diff --git a/Cargo.lock b/Cargo.lock
index 0de6dcf0..3cb7de96 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -10468,6 +10468,7 @@ name = "tinycloud-node"
 version = "1.25.17"
 dependencies = [
  "aes-gcm",
+ "age",
  "anyhow",
  "async-trait",
  "aws-config",
@@ -10492,6 +10493,7 @@ dependencies = [
  "lazy_static",
  "libc",
  "libp2p-identity",
+ "lru 0.12.5",
  "multer",
  "native-tls",
  "opentelemetry",
@@ -10530,6 +10532,7 @@ dependencies = [
  "thiserror 2.0.18",
  "tikv-jemallocator",
  "time",
+ "tinycloud-at-rest-escrow",
  "tinycloud-auth",
  "tinycloud-core",
  "tinycloud-sdk-wasm",
@@ -10546,6 +10549,7 @@ dependencies = [
  "uuid",
  "x25519-dalek",
  "x509-parser 0.16.0",
+ "zeroize",
 ]
 
 [[package]]
diff --git a/docs/at-rest-escrow.md b/docs/at-rest-escrow.md
new file mode 100644
index 00000000..30ac7bb1
--- /dev/null
+++ b/docs/at-rest-escrow.md
@@ -0,0 +1,219 @@
+# At-rest keys and escrow (TC-887)
+
+The node provisions at-rest keys only when `at_rest` is configured (below). The default config does nothing: no key reads, no rows.
+
+The at-rest root key (ARK) is 32 random bytes made by the node and sealed under a wrap key derived from a root. The root is one of:
+- **`root_source = "escrow"` (default):** the node's own root key, with the ARK split 2-of-3 to escrow holders and the escrow gate below;
+- **`root_source = "env"`:** a 32-byte key the operator supplies in `TINYCLOUD_AT_REST_ROOT_KEY`, with no escrow (see [Root from the environment](#root-from-the-environment)).
+
+Everything below the ARK (per-space data keys, object names, the key copies in the block store) is the same for both, so moving from one root to the other re-seals the ARK rows and rewrites no data.
+
+- `tinycloud-at-rest-escrow` (a node workspace member) holds the escrow format:
+  - the 2-of-3 split of the ARK;
+  - shares sealed to age recipients;
+  - the bundle and its fingerprint;
+  - the canary;
+  - the verification record;
+  - the recovery wire format.
+- The `tinycloud-at-rest` tool that holders and operators run for the escrow ceremony (a Cargo workspace of its own, `tinycloud-at-rest-cli`) lands with the hardware-key escrow work; the commands below describe it.
+
+## Formats
+
+`lp(x)` is `u32 BE length ‖ x`. Digests are SHA-256, written in lowercase hex.
+
+- **Share.**
+  - The ARK is split with Shamir over GF(256) (`vsss-rs` 5.4.0): threshold 2 of 3, and share `i` has x-coordinate `i`.
+  - The sealed plaintext is `"TCS1" ‖ ark_id(16) ‖ generation u32 BE ‖ i ‖ share(33)`, 58 bytes.
+- **Recipients.** Each share is age-encrypted (`age` 0.12.1, ASCII armor) to one holder. The recipient type can be:
+  - `age1yubikey1…` (`piv-p256` stanza). This is what released age-plugin-yubikey (0.5.x) prints and decrypts. The stanza is produced exactly as the plugin's own `wrap_file_key`, so the TEE needs no plugin.
+  - `age1tag1…` (`p256tag` stanza). This is native age 1.3 tagged P-256. The released age-plugin-yubikey 0.5.1 **cannot** decrypt it, so every command warns when a holder uses one.
+  - `age1…` X25519. These are software keys, refused unless software recipients are explicitly allowed (`--allow-software` on the CLI; tests and self-hosted nodes only). Every command prints a warning while that is in effect.
+  - A recipient format proves which kind of key decrypts, **not** where the private key lives. That a P-256 key was generated on a YubiKey is established in the escrow ceremony.
+- **Commitment.** `SHA-256(lp("tinycloud/at-rest/escrow-share-commit/v1") ‖ ark_id ‖ generation ‖ i ‖ lp(share))`.
+- **Canary.**
+  - `canary = HKDF-SHA256(ikm = ARK, salt = ark_id, info = lp("tinycloud/at-rest/escrow-canary/v1") ‖ generation)`.
+  - `canary_fp = SHA-256(lp("tinycloud/at-rest/escrow-canary-fp/v1") ‖ ark_id ‖ generation ‖ lp(canary))`.
+- **Bundle.** JSON with `version`, `ark_id`, `generation`, `threshold`, `canary_fp`, and `shares[{index, holder, recipient, commitment, ciphertext}]`. Unknown fields are rejected.
+- **EFP (escrow fingerprint).** `SHA-256(lp("tinycloud/at-rest/escrow-bundle/v1") ‖ version ‖ ark_id ‖ generation ‖ threshold ‖ canary_fp ‖ n ‖ for each share: i ‖ lp(holder) ‖ lp(recipient) ‖ commitment ‖ SHA-256(ciphertext))`.
+- **Verification record.**
+  - It is JSON naming the EFP, all three indices and all three pairs, with an HMAC-SHA256 under `HKDF(ARK, salt = ark_id, info = lp("tinycloud/at-rest/escrow-record/v1"))`.
+  - Only the ARK holder (the TEE) can make or check the MAC. `record-efp` checks only the public fields and says so.
+- **Recovery binding.**
+  - The binding string is `xyz.tinycloud.at-rest/recovery-key/v1\0:<recovery recipient>:<efp>:<nonce>`, where `\0` is two characters.
+  - A TDX quote's REPORTDATA must be `SHA-256(binding) ‖ 32 zero bytes`.
+
+## Commands
+
+Every command that reads a bundle:
+- refuses software holders unless `--allow-software` is given;
+- accepts `--expect-efp E` (case-insensitive) and refuses a bundle with any other EFP.
+
+Bundles, records and the node's recovery response carry a `version`, which is checked before any other field. A newer format is reported as "version N; this tool reads version 1".
+
+Exit codes:
+- `0`: OK.
+- `1`: REFUSED. A check failed: don't release a share and don't pin a value.
+- `2`: usage error.
+- `3`: ERROR. A file, stdin or the PCCS couldn't be read.
+
+| Command | Reads | Prints |
+|---|---|---|
+| `recipients --holder NAME=RECIPIENT` ×3 | — | `[at_rest.escrow]` TOML and the compose env line |
+| `self-test --recipient R [--out DIR]` | — | a throwaway escrow whose share 1 is sealed to `R` by the TEE's own code (ceremony step 0) |
+| `nonce` | — | 32 random bytes, base64url |
+| `inspect --bundle B` | bundle | EFP, ark_id, generation, canary_fp, each holder's recipient kind |
+| `extract-share --bundle B --holder H` | bundle | holder H's armored age file |
+| `check-share --bundle B` | decrypted share on **stdin** | which share it is; refuses on a commitment mismatch (e.g. a share from an earlier split) |
+| `verify-compose --app-compose A --trust T` | the deployment's `app-compose.json` | OK if it hashes to `compose_hash` and its compose YAML passes the strict check below; also lists the other app-compose settings to review |
+| `verify-node --bundle B --recovery R --nonce N --trust T [--collateral C \| --pccs-url U]` | node's recovery response | OK (with node state and shares held) or REFUSED |
+| `share-wrap` (same flags) | decrypted share on **stdin** | after `verify-node` passes: the share sealed to the node's recovery key |
+| `record-efp --bundle B --record V` | record | `TINYCLOUD_AT_REST__ESCROW__VERIFIED_FP=<efp>`, marked NOT AUTHENTICATED: the record's MAC is checked only in the TEE |
+
+A decrypted share only ever arrives on stdin (`age -d -i <identity> share.age | tinycloud-at-rest …`). It never goes on argv or to a file.
+
+### What `verify-node` and `share-wrap` check before releasing a share
+
+All of these must hold, or the command prints `REFUSED: …` and exits 1:
+
+1. The node answered as an attested TEE: `mode` is `dstack` and a quote is present.
+2. The node's `efp`, `ark_id` and `generation` equal the holder's own bundle.
+3. The node's binding is exactly the one recomputed from the recovery recipient, that EFP, and the holder's nonce (at least 22 characters). A response made for any other nonce is stale.
+4. The quote passes Intel DCAP verification with `dcap-qvl` 0.7.0: signature, PCK chain, CRLs, TCB info and QE identity. Collateral comes from the PCCS (Phala's by default; Intel PCS also works) with a 60 s timeout, or from `--collateral`, and is checked at the current time.
+5. The TCB status is one fixed class:
+   - `UpToDate` passes.
+   - `SWHardeningNeeded`, `ConfigurationNeeded` and `ConfigurationAndSWHardeningNeeded` pass only if the policy lists them and pins every advisory ID the TCB level carries.
+   - `OutOfDate*`, `TDRelaunchAdvised*`, `Revoked` and unknown statuses never pass.
+   - On a pass, the status, the advisory IDs and the collateral dates are printed.
+6. The TD debug bit is clear.
+7. MRTD and RTMR0-2 equal the trust policy.
+8. The dstack event log replays to the quoted RTMR3:
+   - each `boot-mr-done` and `system-ready` marker appears once, in that order;
+   - exactly one `app-id` and one `compose-hash` event appear, each before `boot-mr-done`, and each equals the trust policy;
+   - v2 events must carry their canonical preimage.
+9. The quoted REPORTDATA is `SHA-256(binding) ‖ 0³²`.
+
+Not pinned: `key-provider`, `instance-id`, `os-image-hash`, XFAM, MRCONFIGID, MROWNER and MROWNERCONFIG. RTMR0-2 and the compose hash cover what the per-boot, in-memory recovery key depends on.
+
+`compose_hash` pins container images only if `app-compose.json` references every image by digest. `verify-compose` reads it with a real parser (`tinycloud_at_rest_escrow::compose`, shared with the node) and accepts only a small subset:
+- `runner` is `docker-compose`;
+- the compose text is newlines and printable ASCII only, because YAML parsers disagree on Unicode line breaks such as U+2028;
+- exactly one document;
+- no anchors, aliases, merge keys, tags or duplicate keys;
+- a `services` mapping, and no `include`;
+- every service has a string `image` of the form `<name>[:tag]@sha256:<64 lowercase hex>`, with no `build` or `extends`;
+- `TINYCLOUD_AT_REST__ESCROW__RECIPIENTS` and `TINYCLOUD_AT_REST__ESCROW__VERIFIED_FP`, if set, are literal values: no `$` interpolation and no pass-through from the runtime environment.
+
+Anything else is refused. `verify-compose` prints the escrow values the compose sets and every other app-compose setting in full (scripts included). All untrusted text is escaped, so control characters and terminal escapes show up as `\u{…}`. Run it when building the trust policy.
+
+A PCCS can't forge collateral, which is Intel-signed. A malicious PCCS can, however, serve older collateral that is still valid (TCB info is valid for about 30 days), which could hide a TCB recovery for that long. Use Intel PCS when that matters.
