, password: &str) -> Result<bool> {
+            // Mirrors `Sage::verify_password`: only an actual decrypted
+            // secret counts as a match, and a missing secret fails closed.
+            match self
+                .keychain
+                .extract_secrets(fingerprint, password.as_bytes())
+            {
+                Ok((_, Some(_))) => Ok(true),
+                Ok((_, None)) => Err(Error {
+                    kind: ErrorKind::Internal,
+                    reason: KeychainError::NoSecretKey.to_string(),
+                }),
+                Err(KeychainError::Decrypt) => Ok(false),
+                Err(err) => Err(Error {
+                    kind: ErrorKind::Internal,
+                    reason: err.to_string(),
+                }),
+            }
+        }
+    }
+
+    fn protected_keychain(password: &str) -> (KeychainVerifier, u32) {
+        let mut keychain = Keychain::default();
+        let mnemonic = bip39::Mnemonic::from_entropy(&[7u8; 32]).unwrap();
+        let fingerprint = keychain
+            .add_mnemonic(&mnemonic, password.as_bytes())
+            .expect("failed to add mnemonic");
+        (KeychainVerifier { keychain }, fingerprint)
+    }
+
+    fn pw(s: &str) -> PasswordOutcome {
+        PasswordOutcome::Password {
+            password: s.to_string(),
+        }
+    }
+
+    #[tokio::test]
+    async fn correct_password_resolves_on_first_attempt() {
+        let (verifier, fingerprint) = protected_keychain("hunter2");
+        let prompter = MockPrompter::new(vec![pw("hunter2")]);
+
+        let result = resolve_with(&prompter, &verifier, fingerprint, true)
+            .await
+            .unwrap();
+
+        assert_eq!(result, Some("hunter2".to_string()));
+        let seen = prompter.seen();
+        assert_eq!(seen.len(), 1);
+        assert_eq!(seen[0].attempt, 1);
+        assert!(seen[0].requires_password);
+        assert!(seen[0].error.is_none());
+    }
+
+    #[tokio::test]
+    async fn wrong_then_right_reprompts_with_attempts_remaining() {
+        let (verifier, fingerprint) = protected_keychain("hunter2");
+        let prompter = MockPrompter::new(vec![pw("wrong"), pw("hunter2")]);
+
+        let result = resolve_with(&prompter, &verifier, fingerprint, true)
+            .await
+            .unwrap();
+
+        assert_eq!(result, Some("hunter2".to_string()));
+        let seen = prompter.seen();
+        assert_eq!(seen.len(), 2);
+        assert_eq!(seen[1].attempt, 2);
+        assert_eq!(seen[1].error.as_ref().unwrap().attempts_remaining, 2);
+    }
+
+    #[tokio::test]
+    async fn every_attempt_of_one_resolve_shares_a_request_id() {
+        let (verifier, fingerprint) = protected_keychain("hunter2");
+        let prompter = MockPrompter::new(vec![pw("wrong"), pw("also wrong"), pw("hunter2")]);
+
+        let result = resolve_with(&prompter, &verifier, fingerprint, true)
+            .await
+            .unwrap();
+
+        assert_eq!(result, Some("hunter2".to_string()));
+        let seen = prompter.seen();
+        assert_eq!(seen.len(), 3);
+        assert_eq!(seen[0].request_id, seen[1].request_id);
+        assert_eq!(seen[1].request_id, seen[2].request_id);
+        assert!(!seen[0].request_id.is_empty());
+    }
+
+    #[tokio::test]
+    async fn three_wrong_attempts_fails_unauthorized() {
+        let (verifier, fingerprint) = protected_keychain("hunter2");
+        let prompter = MockPrompter::new(vec![pw("a"), pw("b"), pw("c")]);
+
+        let error = resolve_with(&prompter, &verifier, fingerprint, true)
+            .await
+            .unwrap_err();
+
+        assert!(matches!(error.kind, ErrorKind::TooManyPasswordAttempts));
+        assert_eq!(prompter.seen().len(), MAX_ATTEMPTS as usize);
+    }
+
+    #[tokio::test]
+    async fn cancellation_fails_immediately_without_reprompting() {
+        let (verifier, fingerprint) = protected_keychain("hunter2");
+        let prompter = MockPrompter::new(vec![PasswordOutcome::Cancelled]);
+
+        let error = resolve_with(&prompter, &verifier, fingerprint, true)
+            .await
+            .unwrap_err();
+
+        assert!(matches!(error.kind, ErrorKind::PasswordCancelled));
+        assert_eq!(error.reason, CANCELLED_REASON);
+        assert_eq!(prompter.seen().len(), 1);
+    }
+
+    #[tokio::test]
+    async fn no_auth_needed_resolves_to_none() {
+        let (verifier, fingerprint) = protected_keychain("hunter2");
+        let prompter = MockPrompter::new(vec![PasswordOutcome::NoAuthNeeded]);
+
+        let result = resolve_with(&prompter, &verifier, fingerprint, false)
+            .await
+            .unwrap();
+
+        assert_eq!(result, None);
+        assert_eq!(prompter.seen().len(), 1);
+        assert!(!prompter.seen()[0].requires_password);
+    }
+}
diff --git a/crates/sage-password-gate/src/types.rs b/crates/sage-password-gate/src/types.rs
new file mode 100644
index 000000000..b76b02106
--- /dev/null
+++ b/crates/sage-password-gate/src/types.rs
@@ -0,0 +1,49 @@
+use serde::{Deserialize, Serialize};
+use specta::Type;
+
+/// How the frontend answered a password request.
+#[derive(Debug, Clone, Serialize, Deserialize, Type)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum PasswordOutcome {
+    /// The user supplied a password.
+    Password { password: String },
+    /// No authentication was required, or a biometric gate already passed.
+    NoAuthNeeded,
+    /// The user dismissed the prompt.
+    Cancelled,
+}
+
+/// Attached to a re-prompt after an incorrect password.
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, Type)]
+#[serde(rename_all = "camelCase")]
+pub struct PasswordAttemptError {
+    pub attempts_remaining: u8,
+}
+
+/// The password prompt as it crosses to JavaScript.
+///
+/// Emission targets the `main` webview (see `prompter::SAGE_WEBVIEW_LABEL`),
+/// but that is **not** an isolation guarantee: Tauri's event filter
+/// short-circuits for listeners registered with `EventTarget::Any`, and
+/// `src-tauri/capabilities/apps.json` grants app webviews
+/// `core:event:allow-listen`. Any app runtime can therefore observe this
+/// payload. It deliberately carries nothing sensitive -- no fingerprint, no
+/// wallet identity, and of course no password. The password itself only ever
+/// travels the other way, through the `submit_password_response` command,
+/// which is not granted to app webviews.
+#[derive(Debug, Clone, Serialize, Deserialize, Type, tauri_specta::Event)]
+#[serde(rename_all = "camelCase")]
+pub struct PasswordRequest {
+    pub request_id: String,
+    /// Advisory: the wallet's stored `password_protected` flag. The frontend
+    /// still decides between password dialog, biometric gate, and no auth,
+    /// because Rust does not know whether biometrics are enabled.
+    pub requires_password: bool,
+    /// 1-based. Increments on each incorrect-password re-prompt.
+    pub attempt: u8,
+    /// Retained despite being observable by app webviews: the dialog needs it
+    /// to show "N attempts remaining", and a bare retry counter identifies no
+    /// wallet and reveals nothing an observer could not already infer from the
+    /// re-prompts themselves.
+    pub error: Option<PasswordAttemptError>,
+}
diff --git a/crates/sage-rpc/src/lib.rs b/crates/sage-rpc/src/lib.rs
index 9ca05d6d9..b04d9ba6d 100644
--- a/crates/sage-rpc/src/lib.rs
+++ b/crates/sage-rpc/src/lib.rs
@@ -54,7 +54,11 @@ where
             let status = match error.kind() {
                 ErrorKind::Api => StatusCode::BAD_REQUEST,
                 ErrorKind::NotFound => StatusCode::NOT_FOUND,
-                ErrorKind::Unauthorized | ErrorKind::IncorrectPassword => StatusCode::UNAUTHORIZED,
+                ErrorKind::Unauthorized
+                | ErrorKind::IncorrectPassword
+                | ErrorKind::PasswordCancelled
+                | ErrorKind::TooManyPasswordAttempts
+                | ErrorKind::PasswordPromptTimedOut => StatusCode::UNAUTHORIZED,
                 ErrorKind::DatabaseMigration
                 | ErrorKind::Wallet
                 | ErrorKind::Internal
diff --git a/crates/sage-rpc/src/tests.rs b/crates/sage-rpc/src/tests.rs
index 4a7b9c086..59fb72450 100644
--- a/crates/sage-rpc/src/tests.rs
+++ b/crates/sage-rpc/src/tests.rs
@@ -20,8 +20,8 @@ use rand_chacha::ChaCha8Rng;
 use rustls::crypto::aws_lc_rs::default_provider;
 use sage::Sage;
 use sage_api::{
-    Amount, ChangePassword, DeleteKey, GetKey, GetPeers, GetSecretKey, GetSyncStatus, GetVersion,
-    ImportKey, Login, ReconcileKeyProtection, SendXch,
+    Amount, ChangePassword, DeleteKey, GetKey, GetKeys, GetPeers, GetSecretKey, GetSyncStatus,
+    GetVersion, ImportKey, Login, ReconcileDriftedKeyProtection, ReconcileKeyProtection, SendXch,
 };
 use sage_api_macro::impl_endpoints;
 use sage_wallet::{SyncCommand, SyncEvent};
@@ -350,7 +350,7 @@ async fn test_change_password() -> Result<()> {
     // Set password
     app.change_password(ChangePassword {
         fingerprint,
-        old_password: "".to_string(),
+        old_password: String::new(),
         new_password: "secret".to_string(),
     })
     .await?;
@@ -518,6 +518,165 @@ async fn test_password_protected_delete() -> Result<()> {
     Ok(())
 }
 
+/// The `password_protected` config flag is a cache, not the truth: a build that
+/// does not know the field strips it on the next config write, leaving a
+/// protected wallet flagged unprotected. Every gate reads that flag, so the
+/// drift fails *open* — no prompt, then a decrypt failure. Logging in must
+/// re-derive it from the keychain so the gate can never be wrong about the
+/// wallet the user is actually using.
+#[tokio::test]
+async fn test_login_reconciles_a_drifted_protection_flag() -> Result<()> {
+    let mut app = TestApp::new().await?;
+
+    let fingerprint = app.setup_bls_with_password(0, "secret").await?;
+
+    app.sage
+        .lock()
+        .await
+        .set_password_protected(fingerprint, false)?;
+
+    assert!(
+        !app.get_key(GetKey {
+            fingerprint: Some(fingerprint),
+        })
+        .await?
+        .key
+        .unwrap()
+        .has_password,
+        "precondition: the flag is drifted false"
+    );
+
+    app.login(Login { fingerprint }).await?;
+
+    assert!(
+        app.get_key(GetKey {
+            fingerprint: Some(fingerprint),
+        })
+        .await?
+        .key
+        .unwrap()
+        .has_password,
+        "login must re-derive the flag from the keychain"
+    );
+
+    Ok(())
+}
+
+/// Login only covers the active wallet. The wallet list, and the logged-out
+/// `delete_key` / `get_secret_key` gates, read the flag for wallets that were
+/// never logged into this session, so a startup sweep has to correct those too.
+#[tokio::test]
+async fn test_reconcile_all_key_protection_corrects_every_wallet() -> Result<()> {
+    let mut app = TestApp::new().await?;
+
+    let protected = app.setup_bls_with_password(0, "secret").await?;
+    let plain = app.setup_bls(0).await?;
+
+    {
+        let mut sage = app.sage.lock().await;
+        sage.set_password_protected(protected, false)?;
+        sage.set_password_protected(plain, true)?;
+    }
+
+    let corrected = app.sage.lock().await.reconcile_all_key_protection()?;
+    assert_eq!(corrected, 2);
+
+    let keys = app.get_keys(GetKeys {}).await?.keys;
+    let find = |fingerprint: u32| {
+        keys.iter()
+            .find(|key| key.fingerprint == fingerprint)
+            .unwrap_or_else(|| panic!("missing key {fingerprint}"))
+    };
+
+    assert!(find(protected).has_password);
+    assert!(!find(plain).has_password);
+
+    // A second sweep finds nothing left to correct.
+    assert_eq!(app.sage.lock().await.reconcile_all_key_protection()?, 0);
+
+    Ok(())
+}
+
+/// The on-demand recovery path runs after a decrypt failure, so it must probe
+/// only the drift direction that fails open: flagged unprotected while actually
+/// holding an encrypted secret. A wallet already flagged protected is just a
+/// mistyped password, and must not cost an Argon2 probe.
+#[tokio::test]
+async fn test_reconcile_drifted_key_protection_corrects_only_drifted_false() -> Result<()> {
+    let mut app = TestApp::new().await?;
+
+    let drifted = app.setup_bls_with_password(0, "secret").await?;
+    let honest = app.setup_bls_with_password(0, "secret").await?;
+    let plain = app.setup_bls(0).await?;
+
+    {
+        let mut sage = app.sage.lock().await;
+        sage.set_password_protected(drifted, false)?;
+        // Drifted the other way: flagged protected with no password. Only
+        // costs a spurious prompt, so this path leaves it for the sweep.
+        sage.set_password_protected(plain, true)?;
+    }
+
+    let corrected = app
+        .reconcile_drifted_key_protection(ReconcileDriftedKeyProtection {})
+        .await?
+        .corrected;
+    assert_eq!(corrected, 1);
+
+    let keys = app.get_keys(GetKeys {}).await?.keys;
+    let find = |fingerprint: u32| {
+        keys.iter()
+            .find(|key| key.fingerprint == fingerprint)
+            .unwrap_or_else(|| panic!("missing key {fingerprint}"))
+    };
+
+    assert!(
+        find(drifted).has_password,
+        "drifted-false must be corrected"
+    );
+    assert!(find(honest).has_password, "correct flag must be left alone");
+    assert!(
+        find(plain).has_password,
+        "drifted-true is out of scope for this path"
+    );
+
+    // Nothing left that could be drifted false.
+    assert_eq!(
+        app.reconcile_drifted_key_protection(ReconcileDriftedKeyProtection {})
+            .await?
+            .corrected,
+        0
+    );
+
+    Ok(())
+}
+
+/// The active wallet is the only one whose drift fails open, and a relaunch
+/// makes it active without going through `login`. The sweep has to reach it
+/// before any wallet that would merely fail closed.
+#[tokio::test]
+async fn test_sweep_probes_the_active_wallet_first() -> Result<()> {
+    let mut app = TestApp::new().await?;
+
+    let first = app.setup_bls(0).await?;
+    let second = app.setup_bls(0).await?;
+    let third = app.setup_bls(0).await?;
+
+    app.login(Login { fingerprint: third }).await?;
+
+    let order = app.sage.lock().await.sweep_fingerprints();
+
+    assert_eq!(
+        order.first(),
+        Some(&third),
+        "active wallet must be swept first"
+    );
+    assert_eq!(order.len(), 3);
+    assert!(order.contains(&first) && order.contains(&second));
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn test_reconcile_key_protection() -> Result<()> {
     let mut app = TestApp::new().await?;
diff --git a/crates/sage/src/endpoints/keys.rs b/crates/sage/src/endpoints/keys.rs
index 7fddb3d5e..12c8c1c16 100644
--- a/crates/sage/src/endpoints/keys.rs
+++ b/crates/sage/src/endpoints/keys.rs
@@ -18,9 +18,9 @@ use sage_api::{
     DeleteKeyResponse, GenerateMnemonic, GenerateMnemonicResponse, GetKey, GetKeyResponse, GetKeys,
     GetKeysResponse, GetSecretKey, GetSecretKeyResponse, GetWalletAddress,
     GetWalletAddressResponse, ImportKey, ImportKeyResponse, KeyInfo, KeyKind, Login, LoginResponse,
-    Logout, LogoutResponse, ReconcileKeyProtection, ReconcileKeyProtectionResponse, RenameKey,
-    RenameKeyResponse, Resync, ResyncResponse, SecretKeyInfo, SetWalletEmoji,
-    SetWalletEmojiResponse,
+    Logout, LogoutResponse, ReconcileDriftedKeyProtection, ReconcileDriftedKeyProtectionResponse,
+    ReconcileKeyProtection, ReconcileKeyProtectionResponse, RenameKey, RenameKeyResponse, Resync,
+    ResyncResponse, SecretKeyInfo, SetWalletEmoji, SetWalletEmojiResponse,
 };
 use sage_config::Wallet;
 use sage_database::{Database, Derivation};
@@ -30,6 +30,19 @@ use crate::{Error, Result, Sage};
 
 impl Sage {
     pub async fn login(&mut self, req: Login) -> Result<LoginResponse> {
+        // Every password gate reads the `password_protected` config flag, so a
+        // flag that drifted false silently disables the gate — no prompt, then
+        // a decrypt failure. The flag is only a cache of the keychain, and a
+        // build that predates the field strips it on its next config write, so
+        // re-derive it here. One Argon2 probe per login, never on a hot path.
+        // Tolerant of a fingerprint with no config entry: that is `switch_wallet`'s
+        // error to report, not this cache refresh's.
+        if self.has_wallet_config(req.fingerprint) {
+            self.reconcile_key_protection(ReconcileKeyProtection {
+                fingerprint: req.fingerprint,
+            })?;
+        }
+
         self.config.global.fingerprint = Some(req.fingerprint);
         self.save_config()?;
         self.switch_wallet().await?;
@@ -387,12 +400,7 @@ impl Sage {
         Ok(ChangePasswordResponse {})
     }
 
-    /// Re-derives the `password_protected` flag from the actual keychain state and
-    /// persists any correction. This is the recovery path for the rare case where
-    /// the config flag drifts from reality (e.g. a crash between writing `keys.bin`
-    /// and the config in `change_password`). It runs a single decrypt probe, so it
-    /// is only invoked on demand after an unexpected decrypt failure — never on the
-    /// login hot path.
+    /// Re-derives the `password_protected` flag from the actual keychain state
     pub fn reconcile_key_protection(
         &mut self,
         req: ReconcileKeyProtection,
@@ -402,6 +410,89 @@ impl Sage {
         Ok(ReconcileKeyProtectionResponse { has_password })
     }
 
+    /// The fingerprints a full sweep must probe, active wallet first.
+    ///
+    /// Order matters: the active wallet is the only one whose drift fails
+    /// *open*. The bridge approval gate reads the flag for `SendXch` /
+    /// `SignCoinSpends` / `SignMessage` against a wallet whose key is already
+    /// unlocked in memory, so a flag drifted false there skips the prompt and
+    /// signs anyway — no decrypt failure to recover from. Every other wallet
+    /// fails closed at the keychain, which the on-demand path then heals.
+    /// Login re-derives the flag itself, but a relaunch restores the previously
+    /// active wallet through `switch_wallet`, never `login`, so this sweep is
+    /// the only thing that covers it.
+    pub fn sweep_fingerprints(&self) -> Vec<u32> {
+        let active = self.config.global.fingerprint;
+
+        let mut fingerprints: Vec<u32> = self
+            .wallet_config
+            .wallets
+            .iter()
+            .map(|wallet| wallet.fingerprint)
+            .collect();
+
+        fingerprints.sort_by_key(|fingerprint| Some(*fingerprint) != active);
+        fingerprints
+    }
+
+    /// Re-derives `password_protected` for a single wallet, reporting whether
+    /// the stored flag was actually wrong.
+    ///
+    /// Each call costs one Argon2 probe, so callers that sweep many wallets
+    /// should drive this one fingerprint at a time rather than holding a lock
+    /// across the whole set.
+    pub fn reconcile_one_key_protection(&mut self, fingerprint: u32) -> Result<bool> {
+        let was_protected = self.is_password_protected_flag(fingerprint);
+        let response = self.reconcile_key_protection(ReconcileKeyProtection { fingerprint })?;
+        Ok(response.has_password != was_protected)
+    }
+
+    /// Re-derives `password_protected` for every configured wallet and returns
+    /// how many were corrected.
+    pub fn reconcile_all_key_protection(&mut self) -> Result<usize> {
+        let mut corrected = 0;
+
+        for fingerprint in self.sweep_fingerprints() {
+            if self.reconcile_one_key_protection(fingerprint)? {
+                corrected += 1;
+            }
+        }
+
+        Ok(corrected)
+    }
+
+    /// Re-derives `password_protected` for the wallets whose flag could be
+    /// drifted false: flagged unprotected, but holding a secret key.
+    ///
+    /// This is the on-demand recovery path, reached after a decrypt failure.
+    /// Filtering here rather than in the caller keeps the common case — a
+    /// plainly mistyped password on a correctly flagged wallet — at zero Argon2
+    /// probes. The opposite drift (flagged protected, no password) only costs a
+    /// spurious prompt, so it is left to the startup sweep.
+    pub fn reconcile_drifted_key_protection(
+        &mut self,
+        _req: ReconcileDriftedKeyProtection,
+    ) -> Result<ReconcileDriftedKeyProtectionResponse> {
+        let suspects: Vec<u32> = self
+            .wallet_config
+            .wallets
+            .iter()
+            .filter(|wallet| !wallet.password_protected)
+            .map(|wallet| wallet.fingerprint)
+            .filter(|fingerprint| self.keychain.has_secret_key(*fingerprint))
+            .collect();
+
+        let mut corrected = 0;
+
+        for fingerprint in suspects {
+            if self.reconcile_one_key_protection(fingerprint)? {
+                corrected += 1;
+            }
+        }
+
+        Ok(ReconcileDriftedKeyProtectionResponse { corrected })
+    }
+
     pub fn get_keys(&self, _req: GetKeys) -> Result<GetKeysResponse> {
         let mut keys = Vec::new();
 
diff --git a/crates/sage/src/sage.rs b/crates/sage/src/sage.rs
index 21a805779..4528ed45e 100644
--- a/crates/sage/src/sage.rs
+++ b/crates/sage/src/sage.rs
@@ -532,13 +532,43 @@ impl Sage {
         Ok(())
     }
 
-    /// Updates the wallet config's `password_protected` flag if it doesn't
-    /// match the actual state, and persists the change.
+    /// Whether `fingerprint` has an entry in the wallet config.
+    pub fn has_wallet_config(&self, fingerprint: u32) -> bool {
+        self.wallet_config
+            .wallets
+            .iter()
+            .any(|w| w.fingerprint == fingerprint)
+    }
+
+    /// The wallet config's `password_protected` flag for `fingerprint`, or
+    /// `false` when the fingerprint has no config entry.
+    pub fn is_password_protected_flag(&self, fingerprint: u32) -> bool {
+        self.wallet_config
+            .wallets
+            .iter()
+            .find(|wallet| wallet.fingerprint == fingerprint)
+            .is_some_and(|wallet| wallet.password_protected)
+    }
+
+    /// Whether `password` unlocks `fingerprint`'s secret key.
+    pub fn verify_password(&self, fingerprint: u32, password: &str) -> Result<bool> {
+        match self
+            .keychain
+            .extract_secrets(fingerprint, password.as_bytes())
+        {
+            Ok((_, Some(_))) => Ok(true),
+            Ok((_, None)) => Err(Error::Keychain(sage_keychain::KeychainError::NoSecretKey)),
+            Err(sage_keychain::KeychainError::Decrypt) => Ok(false),
+            Err(err) => Err(err.into()),
+        }
+    }
+
+    /// Updates the wallet config's `password_protected` flag
     pub fn set_password_protected(
         &mut self,
         fingerprint: u32,
         password_protected: bool,
-    ) -> Result<()> {
+    ) -> Result<bool> {
         let wallet = self
             .wallet_config
             .wallets
@@ -546,11 +576,13 @@ impl Sage {
             .find(|w| w.fingerprint == fingerprint)
             .ok_or(Error::UnknownFingerprint)?;
 
-        if wallet.password_protected != password_protected {
-            wallet.password_protected = password_protected;
-            self.save_config()?;
+        if wallet.password_protected == password_protected {
+            return Ok(false);
         }
-        Ok(())
+
+        wallet.password_protected = password_protected;
+        self.save_config()?;
+        Ok(true)
     }
 
     pub fn save_keychain(&self) -> Result<()> {
diff --git a/docs/superpowers/specs/2026-03-15-password-protection-design.md b/docs/generated/2026-03-15-password-protection-design.md
similarity index 53%
rename from docs/superpowers/specs/2026-03-15-password-protection-design.md
rename to docs/generated/2026-03-15-password-protection-design.md
index ace7d0d2c..7033f50ae 100644
--- a/docs/superpowers/specs/2026-03-15-password-protection-design.md
+++ b/docs/generated/2026-03-15-password-protection-design.md
@@ -2,17 +2,29 @@
 
 **Issue:** [xch-dev/sage#206](https://github.com/xch-dev/sage/issues/206)
 **Date:** 2026-03-15
-**Status:** Implemented
+**Status:** Implemented; the frontend half superseded by
+[2026-08-21-password-gate-design.md](2026-08-21-password-gate-design.md)
+
+> **What is still current:** the keychain and encryption model, the sentinel convention, the set of
+> protected operations, and password management in Settings.
+>
+> **What has moved:** who decides that authentication is needed, and who collects it. This document
+> describes a frontend that calls `requestPassword(hasPassword)` at ~16 call sites and threads the
+> result into each command. That is no longer how it works. Rust now decides and prompts, and no
+> caller supplies a password. The sections below marked _(superseded)_ are kept for the history of
+> why the backend looks the way it does; read the password-gate design for current behaviour.
 
 ## Overview
 
 Add opt-in password protection to Sage wallet, requiring authentication for three categories of sensitive operations: displaying secrets, signing transactions/offers, and generating hardened keys. Biometric unlock (Touch ID, Face ID) is available as a standalone gate for wallets without passwords. Biometric and password are mutually exclusive — password takes precedence.
 
+The prompt itself is now driven from Rust rather than from the call site; the decision tree below survives intact, but it runs inside `PasswordContext` as a _responder_ to a `PasswordRequest` event.
+
 ## Design Decisions
 
 - **Per-operation authentication** — every protected operation prompts for the password. No session caching.
 - **Opt-in** — existing wallets continue working without a password. Users can enable protection via "Set Password."
-- **Per-key passwords** — each key in the keychain has its own password (or no password). This follows from the existing data model where each `KeyData::Secret` has its own `Encrypted` struct with its own salt. The frontend should use the active wallet's fingerprint to determine which key's password to prompt for.
+- **Per-key passwords** — each key in the keychain has its own password (or no password). This follows from the existing data model where each `KeyData::Secret` has its own `Encrypted` struct with its own salt. Which key's password is being asked for is resolved in Rust: the gate uses the active wallet, except for endpoints carrying a `fingerprint`, which name their own wallet.
 - **Biometric is mutually exclusive with password** — biometric is a standalone gate for no-password wallets. If a wallet has a password, the password dialog is always shown regardless of biometric settings. The two never interact.
 
 ## Architecture
@@ -36,9 +48,30 @@ The empty byte string `b""` is the "no password" sentinel. This is what existing
 
 ### Has-Password Indicator
 
-Add a `has_password: bool` field to the `KeyInfo` struct returned by `get_key()` / `get_keys()`. Determined by attempting a trial decryption with `b""` at key load time and caching the result, or by adding a `password_protected: bool` field to `KeyData::Secret`.
-
-Preferred approach: add `password_hint: Option<String>` or a simple `password_protected: bool` to `KeyData::Secret`. This avoids trial decryption and is serialized into `keys.bin`. Set to `true` when a non-empty password is used at encryption time. Exposed via `KeyInfo` to the frontend.
+`KeyInfo` carries `has_password: bool`, returned by `get_key()` / `get_keys()`.
+
+**As implemented**, the flag is read from `Wallet::password_protected` in the wallet config
+(`crates/sage/src/endpoints/keys.rs:357` and `:419`) — a cheap field lookup, not a trial decrypt.
+`keys.bin` is untouched; `KeyData::Secret` has no such field. An early draft proposed storing it in
+`KeyData::Secret`, which would have changed the `keys.bin` serialization format and required a
+versioned deserialization fallback. That draft was not built.
+
+The flag is a cache of the keychain, and the two can drift apart — a build that predates the field
+strips it on its next config write, and a restored `keys.bin` never matched the config to begin with.
+That drift fails **open**: every gate reads the flag, so a wallet wrongly flagged unprotected is not
+prompted at all and then fails to decrypt. Three things reconcile it against reality, all by
+trial-decrypting with `b""` via `Keychain::is_password_protected`:
+
+- `Sage::login` re-derives the flag for the wallet being logged into, before anything can read it.
+  One Argon2 probe per login, never on a request hot path.
+- `Sage::reconcile_all_key_protection` sweeps every configured wallet. The host runs it in a spawned
+  task at startup rather than inside `initialize`, because it costs a probe per wallet. Login only
+  covers the active wallet; this covers the wallet list and the logged-out `delete_key` /
+  `get_secret_key` gates.
+- The `reconcile_key_protection` endpoint self-heals on demand. The frontend calls it from
+  `ErrorContext` when a decrypt fails on a wallet whose flag says "no password" — that mismatch is
+  the drift signal — so the next attempt prompts correctly. Note this last one cannot fire for
+  app-bridge requests: those failures are delivered to the app's webview, not the main window.
 
 ### Biometric Gate (Mobile)
 
@@ -54,13 +87,15 @@ Biometric is a frontend-only concern, mutually exclusive with password. It serve
 
 ## Protected Operations
 
-There are 7 code points where `b""` is passed to `extract_secrets` or `add_mnemonic`/`add_secret_key`, plus 2 encrypt-at-creation sites. However, because `sign()` is called through `transact()` and `transact_with()`, the password must flow through a much larger API surface.
+There are 8 `extract_secrets` call sites, plus 2 encrypt-at-creation sites that still use the `b""`
+sentinel. Because `sign()` is reached through `transact()` and `transact_with()`, the password flows
+through a much larger API surface than that count suggests.
 
 ### 1. Display mnemonic/secret key (1 site)
 
 | Call site                               | Function           |
 | --------------------------------------- | ------------------ |
-| `crates/sage/src/endpoints/keys.rs:353` | `get_secret_key()` |
+| `crates/sage/src/endpoints/keys.rs:367` | `get_secret_key()` |
 
 ### 2. Sign transactions and offers
 
@@ -74,11 +109,12 @@ endpoint method → transact() / transact_with() → sign() → extract_secrets(
 
 | Call site                                         | Function                                                        |
 | ------------------------------------------------- | --------------------------------------------------------------- |
-| `crates/sage/src/utils/spends.rs:15`              | `sign()` — called by `transact_with()` and `sign_coin_spends()` |
-| `crates/sage/src/endpoints/offers.rs:170`         | `make_offer()` — calls `extract_secrets` directly               |
-| `crates/sage/src/endpoints/offers.rs:208`         | `take_offer()` — calls `extract_secrets` directly               |
-| `crates/sage/src/endpoints/wallet_connect.rs:181` | `sign_message_with_public_key()`                                |
-| `crates/sage/src/endpoints/wallet_connect.rs:220` | `sign_message_by_address()`                                     |
+| `crates/sage/src/utils/spends.rs:17`              | `sign()` — called by `transact_with()` and `sign_coin_spends()` |
+| `crates/sage/src/endpoints/offers.rs:172`         | `make_offer()` — calls `extract_secrets` directly               |
+| `crates/sage/src/endpoints/offers.rs:212`         | `take_offer()` — calls `extract_secrets` directly               |
+| `crates/sage/src/endpoints/wallet_connect.rs:186` | `sign_message_with_public_key()`                                |
+| `crates/sage/src/endpoints/wallet_connect.rs:227` | `sign_message_by_address()`                                     |
+| `crates/sage/src/endpoints/keys.rs:279`           | `delete_key()` — verifies before an irreversible delete         |
 
 **Transaction endpoints that flow through `transact()` → `sign()`** (21 endpoints):
 
@@ -88,24 +124,35 @@ Plus `cancel_offer`, `cancel_offers`, and `create_transaction` (action system) w
 
 ### 3. Delete wallet key
 
-Password-protected wallets require password verification before deletion. Since the Rust `delete_key()` endpoint does not accept a password, verification is performed on the frontend by calling `get_secret_key()` first — if decryption fails, the delete is blocked.
+Password-protected wallets require password verification before deletion. This is enforced in Rust:
+`delete_key()` takes a `password` and calls `extract_secrets` itself when
+`keychain.is_password_protected(req.fingerprint)`
+(`crates/sage/src/endpoints/keys.rs:277`). Deletion is irreversible, so it does not trust a caller to
+have checked.
+
+An earlier draft verified on the frontend by calling `get_secret_key()` first and blocking the delete
+if decryption failed. `WalletCard.deleteSelf()` now simply calls `deleteKey`.
 
-| Call site           | Function                                                        |
-| ------------------- | --------------------------------------------------------------- |
-| `WalletCard.tsx:81` | `deleteSelf()` — verifies via `getSecretKey` before `deleteKey` |
+| Call site        | Function                                            |
+| ---------------- | --------------------------------------------------- |
+| `WalletCard.tsx` | `deleteSelf()` — calls `deleteKey` and nothing else |
 
 ### 4. Generate hardened keys (1 site)
 
 | Call site                                  | Function                      |
 | ------------------------------------------ | ----------------------------- |
-| `crates/sage/src/endpoints/actions.rs:201` | `increase_derivation_index()` |
+| `crates/sage/src/endpoints/actions.rs:204` | `increase_derivation_index()` |
 
-### 4. Key import — encrypt at creation (2 sites)
+### 5. Key import — encrypt at creation (2 sites)
 
 | Call site                               | Function                         |
 | --------------------------------------- | -------------------------------- |
-| `crates/sage/src/endpoints/keys.rs:141` | `import_key()` — secret key path |
-| `crates/sage/src/endpoints/keys.rs:178` | `import_key()` — mnemonic path   |
+| `crates/sage/src/endpoints/keys.rs:143` | `import_key()` — secret key path |
+| `crates/sage/src/endpoints/keys.rs:180` | `import_key()` — mnemonic path   |
+
+**Import takes no password.** Both sites pass the `b""` sentinel, and `ImportKey` has no `password`
+field at all — an early draft added one, but the shipped design sets a password afterwards through
+Settings instead. This is why `import_key` is absent from the gating manifest.
 
 Note: `import_key()` also generates hardened derivations using the in-memory master key during import. This does NOT need the password since the key is already decrypted at that point.
 
@@ -132,7 +179,7 @@ Decrypts with old password, re-encrypts with new password, replaces the `KeyData
 
 **`wallet.rs`** — Add `password_protected: bool` to `Wallet` (defaults to `false`, so existing `config.toml` files deserialize unchanged).
 
-Because the config file and `keys.bin` can drift apart (e.g. a restored `keys.bin`), `Sage::switch_wallet` self-heals the flag via `Keychain::is_password_protected`, which trial-decrypts the entry with an empty password.
+Because the config file and `keys.bin` can drift apart (e.g. a restored `keys.bin`, or an older build that does not know the field rewriting the config without it), `Sage::login` and the startup sweep `Sage::reconcile_all_key_protection` both self-heal the flag via `Keychain::is_password_protected`, which trial-decrypts the entry with an empty password. See **Storage** above for why this drift has to be corrected proactively rather than on demand.
 