+
+Trust policy (`--trust`), from a source independent of the node being checked:
+
+```json
+{
+  "app_id": "<40 hex>",
+  "compose_hash": "<64 hex: SHA-256 of app-compose.json>",
+  "mrtd": "<96 hex>",
+  "rtmr0": "<96 hex>",
+  "rtmr1": "<96 hex>",
+  "rtmr2": "<96 hex>",
+  "allowed_tcb_status": ["UpToDate"],
+  "allowed_advisories": []
+}
+```
+
+## Node configuration and endpoints
+
+```toml
+[at_rest]
+mode = "off"            # off | encrypt | strict
+root_source = "escrow"  # escrow | env
+escrow_none = false     # self-hosted Static-root nodes only (refused in a TEE)
+
+[at_rest.escrow]
+recipients = [ { holder = "sam", recipient = "age1yubikey1…" }, … ]   # exactly 3
+verified_fp = "<efp>"   # after the ceremony (record-efp)
+allow_software = false  # X25519 holders; tests and self-host only, refused in a TEE
+allow_resplit_before_verify = false  # before the ceremony only: corrected holders get a fresh root key
+```
+
+The same settings as compose env: `TINYCLOUD_AT_REST__MODE`, `TINYCLOUD_AT_REST__ROOT_SOURCE`, `TINYCLOUD_AT_REST__ESCROW_NONE`, `TINYCLOUD_AT_REST__ESCROW__RECIPIENTS=[{holder="…",recipient="…"},…]`, `TINYCLOUD_AT_REST__ESCROW__VERIFIED_FP`, `TINYCLOUD_AT_REST__ESCROW__ALLOW_SOFTWARE`, `TINYCLOUD_AT_REST__ESCROW__ALLOW_RESPLIT_BEFORE_VERIFY`. The root keys are not config fields: they are read from `TINYCLOUD_AT_REST_ROOT_KEY` and `TINYCLOUD_AT_REST_PREVIOUS_ROOT_KEY` (single underscores) only.
+
+- **Recipients set, `mode = "off"`:**
+  - at boot the node creates the ARK (sealed under its root) and the escrow bundle;
+  - it keeps a copy of the sealed key, the bundle, the ceremony record and each space's wrapped data key in the block store (`_tc/at-rest/` in S3, `{datadir}/at-rest/_tc/at-rest/` on disk). Data-key objects are named by a keyed hash, not the space;
+  - in this mode a copy that can't be written is logged and the boot goes on (nothing depends on it yet). With `encrypt` or `strict`, every boot-time copy must be written: a block store that refuses the write stops the boot;
+  - nothing is encrypted.
+- **`encrypt` and `strict` are refused at boot until both KV block storage and SQL artifacts seal their writes.** Those are the external, authoritative payloads (KV blocks in the block store, SQL and DuckDB artifacts in the database); until both seal, `/info` never shows `encrypting: true`. With both in place, `encrypt` or `strict` refuses to start unless the gate passes: with escrow, the recipients equal the bundle's, `verified_fp` equals its EFP, and the stored ceremony record verifies under the key inside the TEE. A Static-root node with no recipients may use `escrow_none = true` instead, which acknowledges that no escrow exists. With `root_source = "env"`, the gate needs only unlocked keys.
+- **What is sealed, and what isn't.** External authoritative payloads are sealed. Local working files (SQL and DuckDB working and cache files, upload staging, exports) are plaintext on the node's disk and rely on the CVM's encrypted storage. Operators running without a TEE must protect the local paths, swap and file-level backups themselves (for example, the `data.tar.gz` backup that `deploy/personal-node/node.sh` writes is not encrypted). A node in `encrypt` or `strict` without a TEE logs a warning saying so at boot.
+- **In a TEE, the escrow recipients and `verified_fp` must be literal values in the measured compose.** With any at-rest config, the node reads its `app-compose.json` from the guest agent (`/Info`, `tcb_info.app_compose`), checks it against `compose_hash`, and refuses to boot unless `TINYCLOUD_AT_REST__ESCROW__RECIPIENTS` and `TINYCLOUD_AT_REST__ESCROW__VERIFIED_FP` are set there as literals (no `${…}`, no pass-through) equal to the effective config. Values from the encrypted environment, a file or anywhere else are refused. If the app-compose can't be read or parsed, the node refuses to boot. The `/Info` shape must be confirmed on a live CVM before the escrow ceremony.
+- **The escrow bundle is made or changed only at boot, never by a request.** Every endpoint below only reads it.
+  - **An ARK never gets a second bundle for other holders.** The node refuses to boot (`escrow_holders_changed`) if the configured recipients differ from any existing bundle for its ARK: the active bundle, any stored escrow row, a ceremony record in the block store whose MAC verifies under the ARK, or a bundle object in the block store naming the ARK. This holds after a restore too, when the database lost its escrow rows. The block-store bundle object is unauthenticated, so it can only refuse, never be used. Changing a holder after the ceremony needs an ARK rotation (TC-1345).
+  - **Fixing a wrong holder before the ceremony:** set `allow_resplit_before_verify = true` together with the corrected recipients. The node then **replaces the root key**: it makes a fresh ARK, splits it for the corrected holders, and retires the old ARK and its bundle. Shares of the old bundle become worthless: any two of them rebuild only the retired key, which never protected anything and is never loaded again (a W-authenticated retirement marker in the block store drops it even from a database restored to before the fix). The node does this only if no fingerprint is pinned, no ceremony record exists, and no data key was ever made, checking both the database and the block store. If any of those fails, it still refuses to boot. Remove the flag after the fix.
+  - With `verified_fp` set, the node uses only the pinned bundle, restoring it from the block store if the database lost it, and refuses to boot if that bundle is not for the configured recipients and the newest key.
+- **If the node's root can no longer unseal the key** (new app id or KMS), it boots **locked**:
+  - `/info` shows `at_rest.state = "locked"` and encryption is unavailable;
+  - two holders recover it through the endpoints below, which needs `verified_fp` to be pinned;
+  - the node then re-seals the key under its new root, with no restart and no data rewrite.
+
+| Endpoint | Answer |
+|---|---|
+| `GET /at-rest/status` | `mode`, `state`, `encrypting`, `root_source`, `root_fingerprint` (env root only), `efp`, `generation`, `verified` |
+| `GET /at-rest/escrow` | the active escrow bundle (or, on a locked node, the pinned one) |
+| `GET /at-rest/escrow/record` | the ceremony record, only if its MAC verifies under the live key |
+| `GET /at-rest/recovery?nonce=N` | `RecoveryInfo`: this boot's recovery recipient, bound with `N` and the EFP into a TDX quote (`mode = "classic"` with no quote outside a TEE) |
+| `POST /at-rest/recovery/shares` | body: one share age-sealed to the recovery recipient (≤ 4 KiB). Answers `held` (with `shares_held`), `verified` (all three shares rebuilt the key), or `unlocked` (locked node recovered), with the gate result |
+
+The share endpoint:
+- is rate limited per IP. Until TC-1357, the client IP comes from a proxy header trusted from any peer, so per-client limits are best effort; the per-boot budget below doesn't depend on them;
+- checks every share against the bundle's commitments before it takes one of three slots;
+- counts only shares that authenticate (decrypt and match a commitment) against the node's per-boot share budget, so junk can't starve genuine holders. Rejected shares are limited per client (5, then one a minute);
+- never logs share bytes or ciphertexts.
+
+Shares live in memory for the current boot only.
+
+A keyring failure answers `503` when a retry may help (`store_unavailable`, `mirror_unavailable`, `locked`, `conflict: …`, `dek_unavailable: …`) and `500` when an operator must act (`inconsistent: …`, `escrow_pinned`, `escrow_holders_changed`, `escrow: …`). The reason never contains key material or backend detail; the server log has the rest.
+
+**Recovery is per node.** Each boot has its own recovery key, so a share wrapped for one node is rejected by another. With several nodes on one database:
+- recover one node, by its own address (not through a load balancer);
+- then restart the others; a locked node doesn't pick up another node's recovery until it restarts;
+- every node on one database must use the same root. A node under another root boots locked, and recovering it re-seals the rows under its root, which locks the others out at their next restart.
+
+Production runs one node per database. Multi-node recovery is a known limitation.
+
+### Key continuity
+
+- **Database restored to an earlier point.** At boot the node takes back a key generation or chain from the block-store copy only once it authenticates: the newest under this node's root, each older one by its chain. During recovery, the recovered key authenticates them. Anything else in the copy (forged, junk, a gap, an oversized object) is skipped with a warning and never stored, so objects planted in the bucket can neither lock the node nor stop it booting while the database is healthy. A block store that refuses the node's own writes is different: with `encrypt` or `strict` it stops the boot (see above).
+  - Retirement markers (`_tc/at-rest/retired-<ark_id>.json`, written when a holder fix replaces the root key) follow the same rule. A forged or junk marker is skipped. One that can't be read is skipped too, unless it names a key the node has stored or mirrored and the mode is `encrypt` or `strict`: skipping it then could bring a retired key back, so the boot stops until the object reads. With `mode = "off"` a marker never stops the boot.
+- **Data keys after a restore.** A space's data key missing from the database is restored from its copy only if its wrap authenticates for that space. A copy that exists but doesn't authenticate is never ignored and never overwritten: it may be the genuine key under a generation the node hasn't loaded (for example after a failed read at boot). That space answers `503 dek_unavailable` until the generation loads or an operator removes the object; no new key is made over it.
+  - **Runbook, `dek_unavailable` that doesn't clear:** first restart once the block store reads cleanly; a genuine key under an unloaded generation then authenticates and comes back. If the error stays, the server log names the space's data-key object as not authenticating under any loaded generation. Check no newer key generation exists anywhere (database backups, other nodes); only then delete that object under `_tc/at-rest/` and the space gets a new key on its next write. Deleting a genuine key makes everything sealed under it unreadable.
+- **No key is ever made over existing material.** The node creates a new root key only when the database has no key, escrow or data-key rows and the block store has nothing under `_tc/at-rest/`. A store or mirror error stops the boot instead, and so does an empty database whose block-store copy holds nothing usable.
+- **Escrow and ceremony record after a restore.** A bundle or record the database lost is restored from the block store at boot, so a restore doesn't force a new ceremony: the pinned bundle (the pin authenticates it), or, unpinned, a bundle whose mirrored ceremony record verifies under the key. A record is restored only if its MAC verifies under the key.
+  - **Runbook, `escrow_holders_changed` you didn't expect:** the server log names the evidence. If it is a block-store object (`_tc/at-rest/escrow-…`) and the configured recipients are right, check it isn't a genuine escrow: compare it with the bundle the holders hold (`tinycloud-at-rest inspect`) and the pinned `efp`. Only then remove that object and restart. A planted object can only stop a boot whose database lost its escrow rows; it never changes who can rebuild the key.
+- **Generations.** Each older generation is sealed under the next one's key (its chain), so escrowing the newest generation recovers all of them. At boot under the same root, a missing or broken chain is rebuilt and logged. During recovery under a new root it can't be rebuilt, and the shares are refused with the reason. The newest generation never keeps a chain: a stale one is cleared at boot.
+- The key tables' migration `down` refuses while they hold rows.
+
+### Root from the environment
+
+With `root_source = "env"` the ARK is sealed under a key from `TINYCLOUD_AT_REST_ROOT_KEY` instead of the node's root, and there is no escrow. Anyone who holds that key and can read the stored key rows (database or block store) can open the ARK and every data key, so the key must be generated offline, stored only in the deploy's secret store and one backup, and never printed.