 ### `sage-api` crate (request structs)
 
@@ -140,7 +187,6 @@ Add `password: Option<String>` to **all request structs that trigger signing, se
 
 **Direct secret access:**
 
-- `ImportKey`
 - `GetSecretKey`
 - `DeleteKey` — deletion is irreversible, so `delete_key` verifies the password itself rather than trusting the frontend to have checked
 
@@ -160,20 +206,27 @@ Add `password: Option<String>` to **all request structs that trigger signing, se
 
 - `SignMessageWithPublicKey`, `SignMessageByAddress`
 
-**New request/response pair:**
+**New request/response pairs:**
 
 - `ChangePassword { fingerprint: u32, old_password: String, new_password: String }`
 - `ChangePasswordResponse {}`
+- `ReconcileKeyProtection { fingerprint: u32 }`
+- `ReconcileKeyProtectionResponse { has_password: bool }`
 
 **`KeyInfo`** — add `has_password: bool` field.
 
+Every request type carrying `password: Option<String>` is now also an entry in
+`crates/sage-api/password-gating.json`, and a drift test fails the build if the two sets diverge. The
+field stays because `sage-rpc` clients supply it over mTLS; the Tauri host layer overwrites it with a
+password it resolved itself.
+
 ### `sage` crate (endpoints)
 
 **`spends.rs`**: `sign()` takes `password: &[u8]` parameter, passes to `extract_secrets`.
 
 **`transactions.rs`**: `transact()` and `transact_with()` take `password: &[u8]` parameter, pass to `sign()`. Every transaction endpoint extracts password from its request struct via `req.password.unwrap_or_default().into_bytes()` and passes to `transact()`.
 
-**`keys.rs`**: `import_key()` passes password to `add_mnemonic()`/`add_secret_key()`. `get_secret_key()` passes password to `extract_secrets()`. `get_key()`/`get_keys()` populate `has_password` from `KeyData`.
+**`keys.rs`**: `get_secret_key()` and `delete_key()` pass password to `extract_secrets()`. `get_key()`/`get_keys()` populate `has_password` from the wallet config. `import_key()` is unchanged — it still encrypts with `b""`.
 
 **`offers.rs`**: `make_offer()`, `take_offer()` pass password to `extract_secrets()`. `cancel_offer()`, `cancel_offers()` pass password to `transact()`.
 
@@ -185,21 +238,16 @@ New `change_password()` endpoint.
 
 ### Frontend (TypeScript/React)
 
-#### PasswordContext (`src/contexts/PasswordContext.tsx`)
+#### PasswordContext (`src/contexts/PasswordContext.tsx`) — _(superseded)_
 
-A React context provider that serves as the **single entry point for all operation authentication** — password or biometric (never both). Provides:
+**As originally built**, this provider was the single entry point callers invoked:
 
 ```typescript
-requestPassword(hasPassword: boolean, fingerprint?: number): Promise<string | null | undefined>
+requestPassword(hasPassword: boolean, fingerprint?: number): Promise<string | null | undefined>;
 ```
 
-**Return values:**
-
-- `string` → use this password (typed by user via dialog)
-- `null` → no password needed, all auth passed (biometric gate passed or no auth required)
-- `undefined` → auth cancelled or failed, abort the operation
-
-**Internal decision tree (mutually exclusive):**
+`string` meant "use this password", `null` meant "no auth needed", `undefined` meant "cancelled —
+abort". Its decision tree was:
 
 ```text
 hasPassword=true                          → show password dialog (password always takes precedence)
@@ -208,53 +256,63 @@ hasPassword=false, biometric not enabled  → return null (no auth needed)
 cancelled at any point                    → return undefined
 ```
 
-On desktop (no biometric available), the biometric path is skipped — behaves as if biometric is not enabled.
+**As it works now**, the provider is a responder, not a callable. It subscribes to the Rust
+`PasswordRequest` event, runs that same three-way decision tree unchanged, and replies with
+`submit_password_response(request_id, Password | NoAuthNeeded | Cancelled)`. Requests are queued by
+`requestId`, so overlapping prompts cannot interleave. `requestPassword` is gone; the only export is
+`requireLocalAuth()`, a UI-only biometric gate for the two `Settings.tsx` actions that touch no wallet
+secret (starting the RPC server, toggling run-on-startup) and therefore have no Rust operation to hang
+a prompt off.
 
-Uses a `useRef`-based pending promise pattern to bridge the dialog UI with the async call site.
+The mutual-exclusivity rule, the 5-minute biometric cache, and the desktop fallback are all preserved
+bit-for-bit. What changed is the direction of the call. See
+[2026-08-21-password-gate-design.md](2026-08-21-password-gate-design.md).
 
-**Provider placement:** Inside `I18nProvider` and `WalletProvider`. Wraps `WalletConnectProvider` and all downstream providers, so `usePassword()` is available everywhere.
+**Provider placement:** Inside `I18nProvider` and `WalletProvider`. Wraps `WalletConnectProvider` and
+all downstream providers.
 
-Provider tree: `BiometricProvider` → `I18nProvider` → `WalletProvider` → `PasswordProvider` → `PeerProvider` → `WalletConnectProvider` → `PriceProvider` → `RouterProvider`
+Provider tree: `BiometricProvider` → `I18nProvider` → `WalletProvider` → `PasswordProvider` →
+`PeerProvider` → `WalletConnectProvider` → `PriceProvider` → `RouterProvider`
 
 #### PasswordDialog (`src/components/dialogs/PasswordDialog.tsx`)
 
-A reusable modal dialog rendered by `PasswordProvider`. Features:
+A reusable modal dialog rendered by `PasswordProvider`. Unchanged by the password gate. Features:
 
 - Auto-focuses the password input on open
 - Clears password state on open/close
 - Supports Enter key to submit
-- Cancel closes the dialog and resolves the promise with `undefined` (auth cancelled)
+- Cancel resolves the prompt as cancelled
+
+Retries are driven from Rust: a wrong password re-emits the same `requestId` with an incremented
+`attempt` and the remaining-attempt count, up to three attempts.
 
 #### usePassword hook (`src/hooks/usePassword.ts`)
 
 Thin wrapper around `PasswordContext` with a guard that throws if used outside `PasswordProvider`.
+`Settings.tsx` is its only consumer.
 
-#### Call site pattern
+#### Call site pattern — _(superseded)_
 
-Every protected operation follows the same unified pattern — a single call that handles password or biometric:
+Every protected operation used to open with:
 
 ```typescript
 const password = await requestPassword(wallet?.has_password ?? false);
 if (password === undefined) return; // auth cancelled or failed
 ```
 
-The separate `promptIfEnabled()` biometric call is removed from all call sites. `requestPassword` is now the sole auth gate. Password is then passed to the backend command. Call sites that were updated:
-
-| File                       | Operations                                                                                                                 |
-| -------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
-| `ConfirmationDialog.tsx`   | `signCoinSpends` (Sign Transaction button, Submit button)                                                                  |
-| `WalletCard.tsx`           | `getSecretKey` (View Details dialog), `deleteKey` (password verified via `getSecretKey` before deletion)                   |
-| `Settings.tsx`             | `increaseDerivationIndex` (when hardened keys enabled)                                                                     |
-| `Offers.tsx`               | `cancelOffers` (Cancel All Active)                                                                                         |
-| `OfferRowCard.tsx`         | `cancelOffer` (individual offer cancel)                                                                                    |
-| `useOfferProcessor.ts`     | `makeOffer` (create offer flow)                                                                                            |
-| `Offer.tsx`                | `takeOffer` (take offer flow)                                                                                              |
-| `WalletConnectContext.tsx` | All WC command handling via `HandlerContext`                                                                               |
-| WalletConnect commands     | `signCoinSpends`, `signMessage`, `signMessageByAddress`, `send`, `createOffer`, `takeOffer`, `cancelOffer`, `bulkMintNfts` |
+**No call site does this any more.** `requestPassword` has no remaining references in `src/`. Call
+sites simply invoke the command; if authentication is needed, Rust prompts before executing and
+returns `Unauthorized` if it is refused. The files that carried the old plumbing —
+`ConfirmationDialog.tsx`, `WalletCard.tsx`, `Settings.tsx` (`increaseDerivationIndex`), `Offers.tsx`,
+`OfferRowCard.tsx`, `useOfferProcessor.ts`, `Offer.tsx`, and the WalletConnect command layer — were
+all stripped.
 
-#### WalletConnect integration
+#### WalletConnect integration — _(superseded)_
 
-The `HandlerContext` interface was extended with `requestPassword` and `hasPassword`. WalletConnect command handlers prompt for the password before executing protected operations, using the same pattern as direct UI call sites.
+`HandlerContext` was extended with `requestPassword` and `hasPassword`, and each handler prompted
+before executing. Both fields have since been removed from the handler context, and
+`src/walletconnect/commands/{chip0002,high-level,offers}.ts` no longer prompt. Because these
+handlers set `auto_submit: true`, the gate fires inside the Rust command.
 
 #### Password management in Settings
 
@@ -268,7 +326,19 @@ All three operations call `commands.changePassword()` with appropriate `old_pass
 
 #### Error feedback
 
-Wrong password errors (`ErrorKind::Unauthorized` with reason containing "decrypt") are surfaced as a toast notification "Incorrect password" via the global `ErrorContext.addError` handler. This provides consistent feedback across all password-protected operations without requiring per-call-site error handling. Other unauthorized errors (e.g., wallet transition race conditions) continue to be silently discarded.
+All password feedback is centralized in `ErrorContext.addError`, so no call site handles it:
+
+| Error                                                   | Result                                                                                                       |
+| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
+| `incorrect_password`                                    | "Incorrect password" toast, then a `reconcileKeyProtection` probe if the flag says the wallet is unprotected |
+| `unauthorized` / "Password entry cancelled"             | Silent — a deliberate cancellation is not a failure                                                          |
+| `unauthorized` / "Too many incorrect password attempts" | Translated toast                                                                                             |
+| `unauthorized` / "Password prompt timed out"            | Translated toast                                                                                             |
+| `unauthorized` containing "not found" / "No secret"     | Toast with the raw reason                                                                                    |
+| other `unauthorized`                                    | Silent — `NotLoggedIn` / `NoSigningKey` during wallet transitions                                            |
+
+The three gate reasons are matched on the exact Rust reason string and re-rendered as translated
+text; the constants are duplicated in `ErrorContext.tsx` with comments naming their Rust source.
 
 #### Settings UI changes
 
@@ -279,7 +349,7 @@ The biometric toggle remains in the **Preferences** section of Global Settings (
 - **No password at import time** — users set a password later via Settings. Simpler UX, same security outcome.
 - **No session caching** — every protected operation prompts independently. Passwords are never stored on device.
 - **Single dialog instance** — `PasswordProvider` renders one `PasswordDialog` at the provider level, avoiding duplicate dialog instances across components.
-- **Unified auth entry point** — `requestPassword` subsumes the standalone `promptIfEnabled()` biometric check. Call sites make one auth call instead of two. The `BiometricContext` continues to exist for state management (`enabled`, `available`) but `promptIfEnabled()` is no longer called directly at operation sites.
+- **Unified auth entry point** — a single decision tree handles password and biometric, subsuming the standalone `promptIfEnabled()` check. `BiometricContext` continues to exist for state management (`enabled`, `available`) and to run the prompt, but nothing calls `promptIfEnabled()` at an operation site. Since the password gate, the entry point is a Rust event rather than a function call.
 - **Mutual exclusivity** — biometric and password are mutually exclusive. Password takes precedence. If a wallet has a password, the password dialog is always shown regardless of biometric settings. Biometric is a standalone gate for no-password wallets only.
 - **Global biometric setting** — one toggle applies to all wallets. No per-wallet biometric configuration needed.
 
@@ -295,7 +365,11 @@ The biometric toggle remains in the **Preferences** section of Global Settings (
 
 Existing keys encrypted with `b""` continue to work — the user simply never gets prompted. To add protection, the user triggers "Set Password" which calls `change_password(fingerprint, b"", new_password)`.
 
-The `keys.bin` format change (adding `password_protected` to `KeyData::Secret`) requires a deserialization fallback: try new format first, fall back to old format with `password_protected: false`. On next save, the file is written in the new format.
+**No `keys.bin` migration is needed.** The has-password flag lives in the wallet config, which
+defaults `password_protected` to `false`, so existing `config.toml` files deserialize unchanged and
+existing `keys.bin` files are read by the same code as before. (An earlier draft put the flag in
+`KeyData::Secret` and would have needed a versioned deserialization fallback; see
+**Has-Password Indicator**.)
 
 ## What's NOT Changing
 
@@ -303,5 +377,6 @@ The `keys.bin` format change (adding `password_protected` to `KeyData::Secret`)
 - `keys.bin` encryption scheme — same Argon2 + AES-256-GCM, just with real passwords instead of `b""`
 - Any sync, peer, or database logic
 - `SendTransactionImmediately`, `SubmitTransaction`, `ViewCoinSpends` — these operate on pre-signed spend bundles or read-only data and do not call `extract_secrets()` or `sign()`
-- Backend — no backend changes for the biometric gate. It's entirely frontend.
+- Backend — no backend changes for the biometric gate. Rust never learns whether biometrics are enabled; it emits a prompt request and the frontend decides how to satisfy it.
+- `keys.bin` format — `KeyData::Secret` is unchanged.
 - Biometric — remains as a standalone gate for no-password wallets. `BiometricContext` provides `enabled`/`available` state; `PasswordContext` handles the actual biometric prompt internally.
diff --git a/docs/generated/2026-03-16-protection-matrix.md b/docs/generated/2026-03-16-protection-matrix.md
new file mode 100644
index 000000000..f465e75af
--- /dev/null
+++ b/docs/generated/2026-03-16-protection-matrix.md
@@ -0,0 +1,166 @@
+# Operation Protection Matrix
+
+Coverage of password and biometric protection across every operation in Sage that can reach a wallet
+secret.
+
+**Revised 2026-08-22** for the password gate. The previous revision described enforcement as a
+frontend responsibility split between `ConfirmationDialog` and per-call-site `requestPassword` calls.
+Neither exists any more — see
+[2026-08-21-password-gate-design.md](2026-08-21-password-gate-design.md).
+
+## Architecture
+
+Rust decides when authentication is required and prompts for it. No caller supplies a password.
+
+`crates/sage-api/password-gating.json` assigns every password-bearing endpoint one of three modes,
+and the endpoint macro expands the gate accordingly:
+
+| Mode          | Gate behaviour                                                                |
+| ------------- | ----------------------------------------------------------------------------- |
+| `always`      | prompt on every call, against the active wallet                               |
+| `fingerprint` | prompt on every call, against `req.fingerprint` rather than the active wallet |
+| `auto_submit` | prompt only when `req.auto_submit` is set; otherwise clear `req.password`     |
+
+`auto_submit` mode exists because those endpoints only build a transaction until the caller asks for
+it to be submitted. This is what decides **where the prompt lands**:
+
+- **Normal UI flows** call the endpoint with `auto_submit` unset, get unsigned coin spends back, and
+  render `ConfirmationDialog`. Nothing is asked for during the build. The dialog's Submit button
+  calls `sign_coin_spends`, which is `always`, so exactly one prompt appears — after Submit.
+  (If the user pressed Sign first, Submit reuses that signature and does not prompt again.)
+- **WalletConnect handlers** set `auto_submit: true`, so signing happens inside the command and the
+  prompt lands there.
+- **App bridge requests** do not go through the endpoint macro. They have their own gate in
+  `process_after_approval`, which runs after the user approves the request summary and before the
+  handler executes. It is unconditional for the four approval bodies that reach a secret.
+
+Password and biometric remain mutually exclusive. `PasswordContext` now answers a Rust
+`PasswordRequest` event instead of being called, but its three-way decision — password dialog,
+biometric gate with a 5-minute cache, or `NoAuthNeeded` — is unchanged. A wallet with a password set
+never triggers biometric.
+
+## Matrix — UI operations
+
+Legend: ✅ = reaches a secret and is gated, ❌ = reaches no secret, no gate needed
+
+| Operation                         | Endpoint                    | Mode          | Prompt appears     | Call site                               |
+| --------------------------------- | --------------------------- | ------------- | ------------------ | --------------------------------------- |
+| **Transactions**                  |                             |               |                    |                                         |
+| Send XCH                          | `send_xch`                  | `auto_submit` | ConfirmationDialog | `Send.tsx`                              |
+| Send CAT                          | `send_cat`                  | `auto_submit` | ConfirmationDialog | `Send.tsx`                              |
+| Bulk send XCH                     | `bulk_send_xch`             | `auto_submit` | ConfirmationDialog | `Send.tsx`                              |
+| Bulk send CAT                     | `bulk_send_cat`             | `auto_submit` | ConfirmationDialog | `Send.tsx`                              |
+| Combine coins                     | `combine`                   | `auto_submit` | ConfirmationDialog | `OwnedCoinsCard.tsx`                    |
+| Split coins                       | `split`                     | `auto_submit` | ConfirmationDialog | `OwnedCoinsCard.tsx`                    |
+| Auto-combine XCH / CAT            | `auto_combine_xch` / `_cat` | `auto_submit` | ConfirmationDialog | `OwnedCoinsCard.tsx`                    |
+| Issue CAT                         | `issue_cat`                 | `auto_submit` | ConfirmationDialog | `IssueToken.tsx`                        |
+| Multi-send                        | `multi_send`                | `auto_submit` | —                  | No frontend binding                     |
+| Action system                     | `create_transaction`        | `auto_submit` | ConfirmationDialog | No frontend binding                     |
+| Sign coin spends (Sign button)    | `sign_coin_spends`          | `always`      | immediately        | `ConfirmationDialog.tsx`                |
+| Sign coin spends (Submit button)  | `sign_coin_spends`          | `always`      | immediately        | `ConfirmationDialog.tsx`                |
+| **NFTs / DIDs**                   |                             |               |                    |                                         |
+| Bulk mint NFTs                    | `bulk_mint_nfts`            | `auto_submit` | ConfirmationDialog | `MintNft.tsx`                           |
+| Transfer NFTs                     | `transfer_nfts`             | `auto_submit` | ConfirmationDialog | `MultiSelectActions.tsx`                |
+| Burn NFTs                         | `transfer_nfts`             | `auto_submit` | ConfirmationDialog | `MultiSelectActions.tsx`                |
+| Add NFT URI                       | `add_nft_uri`               | `auto_submit` | ConfirmationDialog | `NftCard.tsx`                           |
+| Assign NFTs to DID                | `assign_nfts_to_did`        | `auto_submit` | ConfirmationDialog | `NftCard.tsx`, `MultiSelectActions.tsx` |
+| Create DID                        | `create_did`                | `auto_submit` | ConfirmationDialog | `CreateProfile.tsx`                     |
+| Transfer / burn DIDs              | `transfer_dids`             | `auto_submit` | ConfirmationDialog | `DidList.tsx`                           |
+| Normalize DIDs                    | `normalize_dids`            | `auto_submit` | ConfirmationDialog | `DidList.tsx`                           |
+| **Options**                       |                             |               |                    |                                         |
+| Mint option                       | `mint_option`               | `auto_submit` | ConfirmationDialog | `MintOption.tsx`                        |
+| Transfer / burn options           | `transfer_options`          | `auto_submit` | ConfirmationDialog | `useOptionActions.tsx`                  |
+| Exercise options                  | `exercise_options`          | `auto_submit` | ConfirmationDialog | `useOptionActions.tsx`                  |
+| **Clawback**                      |                             |               |                    |                                         |
+| Claw back coins                   | `combine`                   | `auto_submit` | ConfirmationDialog | `ClawbackCoinsCard.tsx`                 |
+| Finalize clawback                 | `finalize_clawback`         | `auto_submit` | ConfirmationDialog | `ClawbackCoinsCard.tsx`                 |
+| **Offers**                        |                             |               |                    |                                         |
+| Make offer                        | `make_offer`                | `always`      | immediately        | `useOfferProcessor.ts`                  |
+| Take offer                        | `take_offer`                | `always`      | immediately        | `Offer.tsx`                             |
+| Cancel offer                      | `cancel_offer`              | `auto_submit` | ConfirmationDialog | `OfferRowCard.tsx`                      |
+| Cancel all offers                 | `cancel_offers`             | `auto_submit` | ConfirmationDialog | `Offers.tsx`                            |
+| **Secrets / key management**      |                             |               |                    |                                         |
+| View mnemonic / secret key        | `get_secret_key`            | `fingerprint` | immediately        | `WalletCard.tsx`                        |
+| Delete wallet key                 | `delete_key`                | `fingerprint` | immediately        | `WalletCard.tsx`                        |
+| Import key                        | `import_key`                | ❌ ungated    | —                  | `CreateWallet.tsx`, `ImportWallet.tsx`  |
+| Set / change / remove password    | `change_password`           | ❌ ungated    | inline form        | `PasswordManagementDialog.tsx`          |
+| **Key derivation**                |                             |               |                    |                                         |
+| Increase derivation (hardened)    | `increase_derivation_index` | `always`      | immediately        | `Settings.tsx`                          |
+| Increase derivation (unhardened)  | `increase_derivation_index` | `always`      | immediately        | `Settings.tsx`                          |
+| **Ungated by design**             |                             |               |                    |                                         |
+| Start RPC server, run-on-startup  | —                           | ❌            | `requireLocalAuth` | `Settings.tsx`                          |
+| Submit pre-signed transaction     | `submit_transaction`        | ❌            | —                  | Operates on a signed bundle             |
+| View coin spends                  | `view_coin_spends`          | ❌            | —                  | Read-only                               |
+| Balances, addresses, NFTs         | —                           | ❌            | —                  | Read-only                               |
+| Login / logout                    | —                           | ❌            | —                  | No secret access                        |
+| Rename / resync / emoji           | —                           | ❌            | —                  | Metadata only                           |
+| Enable / disable biometric toggle | —                           | ❌            | —                  | No-op on protected wallets              |
+
+Notes:
+
+- **`import_key` is genuinely ungated.** `ImportKey` has no `password` field; keys are imported
+  encrypted with the `b""` sentinel and protected afterwards through Settings.
+- **`change_password` is deliberately ungated.** Its `old_password` is management form data, not a
+  wallet unlock, and the form collects it directly.
+- **`increase_derivation_index` over-prompts on the unhardened path.** Its `extract_secrets` call is
+  inside `if hardened` (`crates/sage/src/endpoints/actions.rs:204`), so an unhardened-only call
+  reaches no secret — but the mode is per-endpoint, so the gate prompts anyway. `Settings.tsx` calls
+  it with `hardened: false` whenever the wallet has no secrets or hardened derivation is off, and a
+  protected wallet gets a password dialog for a request that will not use the answer. Before the
+  password gate the frontend suppressed this itself with `has_secrets && hardened`. Expressing it
+  would need a fourth gating mode conditioned on `req.hardened`; the same shape as `auto_submit`.
+- **Clawback and auto-combine reuse `combine`**, which is why they inherit its mode.
+- Two endpoints carry an `auto_submit` field but are `always`: `sign_coin_spends` and `take_offer`
+  both reach the keychain before consulting it. A drift test enforces this against the
+  implementations rather than against the field's presence.
+
+## Matrix — WalletConnect operations
+
+WC handlers set `auto_submit: true` (except `chip0002_signCoinSpends`), so the gate fires inside the
+command. `HandlerContext` no longer carries `requestPassword` or `hasPassword`.
+
+| Operation                             | Endpoint                       | `auto_submit` | Mode          | Prompts |
+| ------------------------------------- | ------------------------------ | :-----------: | ------------- | :-----: |
+| `chia_send` (XCH / CAT)               | `send_xch` / `send_cat`        |    `true`     | `auto_submit` |   ✅    |
+| `chia_bulkMintNfts`                   | `bulk_mint_nfts`               |    `true`     | `auto_submit` |   ✅    |
+| `chia_createOffer`                    | `make_offer`                   |   no field    | `always`      |   ✅    |
+| `chia_takeOffer`                      | `take_offer`                   |    `true`     | `always`      |   ✅    |
+| `chia_cancelOffer`                    | `cancel_offer`                 |    `true`     | `auto_submit` |   ✅    |
+| `chip0002_signCoinSpends`             | `sign_coin_spends`             |    `false`    | `always`      |   ✅    |
+| `chip0002_signMessage`                | `sign_message_with_public_key` |   no field    | `always`      |   ✅    |
+| `chia_signMessageByAddress`           | `sign_message_by_address`      |   no field    | `always`      |   ✅    |
+| WC read-only (connect, chainId, etc.) | —                              |       —       | ❌            |    —    |
+
+`chip0002_signCoinSpends` is the one case where `auto_submit: false` still prompts, because
+`sign_coin_spends` signs before it looks at the flag.
+
+## Matrix — app bridge operations
+
+Bridge requests are gated in `process_after_approval`, not by the endpoint macro. On a protected
+wallet the `bridge-approval` card collects the password inline, alongside the request summary, and
+the host verifies it before the handler executes. A wrong password leaves the approval queued for
+another try; `MAX_ATTEMPTS` wrong ones consume it and fail the request `unauthorized`.
+
+| Approval body           | Bridge method                | Gated | Target wallet        |
+| ----------------------- | ---------------------------- | :---: | -------------------- |
+| `SendXch`               | `wallet.sendXch`             |  ✅   | active               |
+| `SignCoinSpends`        | `wallet.signCoinSpends`      |  ✅   | active               |
+| `SignMessage`           | `wallet.signMessage`         |  ✅   | active               |
+| `GetSecretKey`          | `wallet.getSecretKey`        |  ✅   | named by fingerprint |
+| `CapabilityGrant`       | `app.requestCapabilityGrant` |  ❌   | —                    |
+| `NetworkWhitelistGrant` | —                            |  ❌   | —                    |
+
+`approval_requires_password` matches the body exhaustively with no catch-all, so a new approval body
+must decide deliberately.
+
+A password-protected wallet always gets an approval dialog even when the app holds the
+`wallet.send_xch_auto_submit` capability. Silent auto-submit is incompatible with password
+protection.
+
+## Remaining design considerations
+
+1. **Session caching asymmetry** — biometric caches for 5 minutes; password never caches. Session
+   unlock is deferred; see the password-gate design's non-goals.
+2. **`requires_password` is observable** — the `PasswordRequest` event can be received by an app
+   webview, so it deliberately carries no wallet identity and no password. `requires_password` still
+   tells a listener whether the active wallet is protected.
diff --git a/docs/generated/2026-08-21-password-gate-design.md b/docs/generated/2026-08-21-password-gate-design.md
new file mode 100644
index 000000000..ca1f7d414
--- /dev/null
+++ b/docs/generated/2026-08-21-password-gate-design.md
@@ -0,0 +1,320 @@
+# Password Gate: Rust-Owned Password Prompting
+
+**Date:** 2026-08-21
+**Branch:** `password-gate` (off `password`)
+**Status:** Implemented
+
+## Problem
+
+Password prompting in Sage is decided by the frontend. `PasswordContext.requestPassword(hasPassword)`
+reads the wallet's `password_protected` flag, chooses between a password dialog, a biometric gate, and
+no auth at all, and then threads the resulting string into the command it is about to call. Roughly
+sixteen call sites across React pages, components, hooks, and the WalletConnect command layer repeat
+this pattern.
+
+This has two consequences:
+
+1. **Apps cannot transact on a protected wallet.** The sage-apps bridge hardcodes `password: None` in
+   its request conversions (`send_xch.rs`, `sign_message.rs`, `sign_coin_spends.rs`), so any bridge
+   request against a password-protected wallet fails to decrypt. Apps have no path to prompt, and
+   giving them one would mean the master-key password passing through a sandboxed app webview.
+2. **The decision is in the least trustworthy place.** Whether an operation requires authentication is
+   a security property of the wallet, not a UI concern. Every new caller must remember to ask.
+
+## Goals
+
+- Rust decides when authentication is required. Callers never supply a password and never decide.
+- The password dialog renders only in the trusted `main` webview. Secrets never enter app-land.
+- Apps gain a working path to operate on protected wallets.
+- All existing in-app password prompting is replumbed through the same choke point.
+
+## Non-goals
+
+- **Session unlock / key caching.** Prompting once and holding the decrypted master key in memory for
+  a window is a separate change to the security model. Deferred.
+- **`ChangePassword`.** Its `old_password` / `new_password` are password _management_ form data, not
+  wallet unlocking. Unchanged.
+- **`passkey-unlock`.** Independent work on its own branch.
+
+## Key constraint: sage-rpc is headless
+
+`sage-rpc` drives the same `Arc<Mutex<Sage>>` core over mTLS (`crates/sage-rpc/src/lib.rs:33`) and its
+clients legitimately supply `password` in the request body (`crates/sage-rpc/src/tests.rs:216`). There
+is no UI to prompt.
+
+Therefore:
+
+- `password: Option<String>` **stays** on the `sage-api` request types. It is the RPC contract.
+- `Sage::sign(coin_spends, partial, &password)` and the `keychain.extract_secrets` call sites in
+  `crates/sage/src/endpoints/` are **unchanged**.
+- The prompting choke point lives in the **Tauri host layer, above `Sage`** — never in the core.
+
+This placement also removes a re-entrancy hazard. Every endpoint runs inside `app_state.lock().await`.
+Awaiting a round-trip to the main webview while holding that lock risks deadlock if the webview's
+handler invokes any command needing the same lock. Resolving the password _before_ the lock is taken
+avoids the problem entirely.
+
+## Architecture
+
+New crate `crates/sage-password-gate`. It lives outside `src-tauri/src/` because both `sage-tauri`
+and `sage-apps` must call it, and `sage-apps` cannot depend on the `sage-tauri` binary crate. Its entry
+point is
+`resolve(app_handle, state) -> Result<Option<String>>`. It reads the active wallet's fingerprint and
+`password_protected` flag from `state` without holding the lock across the round-trip, asks the main
+webview, validates the answer against the keychain, and returns a verified password or `None`.
+
+A sibling entry point `resolve_for_fingerprint(app_handle, state, gate, fingerprint)` targets an
+explicitly named wallet. Endpoints whose request type carries a `fingerprint` — `delete_key` and
+`get_secret_key`, plus the `wallet.getSecretKey` bridge method — act on a wallet that need not be the
+active one, and are driven from the logged-out wallet list where there is no active wallet at all.
+`resolve` would both prompt for the wrong wallet's password and fail with `NotLoggedIn`, so those
+endpoints use the fingerprint-targeted form. The `password_protected` lookup searches
+`wallet_config.wallets` by fingerprint and needs no active wallet, so this path never calls
+`Sage::wallet()`.
+
+### Gating manifest
+
+`crates/sage-api/password-gating.json` maps each password-bearing endpoint to one of three modes,
+and the macro's `maybe_unlock` expands accordingly:
+
+| Mode          | Expansion                                                                          | Applies to                                                                   |
+| ------------- | ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
+| `always`      | `resolve(...)` on every call                                                       | endpoints that reach a secret unconditionally                                |
+| `fingerprint` | `resolve_for_fingerprint(..., req.fingerprint)` on every call                      | `delete_key`, `get_secret_key`                                               |
+| `auto_submit` | `resolve(...)` only when `req.auto_submit` is set, `req.password = None` otherwise | endpoints that only forward the password to `Sage::transact`/`transact_with` |
+
+The `auto_submit` mode exists because those endpoints build a transaction for the confirmation
+dialog first and touch no key until the caller asks for it to be signed and submitted. Prompting
+unconditionally there asks the user for a password that is then discarded, and then asks again after
+they confirm — two dialogs for one send.
+
+Note that carrying an `auto_submit` field is _not_ the criterion: `sign_coin_spends` and `take_offer`
+both have one but reach the keychain on every call, so both are `always`. The criterion is how the
+implementation consumes the password, and a drift test in `crates/sage-api/src/lib.rs` enforces
+exactly that by scanning `crates/sage/src/endpoints/` — an endpoint whose body calls
+`extract_secrets` or `self.sign` must not be `auto_submit`, and one that only forwards to
+`transact`/`transact_with` must be. Sibling tests keep the manifest's key set equal to the set of
+request types carrying a `password` field, keep `fingerprint` equal to those carrying a
+`fingerprint` field, and reject unknown mode strings.
+
+### Transport
+
+Rust to the main webview is a tauri-specta event; the reply returns as a command, because a password
+must not ride an event broadcast.
+
+- **Event** `PasswordRequest { request_id, requires_password: bool, attempt: u8, error: Option<PasswordAttemptError> }`,
+  emitted with `emit_to(SAGE_WEBVIEW_LABEL, ...)` rather than a plain `emit`.
+
+  Targeting `main` is where the request is _meant_ to land, not a guarantee of where it _can_ land.
+  Tauri resolves an `AnyLabel` target through `Listeners::emit_js_filter` → `match_any_or_filter`,
+  which short-circuits to true for any listener registered with `EventTarget::Any`, never consulting
+  the target. `src-tauri/capabilities/apps.json` grants app webviews `core:event:allow-listen`, and
+  `plugin:event|listen` takes its target straight from JS, so an app runtime that calls
+  `listen('password-request', …)` receives every prompt. The payload is therefore designed to be
+  observable: it carries no wallet fingerprint, no wallet identity, and no password. `attempt` and
+  `error.attemptsRemaining` are retained because the dialog needs them and a bare retry counter
+  identifies nothing an observer could not already infer from the re-prompt timing itself.
+
+  What keeps the _password_ safe is direction, not targeting: the secret only ever travels back on