+
+- **Format:** the standard base64 (with padding, 44 characters) of exactly 32 random bytes, for example `head -c32 /dev/urandom | base64`. A trailing newline is ignored. Anything else is refused at boot, and the error never contains the value.
+- **`mode = "off"` uses the key.** With `root_source = "env"`, even in mode `off` the node provisions with the key: it creates the ARK, seals it under the key, and stores the sealed rows in the database and their copy in the block store. Only data writes stay plaintext. So staging a key in mode `off` commits to it: from then on the node starts only with that key (or with it as the previous root).
+- **In the process.** At startup, before the config loader runs, the node copies both root variables into memory that is wiped when freed, overwrites their bytes in the environment and unsets them, so `/proc/<pid>/environ`, the config and child processes don't see them. With either variable set it also turns core dumps off for the process (Linux: not dumpable, core size limit 0) and refuses to start if it can't. The decoded key lives only in wiped buffers. Code that runs inside the process (or reads its memory with root on the host) can still get the key.
+- **Fingerprint:** the node logs `root_fingerprint` once at boot and shows it in `/at-rest/status`. It is `hex(SHA-256("tinycloud/at-rest/root-fingerprint/v1" ‖ key))[..16]`, so a copy of the key can be matched without showing it:
+  ```sh
+  (printf 'tinycloud/at-rest/root-fingerprint/v1'; printf '%s' "$KEY" | base64 -d) | sha256sum | cut -c1-16
+  ```
+  The fingerprint identifies a key; it doesn't authenticate one (anyone can compute it from the key, and 64 bits is a label, not a check). Equal fingerprints also show that two deployments share a root.
+- **The node refuses to start** when:
+  - `root_source = "env"` and `TINYCLOUD_AT_REST_ROOT_KEY` is missing or malformed;
+  - `TINYCLOUD_AT_REST_ROOT_KEY` is set but `root_source` is `escrow`;
+  - `root_source = "env"` is combined with any `at_rest.escrow` setting or `escrow_none`;
+  - the key doesn't open the stored keys (there is no escrow to recover with). The error names the key's fingerprint;
+  - a dstack TEE is indicated (`tee.mode = "Dstack"`, `TINYCLOUD_TEE_MODE=dstack`, `TINYCLOUD_KEYS_TYPE=Dstack`, `DSTACK_SIMULATOR_ENDPOINT` or a dstack socket) but the guest agent's Info isn't available: the TEE checks below can't run, so the node doesn't boot as if there were no TEE;
+  - in a TEE: the measured compose doesn't set `TINYCLOUD_AT_REST__ROOT_SOURCE` to the literal `env`; any setting of a root key, in any service, is anything but one plain reference to the encrypted environment (`${NAME}`, or `${NAME:?message}` / `${NAME?message}`): a literal, a default or alternate value (`${NAME:-…}`, `${NAME-…}`, `${NAME:+…}`), a pass-through, or a compose this check can't read; the measured app-compose allows `DSTACK_AUTHORIZED_KEYS`; or the guest agent doesn't report a production dstack OS image (the hashes pinned in `PRODUCTION_OS_IMAGE_HASHES` in `tinycloud-node-server/src/at_rest.rs`). Moving to another OS image adds its hash there in a node release first.
+- **`--validate-config`** runs the same checks as startup's first step (`at_rest::check_config`): everything above that needs no key store, database or guest agent. It opens no socket, so with a TEE indicated it refuses at-rest: the TEE checks run only at boot inside the TEE.
+- **Changing the root.** Deploy once with the new root in place and the old one in `TINYCLOUD_AT_REST_PREVIOUS_ROOT_KEY`. When the stored rows don't open under the new root but do under the previous one, the node re-seals every ARK generation under the new root (database and block-store copy) and logs both fingerprints. Data keys and data are unchanged. Remove the previous key on the next deploy; the node refuses to start with a previous key equal to the current one.
+  - **A new env key:** `TINYCLOUD_AT_REST_ROOT_KEY=<new>`, `TINYCLOUD_AT_REST_PREVIOUS_ROOT_KEY=<old>`.
+  - **Moving to escrow:** `root_source = "escrow"` with the escrow settings, and the env key as `TINYCLOUD_AT_REST_PREVIOUS_ROOT_KEY`. The ARK is re-sealed under the node's root and escrowed.
+  - Re-sealing changes which root opens the current rows. A copy of the rows made before the change (a database backup, an older block-store object version) still opens under the old root, and with it every data key that existed then. Retiring an old root fully also needs an ARK rotation and new data keys for later writes (TC-1345), and then the old copies to age out.
diff --git a/docs/at-rest/INTERFACES.md b/docs/at-rest/INTERFACES.md
index 198de792..41784634 100644
--- a/docs/at-rest/INTERFACES.md
+++ b/docs/at-rest/INTERFACES.md
@@ -1,9 +1,9 @@
 # Encryption at rest: interfaces (TC-887)
 
-> **Status (TC-887):** on `main` today: the envelope, key types, `DataKeyProvider` and the
-> harness. Not on `main` yet: key continuity (`docs/at-rest-escrow.md`, `at_rest::keyring`,
-> node wiring) and sealed KV storage (§7). They land with PRs #325–#327 and #329/#333/#336
-> (#336: the S3 store seals KV blocks).
+> **Status (TC-887):** the envelope, key types, `DataKeyProvider`, the keyring
+> (`at_rest::keyring`), the node wiring (`docs/at-rest-escrow.md`) and the storage view
+> (`at_rest::{AtRestMode, AtRestView, AtRestSource}`) are in. Sealed KV storage (§7) and sealed
+> SQL artifacts follow; until both seal, the node refuses `encrypt` and `strict`.
 
 Normative interface and format for `tinycloud_core::at_rest` and the node's sealed KV block
 storage. Plan: TC-887 (encryption at rest inside the TEE). Key continuity and escrow:
@@ -65,10 +65,19 @@ pub trait DataKeyProvider: Send + Sync {
     /// by deliberate crypto-shred).
     async fn key(&self, space: &str, dek_id: DekId) -> Result<DataKey, DataKeyError>;
 
+    /// Before work that may read `space`'s sealed blobs under the invoke write
+    /// lock: put back any of the space's keys the database lost (for example
+    /// from an authenticated mirror). Never creates a key.
+    async fn prepare_read(&self, space: &str) -> Result<(), DataKeyError>;
+
     /// NK for sealed S3 object names. Same value for the life of the deployment.
     fn object_name_key(&self) -> Result<ObjectNameKey, DataKeyError>;
 }
 
+/// Runs `f` as work under the invoke write lock: providers make no key-store
+/// writes there; a key that would need creating or restoring is `NotPrepared`.
+pub async fn write_locked<F: Future>(f: F) -> F::Output;
+
 #[derive(Debug, thiserror::Error)]
 pub enum DataKeyError {
     /// Node booted locked (W cannot unseal ARK). Callers map to HTTP 503.
@@ -81,6 +90,9 @@ pub enum DataKeyError {
     /// PG/S3/unwrap failure (incl. a wrapped DEK failing AEAD). Opaque, no key bytes.
     #[error("data key backend: {0}")]
     Backend(#[source] Box<dyn std::error::Error + Send + Sync>),
+    /// A key needed creating or restoring inside `write_locked`. Callers map to 503.
+    #[error("the space's data key was not prepared before the write lock")]
+    NotPrepared,
 }
 ```
 
diff --git a/test/m1-realdata-e2e/Cargo.lock b/test/m1-realdata-e2e/Cargo.lock
index de7732f4..ee19b9f7 100644
--- a/test/m1-realdata-e2e/Cargo.lock
+++ b/test/m1-realdata-e2e/Cargo.lock
@@ -8637,11 +8637,13 @@ dependencies = [
  "if-addrs",
  "lazy_static",
  "libc",
+ "lru",
  "multer",
  "native-tls",
  "opentelemetry",
  "opentelemetry-otlp",
  "opentelemetry_sdk",
+ "parking_lot",
  "percent-encoding",
  "pin-project",
  "prometheus",
@@ -8667,6 +8669,7 @@ dependencies = [
  "thiserror 2.0.18",
  "tikv-jemallocator",
  "time",
+ "tinycloud-at-rest-escrow",
  "tinycloud-auth",
  "tinycloud-core",
  "tokio",
@@ -8680,6 +8683,7 @@ dependencies = [
  "tracing-opentelemetry",
  "tracing-subscriber",
  "uuid",
+ "zeroize",
 ]
 
 [[package]]
diff --git a/test/w5-policy-runtime-node-e2e/Cargo.lock b/test/w5-policy-runtime-node-e2e/Cargo.lock
index f8df2565..a54256f7 100644
--- a/test/w5-policy-runtime-node-e2e/Cargo.lock
+++ b/test/w5-policy-runtime-node-e2e/Cargo.lock
@@ -9022,11 +9022,13 @@ dependencies = [
  "if-addrs",
  "lazy_static",
  "libc",
+ "lru",
  "multer",
  "native-tls",
  "opentelemetry",
  "opentelemetry-otlp",
  "opentelemetry_sdk",
+ "parking_lot",
  "percent-encoding",
  "pin-project",
  "prometheus",
@@ -9052,6 +9054,7 @@ dependencies = [
  "thiserror 2.0.18",
  "tikv-jemallocator",
  "time",
+ "tinycloud-at-rest-escrow",
  "tinycloud-auth",
  "tinycloud-core",
  "tokio",
@@ -9065,6 +9068,7 @@ dependencies = [
  "tracing-opentelemetry",
  "tracing-subscriber",
  "uuid",
+ "zeroize",
 ]
 
 [[package]]
diff --git a/tinycloud-at-rest-escrow/src/compose.rs b/tinycloud-at-rest-escrow/src/compose.rs
index 7e0c783c..dfc653d9 100644
--- a/tinycloud-at-rest-escrow/src/compose.rs
+++ b/tinycloud-at-rest-escrow/src/compose.rs
@@ -360,20 +360,21 @@ impl AppCompose {
             .collect()
     }
 
-    /// The literal value of `key` in the services' `environment`, if set.
-    ///
-    /// Refused: a value that docker compose would interpolate (`$`), a key
-    /// passed through from the runtime environment (`- KEY` or `KEY:`
-    /// with no value), and different values in different services.
-    pub fn literal_env(&self, key: &str) -> Result<Option<String>> {
-        let mut found: Option<String> = None;
+    /// Every setting of `key` in the services' `environment`, one per service
+    /// that sets it (`KEY: value`, or `- KEY=value` in list form). A value
+    /// that is empty or a YAML null, and a list entry without `=`, pass the
+    /// variable through from the runtime environment: [`EnvSetting::FromRuntime`].
+    /// Errors (never quoting a value): a non-string setting, a key set twice
+    /// in one service, an environment that is not a mapping or list.