+  `submit_password_response`, a command absent from both `apps.json` and `system-apps.json`, and apps
+  hold no `core:event:allow-emit` with which to forge a request.
+
+- **Command** `submit_password_response(request_id, outcome)` where
+  `outcome = Password(String) | NoAuthNeeded | Cancelled`.
+- **State** `PasswordGateState { pending: Mutex<HashMap<String, oneshot::Sender<Outcome>>> }`.
+  The gate awaits the oneshot.
+
+`requires_password` is advisory rather than the whole decision. Rust knows `password_protected`; it
+does not know whether biometric auth is enabled, which is a UI and plugin setting. So the gate always
+emits, and the frontend keeps today's exact three-way logic: password dialog, biometric gate with its
+existing five-minute cache, or an immediate `NoAuthNeeded`. Biometric logic stays where it belongs and
+behavior is preserved bit-for-bit. The cost is one sub-millisecond IPC round-trip on unprotected
+wallets.
+
+_Rejected:_ pushing the biometric setting into Rust to skip that round-trip. Not worth the state-sync
+complexity for the latency saved.
+
+### Verification and retry
+
+The gate verifies with `keychain.extract_secrets(fingerprint, &password)` **before** taking the app
+lock. On `KeychainError::Decrypt` it re-emits with an incremented `attempt` and an inline error, up to
+three attempts, then fails `Unauthorized`. `Cancelled` fails immediately with a distinct error kind so
+the frontend can stay silent rather than surfacing a toast.
+
+Verifying above the lock is what makes bounded retry cheap: a wrong password costs one keychain
+decrypt, not a partially built transaction.
+
+### Gating the endpoints
+
+Every endpoint command is generated from a single `repeat` block (`src-tauri/src/commands.rs:68-83`)
+driven by `crates/sage-api/endpoints.json`. The gate therefore goes in exactly one place.
+
+A `maybe_unlock` token in `crates/sage-api/macro/src/lib.rs` sits alongside `maybe_async` and
+`maybe_await`, driven by the gating manifest above. The repeat block is:
+
+```rust
+#[command]
+#[specta]
+#[allow(unused_variables, unused_mut)]
+pub async fn endpoint(
+    app_handle: AppHandle,
+    state: State<'_, AppState>,
+    gate: State<'_, PasswordGateState>,
+    mut req: Endpoint,
+) -> Result<EndpointResponse> {
+    maybe_unlock
+    Ok(state.lock().await.endpoint(req) maybe_await?)
+}
+```
+
+`maybe_unlock` expands to nothing for endpoints absent from the manifest, so the ~91 ungated
+commands are byte-identical to what they were before the gate existed. The `#[allow]` covers those
+expansions, where `app_handle`, `gate`, and `mut` all go unused.
+
+### Bridge path (apps)
+
+There is one dialog, not two. The `bridge-approval` system app collects the password inline: summary
+and password field in the same card, approved in one gesture. The main-window prompt is not used on
+this path, so nothing has to hide the approval runtime to uncover a dialog underneath it, and the
+hide/restore flicker that arrangement required is gone.
+
+`PendingBridgeApprovalView` carries `requiresPassword`, computed when the approval is queued, and the
+card renders its field from that. The flag is a hint, not the authority.
+
+`process_after_approval` (`crates/sage-apps/src/bridge/bridge_request.rs:86`) **peeks** the pending
+approval rather than consuming it, so a wrong password can leave it queued:
+
+1. Every rejection that does not depend on the password — denied, expired, wallet re-bound — resolves
+   first, so the user is never asked to type a password into a doomed approval.
+2. `approval_needs_password` re-derives, at resolve time, whether this body reaches a secret and
+   whether the wallet it targets is protected. A card whose hint was stale gets `passwordRequired`
+   back and shows the field.
+3. The candidate is verified against the keychain — the fingerprint in the body for `GetSecretKey`,
+   the active wallet otherwise.
+4. Wrong password: `password_attempts` on the host record increments and the card gets
+   `wrongPassword { attemptsRemaining }`. The approval stays queued and the app keeps waiting. The
+   counter lives on the host, so reloading the approval webview cannot reset it.
+5. `MAX_ATTEMPTS` spent: the approval is consumed, the app's request fails `unauthorized` with
+   `TOO_MANY_ATTEMPTS_REASON`, and the card gets `tooManyAttempts`. Both paths share the constant
+   with the native prompt, so the two give the same number of tries.
+6. Verified: the approval is consumed and the password goes straight into `process_shared`.
+
+An approval that needs a password is queued with `BRIDGE_APPROVAL_PASSWORD_TIMEOUT_MS` (3 minutes)
+instead of the usual 30 seconds: reading a summary, typing a master password, and recovering from a
+typo does not fit in 30 seconds. The deadline is still a single clock an app cannot extend.
+
+`ResolveBridgeApprovalArgs` carries the password and a hand-written `Debug` that prints it as
+`Some("<redacted>")`, matching `BridgeTools`. The value is never written to the approval record and
+never crosses back into an app runtime.
+
+Only the four approval bodies that reach a wallet secret are gated — `GetSecretKey`, `SendXch`,
+`SignCoinSpends`, `SignMessage`. `approval_requires_password` matches on the body exhaustively, with
+no catch-all, so `CapabilityGrant` and `NetworkWhitelistGrant` prompt for nothing and a new body must
+opt in deliberately.
+
+The verified password is threaded into the handler through `BridgeTools`, so the conversions in
+`send_xch.rs`, `sign_message.rs`, `sign_coin_spends.rs`, and `get_secret_key.rs` set `Some(...)`
+instead of the hardcoded `None`. `BridgeTools` carries a hand-written `Debug` that prints the field
+as `Some("<redacted>")`.
+
+Collecting the password in the `bridge-approval` webview rather than the main one is a deliberate
+trust-boundary choice: that webview is host-owned system UI, never a third-party app runtime, and the
+value travels the system bridge straight to the host. Apps are desktop-only, so nothing is lost by
+this path no longer consulting the frontend's biometric gate, which only ever applied on mobile.
+
+The bridge does not go through the endpoint macro, so the gating manifest does not apply to it. Both
+`send_xch` and `sign_coin_spends` reach a secret on every bridge call — the former hardcodes
+`auto_submit: true`, the latter signs unconditionally — so the bridge gate is unconditional too.
+
+Separately, `WalletSendXch::approval_request` stops returning `Ok(None)` on a protected wallet even
+when `WalletSendXchAutoSubmit` is granted. A password-protected wallet always gets an approval; silent
+auto-submit is incompatible with password protection.
+
+### Frontend
+
+`PasswordContext` inverts. It stops exporting `requestPassword` as something callers invoke and
+instead subscribes to `PasswordRequest`, runs its existing three-way decision, and replies via
+`submit_password_response`. `PasswordDialog` itself is unchanged.
+
+All call sites then drop their password plumbing:
+
+- `WalletCard.tsx`, `ConfirmationDialog.tsx`, `useOfferProcessor.ts`, `Offer.tsx` — remove the
+  `requestPassword` call and the `password` field on the command.
+- `src/walletconnect/` — `chip0002.ts`, `high-level.ts`, and `offers.ts` lose their prompts;
+  `handler.ts` and `WalletConnectContext.tsx` drop `requestPassword` and `hasPassword` from the
+  handler context entirely.
+- Two sites in `Settings.tsx` gate starting the RPC server and toggling run-on-startup. No wallet
+  secret is involved, so there is no Rust unlock operation to hang them off. They get a new,
+  explicitly named `requireLocalAuth()` from the same provider: a UI-only biometric gate with no Rust
+  round-trip.
+
+## Error handling
+
+| Condition                           | Result                                             |
+| ----------------------------------- | -------------------------------------------------- |
+| Correct password                    | Endpoint executes                                  |
+| Wrong password, attempts 1-2        | Re-prompt with inline error, `attempt` incremented |
+| Wrong password, attempt 3           | `Unauthorized`                                     |
+| User cancels                        | Distinct cancellation error; frontend stays silent |
+| Approval deadline lapses mid-prompt | `approval_timeout`, dialog closes                  |
+| Main webview absent or unresponsive | Gate fails; operation does not proceed             |
+
+## Testing
+
+**Rust**
+
+- Gate unit tests against a mock responder: correct password; wrong-then-right; three strikes;
+  cancellation; prompt timeout.
+- The drift tests over `password-gating.json` described under **Gating manifest**: key set ==
+  request types with a `password` field, `fingerprint` mode == those with a `fingerprint` field,
+  `auto_submit` mode == endpoints that only forward the password to `transact`/`transact_with`.
+- A bridge test that a protected wallet forces an approval despite the `WalletSendXchAutoSubmit` grant.
+- Bridge attempt-accounting tests: a wrong password reports the attempts left, the last one exhausts
+  the approval, over-counting still fails closed, and only secret-bearing bodies require a password
+  (with `GetSecretKey` targeting its own fingerprint).
+- Drift-reconciliation tests in `sage-rpc`: `login` re-derives a flag that was forced false, and
+  `reconcile_all_key_protection` corrects every wallet in both directions and is idempotent.
+- Existing `sage-rpc` password tests must pass **unchanged** — the regression canary proving the core
+  was not disturbed.
+
+**TypeScript**
+
+The repository has no frontend test runner (no vitest or jest, no `test` script in `package.json`),
+and bootstrapping one inside this feature is out of scope. Frontend changes are verified by
+`pnpm run build:frontend` (`tsc -b`), `pnpm run lint`, and a manual smoke run covering all three
+responder branches: password dialog on a protected wallet, biometric gate on an unprotected wallet
+with biometrics on, and immediate `NoAuthNeeded` otherwise.
+
+## Files touched
+
+**New**
+
+- `crates/sage-password-gate/` (`lib.rs`, `types.rs`, `prompter.rs`, `resolve.rs`)
+
+**Rust**
+
+- `src-tauri/src/commands.rs` — repeat block, `submit_password_response`
+- `src-tauri/src/lib.rs` — register state, command, and event
+- `src-tauri/src/error.rs` — `From<sage_password_gate::Error>`
+- `crates/sage-apps/Cargo.toml`, `src-tauri/Cargo.toml`, root `Cargo.toml` — new crate wiring
+- `crates/sage-api/macro/src/lib.rs` — `maybe_unlock` and `GateMode`
+- `crates/sage-api/password-gating.json` — the gating manifest
+- `crates/sage-api/src/lib.rs` — the drift tests
+- `crates/sage-apps/src/bridge/bridge_request.rs` — gate call in `process_after_approval`
+- `crates/sage-apps/src/bridge/methods/user/wallet/{send_xch,sign_message,sign_coin_spends,get_secret_key}.rs`
+- `crates/sage-apps/src/bridge/methods/shared.rs` — `BridgeTools.password`
+- `src-tauri/permissions/main-host.toml` — `submit_password_response` in `commands.allow`
+
+**TypeScript**
+
+- `src/contexts/PasswordContext.tsx`, `src/hooks/usePassword.ts`
+- `src/contexts/WalletConnectContext.tsx`, `src/walletconnect/{handler,commands/chip0002,commands/high-level,commands/offers}.ts`
+- `src/components/{WalletCard,ConfirmationDialog}.tsx`
+- `src/hooks/useOfferProcessor.ts`, `src/pages/{Offer,Settings}.tsx`
+- `src/bindings.ts` (regenerated)
+
+**Unchanged, deliberately**
+
+- `crates/sage/src/**` — all endpoints and `Sage::sign`
+- `crates/sage-rpc/src/**`
+- `password: Option<String>` on all `sage-api` request types
diff --git a/docs/superpowers/specs/2026-03-16-protection-matrix.md b/docs/superpowers/specs/2026-03-16-protection-matrix.md
deleted file mode 100644
index 323f3f44c..000000000
--- a/docs/superpowers/specs/2026-03-16-protection-matrix.md
+++ /dev/null
@@ -1,90 +0,0 @@
-# Operation Protection Matrix
-
-Analysis of biometric vs. password protection across all protected operations in Sage wallet.
-
-## Architecture
-
-Password enforcement happens at two distinct layers, depending on `auto_submit`:
-
-1. **ConfirmationDialog (centralized)** — When `auto_submit: false` (the default for all UI operations), the Rust `transact()` function ignores the password entirely and returns unsigned coin spends. The user reviews the transaction in `ConfirmationDialog`, whose Submit button calls `requestPassword` → `signCoinSpends` → `submitTransaction`. This is the single enforcement point for all normal UI transaction flows.
-
-2. **Direct `requestPassword` (per-call-site)** — WalletConnect handlers set `auto_submit: true`, which means signing happens inside the Rust command itself. These call `requestPassword` and pass the password to the command directly.
-
-Password and biometric are mutually exclusive. `requestPassword(hasPassword)` routes to password dialog OR biometric prompt, never both. A wallet with a password set never triggers biometric.
-
-## Matrix — UI Operations
-
-Legend: ✅ = protected, 🔄 = redundant double-prompt, ⚠️ = bug, ❌ = not protected
-
-| Operation                                           | Protected | Mechanism                           | Status | Call site                                                      |
-| --------------------------------------------------- | :-------: | ----------------------------------- | :----: | -------------------------------------------------------------- |
-| **Transaction Operations (via ConfirmationDialog)** |           |                                     |        |                                                                |
-| Send XCH                                            |    ✅     | ConfirmationDialog                  |   OK   | `Send.tsx:188`                                                 |
-| Send CAT                                            |    ✅     | ConfirmationDialog                  |   OK   | `Send.tsx:206`                                                 |
-| Bulk send XCH                                       |    ✅     | ConfirmationDialog                  |   OK   | `Send.tsx:181`                                                 |
-| Bulk send CAT                                       |    ✅     | ConfirmationDialog                  |   OK   | `Send.tsx:198`                                                 |
-| Combine coins                                       |    ✅     | ConfirmationDialog (via Token.tsx)  |   OK   | `OwnedCoinsCard.tsx:261`                                       |
-| Split coins                                         |    ✅     | ConfirmationDialog (via Token.tsx)  |   OK   | `OwnedCoinsCard.tsx:310`                                       |
-| Auto-combine XCH/CAT                                |    ✅     | ConfirmationDialog (via Token.tsx)  |   OK   | `OwnedCoinsCard.tsx:363`                                       |
-| Issue CAT                                           |    ✅     | ConfirmationDialog                  |   OK   | `IssueToken.tsx:48`                                            |
-| Multi-send                                          |     —     | No frontend binding                 |  N/A   | Rust-only; no TypeScript binding or UI                         |
-| Sign coin spends (Sign button)                      |    ✅     | Direct `requestPassword`            |   OK   | `ConfirmationDialog.tsx:520`                                   |
-| Sign coin spends (Submit button)                    |    ✅     | Direct `requestPassword`            |   OK   | `ConfirmationDialog.tsx:627`                                   |
-| **NFTs / DIDs**                                     |           |                                     |        |                                                                |
-| Bulk mint NFTs                                      |    ✅     | ConfirmationDialog                  |   OK   | `MintNft.tsx:140`                                              |
-| Transfer NFTs                                       |    ✅     | ConfirmationDialog                  |   OK   | `MultiSelectActions.tsx:135`                                   |
-| Burn NFTs                                           |    ✅     | ConfirmationDialog                  |   OK   | `MultiSelectActions.tsx:168`                                   |
-| Add NFT URI                                         |    ✅     | ConfirmationDialog                  |   OK   | `NftCard.tsx:236`                                              |
-| Assign NFTs to DID                                  |    ✅     | ConfirmationDialog                  |   OK   | `MultiSelectActions.tsx:152`                                   |
-| Create DID                                          |    ✅     | ConfirmationDialog                  |   OK   | `CreateProfile.tsx:46`                                         |
-| Transfer DIDs                                       |    ✅     | ConfirmationDialog                  |   OK   | `DidList.tsx:166`                                              |
-| Burn DIDs                                           |    ✅     | ConfirmationDialog                  |   OK   | `DidList.tsx:182`                                              |
-| Normalize DIDs                                      |    ✅     | ConfirmationDialog                  |   OK   | `DidList.tsx:198`                                              |
-| **Options**                                         |           |                                     |        |                                                                |
-| Mint option                                         |    ✅     | ConfirmationDialog                  |   OK   | `MintOption.tsx:91`                                            |
-| Transfer options                                    |    ✅     | ConfirmationDialog                  |   OK   | `useOptionActions.tsx:63`                                      |
-| Exercise options                                    |    ✅     | ConfirmationDialog                  |   OK   | `useOptionActions.tsx:43`                                      |
-| Burn options                                        |    ✅     | ConfirmationDialog                  |   OK   | `useOptionActions.tsx:83`                                      |
-| **Clawback**                                        |           |                                     |        |                                                                |
-| Claw back coins                                     |    ✅     | ConfirmationDialog (via Token.tsx)  |   OK   | `ClawbackCoinsCard.tsx:215`                                    |
-| Finalize clawback                                   |    ✅     | ConfirmationDialog (via Token.tsx)  |   OK   | `ClawbackCoinsCard.tsx:260`                                    |
-| **Offers**                                          |           |                                     |        |                                                                |
-| Make offer (split-NFT path)                         |    ✅     | Direct `requestPassword`            |   OK   | `useOfferProcessor.ts:116` — password forwarded                |
-| Make offer (single/non-split)                       |    ✅     | Direct `requestPassword`            |   OK   | `useOfferProcessor.ts:160` — fixed: password now forwarded     |
-| Take offer                                          |    ✅     | Direct `requestPassword`            |   OK   | `Offer.tsx:105` — signs unconditionally; page prompts          |
-| Cancel offer                                        |    ✅     | ConfirmationDialog                  |   OK   | `OfferRowCard.tsx` — `cancel_offer` defers to `transact()`     |
-| Cancel all offers                                   |    ✅     | ConfirmationDialog                  |   OK   | `Offers.tsx` — `cancel_offers` defers to `transact()`          |
-| **Secrets / Key Management**                        |           |                                     |        |                                                                |
-| View mnemonic / secret key                          |    ✅     | Direct `requestPassword`            |   OK   | `WalletCard.tsx:194`                                           |
-| Delete wallet key                                   |    ✅     | Direct `requestPassword`            |   OK   | `WalletCard.tsx:82` — enforced in `delete_key` (Rust)          |
-| Import key (secret/mnemonic)                        |    ❌     | None                                |   OK   | UI sends no password; set later in Settings (API field exists) |
-| Set / Change / Remove password                      |    ✅     | Inline form (not `requestPassword`) |   OK   | `Settings.tsx:1238`                                            |
-| **Key Derivation**                                  |           |                                     |        |                                                                |
-| Increase derivation (hardened)                      |    ✅     | Direct `requestPassword`            |   OK   | `Settings.tsx:1269`                                            |
-| Increase derivation (unhardened)                    |    ❌     | None                                |   OK   | No private key needed                                          |
-| **Unprotected (by design)**                         |           |                                     |        |                                                                |
-| Enable/disable biometric toggle                     |    ❌     | None                                |   OK   | No-op on password-protected wallets (mutual exclusivity)       |
-| View balances / addresses / NFTs                    |    ❌     | None                                |   OK   | Read-only                                                      |
-| Submit pre-signed transaction                       |    ❌     | None                                |   OK   | No key access needed                                           |
-| Login / logout wallet                               |    ❌     | None                                |   OK   | No secret access                                               |
-| Rename / resync / emoji                             |    ❌     | None                                |   OK   | Metadata only                                                  |
-
-## Matrix — WalletConnect Operations
-
-All WC handlers use `auto_submit: true` (except `signCoinSpends`), so password is required at the call site. All are correctly wired via `HandlerContext.requestPassword`.
-
-| Operation                             | Protected | auto_submit | Status | Call site             |
-| ------------------------------------- | :-------: | :---------: | :----: | --------------------- |
-| `chia_send` (XCH/CAT)                 |    ✅     |   `true`    |   OK   | `high-level.ts:54/64` |
-| `chia_bulkMintNfts`                   |    ✅     |   `true`    |   OK   | `high-level.ts:100`   |
-| `chia_createOffer`                    |    ✅     |   not set   |   OK   | `offers.ts:12`        |
-| `chia_takeOffer`                      |    ✅     |   `true`    |   OK   | `offers.ts:41`        |
-| `chia_cancelOffer`                    |    ✅     |   `true`    |   OK   | `offers.ts:58`        |
-| `chip0002_signCoinSpends`             |    ✅     |   `false`   |   OK   | `chip0002.ts:81`      |
-| `chip0002_signMessage`                |    ✅     |     N/A     |   OK   | `chip0002.ts:105`     |
-| `chia_signMessageByAddress`           |    ✅     |     N/A     |   OK   | `high-level.ts`       |
-| WC read-only (connect, chainId, etc.) |    ❌     |     N/A     |   OK   | No signing            |
-
-## Remaining Design Considerations
-
-1. **Session caching asymmetry** — biometric caches for 5 minutes; password never caches.
diff --git a/packages/sage-system-app-sdk/src/runtime.ts b/packages/sage-system-app-sdk/src/runtime.ts
index 17be81d21..cca32524d 100644
--- a/packages/sage-system-app-sdk/src/runtime.ts
+++ b/packages/sage-system-app-sdk/src/runtime.ts
@@ -402,7 +402,10 @@ export function initSageSystemRuntimeBridge(): boolean {
           },
 