+    pub fn env_settings(&self, key: &str) -> Result<Vec<EnvSetting>> {
+        let mut settings = Vec::new();
         for (service, fields) in services(&self.top)? {
             let service = escape(service);
             let value = match get(fields, "environment") {
                 None => None,
                 Some(Node::Map(env)) => match get(env, key) {
                     None => None,
-                    Some(Node::Scalar(v)) => Some(v.clone()),
+                    Some(Node::Scalar(v)) => Some(Some(v.clone())),
                     Some(_) => {
                         return err(format!("service {service:?} sets {key} to a non-string"))
                     }
@@ -387,16 +388,12 @@ impl AppCompose {
                             ));
                         };
                         let (k, v) = match item.split_once('=') {
-                            Some((k, v)) => (k, Some(v)),
+                            Some((k, v)) => (k, Some(v.to_owned())),
                             None => (item.as_str(), None),
                         };
                         if k == key {
                             ensure!(value.is_none(), "service {service:?} sets {key} twice");
-                            value = Some(v.map(str::to_owned).ok_or_else(|| {
-                                EscrowError::Compose(format!(
-                                    "service {service:?} passes {key} through from the runtime environment; it must be a literal value"
-                                ))
-                            })?);
+                            value = Some(v);
                         }
                     }
                     value
@@ -410,10 +407,32 @@ impl AppCompose {
             let Some(value) = value else { continue };
             // Empty or a YAML 1.2 null (any spelling docker compose reads as
             // null) passes the variable through from the runtime.
-            ensure!(
-                !matches!(value.as_str(), "" | "~" | "null" | "Null" | "NULL"),
-                "service {service:?} passes {key} through from the runtime environment; it must be a literal value"
-            );
+            settings.push(match value {
+                Some(v) if !matches!(v.as_str(), "" | "~" | "null" | "Null" | "NULL") => {
+                    EnvSetting::Value { service, value: v }
+                }
+                _ => EnvSetting::FromRuntime { service },
+            });
+        }
+        Ok(settings)
+    }
+
+    /// The literal value of `key` in the services' `environment`, if set.
+    ///
+    /// Refused: a value that docker compose would interpolate (`$`), a key
+    /// passed through from the runtime environment (`- KEY` or `KEY:`
+    /// with no value), and different values in different services.
+    pub fn literal_env(&self, key: &str) -> Result<Option<String>> {
+        let mut found: Option<String> = None;
+        for setting in self.env_settings(key)? {
+            let (service, value) = match setting {
+                EnvSetting::FromRuntime { service } => {
+                    return err(format!(
+                        "service {service:?} passes {key} through from the runtime environment; it must be a literal value"
+                    ))
+                }
+                EnvSetting::Value { service, value } => (service, value),
+            };
             ensure!(
                 !value.contains('$'),
                 "service {service:?} sets {key} by interpolation; it must be a literal value"
@@ -427,6 +446,24 @@ impl AppCompose {
     }
 }
 
+/// One service's setting of an environment variable ([`AppCompose::env_settings`]).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum EnvSetting {
+    /// `KEY: value` or `- KEY=value`, exactly as written (before docker
+    /// compose interpolation). `service` is escaped for display.
+    Value { service: String, value: String },
+    /// The variable is passed through from the runtime environment.
+    FromRuntime { service: String },
+}
+
+impl EnvSetting {
+    pub fn service(&self) -> &str {
+        match self {
+            Self::Value { service, .. } | Self::FromRuntime { service } => service,
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/tinycloud-core/src/at_rest/mod.rs b/tinycloud-core/src/at_rest/mod.rs
index 7b652a5d..4487642b 100644
--- a/tinycloud-core/src/at_rest/mod.rs
+++ b/tinycloud-core/src/at_rest/mod.rs
@@ -1,5 +1,5 @@
-//! Encryption at rest (TC-887). Nothing in the node calls this module yet; it
-//! is switched off until the key-continuity gate exists.
+//! Encryption at rest (TC-887): the TCE1 envelope, the keyring, and the
+//! view storage reads of the node's at-rest state. Off unless configured.
 
 mod envelope;
 mod hierarchy;
@@ -13,6 +13,7 @@ mod stream;
 mod testing;
 #[cfg(test)]
 mod tests;
+mod view;
 
 pub use envelope::{
     ciphertext_len, format_version, open, plaintext_len, seal, BlobIdentity, EnvelopeError, Header,
@@ -27,3 +28,4 @@ pub use testing::FixedKeyProvider;
 
 pub use keyring::{AtRestKeyring, KeyringConfig, KeyringState};
 pub use store::{AtRestStore, KeyMirror};
+pub use view::{AtRestMode, AtRestSource, AtRestView};
diff --git a/tinycloud-core/src/at_rest/view.rs b/tinycloud-core/src/at_rest/view.rs
new file mode 100644
index 00000000..a3e199c0
--- /dev/null
+++ b/tinycloud-core/src/at_rest/view.rs
@@ -0,0 +1,68 @@
+//! What storage sees of the node's at-rest state, per operation (TC-887).
+//!
+//! The node owns the keyring and the mode; block stores and the SQL artifact
+//! repository read a fresh [`AtRestView`] from an [`AtRestSource`] for each
+//! operation, because keys arrive after migrations and may unlock later.
+//!
+//! Rules every store follows (`docs/at-rest/INTERFACES.md`):
+//! - mode `off` writes plaintext exactly as before;
+//! - any other mode seals iff [`AtRestView::encrypting`], else the write fails
+//!   (503), never a plaintext fallback;
+//! - sealed data is read whenever keys exist; legacy plaintext is read unless
+//!   the mode is `strict`.
+
+use std::sync::Arc;
+
+use serde::{Deserialize, Serialize};
+
+use super::{DataKeyProvider, ObjectNameKey};
+
+/// `at_rest.mode`.
+#[derive(Serialize, Deserialize, Debug, Default, Clone, Copy, Hash, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum AtRestMode {
+    /// New writes are plaintext; sealed data is still read when keys exist.
+    #[default]
+    Off,
+    /// New writes are sealed; legacy plaintext is still read.
+    Encrypt,
+    /// New writes are sealed; legacy plaintext is refused.
+    Strict,
+}
+
+/// A snapshot of the node's at-rest state for one storage operation.
+#[derive(Clone)]
+pub struct AtRestView {
+    pub mode: AtRestMode,
+    /// The gate passed and the keys are unlocked: new writes are sealed.
+    pub encrypting: bool,
+    /// Set once the keyring is installed (locked or not).
+    pub provider: Option<Arc<dyn DataKeyProvider>>,
+}
+
+impl AtRestView {
+    /// The state of a node without at-rest wiring: `off`, no keys.
+    pub fn off() -> Self {
+        Self {
+            mode: AtRestMode::Off,
+            encrypting: false,
+            provider: None,
+        }
+    }
+
+    /// The object-name key, if keys are set up and unlocked.
+    pub fn object_name_key(&self) -> Option<ObjectNameKey> {
+        self.provider.as_ref()?.object_name_key().ok()
+    }
+
+    /// Whether legacy plaintext may be read (every mode but `strict`).
+    pub fn legacy_readable(&self) -> bool {
+        self.mode != AtRestMode::Strict
+    }
+}
+
+/// Where storage reads its at-rest state from: the node's runtime, or a
+/// test double.
+pub trait AtRestSource: Send + Sync {
+    fn view(&self) -> AtRestView;
+}
diff --git a/tinycloud-node-server/Cargo.toml b/tinycloud-node-server/Cargo.toml
index 59c1a04a..f0084161 100644
--- a/tinycloud-node-server/Cargo.toml
+++ b/tinycloud-node-server/Cargo.toml
@@ -59,6 +59,9 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 serde_with = { version = "3.0", features = ["base64", "hex"] }
 sha2 = "0.10"
+parking_lot = "0.12"
+lru = "0.12"
+zeroize = "1"
 serde_ipld_dagcbor.workspace = true
 toml = "0.8"
 thiserror = "2.0"
@@ -107,6 +110,10 @@ features = ["sqlite", "postgres", "mysql", "tokio"]
 [dependencies.tinycloud-auth]
 path = "../tinycloud-auth/"
 
+# TC-887: escrow bundle and recovery wire types for the at-rest routes.
+[dependencies.tinycloud-at-rest-escrow]
+path = "../tinycloud-at-rest-escrow/"
+
 # TC-409: only for test builds, enable tinycloud-core's opt-in
 # verification-count test hook so node route tests can assert exactly-once
 # signature verification. Cargo only activates dev-dependency features when
@@ -119,6 +126,8 @@ default-features = false
 features = ["sqlite", "postgres", "mysql", "tokio", "verification-count-test-hook", "test-util"]
 
 [dev-dependencies]
+# TC-887: escrow holders decrypting their shares in tests/at_rest_ceremony.rs.
+age = { version = "=0.12.1", default-features = false, features = ["armor"] }
 # Parse production Rust items in the DID resolver source guard (tests only).
 syn = { version = "2", features = ["full", "visit"] }
 quote = "1"
diff --git a/tinycloud-node-server/src/at_rest.rs b/tinycloud-node-server/src/at_rest.rs
new file mode 100644
index 00000000..264871b5
--- /dev/null
+++ b/tinycloud-node-server/src/at_rest.rs
@@ -0,0 +1,1412 @@
+//! Node wiring for encryption at rest (TC-887 S1): config → keyring, the
+//! boot-time escrow gate, and the runtime state the routes use.
+//!
+//! Two phases, because block storage opens before migrations and the
+//! keyring needs its tables: [`AtRestRuntime::new`] before storage, then
+//! [`setup`] after migrations installs the keyring.
+//!
+//! In this build no storage seals anything yet: nothing calls
+//! [`AtRestRuntime::declare_seal_path`], so `setup` refuses every mode
+//! but `off` and `encrypting()` is always false.
+//!
+//! With the default config (`mode = "off"`, `root_source = "escrow"`, no
+//! recipients, no `escrow_none`) nothing is set up: no key reads, no rows, no
+//! mirror.
+//!
+//! The root that seals the at-rest root key (ARK) is the node's own root
+//! (`root_source = "escrow"`, with the escrow gate) or a 32-byte key from
+//! [`ROOT_KEY_ENV`] (`root_source = "env"`, no escrow). Either way the ARK
+//! and everything below it are the same, so moving between them re-seals
+//! the ARK rows ([`PREVIOUS_ROOT_KEY_ENV`]) and rewrites no data.
+
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, OnceLock};
+
+use anyhow::{anyhow, bail, ensure, Context, Result};
+use sha2::Digest as _;
+use tinycloud_at_rest_escrow::compose::{AppCompose, EnvSetting, RECIPIENTS_ENV, VERIFIED_FP_ENV};
+use tinycloud_at_rest_escrow::{Efp, HolderRecipient, RecipientPolicy};
+use tinycloud_core::{
+    at_rest::{
+        keyring::{GatePass, GateRefusal},
+        AtRestKeyring, AtRestSource, AtRestStore, AtRestView, DataKeyProvider, KeyMirror,
+        KeyringConfig, KeyringState,
+    },
+    storage::either::Either,
+    RecoveringConnection,
+};
+use zeroize::Zeroizing;
+
+use crate::config::{AtRestConfig, AtRestEscrowConfig, AtRestMode, AtRestRootSource, Storage};
+use crate::dstack::MeasuredInfo;
+use crate::storage::at_rest_mirror::{FsKeyMirror, S3KeyMirror};
+use crate::tee::TeeContext;
+
+/// The at-rest root when `root_source = "env"`: 32 bytes, standard base64.