           async resolve(input: Generated.ResolveBridgeApprovalArgs) {
-            return await callHost<void>('bridgeApprovals.resolve', input);
+            return await callHost<Generated.ResolveBridgeApprovalResult>(
+              'bridgeApprovals.resolve',
+              input,
+            );
           },
 
           onChanged(
diff --git a/packages/sage-system-app-sdk/src/types.ts b/packages/sage-system-app-sdk/src/types.ts
index 05b93bab3..d8ab62a6b 100644
--- a/packages/sage-system-app-sdk/src/types.ts
+++ b/packages/sage-system-app-sdk/src/types.ts
@@ -76,7 +76,9 @@ export type SageSystemFileSystemClient = {
 
 export type SageSystemBridgeApprovalsClient = {
   listPending(): Promise<Generated.PendingBridgeApprovalView[]>;
-  resolve(input: Generated.ResolveBridgeApprovalArgs): Promise<void>;
+  resolve(
+    input: Generated.ResolveBridgeApprovalArgs,
+  ): Promise<Generated.ResolveBridgeApprovalResult>;
   onChanged(
     handler: (event: Generated.BridgeApprovalsChangedEvent) => void,
   ): () => void;
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 65ff2513e..992d6514f 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -27,6 +27,7 @@ required-features = ["dev-tools"]
 sage = { workspace = true }
 sage-api = { workspace = true, features = ["tauri"] }
 sage-api-macro = { workspace = true }
+sage-password-gate = { workspace = true }
 sage-config = { workspace = true }
 sage-wallet = { workspace = true }
 sage-rpc = { workspace = true }
diff --git a/src-tauri/permissions/main-host.toml b/src-tauri/permissions/main-host.toml
index 741e81fbc..1a23549e9 100644
--- a/src-tauri/permissions/main-host.toml
+++ b/src-tauri/permissions/main-host.toml
@@ -18,6 +18,7 @@ commands.allow = [
     "get_wallet_address",
     "change_password",
     "reconcile_key_protection",
+    "submit_password_response",
     "send_xch",
     "bulk_send_xch",
     "combine",
diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs
index 016532255..ca6de53d8 100644
--- a/src-tauri/src/commands.rs
+++ b/src-tauri/src/commands.rs
@@ -12,6 +12,7 @@ use sage_api_macro::impl_endpoints_tauri;
 #[cfg(not(mobile))]
 use sage_apps::ensure_initial_sandbox_run;
 use sage_config::{NetworkConfig, Wallet, WalletDefaults};
+use sage_password_gate::{PasswordGateState, PasswordOutcome};
 use sage_rpc::start_rpc;
 use serde::{Deserialize, Serialize};
 use specta::{Type, specta};
@@ -39,6 +40,42 @@ pub async fn initialize(
     app_state::initialize(app_handle.clone(), &mut sage).await?;
     drop(sage);
 
+    // Correct any wallet whose `password_protected` flag has drifted from the
+    // keychain. Off the startup path because it costs an Argon2 probe per
+    // wallet.
+    //
+    // The wallet restored from `config.global.fingerprint` is swept first: it
+    // is active without ever passing through `login`, and the bridge approval
+    // gate reads the flag against a key that is already unlocked, so drift
+    // there signs without a prompt instead of failing closed. The rest fail
+    // closed at the keychain and are healed on demand.
+    //
+    // One fingerprint per lock acquisition, each probe on a blocking thread:
+    // a single sweep must not pin the shared state or an async worker for the
+    // length of N password hashes.
+    let app_state = (*state).clone();
+
+    tokio::spawn(async move {
+        let fingerprints = app_state.lock().await.sweep_fingerprints();
+        let mut corrected = 0;
+
+        for fingerprint in fingerprints {
+            let mut sage = app_state.lock().await;
+
+            match tokio::task::block_in_place(|| sage.reconcile_one_key_protection(fingerprint)) {
+                Ok(true) => corrected += 1,
+                Ok(false) => {}
+                Err(error) => {
+                    error!("Error while reconciling password protection: {error:?}");
+                }
+            }
+        }
+
+        if corrected > 0 {
+            tracing::info!("Corrected the password-protection flag on {corrected} wallet(s)");
+        }
+    });
+
     let app_state = (*state).clone();
 
     tokio::spawn(async move {
@@ -68,7 +105,14 @@ impl_endpoints_tauri! {
     (repeat
         #[command]
         #[specta]
-        pub async fn endpoint(state: State<'_, AppState>, req: Endpoint) -> Result<EndpointResponse> {
+        #[allow(unused_variables, unused_mut)]
+        pub async fn endpoint(
+            app_handle: AppHandle,
+            state: State<'_, AppState>,
+            gate: State<'_, PasswordGateState>,
+            mut req: Endpoint,
+        ) -> Result<EndpointResponse> {
+            maybe_unlock
             Ok(state.lock().await.endpoint(req) maybe_await?)
         }
     )
@@ -258,3 +302,13 @@ pub async fn get_logs(state: State<'_, AppState>) -> Result<Vec<LogFile>> {
 
     Ok(log_files)
 }
+
+#[command]
+#[specta]
+pub async fn submit_password_response(
+    gate: State<'_, PasswordGateState>,
+    request_id: String,
+    outcome: PasswordOutcome,
+) -> Result<()> {
+    Ok(gate.deliver(&request_id, outcome).await?)
+}
diff --git a/src-tauri/src/error.rs b/src-tauri/src/error.rs
index 027fb32fa..b3587366c 100644
--- a/src-tauri/src/error.rs
+++ b/src-tauri/src/error.rs
@@ -19,6 +19,15 @@ impl From<sage::Error> for Error {
     }
 }
 
+impl From<sage_password_gate::Error> for Error {
+    fn from(error: sage_password_gate::Error) -> Self {
+        Self {
+            kind: error.kind,
+            reason: error.reason,
+        }
+    }
+}
+
 impl fmt::Display for Error {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         write!(f, "{}", self.reason)
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 147a81c2e..909dec5d7 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -17,6 +17,7 @@ mod error;
 
 #[cfg(not(mobile))]
 use sage_apps as apps;
+use sage_password_gate as password_gate;
 
 #[cfg(not(mobile))]
 use sage_apps::{
@@ -147,9 +148,11 @@ macro_rules! sage_commands {
             commands::move_key,
             commands::download_cni_offercode,
             commands::get_logs,
+            commands::submit_password_response,
             commands::is_asset_owned,
             commands::change_password,
             commands::reconcile_key_protection,
+            commands::reconcile_drifted_key_protection,
             commands::get_xch_usd_price,
             $($extra_command)*
         ]
@@ -184,7 +187,7 @@ fn specta_builder() -> Builder<tauri::Wry> {
             apps::apps_get_auto_update_enabled,
             apps::apps_set_auto_update_enabled,
         ])
-        .events(collect_events![SyncEvent])
+        .events(collect_events![SyncEvent, password_gate::PasswordRequest])
 }
 
 #[cfg(all(debug_assertions, not(mobile)))]
@@ -212,7 +215,7 @@ pub fn run() {
     let builder = Builder::<tauri::Wry>::new()
         .error_handling(ErrorHandlingMode::Throw)
         .commands(sage_commands![])
-        .events(collect_events![SyncEvent]);
+        .events(collect_events![SyncEvent, password_gate::PasswordRequest]);
 
     let mut tauri_builder = tauri::Builder::default()
         .plugin(tauri_plugin_opener::init())
@@ -283,6 +286,7 @@ pub fn run() {
             app.manage(Initialized(Mutex::new(false)));
             app.manage(RpcTask(Mutex::new(None)));
             app.manage(app_state);
+            app.manage(password_gate::PasswordGateState::default());
 
             #[cfg(not(mobile))]
             {
diff --git a/src/bindings.ts b/src/bindings.ts
index f02760306..3efb1ad12 100644
--- a/src/bindings.ts
+++ b/src/bindings.ts
@@ -359,6 +359,9 @@ async downloadCniOffercode(code: string) : Promise<string> {
 async getLogs() : Promise<LogFile[]> {
     return await TAURI_INVOKE("get_logs");
 },
+async submitPasswordResponse(requestId: string, outcome: PasswordOutcome) : Promise<null> {
+    return await TAURI_INVOKE("submit_password_response", { requestId, outcome });
+},
 async isAssetOwned(req: IsAssetOwned) : Promise<IsAssetOwnedResponse> {
     return await TAURI_INVOKE("is_asset_owned", { req });
 },
@@ -368,6 +371,9 @@ async changePassword(req: ChangePassword) : Promise<ChangePasswordResponse> {
 async reconcileKeyProtection(req: ReconcileKeyProtection) : Promise<ReconcileKeyProtectionResponse> {
     return await TAURI_INVOKE("reconcile_key_protection", { req });
 },
+async reconcileDriftedKeyProtection(req: ReconcileDriftedKeyProtection) : Promise<ReconcileDriftedKeyProtectionResponse> {
+    return await TAURI_INVOKE("reconcile_drifted_key_protection", { req });
+},
 async getXchUsdPrice(req: GetXchUsdPrice) : Promise<GetXchUsdPriceResponse> {
     return await TAURI_INVOKE("get_xch_usd_price", { req });
 },
@@ -443,8 +449,10 @@ async appsSetAutoUpdateEnabled(enabled: boolean) : Promise<boolean> {
 
 
 export const events = __makeEvents__<{
+passwordRequest: PasswordRequest,
 syncEvent: SyncEvent
 }>({
+passwordRequest: "password-request",
 syncEvent: "sync-event"
 })
 
@@ -957,7 +965,7 @@ export type DidRecord = { launcher_id: string; name: string | null; visible: boo
 export type EmptyResponse = Record<string, never>
 export type EnvironmentThemeView = { name: string; displayName: string; mostLike?: string | null; inherits?: string | null; cssVars: Partial<{ [key in string]: string }> }
 export type Error = { kind: ErrorKind; reason: string }
-export type ErrorKind = "wallet" | "api" | "not_found" | "unauthorized" | "incorrect_password" | "internal" | "database_migration" | "nfc"
+export type ErrorKind = "wallet" | "api" | "not_found" | "unauthorized" | "incorrect_password" | "password_cancelled" | "too_many_password_attempts" | "password_prompt_timed_out" | "internal" | "database_migration" | "nfc"
 /**
  * Exercise options
  */
@@ -2238,6 +2246,57 @@ amount: Amount }
 export type OptionAssets = { underlying_asset: Asset; underlying_amount: Amount; strike_asset: Asset; strike_amount: Amount; expiration_seconds: number }
 export type OptionRecord = { launcher_id: string; name: string | null; visible: boolean; coin_id: string; address: string; amount: Amount; underlying_asset: Asset; underlying_amount: Amount; underlying_coin_id: string; strike_asset: Asset; strike_amount: Amount; expiration_seconds: number; created_height: number | null; created_timestamp: number | null }
 export type OptionSortMode = "name" | "created_height" | "expiration_seconds"
+/**
+ * Attached to a re-prompt after an incorrect password.
+ */
+export type PasswordAttemptError = { attemptsRemaining: number }
+/**
+ * How the frontend answered a password request.
+ */
+export type PasswordOutcome = 
+/**
+ * The user supplied a password.
+ */
+{ kind: "password"; password: string } | 
+/**
+ * No authentication was required, or a biometric gate already passed.
+ */
+{ kind: "no_auth_needed" } | 
+/**
+ * The user dismissed the prompt.
+ */
+{ kind: "cancelled" }
+/**
+ * The password prompt as it crosses to JavaScript.
+ * 
+ * Emission targets the `main` webview (see `prompter::SAGE_WEBVIEW_LABEL`),
+ * but that is **not** an isolation guarantee: Tauri's event filter
+ * short-circuits for listeners registered with `EventTarget::Any`, and
+ * `src-tauri/capabilities/apps.json` grants app webviews
+ * `core:event:allow-listen`. Any app runtime can therefore observe this
+ * payload. It deliberately carries nothing sensitive -- no fingerprint, no
+ * wallet identity, and of course no password. The password itself only ever
+ * travels the other way, through the `submit_password_response` command,
+ * which is not granted to app webviews.
+ */
+export type PasswordRequest = { requestId: string; 
+/**
+ * Advisory: the wallet's stored `password_protected` flag. The frontend
+ * still decides between password dialog, biometric gate, and no auth,
+ * because Rust does not know whether biometrics are enabled.
+ */
+requiresPassword: boolean; 
+/**
+ * 1-based. Increments on each incorrect-password re-prompt.
+ */
+attempt: number; 
+/**
+ * Retained despite being observable by app webviews: the dialog needs it
+ * to show "N attempts remaining", and a bare retry counter identifies no
+ * wallet and reveals nothing an observer could not already infer from the
+ * re-prompts themselves.
+ */
+error: PasswordAttemptError | null }
 export type PeerRecord = { ip_addr: string; port: number; peak_height: number; user_managed: boolean }
 export type PendingTransactionRecord = { transaction_id: string; fee: Amount; submitted_at: number | null; spent: TransactionCoinRecord[]; created: TransactionCoinRecord[] }
 /**
@@ -2276,6 +2335,19 @@ pages_vacuumed: number;
  * Number of WAL pages checkpointed
  */
 wal_pages_checkpointed: number }
+/**
+ * Re-derive the password-protection flag for every wallet that could be
+ * drifted *false* — i.e. flagged unprotected but holding a secret key
+ */
+export type ReconcileDriftedKeyProtection = Record<string, never>
+/**
+ * Response with the number of wallets whose flag was corrected
+ */
+export type ReconcileDriftedKeyProtectionResponse = { 
+/**
+ * How many wallets had a drifted flag corrected
+ */
+corrected: number }
 /**
  * Response with the wallet's receive address
  * Re-derive a wallet's password-protection flag from its actual key state
diff --git a/src/components/ConfirmationDialog.tsx b/src/components/ConfirmationDialog.tsx
index 07dd3ff22..9442f5331 100644
--- a/src/components/ConfirmationDialog.tsx
+++ b/src/components/ConfirmationDialog.tsx
@@ -9,7 +9,6 @@ import {
 } from '@/components/ui/dialog';
 import { LoadingButton } from '@/components/ui/loading-button';
 import { useErrors } from '@/hooks/useErrors';
-import { usePassword } from '@/hooks/usePassword';
 import { useWallet } from '@/contexts/WalletContext';
 import { fromMojos } from '@/lib/utils';
 import { useWalletState } from '@/state';
@@ -67,8 +66,6 @@ export default function ConfirmationDialog({
   const ticker = walletState.sync.unit.ticker;
 
   const { addError } = useErrors();
-  const { requestPassword } = usePassword();
-  const { wallet } = useWallet();
   const { isReadOnly, allowUnsigned } = useWallet();
 
   const isColdWalletUnsignedMode = isReadOnly && allowUnsigned;
@@ -531,11 +528,6 @@ export default function ConfirmationDialog({
                   <ReadOnlyButton
                     size='sm'
                     onClick={async () => {
-                      const password = await requestPassword(
-                        wallet?.has_password ?? false,
-                      );
-                      if (password === undefined) return;
-
                       commands
                         .signCoinSpends({
                           coin_spends:
@@ -544,7 +536,6 @@ export default function ConfirmationDialog({
                               : 'coin_spends' in response
                                 ? response.coin_spends
                                 : response.spend_bundle.coin_spends,
-                          password,
                         })
                         .then((data) => {
                           setSignature(data.spend_bundle.aggregated_signature);
@@ -660,15 +651,9 @@ export default function ConfirmationDialog({
                     response !== null &&
                     'coin_spends' in response
                   ) {
-                    const password = await requestPassword(
-                      wallet?.has_password ?? false,
-                    );
-                    if (password === undefined) return;
-
                     const data = await commands
                       .signCoinSpends({
                         coin_spends: response.coin_spends,
-                        password,
                       })
                       .catch(addError);
 
diff --git a/src/components/WalletCard.tsx b/src/components/WalletCard.tsx
index 0aafd7b4d..1e5a870f3 100644
--- a/src/components/WalletCard.tsx
+++ b/src/components/WalletCard.tsx
@@ -21,7 +21,6 @@ import {
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
 import { useErrors } from '@/hooks/useErrors';
-import { usePassword } from '@/hooks/usePassword';
 import { useSortable } from '@dnd-kit/sortable';
 import { CSS } from '@dnd-kit/utilities';
 import { t } from '@lingui/core/macro';
@@ -66,7 +65,6 @@ export function WalletCard({
   const navigate = useNavigate();
   const { addError } = useErrors();
   const { setWallet } = useWallet();
-  const { requestPassword } = usePassword();
 
   const [isDeleteOpen, setIsDeleteOpen] = useState(false);
   const [isDetailsOpen, setIsDetailsOpen] = useState(false);
@@ -79,14 +77,8 @@ export function WalletCard({
   const { currentTheme } = useTheme();
 
   const deleteSelf = async () => {
-    const password = await requestPassword(info.has_password);
-    if (password === undefined) {
-      setIsDeleteOpen(false);
-      return;
-    }
-
     await commands
-      .deleteKey({ fingerprint: info.fingerprint, password })
+      .deleteKey({ fingerprint: info.fingerprint })
       .then(() => {
         setKeys(keys.filter((key) => key.fingerprint !== info.fingerprint));
       })
@@ -177,24 +169,12 @@ export function WalletCard({
         return;
       }
 
-      const password = await requestPassword(info.has_password);
-      if (password === undefined) {
-        setIsDetailsOpen(false);
-        return;
-      }
-
       commands
-        .getSecretKey({ fingerprint: info.fingerprint, password })
+        .getSecretKey({ fingerprint: info.fingerprint })
         .then((data) => data.secrets !== null && setSecrets(data.secrets))
         .catch(addError);
     })();
-  }, [
-    isDetailsOpen,
-    info.fingerprint,
-    info.has_password,
-    addError,
-    requestPassword,
-  ]);
+  }, [isDetailsOpen, info.fingerprint, info.has_password, addError]);
 
   const values = useSortable({
     id: draggable ? info.fingerprint : 'not-draggable',
diff --git a/src/components/dialogs/OfferCreationProgressDialog.tsx b/src/components/dialogs/OfferCreationProgressDialog.tsx
index 2927bbe08..f265b93f7 100644
--- a/src/components/dialogs/OfferCreationProgressDialog.tsx
+++ b/src/components/dialogs/OfferCreationProgressDialog.tsx
@@ -56,6 +56,7 @@ export function OfferCreationProgressDialog({
   const {
     createdOffers,
     isProcessing,
+    processingFailed,
     processOffer,
     clearProcessedOffers,
     cancelProcessing,
@@ -76,7 +77,11 @@ export function OfferCreationProgressDialog({
       createdOffers.length > 0 &&
       !isUnknown &&
       !isProcessing &&
-      !isCanceling
+      !isCanceling &&
+      // A partial batch is shown to the user but never auto-uploaded: the
+      // run failed (e.g. a password prompt was cancelled mid-batch), so
+      // publishing what did get created is not something they asked for.
+      !processingFailed
     ) {
       let isMounted = true;
 
@@ -143,6 +148,7 @@ export function OfferCreationProgressDialog({
     enabledMarketplaces,
     isProcessing,
     isCanceling,
+    processingFailed,
   ]);
 
   // Start processing when dialog opens
@@ -167,7 +173,9 @@ export function OfferCreationProgressDialog({
               reason: error instanceof Error ? error.message : t`Unknown error`,
             });
           }
-          onOpenChange(false);
+          // Closing happens in the effect below, which can see whether the
+          // failed run left partial offers worth showing; this catch's
+          // `createdOffers` closure is stale.
         }
       };
       startProcessing();
@@ -181,6 +189,16 @@ export function OfferCreationProgressDialog({
     onOpenChange,
   ]);
 
+  // After a failed run: close outright when nothing was created, but stay
+  // open on a partial batch so the "Offers Created" view shows the offers
+  // that DO exist (they are live in the wallet; hiding them would leave the
+  // user unaware of offers others could still take).
+  useEffect(() => {
+    if (processingFailed && !isProcessing && createdOffers.length === 0) {
+      onOpenChange(false);
+    }
+  }, [processingFailed, isProcessing, createdOffers, onOpenChange]);
+
   // Reset processing state when dialog closes
   useEffect(() => {
     if (!open) {
diff --git a/src/components/dialogs/PasswordDialog.tsx b/src/components/dialogs/PasswordDialog.tsx
index 8f7803615..aae57e3f0 100644
--- a/src/components/dialogs/PasswordDialog.tsx
+++ b/src/components/dialogs/PasswordDialog.tsx
@@ -1,5 +1,5 @@
 import { t } from '@lingui/core/macro';
-import { Trans } from '@lingui/react/macro';
+import { Plural, Trans } from '@lingui/react/macro';
 import { KeyRoundIcon } from 'lucide-react';
 import { useCallback, useEffect, useRef, useState } from 'react';
 import { Button } from '../ui/button';
@@ -15,12 +15,14 @@ import { Input } from '../ui/input';
 
 export interface PasswordDialogProps {
   open: boolean;
+  attemptsRemaining?: number;
   onSubmit: (password: string) => void;
   onCancel: () => void;
 }
 
 export function PasswordDialog({
   open,
+  attemptsRemaining,
   onSubmit,
   onCancel,
 }: PasswordDialogProps) {
@@ -59,6 +61,16 @@ export function PasswordDialog({
             </Trans>
           </DialogDescription>
         </DialogHeader>
+        {attemptsRemaining !== undefined && (
+          <p className='text-sm text-destructive'>
+            <Trans>Incorrect password.</Trans>{' '}
+            <Plural
+              value={attemptsRemaining}
+              one='# attempt remaining.'
+              other='# attempts remaining.'
+            />
+          </p>
+        )}
         <Input
           ref={inputRef}
           type='password'
diff --git a/src/contexts/ErrorContext.tsx b/src/contexts/ErrorContext.tsx
index fb2167d8e..06bc81af5 100644
--- a/src/contexts/ErrorContext.tsx
+++ b/src/contexts/ErrorContext.tsx
@@ -7,7 +7,7 @@ import {
   DialogHeader,
   DialogTitle,
 } from '@/components/ui/dialog';
-import { reconcileActiveKeyProtection } from '@/state';
+import { reconcileDriftedKeyProtection } from '@/state';
 import { t } from '@lingui/core/macro';
 import { createContext, ReactNode, useCallback, useState } from 'react';
 import { toast } from 'react-toastify';
@@ -31,18 +31,35 @@ export function ErrorProvider({ children }: { children: ReactNode }) {
   const [errors, setErrors] = useState<CustomError[]>([]);
 
   const addError = useCallback((error: CustomError) => {
+    // The password-gate outcomes arrive as structured kinds (see
+    // sage-api's ErrorKind), so they are matched on kind and rendered as
+    // translated text; the English `reason` is purely human-facing.
+    if (error.kind === 'password_cancelled') {
+      // Deliberate user cancellation of the password prompt, not a failure.
+      return;
+    }
     if (error.kind === 'incorrect_password') {
       // Wrong password — AES decryption failed
       toast.error(t`Incorrect password`);
-      // Self-heal if the active wallet's has_password flag drifted false:
-      // this corrects it so the next attempt prompts for the password.
-      void reconcileActiveKeyProtection();
+      // Self-heal if a wallet's has_password flag drifted false: this
+      // corrects it so the next attempt prompts for the password. The sweep
+      // covers every wallet, not just the active one, because delete_key and
+      // get_secret_key gate on their own fingerprint from the wallet list.
+      void reconcileDriftedKeyProtection();
+      return;
+    }
+    if (error.kind === 'too_many_password_attempts') {
+      toast.error(t`Too many incorrect password attempts`);
+      return;
+    }
+    if (error.kind === 'password_prompt_timed_out') {
+      toast.error(t`Password prompt timed out`);
       return;
     }
     if (error.kind === 'unauthorized') {
       const reason = error.reason ?? '';
       if (reason.includes('not found') || reason.includes('No secret')) {
-        // KeyNotFound or NoSecretKey — wallet-level issue, not a transition
+        // KeyNotFound / NoSecretKey: a wallet-level issue, not a transition.
         toast.error(error.reason);
       }
       // NotLoggedIn / NoSigningKey during wallet transitions are silently ignored
diff --git a/src/contexts/PasswordContext.tsx b/src/contexts/PasswordContext.tsx
index 41c8d3722..f30475f04 100644
--- a/src/contexts/PasswordContext.tsx
+++ b/src/contexts/PasswordContext.tsx
@@ -1,19 +1,26 @@
 import { PasswordDialog } from '@/components/dialogs/PasswordDialog';
 import { useBiometric } from '@/hooks/useBiometric';
+import { commands, events, PasswordRequest } from '@/bindings';
 import { platform } from '@tauri-apps/plugin-os';
-import { createContext, ReactNode, useCallback, useRef, useState } from 'react';
+import {
+  createContext,
+  ReactNode,
+  useCallback,
+  useEffect,
+  useRef,
+  useState,
+} from 'react';
 
 const isMobile = platform() === 'ios' || platform() === 'android';
 
-// Biometric caching interval (5 minutes)
-const BIOMETRIC_CACHE_MS = 5 * 60 * 1000;
-
-interface PasswordRequest {
-  resolve: (password: string | null | undefined) => void;
-}
-
 export interface PasswordContextType {
-  requestPassword: (hasPassword: boolean) => Promise<string | null | undefined>;
+  /**
+   * UI-only authentication gate for actions that touch no wallet secret
+   * (starting the RPC server, toggling run-on-startup). Returns true if the
+   * caller may proceed. This deliberately does NOT go through the Rust
+   * password gate — there is no unlock operation behind it.
+   */
+  requireLocalAuth: () => Promise<boolean>;
 }
 
 export const PasswordContext = createContext<PasswordContextType | undefined>(
@@ -21,68 +28,110 @@ export const PasswordContext = createContext<PasswordContextType | undefined>(
 );
 
 export function PasswordProvider({ children }: { children: ReactNode }) {
-  const [open, setOpen] = useState(false);
-  const pendingRef = useRef<PasswordRequest | null>(null);
-  const { enabled: biometricEnabled } = useBiometric();
+  // A queue rather than a single slot: Rust can have multiple gated
+  // operations in flight concurrently (one per requestId), and each one
+  // needs a reply eventually or it hangs for the full 5-minute timeout.
+  // The dialog always shows the front of the queue; later requests wait
+  // their turn instead of clobbering the one in progress.
+  const [queue, setQueue] = useState<PasswordRequest[]>([]);
+  const pending = queue[0] ?? null;
+  // BiometricContext owns the single biometric gate (and its 5-minute
+  // cache); this context only decides *when* to invoke it.
+  const { enabled: biometricEnabled, promptIfEnabled } = useBiometric();
 
-  // Biometric caching for standalone gate
-  const lastBiometricPromptRef = useRef<number | null>(null);
+  const requireLocalAuth = useCallback(async (): Promise<boolean> => {
+    if (!isMobile) return true;
+    return promptIfEnabled();
+  }, [promptIfEnabled]);
 
-  const requestPassword = useCallback(
-    async (hasPassword: boolean): Promise<string | null | undefined> => {
-      // Case 1: Has password → password takes precedence, show dialog
-      if (hasPassword) {
-        return new Promise<string | null | undefined>((resolve) => {
-          pendingRef.current = { resolve };
-          setOpen(true);
+  // The listener reads biometric state through a ref so it can be registered
+  // exactly once. Re-registering on every `biometricEnabled` change would
+  // open a gap between unlisten and the new (async) listen resolving, and a
+  // PasswordRequest emitted in that gap would never be answered — the gated
+  // operation would hang for the full prompt timeout.
+  const biometricRef = useRef({ enabled: biometricEnabled, promptIfEnabled });
+  biometricRef.current = { enabled: biometricEnabled, promptIfEnabled };
+
+  useEffect(() => {
+    const unlisten = events.passwordRequest.listen(async ({ payload }) => {
+      // Case 1: password takes precedence — enqueue for the dialog. If a
+      // request with the same requestId is already queued, replace it in
+      // place rather than duplicating it. A wrong-password re-prompt arrives
+      // *after* handleSubmit dequeued the entry, so it carries an `error`
+      // payload but is no longer queued: put it back at the FRONT, resuming
+      // the dialog the user was just typing into, rather than appending it
+      // behind an unrelated request (where the user would mistake the next
+      // request's prompt for this retry and type this password into it).
+      if (payload.requiresPassword) {
+        setQueue((prev) => {
+          const index = prev.findIndex(
+            (r) => r.requestId === payload.requestId,
+          );
+          if (index === -1) {
+            return payload.error ? [payload, ...prev] : [...prev, payload];
+          }
+          const next = [...prev];
+          next[index] = payload;
+          return next;
         });
+        return;
       }
 
-      // Case 2: No password, biometric enabled → standalone biometric gate with 5-min cache
-      if (biometricEnabled && isMobile) {
-        const now = performance.now();
-        if (
-          lastBiometricPromptRef.current !== null &&
-          now - lastBiometricPromptRef.current < BIOMETRIC_CACHE_MS
-        ) {
-          return null; // Within cache window, skip prompt
-        }
-
-        try {
-          const { authenticate } = await import('@tauri-apps/plugin-biometric');
-          await authenticate('Authenticate to continue', {
-            allowDeviceCredential: false,
-          });
-          lastBiometricPromptRef.current = now;
-          return null;
-        } catch {
-          return undefined; // biometric failed/cancelled
-        }
+      // Case 2: no password, biometric enabled — standalone gate with cache.
+      if (isMobile && biometricRef.current.enabled) {
+        const ok = await biometricRef.current.promptIfEnabled();
+        await commands
+          .submitPasswordResponse(
+            payload.requestId,
+            ok ? { kind: 'no_auth_needed' } : { kind: 'cancelled' },
+          )
+          .catch((error) => console.error('password response failed', error));
+        return;
       }
 
-      // Case 3: No password, no biometric → no auth needed
-      return null;
-    },
-    [biometricEnabled],
-  );
+      // Case 3: no password, no biometric — nothing to do.
+      await commands
+        .submitPasswordResponse(payload.requestId, { kind: 'no_auth_needed' })
+        .catch((error) => console.error('password response failed', error));
+    });
 
-  const handleSubmit = useCallback((password: string) => {
-    setOpen(false);
-    pendingRef.current?.resolve(password);
-    pendingRef.current = null;
+    return () => {
+      unlisten.then((fn) => fn());
+    };
   }, []);
 
+  // A response can fail benignly: the Rust side times a request out after
+  // PROMPT_TIMEOUT and clears it, so a submit into a stale dialog gets
+  // NotFound. The operation's own timeout error already reaches the user via
+  // ErrorContext; here it only must not become an unhandled rejection.
+  const handleSubmit = useCallback(
+    (password: string) => {
+      if (!pending) return;
+      setQueue((prev) => prev.slice(1));
+      commands
+        .submitPasswordResponse(pending.requestId, {
+          kind: 'password',
+          password,
+        })
+        .catch((error) => console.error('password response failed', error));
+    },
+    [pending],
+  );
+
   const handleCancel = useCallback(() => {
-    setOpen(false);
-    pendingRef.current?.resolve(undefined);
-    pendingRef.current = null;
-  }, []);
+    if (!pending) return;
+    setQueue((prev) => prev.slice(1));
+    commands
+      .submitPasswordResponse(pending.requestId, { kind: 'cancelled' })
+      .catch((error) => console.error('password response failed', error));
+  }, [pending]);
 
   return (
-    <PasswordContext.Provider value={{ requestPassword }}>
+    <PasswordContext.Provider value={{ requireLocalAuth }}>
       {children}
       <PasswordDialog
-        open={open}
+        open={pending !== null}
+        attemptsRemaining={pending?.error?.attemptsRemaining ?? undefined}
         onSubmit={handleSubmit}
         onCancel={handleCancel}
       />
diff --git a/src/contexts/WalletConnectContext.tsx b/src/contexts/WalletConnectContext.tsx
index b271dc602..d949997e3 100644
--- a/src/contexts/WalletConnectContext.tsx
+++ b/src/contexts/WalletConnectContext.tsx
@@ -23,7 +23,6 @@ import { Switch } from '@/components/ui/switch';
 import { useWallet } from '@/contexts/WalletContext';
 import { useDefaultFee } from '@/hooks/useDefaultFee';
 import { useErrors } from '@/hooks/useErrors';
-import { usePassword } from '@/hooks/usePassword';
 import { decodeHexMessage, fromMojos, toMojos, isHex } from '@/lib/utils';
 import { useWalletState } from '@/state';
 import {
@@ -66,7 +65,6 @@ type SessionRequest = SignClientTypes.EventArguments['session_request'];
 export function WalletConnectProvider({ children }: { children: ReactNode }) {
   const { wallet, isReadOnly } = useWallet();
   const { addError } = useErrors();
-  const { requestPassword } = usePassword();
 
   const [signClient, setSignClient] = useState<Awaited<
     ReturnType<typeof SignClient.init>
@@ -106,8 +104,6 @@ export function WalletConnectProvider({ children }: { children: ReactNode }) {
           method,
           request.params.request.params,
           {
-            requestPassword,
-            hasPassword: wallet?.has_password ?? false,
             isReadOnly,
           },
         );
@@ -143,7 +139,7 @@ export function WalletConnectProvider({ children }: { children: ReactNode }) {
         });
       }
     },
-    [signClient, addError, requestPassword, wallet?.has_password, isReadOnly],
+    [signClient, addError, isReadOnly],
   );
 
   useEffect(() => {
diff --git a/src/hooks/useOfferProcessor.ts b/src/hooks/useOfferProcessor.ts
index 9634409a8..97d3803c9 100644
--- a/src/hooks/useOfferProcessor.ts
+++ b/src/hooks/useOfferProcessor.ts
@@ -1,6 +1,4 @@
 import { commands, OfferAmount } from '@/bindings';
-import { useWallet } from '@/contexts/WalletContext';
-import { usePassword } from '@/hooks/usePassword';
 import { toMojos } from '@/lib/utils';
 import { OfferState, useWalletState } from '@/state';
 import { t } from '@lingui/core/macro';
@@ -16,6 +14,10 @@ interface UseOfferProcessorProps {
 interface UseOfferProcessorReturn {
   createdOffers: string[];
   isProcessing: boolean;
+  /** True when the last run threw mid-batch. `createdOffers` then holds the
+   * offers that were created before the failure, which are live in the
+   * wallet and must be shown — but not auto-uploaded anywhere. */
+  processingFailed: boolean;
   processOffer: () => Promise<void>;
   clearProcessedOffers: () => void;
   cancelProcessing: () => void;
@@ -28,10 +30,9 @@ export function useOfferProcessor({
   onProgress,
 }: UseOfferProcessorProps): UseOfferProcessorReturn {
   const walletState = useWalletState();
-  const { requestPassword } = usePassword();
-  const { wallet } = useWallet();
   const [createdOffers, setCreatedOffers] = useState<string[]>([]);
   const [isProcessing, setIsProcessing] = useState(false);
+  const [processingFailed, setProcessingFailed] = useState(false);
   const isCancelled = useRef(false);
 
   const clearProcessedOffers = useCallback(() => {
@@ -48,6 +49,7 @@ export function useOfferProcessor({
     setIsProcessing(true);
     isCancelled.current = false;
     setCreatedOffers([]);
+    setProcessingFailed(false);
 
     let expiresAtSecond: number | null = null;
     if (offerState.expiration !== null) {
@@ -62,11 +64,6 @@ export function useOfferProcessor({
       expiresAtSecond = Math.ceil(Date.now() / 1000) + totalSeconds;
     }
 