+pub const ROOT_KEY_ENV: &str = "TINYCLOUD_AT_REST_ROOT_KEY";
+/// The root the stored ARK rows were sealed under before a root change. The
+/// node re-seals them under the current root at boot; remove it afterwards.
+pub const PREVIOUS_ROOT_KEY_ENV: &str = "TINYCLOUD_AT_REST_PREVIOUS_ROOT_KEY";
+/// In a TEE, `root_source = "env"` must be this literal in the measured compose.
+pub const ROOT_SOURCE_ENV: &str = "TINYCLOUD_AT_REST__ROOT_SOURCE";
+/// The variable that gives a dstack CVM SSH authorized keys.
+const SSH_KEYS_ENV: &str = "DSTACK_AUTHORIZED_KEYS";
+/// dstack production (not dev) OS images a TEE node may use
+/// `root_source = "env"` on: `dstack-0.5.12`, as pinned by the deploy
+/// (`PHALA_OS_IMAGE_HASH` in `.github/workflows/docker.yml`). Moving to
+/// another OS image adds its hash here in a node release first.
+pub const PRODUCTION_OS_IMAGE_HASHES: &[&str] =
+    &["8db40cb23008d6213668b5816702d100b37b859a8a5bfd18d938ae3a1b3715bd"];
+
+/// Whether this build's storage seals every write when at-rest is set up:
+/// both KV block storage and SQL artifacts ([`SealPath`]). `--validate-config`
+/// decides the seal-path refusal from this; startup checks that the seal
+/// paths storage actually declared agree with it.
+pub const STORAGE_SEALS_EVERY_WRITE: bool = false;
+
+/// The root variables as read from the process environment, held only in
+/// zeroizing buffers. Debug is redacted.
+#[derive(Default)]
+pub struct RootEnv {
+    current: Option<Zeroizing<String>>,
+    previous: Option<Zeroizing<String>>,
+}
+
+impl std::fmt::Debug for RootEnv {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("RootEnv")
+            .field("current", &self.current.is_some())
+            .field("previous", &self.previous.is_some())
+            .finish()
+    }
+}
+
+/// [`RootEnv::take`] in `main`, before the config loader and any other
+/// thread start; the node takes it from here at boot.
+static STASHED_ROOT_ENV: std::sync::Mutex<Option<RootEnv>> = std::sync::Mutex::new(None);
+
+impl RootEnv {
+    /// Explicit values (tests, and callers that already hold them).
+    pub fn new(current: Option<Zeroizing<String>>, previous: Option<Zeroizing<String>>) -> Self {
+        Self { current, previous }
+    }
+
+    /// Takes [`ROOT_KEY_ENV`] and [`PREVIOUS_ROOT_KEY_ENV`] out of the process
+    /// environment: copies each value into a zeroizing buffer, overwrites the
+    /// environment's own bytes, and unsets the variable, so neither the
+    /// config loader nor `/proc/<pid>/environ` sees it again. With either set,
+    /// it also turns core dumps off for the process (Linux: not dumpable,
+    /// core size limit 0), and refuses if that fails.
+    ///
+    /// Call it before other threads run where possible (`main` does): it
+    /// writes the environment.
+    pub fn take() -> Result<Self> {
+        let env = Self {
+            current: take_var(ROOT_KEY_ENV),
+            previous: take_var(PREVIOUS_ROOT_KEY_ENV),
+        };
+        if env.current.is_some() || env.previous.is_some() {
+            disable_core_dumps()?;
+        }
+        Ok(env)
+    }
+
+    /// Keeps `self` for [`Self::for_boot`].
+    pub fn stash(self) {
+        *STASHED_ROOT_ENV.lock().unwrap_or_else(|p| p.into_inner()) = Some(self);
+    }
+
+    /// The stashed root variables if `main` took them, else [`Self::take`].
+    pub fn for_boot() -> Result<Self> {
+        match STASHED_ROOT_ENV
+            .lock()
+            .unwrap_or_else(|p| p.into_inner())
+            .take()
+        {
+            Some(env) => Ok(env),
+            None => Self::take(),
+        }
+    }
+}
+
+fn take_var(name: &str) -> Option<Zeroizing<String>> {
+    use std::os::unix::ffi::OsStringExt as _;
+    let raw = Zeroizing::new(std::env::var_os(name)?.into_vec());
+    // The environment block holds its own copy: overwrite it, then unset.
+    if let Ok(c_name) = std::ffi::CString::new(name) {
+        // SAFETY: getenv returns NUL-terminated memory owned by the
+        // environment; we only overwrite the value's own bytes before
+        // unsetting it. `main` calls this before other threads start.
+        unsafe {
+            let value = libc::getenv(c_name.as_ptr());
+            if !value.is_null() {
+                std::ptr::write_bytes(value, 0, libc::strlen(value));
+            }
+        }
+    }
+    std::env::remove_var(name);
+    // A value that isn't UTF-8 isn't a key; keep a stand-in that fails to
+    // parse rather than a lossy copy of the bytes.
+    let mut value = Zeroizing::new(String::new());
+    match std::str::from_utf8(&raw) {
+        Ok(text) => value.push_str(text),
+        Err(_) => value.push('\u{fffd}'),
+    }
+    Some(value)
+}
+
+fn disable_core_dumps() -> Result<()> {
+    #[cfg(target_os = "linux")]
+    // SAFETY: plain syscalls on this process with valid arguments.
+    unsafe {
+        ensure!(
+            libc::prctl(libc::PR_SET_DUMPABLE, 0, 0, 0, 0) == 0,
+            "could not turn off core dumps (prctl PR_SET_DUMPABLE)"
+        );
+        let none = libc::rlimit {
+            rlim_cur: 0,
+            rlim_max: 0,
+        };
+        ensure!(
+            libc::setrlimit(libc::RLIMIT_CORE, &none) == 0,
+            "could not turn off core dumps (RLIMIT_CORE)"
+        );
+    }
+    Ok(())
+}
+
+/// An operator-supplied at-rest root: exactly 32 bytes. Debug is redacted;
+/// only [`Self::fingerprint`] is ever logged.
+pub struct RootKey(Zeroizing<[u8; 32]>);
+
+impl RootKey {
+    /// Standard base64 with padding (44 characters, canonical) of 32 bytes.
+    /// A trailing newline is ignored; anything else is refused, as is a key
+    /// of one repeated byte (a placeholder, not a key). Decoding and the
+    /// canonical check use fixed zeroizing buffers, no heap copies.
+    pub fn parse(value: &str) -> Result<Self> {
+        let value = value
+            .strip_suffix("\r\n")
+            .or_else(|| value.strip_suffix('\n'))
+            .unwrap_or(value);
+        ensure!(
+            value.len() == 44,
+            "must be the standard base64 of exactly 32 bytes (44 characters)"
+        );
+        // 44 characters decode to at most 33 bytes.
+        let mut decoded = Zeroizing::new([0u8; 33]);
+        let len = base64::decode_config_slice(value, base64::STANDARD, &mut decoded[..])
+            .map_err(|_| anyhow!("is not standard base64"))?;
+        ensure!(len == 32, "does not decode to exactly 32 bytes");
+        let mut key = Zeroizing::new([0u8; 32]);
+        key.copy_from_slice(&decoded[..32]);
+        let mut encoded = Zeroizing::new([0u8; 44]);
+        base64::encode_config_slice(key.as_slice(), base64::STANDARD, &mut encoded[..]);
+        ensure!(
+            encoded.as_slice() == value.as_bytes(),
+            "is not canonical standard base64"
+        );
+        ensure!(
+            key.iter().any(|b| *b != key[0]),
+            "is one repeated byte, not a key"
+        );
+        Ok(Self(key))
+    }
+
+    pub fn bytes(&self) -> &[u8] {
+        self.0.as_slice()
+    }
+
+    /// `hex(SHA-256("tinycloud/at-rest/root-fingerprint/v1" ‖ key))[..16]`:
+    /// names the key in logs and `/at-rest/status`, and can be computed
+    /// offline (`(printf '<label>'; base64 -d) | sha256sum`). It identifies a
+    /// key, it doesn't authenticate one, and equal fingerprints show that
+    /// two deployments share a root.
+    pub fn fingerprint(&self) -> String {
+        let mut h = sha2::Sha256::new();
+        h.update(b"tinycloud/at-rest/root-fingerprint/v1");
+        h.update(self.bytes());
+        hex::encode(h.finalize())[..16].to_string()
+    }
+}
+
+impl std::fmt::Debug for RootKey {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "RootKey({})", self.fingerprint())
+    }
+}
+
+/// The at-rest roots for this boot, from config and the environment.
+#[derive(Debug)]
+pub struct Roots {
+    /// `Some` for `root_source = "env"`; otherwise the node root is used.
+    pub env: Option<RootKey>,
+    pub previous: Option<RootKey>,
+}
+
+impl Roots {
+    /// Parses the root variables taken by [`RootEnv::take`].
+    /// Refuses: `root_source = "env"` without a valid key; a malformed value
+    /// (never ignored); a root key with `root_source = "escrow"`; a previous
+    /// root equal to the current one.
+    pub fn read(config: &AtRestConfig, node_root: &[u8], env: &RootEnv) -> Result<Self> {
+        let read = |name: &str, value: &Option<Zeroizing<String>>| -> Result<Option<RootKey>> {
+            value
+                .as_ref()
+                .map(|v| RootKey::parse(v).with_context(|| format!("{name} is invalid")))
+                .transpose()
+        };
+        let current = read(ROOT_KEY_ENV, &env.current)?;
+        let previous = read(PREVIOUS_ROOT_KEY_ENV, &env.previous)?;
+        let env_root = match (config.root_source, current) {
+            (AtRestRootSource::Env, Some(key)) => Some(key),
+            (AtRestRootSource::Env, None) => {
+                bail!("at_rest.root_source = \"env\" needs {ROOT_KEY_ENV}: the standard base64 of 32 bytes")
+            }
+            (AtRestRootSource::Escrow, Some(_)) => bail!(
+                "{ROOT_KEY_ENV} is set but at_rest.root_source is \"escrow\"; set root_source = \"env\", or pass the key as {PREVIOUS_ROOT_KEY_ENV} to re-seal under the node root"
+            ),
+            (AtRestRootSource::Escrow, None) => None,
+        };
+        let roots = Self {
+            env: env_root,
+            previous,
+        };
+        if let Some(previous) = &roots.previous {
+            ensure!(
+                previous.bytes() != roots.root(node_root),
+                "{PREVIOUS_ROOT_KEY_ENV} is the current at-rest root; remove it"
+            );
+        }
+        Ok(roots)
+    }
+
+    /// The root the keyring seals the ARK under.
+    pub fn root<'a>(&'a self, node_root: &'a [u8]) -> &'a [u8] {
+        self.env.as_ref().map_or(node_root, RootKey::bytes)
+    }
+}
+
+/// Whether, and why, the node is meant to run in a dstack TEE, and whether
+/// its guest agent answered.
+#[derive(Debug, Clone, Copy)]
+pub struct TeeState<'a> {
+    /// What indicates a TEE (TEE mode, key type, a socket), if anything.
+    pub indicated: Option<&'a str>,
+    /// The guest agent's Info was read (the node has a TEE context).
+    pub present: bool,
+}
+
+/// The at-rest checks that need no key store, database, block store or
+/// guest-agent measurement. Startup runs them before opening the keyring,
+/// and `--validate-config` runs the same function, so the preflight refuses
+/// whatever these refuse at boot. `storage_seals`: whether storage seals
+/// every write (startup: the declared seal paths; validation:
+/// [`STORAGE_SEALS_EVERY_WRITE`]).
+pub fn check_config(
+    config: &AtRestConfig,
+    roots: &Roots,
+    storage_seals: bool,
+    tee: TeeState<'_>,
+) -> Result<()> {
+    let escrow = &config.escrow;
+    if !enabled(config) {
+        ensure!(
+            roots.previous.is_none(),
+            "{PREVIOUS_ROOT_KEY_ENV} is set but at-rest is not configured; remove it"
+        );
+        return Ok(());
+    }
+    if config.mode != AtRestMode::Off && !storage_seals {
+        bail!(
+            "at_rest.mode = \"{}\" is refused: this build's storage has no at-rest seal path, so nothing would be encrypted; use mode = \"off\"",
+            mode_name(config.mode)
+        );
+    }
+    if config.escrow_none && !escrow.recipients.is_empty() {
+        bail!("set at_rest.escrow.recipients or at_rest.escrow_none, not both");
+    }
+    if config.root_source == AtRestRootSource::Env
+        && (config.escrow_none || *escrow != AtRestEscrowConfig::default())
+    {
+        bail!("at_rest.root_source = \"env\" has no escrow: remove at_rest.escrow and at_rest.escrow_none");
+    }
+    if let (Some(hint), false) = (tee.indicated, tee.present) {
+        bail!(
+            "refusing to start: {hint} indicates a dstack TEE, but its guest agent's Info is not available here, so the at-rest TEE checks can't run (they run at boot inside the TEE)"
+        );
+    }
+    if tee.present && config.escrow_none {
+        bail!("at_rest.escrow_none is only for self-hosted Static-root nodes; a TEE node must escrow its key");
+    }
+    if tee.present && escrow.allow_software {
+        bail!("at_rest.escrow.allow_software is refused inside a TEE: escrow holders must use hardware keys");
+    }
+    Ok(())
+}
+
+fn mode_name(mode: AtRestMode) -> &'static str {
+    match mode {
+        AtRestMode::Off => "off",
+        AtRestMode::Encrypt => "encrypt",
+        AtRestMode::Strict => "strict",
+    }
+}
+
+/// The storage that must seal its writes before a mode other than `off`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SealPath {
+    /// KV block storage (S3 or the file system).
+    Blocks,
+    /// SQL and DuckDB artifacts (`database_artifact`).
+    SqlArtifacts,
+}
+
+/// At-rest state shared by the routes and `/info` (and, once it seals
+/// writes, block storage). Rocket manages it as `Arc<AtRestRuntime>`.
+///
+/// The contract for the storage seal path (TC-887 S3), not yet wired: mode
+/// `off` behaves exactly as without at-rest. Otherwise writes are sealed
+/// only while [`encrypting`](Self::encrypting) (else 503, never plaintext);
+/// a sealed read whose key is `Locked` is a 503; legacy plaintext reads are
+/// allowed unless the mode is `strict`.
+pub struct AtRestRuntime {
+    mode: AtRestMode,
+    escrow_none: bool,
+    root_source: AtRestRootSource,
+    /// Set at boot for `root_source = "env"`.
+    root_fingerprint: OnceLock<String>,
+    keyring: OnceLock<Arc<AtRestKeyring>>,
+    /// The gate passed for a non-`off` mode and the keys are unlocked: new
+    /// writes may be encrypted. Set at boot, or after a recovery unlocks a
+    /// node whose gate then passes.
+    encrypting: AtomicBool,
+    /// Set by block storage and by the SQL artifact store when each seals
+    /// its writes. Until both are set a mode other than `off` is refused at
+    /// boot and `encrypting` stays false.
+    blocks_seal: AtomicBool,
+    sql_seal: AtomicBool,
+    share_failures: ShareFailureLimiter,
+}
+
+/// Failed share submissions per client: a share that doesn't decrypt to
+/// this boot's recovery key or match a commitment. A client that keeps
+/// failing is refused for a while. Failures never spend the keyring's
+/// per-boot share budget, which only authenticated shares count against.
+///
+/// Bounded: an LRU of [`Self::MAX_CLIENTS`] entries, O(1) per call. When
+/// full, the least recently seen client is forgotten (so its budget
+/// resets), which only weakens a best-effort limit (TC-1357), never the
+/// per-boot budget.
+pub struct ShareFailureLimiter {
+    clients: parking_lot::Mutex<lru::LruCache<std::net::IpAddr, (f64, std::time::Instant)>>,
+}
+
+impl ShareFailureLimiter {
+    /// Failures a client may make at once, then one more per minute.
+    pub const BURST: f64 = 5.0;
+    const REFILL_PER_SEC: f64 = 1.0 / 60.0;
+    pub const MAX_CLIENTS: usize = 4096;
+
+    fn new() -> Self {
+        Self {
+            clients: parking_lot::Mutex::new(lru::LruCache::new(
+                std::num::NonZeroUsize::new(Self::MAX_CLIENTS).expect("non-zero"),
+            )),
+        }
+    }
+
+    fn refilled(entry: &mut (f64, std::time::Instant)) {
+        let now = std::time::Instant::now();
+        let elapsed = now.duration_since(entry.1).as_secs_f64();
+        entry.0 = (entry.0 + elapsed * Self::REFILL_PER_SEC).min(Self::BURST);
+        entry.1 = now;
+    }
+
+    /// Whether `ip` may submit now.
+    pub fn allows(&self, ip: std::net::IpAddr) -> bool {
+        let mut clients = self.clients.lock();
+        match clients.get_mut(&ip) {
+            None => true,
+            Some(entry) => {
+                Self::refilled(entry);
+                entry.0 >= 1.0
+            }
+        }
+    }
+
+    pub fn record_failure(&self, ip: std::net::IpAddr) {
+        let mut clients = self.clients.lock();
+        let entry = clients.get_or_insert_mut(ip, || (Self::BURST, std::time::Instant::now()));
+        Self::refilled(entry);
+        entry.0 = (entry.0 - 1.0).max(0.0);
+    }
+}
+
+/// The node's [`AtRestRuntime`], if it manages one. Unlike a `State` guard it
+/// never fails, so a node without it (a test fixture) still launches.
+pub struct AtRestState<'r>(pub Option<&'r AtRestRuntime>);
+
+#[rocket::async_trait]
+impl<'r> rocket::request::FromRequest<'r> for AtRestState<'r> {
+    type Error = std::convert::Infallible;
+
+    async fn from_request(
+        request: &'r rocket::Request<'_>,
+    ) -> rocket::request::Outcome<Self, Self::Error> {
+        rocket::request::Outcome::Success(AtRestState(
+            request
+                .rocket()
+                .state::<Arc<AtRestRuntime>>()
+                .map(|r| r.as_ref()),
+        ))
+    }
+}
+
+impl AtRestRuntime {
+    /// Phase one, before block storage opens. No keys yet: `provider()` is
+    /// `None` and `encrypting()` is false until [`setup`] runs.
+    pub fn new(config: &AtRestConfig) -> Arc<Self> {
+        Arc::new(Self {
+            mode: config.mode,
+            escrow_none: config.escrow_none,
+            root_source: config.root_source,
+            root_fingerprint: OnceLock::new(),
+            keyring: OnceLock::new(),
+            encrypting: AtomicBool::new(false),
+            blocks_seal: AtomicBool::new(false),
+            sql_seal: AtomicBool::new(false),
+            share_failures: ShareFailureLimiter::new(),
+        })
+    }
+
+    pub fn mode(&self) -> AtRestMode {
+        self.mode
+    }
+
+    /// Whether new writes may be sealed now: storage has a seal path, the
+    /// gate passed (non-`off` mode) and the keys are unlocked.
+    pub fn encrypting(&self) -> bool {
+        self.encrypting.load(Ordering::SeqCst)
+    }
+
+    /// Block storage and the SQL artifact store each call this when they
+    /// open with a seal path for every write. Until both have, `setup`
+    /// refuses any mode other than `off`, so the node never claims to
+    /// encrypt while some storage writes plaintext.
+    pub fn declare_seal_path(&self, path: SealPath) {
+        match path {
+            SealPath::Blocks => &self.blocks_seal,
+            SealPath::SqlArtifacts => &self.sql_seal,
+        }
+        .store(true, Ordering::SeqCst);
+    }
+
+    pub fn has_seal_path(&self) -> bool {
+        self.blocks_seal.load(Ordering::SeqCst) && self.sql_seal.load(Ordering::SeqCst)
+    }
+
+    pub fn share_failures(&self) -> &ShareFailureLimiter {
+        &self.share_failures
+    }
+
+    /// The data-key provider, once [`setup`] installed a keyring. `None`
+    /// when at-rest isn't configured. A locked keyring is still returned;
+    /// its calls fail with `DataKeyError::Locked`.
+    pub fn provider(&self) -> Option<Arc<dyn DataKeyProvider>> {
+        self.keyring
+            .get()
+            .map(|k| k.clone() as Arc<dyn DataKeyProvider>)
+    }
+
+    pub fn keyring(&self) -> Option<&Arc<AtRestKeyring>> {
+        self.keyring.get()
+    }
+
+    /// Re-run the gate, e.g. after a recovery unlocked the keys. Only a
+    /// non-`off` mode can turn encryption on. With `root_source = "env"`
+    /// there is no escrow by design, so the gate needs only unlocked keys.
+    pub async fn reevaluate(&self) -> Result<GatePass, GateRefusal> {
+        let Some(keyring) = self.keyring.get() else {
+            return Err(GateRefusal::NotProvisioned);
+        };
+        let unescrowed = self.escrow_none || self.root_source == AtRestRootSource::Env;
+        let result = keyring.gate(unescrowed).await;
+        let on = self.mode != AtRestMode::Off && self.has_seal_path() && result.is_ok();
+        self.encrypting.store(on, Ordering::SeqCst);
+        result
+    }
+
+    /// While a mode other than `off` is configured and encryption is off on
+    /// an unlocked node (for example the gate hit a transient store or
+    /// mirror error after a recovery), re-run the gate every `every`.
+    pub fn spawn_gate_retry(self: &Arc<Self>, every: std::time::Duration) {
+        if self.mode == AtRestMode::Off {
+            return;
+        }
+        let runtime = Arc::downgrade(self);
+        tokio::spawn(async move {
+            loop {
+                tokio::time::sleep(every).await;
+                let Some(runtime) = runtime.upgrade() else {
+                    return;
+                };
+                let unlocked = runtime
+                    .keyring()
+                    .is_some_and(|k| k.state() == KeyringState::Unlocked);
+                if unlocked && !runtime.encrypting() {
+                    match runtime.reevaluate().await {
+                        Ok(_) if runtime.encrypting() => {
+                            ::tracing::info!(
+                                "at-rest escrow gate passed on retry; encryption enabled"
+                            )
+                        }
+                        Ok(_) => {}
+                        Err(reason) => {
+                            ::tracing::warn!(%reason, "at-rest escrow gate still closed")
+                        }
+                    }
+                }
+            }
+        });
+    }
+
+    pub fn mode_name(&self) -> &'static str {
+        match self.mode {
+            AtRestMode::Off => "off",
+            AtRestMode::Encrypt => "encrypt",
+            AtRestMode::Strict => "strict",
+        }
+    }
+
+    pub fn state_name(&self) -> &'static str {
+        match self.keyring.get().map(|k| k.state()) {
+            None => "disabled",
+            Some(KeyringState::NotProvisioned) => "not_provisioned",
+            Some(KeyringState::Locked) => "locked",
+            Some(KeyringState::Unlocked) => "unlocked",
+        }
+    }
+
+    pub fn root_source_name(&self) -> &'static str {
+        match self.root_source {
+            AtRestRootSource::Escrow => "escrow",
+            AtRestRootSource::Env => "env",
+        }
+    }
+
+    /// [`RootKey::fingerprint`] of the env root, for `root_source = "env"`.