-    const password = await requestPassword(wallet?.has_password ?? false);
-    if (password === undefined) {
-      throw new Error(t`Authentication was cancelled`);
-    }
-
     const offeredTokens = offerState.offered.tokens.map((token) => ({
       asset_id: token.asset_id,
       amount: toMojos(token.amount.toString(), token.asset_id ? 3 : 12),
@@ -77,12 +74,13 @@ export function useOfferProcessor({
       amount: toMojos(token.amount.toString(), token.asset_id ? 3 : 12),
     }));
 
+    const newOffers: string[] = [];
+
     try {
       if (
         splitNftOffers &&
         offerState.offered.nfts.filter((n) => n).length > 1
       ) {
-        const newOffers: string[] = [];
         const nfts = offerState.offered.nfts.filter((n) => n);
 
         for (const [index, nft] of nfts.entries()) {
@@ -121,7 +119,6 @@ export function useOfferProcessor({
               walletState.sync.unit.precision,
             ),
             expires_at_second: expiresAtSecond,
-            password,
           });
           if (!isCancelled.current) {
             newOffers.push(data.offer);
@@ -165,7 +162,6 @@ export function useOfferProcessor({
             walletState.sync.unit.precision,
           ),
           expires_at_second: expiresAtSecond,
-          password,
         });
         if (!isCancelled.current) {
           setCreatedOffers([data.offer]);
@@ -173,6 +169,10 @@ export function useOfferProcessor({
       }
     } catch (err) {
       if (!isCancelled.current) {
+        setProcessingFailed(true);
+        if (newOffers.length > 0) {
+          setCreatedOffers(newOffers);
+        }
         throw err;
       }
     } finally {
@@ -185,8 +185,6 @@ export function useOfferProcessor({
     offerState,
     splitNftOffers,
     walletState.sync.unit.precision,
-    requestPassword,
-    wallet?.has_password,
     onProcessingEnd,
     onProgress,
   ]);
@@ -194,6 +192,7 @@ export function useOfferProcessor({
   return {
     createdOffers,
     isProcessing,
+    processingFailed,
     processOffer,
     clearProcessedOffers,
     cancelProcessing,
diff --git a/src/pages/Offer.tsx b/src/pages/Offer.tsx
index b92a95da7..02fcd861f 100644
--- a/src/pages/Offer.tsx
+++ b/src/pages/Offer.tsx
@@ -17,7 +17,6 @@ import { FeeAmountInput } from '@/components/ui/masked-input';
 import { CustomError } from '@/contexts/ErrorContext';
 import { useWallet } from '@/contexts/WalletContext';
 import { useErrors } from '@/hooks/useErrors';
-import { usePassword } from '@/hooks/usePassword';
 import { resolveOfferData } from '@/lib/offerData';
 import { toMojos } from '@/lib/utils';
 import { useWalletState } from '@/state';
@@ -33,8 +32,6 @@ export function Offer() {
   const { isReadOnly } = useWallet();
   const walletState = useWalletState();
   const navigate = useNavigate();
-  const { wallet } = useWallet();
-  const { requestPassword } = usePassword();
 
   const [isLoading, setIsLoading] = useState(true);
   const [loadingStatus, setLoadingStatus] = useState(t`Initializing...`);
@@ -108,14 +105,10 @@ export function Offer() {
       return;
     }
 
-    const password = await requestPassword(wallet?.has_password ?? false);
-    if (password === undefined) return;
-
     try {
       const result = await commands.takeOffer({
         offer: resolvedOffer,
         fee: toMojos(fee || '0', walletState.sync.unit.precision),
-        password,
       });
       setResponse(result);
     } catch (error) {
diff --git a/src/pages/Settings.tsx b/src/pages/Settings.tsx
index d4f84330c..fa86bb61a 100644
--- a/src/pages/Settings.tsx
+++ b/src/pages/Settings.tsx
@@ -1080,7 +1080,7 @@ function ColdWalletSettings() {
 
 function RpcSettings() {
   const { addError } = useErrors();
-  const { requestPassword } = usePassword();
+  const { requireLocalAuth } = usePassword();
 
   const [isRunning, setIsRunning] = useState(false);
   const [runOnStartup, setRunOnStartup] = useState(false);
@@ -1103,8 +1103,7 @@ function RpcSettings() {
   }, [addError]);
 
   const start = async () => {
-    const auth = await requestPassword(false);
-    if (auth === undefined) return;
+    if (!(await requireLocalAuth())) return;
 
     commands
       .startRpcServer()
@@ -1120,8 +1119,7 @@ function RpcSettings() {
   };
 
   const toggleRunOnStartup = async (checked: boolean) => {
-    const auth = await requestPassword(false);
-    if (auth === undefined) return;
+    if (!(await requireLocalAuth())) return;
 
     commands
       .setRpcRunOnStartup(checked)
@@ -1166,7 +1164,6 @@ function RpcSettings() {
 
 function WalletSettings({ fingerprint }: { fingerprint: number }) {
   const { addError } = useErrors();
-  const { requestPassword } = usePassword();
   const { setWallet: setGlobalWallet } = useWallet();
 
   const walletState = useWalletState();
@@ -1366,16 +1363,12 @@ function WalletSettings({ fingerprint }: { fingerprint: number }) {
   const handler = async (values: z.infer<typeof schema>) => {
     const needsPassword = key?.has_secrets && hardened;
     if (needsPassword) {
-      const password = await requestPassword(key?.has_password ?? false);
-      if (password === undefined) return;
-
       setPending(true);
       commands
         .increaseDerivationIndex({
           index: parseInt(values.index),
           hardened: true,
           unhardened,
-          password,
         })
         .then(() => {
           setDeriveOpen(false);
diff --git a/src/state.ts b/src/state.ts
index 82970ee6b..ffcf934c6 100644
--- a/src/state.ts
+++ b/src/state.ts
@@ -141,23 +141,24 @@ export function initializeWalletState(
   setWalletState = setter;
 }
 
-// Recovery path for the rare case where the active wallet's stored
-// `has_password` flag drifts from the actual encrypted key (e.g. a crash
-// mid-`change_password`). We only reconcile when the flag says "no password"
-// yet a decrypt just failed — that mismatch is the drift signal. A genuine
-// wrong password (flag already true) needs no reconcile, so we skip the
-// backend probe entirely to avoid its cost.
-export async function reconcileActiveKeyProtection(): Promise<void> {
+// Recovery path for the rare case where a wallet's stored `has_password`
+// flag drifts from the actual encrypted key (e.g. a crash
+// mid-`change_password`). A decrypt just failed, so some wallet whose flag
+// says "no password" is actually protected — that mismatch is the drift
+// signal. The failing wallet is not necessarily the active one: `delete_key`
+// and `get_secret_key` are gated by their own fingerprint and run from the
+// logged-out wallet list, so the backend reconciles every wallet the flag
+// could have silently un-gated rather than just the active one. It filters to
+// those suspects itself, which keeps the common case — a plainly mistyped
+// password — at zero Argon2 probes.
+export async function reconcileDriftedKeyProtection(): Promise<void> {
   try {
-    const current = await commands.getKey({});
-    if (!current.key || current.key.has_password) {
+    const { corrected } = await commands.reconcileDriftedKeyProtection({});
+
+    if (corrected === 0) {
       return;
     }
 
-    await commands.reconcileKeyProtection({
-      fingerprint: current.key.fingerprint,
-    });
-
     const updated = await commands.getKey({});
     setWalletState?.(updated.key);
   } catch (error) {
diff --git a/src/walletconnect/commands/chip0002.ts b/src/walletconnect/commands/chip0002.ts
index 4e17407ab..9dff5004e 100644
--- a/src/walletconnect/commands/chip0002.ts
+++ b/src/walletconnect/commands/chip0002.ts
@@ -1,7 +1,6 @@
 import { commands } from '@/bindings';
 import { BigNumber } from 'bignumber.js';
 import { Params } from '../commands';
-import { HandlerContext } from '../handler';
 
 export async function handleChainId() {
   const data = await commands.getNetwork({});
@@ -74,11 +73,7 @@ export async function handleGetAssetBalance(
 
 export async function handleSignCoinSpends(
   params: Params<'chip0002_signCoinSpends'>,
-  context: HandlerContext,
 ) {
-  const password = await context.requestPassword(context.hasPassword);
-  if (password === undefined) throw new Error('Authentication failed');
-
   const data = await commands.signCoinSpends({
     coin_spends: params.coinSpends.map((coinSpend) => {
       return {
@@ -93,7 +88,6 @@ export async function handleSignCoinSpends(
     }),
     partial: params.partialSign,
     auto_submit: false,
-    password,
   });
 
   return data.spend_bundle.aggregated_signature;
@@ -101,12 +95,8 @@ export async function handleSignCoinSpends(
 
 export async function handleSignMessage(
   params: Params<'chip0002_signMessage'>,
-  context: HandlerContext,
 ) {
-  const password = await context.requestPassword(context.hasPassword);
-  if (password === undefined) throw new Error('Authentication failed');
-
-  const data = await commands.signMessageWithPublicKey({ ...params, password });
+  const data = await commands.signMessageWithPublicKey({ ...params });
 
   return data.signature;
 }
diff --git a/src/walletconnect/commands/high-level.ts b/src/walletconnect/commands/high-level.ts
index a5865af66..f91944dd1 100644
--- a/src/walletconnect/commands/high-level.ts
+++ b/src/walletconnect/commands/high-level.ts
@@ -1,7 +1,6 @@
 import { commands } from '@/bindings';
 import { useWalletState } from '@/state';
 import { Params, Return } from '../commands';
-import { HandlerContext } from '../handler';
 
 export async function handleGetNfts(
   params: Params<'chia_getNfts'>,
@@ -45,11 +44,7 @@ export async function handleGetNfts(
 
 export async function handleSend(
   params: Params<'chia_send'>,
-  context: HandlerContext,
 ): Promise<Return<'chia_send'>> {
-  const password = await context.requestPassword(context.hasPassword);
-  if (password === undefined) throw new Error('Authentication failed');
-
   if (params.assetId) {
     await commands.sendCat({
       asset_id: params.assetId,
@@ -58,7 +53,6 @@ export async function handleSend(
       fee: params.fee ?? 0,
       memos: params.memos ?? [],
       auto_submit: true,
-      password,
     });
   } else {
     await commands.sendXch({
@@ -67,7 +61,6 @@ export async function handleSend(
       fee: params.fee ?? 0,
       memos: params.memos ?? [],
       auto_submit: true,
-      password,
     });
   }
 
@@ -82,26 +75,17 @@ export async function handleGetAddress(): Promise<Return<'chia_getAddress'>> {
 
 export async function handleSignMessageByAddress(
   params: Params<'chia_signMessageByAddress'>,
-  context: HandlerContext,
 ) {
-  const password = await context.requestPassword(context.hasPassword);
-  if (password === undefined) throw new Error('Authentication failed');
-
-  return await commands.signMessageByAddress({ ...params, password });
+  return await commands.signMessageByAddress({ ...params });
 }
 
 export async function handleBulkMintNfts(
   params: Params<'chia_bulkMintNfts'>,
-  context: HandlerContext,
 ): Promise<Return<'chia_bulkMintNfts'>> {
-  const password = await context.requestPassword(context.hasPassword);
-  if (password === undefined) throw new Error('Authentication failed');
-
   const response = await commands.bulkMintNfts({
     did_id: params.did,
     fee: params.fee ?? 0,
     auto_submit: true,
-    password,
     mints: params.nfts.map((nft) => {
       if (nft.dataUris?.length && !nft.dataHash) {
         throw new Error('Data hash is required if data uris are provided');
diff --git a/src/walletconnect/commands/offers.ts b/src/walletconnect/commands/offers.ts
index b15fd2699..7518ea954 100644
--- a/src/walletconnect/commands/offers.ts
+++ b/src/walletconnect/commands/offers.ts
@@ -1,14 +1,7 @@
 import { commands } from '@/bindings';
 import { Params } from '../commands';
-import { HandlerContext } from '../handler';
-
-export async function handleCreateOffer(
-  params: Params<'chia_createOffer'>,
-  context: HandlerContext,
-) {
-  const password = await context.requestPassword(context.hasPassword);
-  if (password === undefined) throw new Error('Authentication failed');
 
+export async function handleCreateOffer(params: Params<'chia_createOffer'>) {
   const data = await commands.makeOffer({
     fee: params.fee ?? 0,
     offered_assets: params.offerAssets.map((asset) => ({
@@ -22,7 +15,6 @@ export async function handleCreateOffer(
       amount: asset.amount,
     })),
     expires_at_second: null,
-    password,
   });
 
   return {
@@ -31,35 +23,21 @@ export async function handleCreateOffer(
   };
 }
 
-export async function handleTakeOffer(
-  params: Params<'chia_takeOffer'>,
-  context: HandlerContext,
-) {
-  const password = await context.requestPassword(context.hasPassword);
-  if (password === undefined) throw new Error('Authentication failed');
-
+export async function handleTakeOffer(params: Params<'chia_takeOffer'>) {
   const data = await commands.takeOffer({
     offer: params.offer,
     fee: params.fee ?? 0,
     auto_submit: true,
-    password,
   });
 
   return { id: data.transaction_id };
 }
 
-export async function handleCancelOffer(
-  params: Params<'chia_cancelOffer'>,
-  context: HandlerContext,
-) {
-  const password = await context.requestPassword(context.hasPassword);
-  if (password === undefined) throw new Error('Authentication failed');
-
+export async function handleCancelOffer(params: Params<'chia_cancelOffer'>) {
   await commands.cancelOffer({
     offer_id: params.id,
     fee: params.fee ?? 0,
     auto_submit: true,
-    password,
   });
 
   return {};
diff --git a/src/walletconnect/handler.ts b/src/walletconnect/handler.ts
index cb02725a1..7e8b16646 100644
--- a/src/walletconnect/handler.ts
+++ b/src/walletconnect/handler.ts
@@ -25,8 +25,6 @@ import {
 import { t } from '@lingui/core/macro';
 
 export interface HandlerContext {
-  requestPassword: (hasPassword: boolean) => Promise<string | null | undefined>;
-  hasPassword: boolean;
   /** True when the active wallet has no signing keys (cold/watch-only). */
   isReadOnly: boolean;
 }
@@ -67,30 +65,27 @@ export const handleCommand = async (
     case 'chip0002_getAssetBalance':
       return await handleGetAssetBalance(parseCommand(command, params));
     case 'chip0002_signCoinSpends':
-      return await handleSignCoinSpends(parseCommand(command, params), context);
+      return await handleSignCoinSpends(parseCommand(command, params));
     case 'chip0002_signMessage':
-      return await handleSignMessage(parseCommand(command, params), context);
+      return await handleSignMessage(parseCommand(command, params));
     case 'chip0002_sendTransaction':
       return await handleSendTransaction(parseCommand(command, params));
     case 'chia_createOffer':
-      return await handleCreateOffer(parseCommand(command, params), context);
+      return await handleCreateOffer(parseCommand(command, params));
     case 'chia_takeOffer':
-      return await handleTakeOffer(parseCommand(command, params), context);
+      return await handleTakeOffer(parseCommand(command, params));
     case 'chia_cancelOffer':
-      return await handleCancelOffer(parseCommand(command, params), context);
+      return await handleCancelOffer(parseCommand(command, params));
     case 'chia_getNfts':
       return await handleGetNfts(parseCommand(command, params));
     case 'chia_send':
-      return await handleSend(parseCommand(command, params), context);
+      return await handleSend(parseCommand(command, params));
     case 'chia_getAddress':
       return await handleGetAddress();
     case 'chia_signMessageByAddress':
-      return await handleSignMessageByAddress(
-        parseCommand(command, params),
-        context,
-      );
+      return await handleSignMessageByAddress(parseCommand(command, params));
     case 'chia_bulkMintNfts':
-      return await handleBulkMintNfts(parseCommand(command, params), context);
+      return await handleBulkMintNfts(parseCommand(command, params));
     default:
       throw new Error(`Unknown command: ${command}`);
   }