+    pub fn root_fingerprint(&self) -> Option<&str> {
+        self.root_fingerprint.get().map(String::as_str)
+    }
+}
+
+impl AtRestSource for AtRestRuntime {
+    fn view(&self) -> AtRestView {
+        AtRestView {
+            mode: self.mode,
+            encrypting: self.encrypting(),
+            provider: self.provider(),
+        }
+    }
+}
+
+/// Phase two, after migrations ran: open the keyring and run the gate.
+/// `node_root` is the node's own root; the env roots come from `root_env`
+/// ([`RootEnv::take`]); `tee_indicated` is what marks this host as a dstack
+/// TEE, if anything.
+///
+/// Refuses (an error, so the node does not start):
+/// - everything [`check_config`] refuses (the same checks as
+///   `--validate-config`), with the seal paths storage declared
+///   ([`AtRestRuntime::declare_seal_path`]);
+/// - a missing, malformed or misplaced root key ([`Roots::read`]);
+/// - in a TEE, escrow recipients or a pin that are not literal values in
+///   the measured compose ([`check_measured_escrow`]), and for
+///   `root_source = "env"` the checks in [`check_tee_env_root`];
+/// - `encrypt` or `strict` when the keys are unlocked but the gate fails;
+/// - `root_source = "env"` when the key doesn't open the stored keys: there
+///   is no escrow to recover with.
+///
+/// An escrow node that boots **locked** starts anyway, with encryption
+/// unavailable, so two holders can recover it.
+#[allow(clippy::too_many_arguments)]
+pub async fn setup(
+    runtime: &AtRestRuntime,
+    config: &AtRestConfig,
+    storage: &Storage,
+    node_root: &[u8],
+    root_env: &RootEnv,
+    db: RecoveringConnection,
+    sqlite_writer_lock: Option<Arc<tokio::sync::Mutex<()>>>,
+    tee: Option<&TeeContext>,
+    tee_indicated: Option<&str>,
+) -> Result<()> {
+    let escrow = &config.escrow;
+    let roots = Roots::read(config, node_root, root_env)?;
+    ensure!(
+        runtime.has_seal_path() == STORAGE_SEALS_EVERY_WRITE,
+        "at-rest: the seal paths storage declared don't match this build (STORAGE_SEALS_EVERY_WRITE)"
+    );
+    check_config(
+        config,
+        &roots,
+        runtime.has_seal_path(),
+        TeeState {
+            indicated: tee_indicated,
+            present: tee.is_some(),
+        },
+    )?;
+    if !enabled(config) {
+        return Ok(());
+    }
+    // In a TEE every at-rest configuration is checked against the measured
+    // compose and, for an env root, the OS image.
+    if let Some(tee) = tee {
+        let measured = crate::dstack::get_measured_info()
+            .await
+            .context("refusing to start: at-rest needs the guest agent's Info")?;
+        match config.root_source {
+            AtRestRootSource::Escrow => check_tee_escrow(measured.app_compose, tee, escrow)?,
+            AtRestRootSource::Env => check_tee_env_root(measured, tee)?,
+        }
+    }
+    if let Some(key) = &roots.env {
+        let fingerprint = key.fingerprint();
+        ::tracing::info!(root_fingerprint = %fingerprint, "at-rest root from the environment");
+        let _ = runtime.root_fingerprint.set(fingerprint);
+    }
+    if let Some(previous) = &roots.previous {
+        ::tracing::warn!(
+            previous_root_fingerprint = %previous.fingerprint(),
+            "a previous at-rest root is set; keys sealed under it are re-sealed under the current root"
+        );
+    }
+    let pinned_efp = escrow.verified_fp.as_deref().map(parse_efp).transpose()?;
+    let mirror: Arc<dyn KeyMirror> = match &storage.blocks {
+        Either::A(s3) => Arc::new(S3KeyMirror::new(s3).await),
+        Either::B(_) => Arc::new(FsKeyMirror::new(storage.datadir.join("at-rest"))),
+    };
+    let keyring = AtRestKeyring::open_with_previous_root(
+        AtRestStore::new(db).with_sqlite_writer_lock(sqlite_writer_lock),
+        mirror,
+        roots.root(node_root),
+        roots.previous.as_ref().map(RootKey::bytes),
+        KeyringConfig {
+            provision: true,
+            holders: escrow.recipients.clone(),
+            recipient_policy: if escrow.allow_software {
+                RecipientPolicy::AllowSoftware
+            } else {
+                RecipientPolicy::HardwareOnly
+            },
+            pinned_efp,
+            app_id: tee.map(|t| t.app_id.clone()),
+            compose_hash: tee.map(|t| t.compose_hash.clone()),
+            // Once keys may seal data, the mirror must hold a copy of every
+            // key; with mode off, mirror contents never stop the node.
+            require_mirror: config.mode != AtRestMode::Off,
+            allow_resplit_before_verify: escrow.allow_resplit_before_verify,
+        },
+    )
+    .await
+    .context("at-rest keys")?;
+    if runtime.keyring.set(Arc::new(keyring)).is_err() {
+        bail!("at-rest keys were already set up");
+    }
+    let env_root = config.root_source == AtRestRootSource::Env;
+    match runtime.keyring().map(|k| k.state()) {
+        Some(KeyringState::Unlocked) => {
+            let gate = runtime.reevaluate().await;
+            match (config.mode, gate) {
+                (AtRestMode::Off, Ok(GatePass::Verified { .. })) => {
+                    ::tracing::info!("at-rest keys unlocked; escrow verified; mode off")
+                }
+                (AtRestMode::Off, Ok(GatePass::Unescrowed)) if env_root => {
+                    ::tracing::info!("at-rest keys unlocked; root from the environment; mode off")
+                }
+                (AtRestMode::Off, Ok(GatePass::Unescrowed)) => ::tracing::info!(
+                    "at-rest keys unlocked; no escrow (escrow_none acknowledged); mode off"
+                ),
+                (AtRestMode::Off, Err(refusal)) => ::tracing::warn!(
+                    reason = %refusal,
+                    "at-rest keys unlocked; the escrow gate is not satisfied yet"
+                ),
+                (mode, Ok(_)) => {
+                    ::tracing::info!(
+                        ?mode,
+                        root_source = runtime.root_source_name(),
+                        "at-rest encryption enabled"
+                    );
+                    if tee.is_none() {
+                        ::tracing::warn!(
+                            "at-rest encryption seals KV blocks and SQL artifacts in external storage; local working, cache, staging and export files stay plaintext on this host (no TEE): protect the data directory, swap and file backups"
+                        );
+                    }
+                }
+                (mode, Err(refusal)) => {
+                    bail!("at_rest.mode = {mode:?} is refused: {refusal}")
+                }
+            }
+        }
+        Some(KeyringState::Locked) if env_root => bail!(
+            "refusing to start: the at-rest root from {ROOT_KEY_ENV} (fingerprint {}) does not open the stored at-rest keys; set the root they were sealed under, or pass it as {PREVIOUS_ROOT_KEY_ENV} to re-seal them",
+            runtime.root_fingerprint().unwrap_or("?")
+        ),
+        Some(KeyringState::Locked) => ::tracing::error!(
+            mode = runtime.mode_name(),
+            "at-rest keys are LOCKED: encrypted data is unavailable until two escrow holders recover the key (POST /at-rest/recovery/shares)"
+        ),
+        _ => bail!("at-rest keys were not provisioned"),
+    }
+    Ok(())
+}
+
+/// Whether any at-rest setting is configured (otherwise nothing is set up).
+pub fn enabled(config: &AtRestConfig) -> bool {
+    config.mode != AtRestMode::Off
+        || config.root_source == AtRestRootSource::Env
+        || !config.escrow.recipients.is_empty()
+        || config.escrow_none
+}
+
+/// The dstack socket exists but its Info couldn't be read, so the node
+/// can't tell whether it runs in a TEE. Booting as non-TEE would skip the
+/// TEE-only checks (measured compose, no `escrow_none`, no software
+/// holders), so with any at-rest setting the node refuses to start.
+pub fn refuse_unknown_tee(config: &AtRestConfig, info_error: &anyhow::Error) -> Result<()> {
+    if enabled(config) {
+        bail!(
+            "refusing to start: the dstack socket is present but its Info could not be read ({info_error:#}), so the at-rest TEE checks can't run"
+        );
+    }
+    Ok(())
+}
+
+/// The TEE boot check: `app_compose` is what the guest agent returned for
+/// `tcb_info.app_compose`. If it couldn't be read, or doesn't parse, or the
+/// escrow config doesn't match its literals, the node refuses to start: it
+/// never runs at-rest in a TEE without the check. (The guest agent's Info
+/// shape is to be confirmed on a live CVM before the escrow ceremony.)
+pub fn check_tee_escrow(
+    app_compose: Result<String>,
+    tee: &TeeContext,
+    escrow: &AtRestEscrowConfig,
+) -> Result<()> {
+    let app_compose = app_compose.context(
+        "refusing to start: at-rest needs the measured app-compose (dstack Info tcb_info.app_compose) to check the escrow config, and it could not be read",
+    )?;
+    check_measured_escrow(&app_compose, &tee.compose_hash, escrow).context(
+        "refusing to start: the at-rest escrow config does not match the measured app-compose",
+    )
+}
+
+fn parse_efp(s: &str) -> Result<Efp> {
+    s.trim()
+        .to_ascii_lowercase()
+        .parse::<Efp>()
+        .map_err(|_| anyhow::anyhow!("at_rest.escrow.verified_fp must be 64 hex characters"))
+}
+
+/// In a TEE, the escrow recipients and the pinned fingerprint decide who can
+/// rebuild the root key, so they must come from the attested compose: each
+/// must equal a literal value in the measured `app-compose.json` (covered by
+/// `compose_hash`), never the encrypted environment, a file or any other
+/// runtime source. Either one configured without a matching literal, or a
+/// literal the effective config doesn't match, is refused.
+pub fn check_measured_escrow(
+    app_compose: &str,
+    compose_hash: &str,
+    escrow: &AtRestEscrowConfig,
+) -> Result<()> {
+    let compose = measured_compose(app_compose, compose_hash)?;
+    let literal_recipients = compose.literal_env(RECIPIENTS_ENV)?;
+    match literal_recipients {
+        None => ensure!(
+            escrow.recipients.is_empty(),
+            "at_rest.escrow.recipients must be set as a literal {RECIPIENTS_ENV} in the measured compose, not from the environment or a file"
+        ),
+        Some(literal) => {
+            let value: rocket::figment::value::Value =
+                literal.parse().unwrap_or_else(|never| match never {});
+            let measured: Vec<HolderRecipient> = value
+                .deserialize()
+                .with_context(|| format!("the measured {RECIPIENTS_ENV} does not parse"))?;
+            ensure!(
+                measured == escrow.recipients,
+                "at_rest.escrow.recipients differ from the literal {RECIPIENTS_ENV} in the measured compose"
+            );
+        }
+    }
+    let literal_fp = compose.literal_env(VERIFIED_FP_ENV)?;
+    let configured = escrow.verified_fp.as_deref().map(parse_efp).transpose()?;
+    match (literal_fp, configured) {
+        (None, None) => {}
+        (None, Some(_)) => bail!(
+            "at_rest.escrow.verified_fp must be set as a literal {VERIFIED_FP_ENV} in the measured compose, not from the environment or a file"
+        ),
+        (Some(_), None) => bail!(
+            "the measured compose pins {VERIFIED_FP_ENV}, but the effective config has no at_rest.escrow.verified_fp"
+        ),
+        (Some(literal), Some(configured)) => ensure!(
+            parse_efp(&literal)? == configured,
+            "at_rest.escrow.verified_fp differs from the literal {VERIFIED_FP_ENV} in the measured compose"
+        ),
+    }
+    Ok(())
+}
+
+/// `app_compose` parsed, after checking it is the measured one.
+fn measured_compose(app_compose: &str, compose_hash: &str) -> Result<AppCompose> {
+    let digest = hex::encode(sha2::Sha256::digest(app_compose.as_bytes()));
+    ensure!(
+        digest.eq_ignore_ascii_case(compose_hash.trim()),
+        "the app-compose the guest agent reports hashes to {digest}, not the measured compose_hash {compose_hash}"
+    );
+    AppCompose::parse(app_compose.as_bytes()).context("reading the measured app-compose")
+}
+
+/// The TEE boot check for `root_source = "env"`. Refuses to start unless:
+/// - the measured compose sets [`ROOT_SOURCE_ENV`] to the literal `env`, so
+///   the attested compose shows that the at-rest root comes from the
+///   environment;
+/// - every setting of either root key, in every service, is exactly one
+///   plain reference to a variable of the encrypted environment (`${NAME}`,
+///   or `${NAME:?message}` / `${NAME?message}`, which fail when unset): never
+///   a literal, a default or alternate value, a pass-through or anything
+///   else docker compose would expand (the compose is public);
+/// - the measured app-compose does not allow [`SSH_KEYS_ENV`] (SSH into the
+///   CVM would expose the key);
+/// - the guest agent reports a production OS image
+///   ([`PRODUCTION_OS_IMAGE_HASHES`]), not a dev image.
+pub fn check_tee_env_root(measured: MeasuredInfo, tee: &TeeContext) -> Result<()> {
+    let app_compose = measured.app_compose.context(
+        "refusing to start: at-rest needs the measured app-compose (dstack Info tcb_info.app_compose), and it could not be read",
+    )?;
+    check_measured_env_root(&app_compose, &tee.compose_hash)
+        .context("refusing to start: at_rest.root_source = \"env\" is not allowed by the measured app-compose")?;
+    let os_image_hash = measured.os_image_hash.context(
+        "refusing to start: at_rest.root_source = \"env\" needs the OS image hash from dstack Info",
+    )?;
+    ensure!(
+        PRODUCTION_OS_IMAGE_HASHES.contains(&os_image_hash.as_str()),
+        "refusing to start: at_rest.root_source = \"env\" runs only on a production dstack OS image; this CVM runs OS image {os_image_hash}"
+    );
+    Ok(())
+}
+
+/// The compose part of [`check_tee_env_root`].
+pub fn check_measured_env_root(app_compose: &str, compose_hash: &str) -> Result<()> {
+    let compose = measured_compose(app_compose, compose_hash)?;
+    match compose.literal_env(ROOT_SOURCE_ENV) {
+        Ok(Some(source)) if source == "env" => {}
+        _ => bail!("the measured compose must set {ROOT_SOURCE_ENV} to the literal value env"),
+    }
+    for key in [ROOT_KEY_ENV, PREVIOUS_ROOT_KEY_ENV] {
+        // A compose this reader can't read is refused, never assumed safe.
+        for setting in compose.env_settings(key).with_context(|| {
+            format!("{key}: the measured compose's environment could not be read")
+        })? {
+            let plain = match &setting {
+                EnvSetting::Value { value, .. } => is_plain_env_reference(value),
+                EnvSetting::FromRuntime { .. } => false,
+            };
+            // The message never quotes the value: it may hold a key.
+            ensure!(
+                plain,
+                "service {:?} must set {key} to a plain reference to the encrypted environment (${{NAME}}); it must come from the encrypted environment, not a literal, a default or a pass-through in the compose",
+                setting.service()
+            );
+        }
+    }
+    let doc: serde_json::Value = serde_json::from_str(app_compose)?;
+    let allows_ssh = doc
+        .get("allowed_envs")
+        .and_then(|v| v.as_array())
+        .is_some_and(|names| names.iter().any(|n| n.as_str() == Some(SSH_KEYS_ENV)));
+    ensure!(
+        !allows_ssh,
+        "the measured app-compose allows {SSH_KEYS_ENV} (SSH into the CVM)"
+    );
+    Ok(())
+}
+
+/// `${NAME}`, `${NAME:?message}` or `${NAME?message}` and nothing else: one
+/// braced reference to a variable name, with at most an error message for
+/// when it is unset (the message can't expand anything).
+fn is_plain_env_reference(value: &str) -> bool {
+    let Some(inner) = value
+        .strip_prefix("${")
+        .and_then(|rest| rest.strip_suffix('}'))
+    else {
+        return false;
+    };
+    let name_len = inner
+        .find(|c: char| !(c.is_ascii_alphanumeric() || c == '_'))
+        .unwrap_or(inner.len());
+    let (name, rest) = inner.split_at(name_len);
+    let valid_name = name
+        .chars()
+        .next()
+        .is_some_and(|c| c.is_ascii_alphabetic() || c == '_');
+    let message = rest.strip_prefix(":?").or_else(|| rest.strip_prefix('?'));
+    valid_name
+        && match message {
+            None => rest.is_empty(),
+            Some(message) => !message.contains(['$', '{', '}']),
+        }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const R: &str = "[{holder=\"sam\",recipient=\"age1yubikey1qg3fps8csqk30gjdt552hf7jyjnmt753z9yhk4p8f0x5vvr5m53mju3vr5u\"},{holder=\"hunter\",recipient=\"age1yubikey1qg3fps8csqk30gjdt552hf7jyjnmt753z9yhk4p8f0x5vvr5m53mju3vr5u\"},{holder=\"safe\",recipient=\"age1yubikey1qg3fps8csqk30gjdt552hf7jyjnmt753z9yhk4p8f0x5vvr5m53mju3vr5u\"}]";
+
+    fn app_compose(env: &str) -> String {
+        let digest = "a".repeat(64);
+        serde_json::to_string(&serde_json::json!({
+            "manifest_version": 2,
+            "runner": "docker-compose",
+            "docker_compose_file": format!(
+                "services:\n  tinycloud:\n    image: n@sha256:{digest}\n    environment:\n{env}"
+            ),
+        }))
+        .unwrap()
+    }
+
+    fn hash(s: &str) -> String {
+        hex::encode(sha2::Sha256::digest(s.as_bytes()))
+    }
+
+    fn escrow(recipients: &str, fp: Option<&str>) -> AtRestEscrowConfig {
+        let value: rocket::figment::value::Value = recipients.parse().unwrap();
+        AtRestEscrowConfig {
+            recipients: value.deserialize().unwrap(),
+            verified_fp: fp.map(str::to_owned),
+            allow_software: false,
+            allow_resplit_before_verify: false,
+        }
+    }
+
+    /// The standard base64 of bytes 0..32.
+    fn key_b64(offset: u8) -> String {
+        let bytes: Vec<u8> = (0..32u8).map(|b| b.wrapping_add(offset)).collect();
+        base64::encode_config(bytes, base64::STANDARD)
+    }
+
+    fn env_config() -> AtRestConfig {
+        AtRestConfig {
+            root_source: AtRestRootSource::Env,
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn a_root_key_is_exactly_32_bytes_of_canonical_standard_base64() {
+        let good = key_b64(0);
+        let key = RootKey::parse(&good).unwrap();
+        assert_eq!(key.bytes(), (0..32u8).collect::<Vec<_>>().as_slice());
+        assert_eq!(key.fingerprint().len(), 16);
+        assert_eq!(
+            RootKey::parse(&format!("{good}\n")).unwrap().fingerprint(),
+            key.fingerprint()
+        );
+        let mut url_bytes = [0xfb; 32];
+        url_bytes[31] = 1;
+        let url_safe = base64::encode_config(url_bytes, base64::URL_SAFE);
+        let bad = [
+            String::new(),
+            format!(" {good}"),
+            format!("{good}\n\n"),
+            good.trim_end_matches('=').to_string(),
+            base64::encode_config([7u8; 31], base64::STANDARD),
+            base64::encode_config([7u8; 33], base64::STANDARD),
+            base64::encode_config([7u8; 32], base64::STANDARD),
+            url_safe,
+            format!("{}B=", &good[..42]),
+        ];
+        for value in bad {
+            let err = format!("{:#}", RootKey::parse(&value).unwrap_err());
+            if !value.is_empty() {
+                assert!(!err.contains(value.trim()), "error echoes the value: {err}");
+            }
+        }
+        assert!(!format!("{key:?}").contains(&good));
+    }
+
+    #[test]
+    fn roots_refuse_a_missing_misplaced_or_malformed_key() {
+        let node_root = [5u8; 64];
+        let env = |pairs: Vec<(&'static str, String)>| {
+            let get = |name: &str| {
+                pairs
+                    .iter()
+                    .find(|(k, _)| *k == name)
+                    .map(|(_, v)| Zeroizing::new(v.clone()))
+            };
+            RootEnv::new(get(ROOT_KEY_ENV), get(PREVIOUS_ROOT_KEY_ENV))
+        };
+        let roots = Roots::read(
+            &env_config(),
+            &node_root,
+            &env(vec![(ROOT_KEY_ENV, key_b64(0))]),
+        )
+        .unwrap();
+        assert_eq!(
+            roots.root(&node_root),
+            RootKey::parse(&key_b64(0)).unwrap().bytes()
+        );
+        let roots = Roots::read(&AtRestConfig::default(), &node_root, &env(vec![])).unwrap();
+        assert_eq!(roots.root(&node_root), &node_root[..]);
+
+        let refused = [
+            (env_config(), vec![]),
+            (env_config(), vec![(ROOT_KEY_ENV, "not a key".to_string())]),
+            (AtRestConfig::default(), vec![(ROOT_KEY_ENV, key_b64(0))]),
+            (
+                env_config(),
+                vec![
+                    (ROOT_KEY_ENV, key_b64(0)),
+                    (PREVIOUS_ROOT_KEY_ENV, "x".to_string()),
+                ],
+            ),
+            (
+                env_config(),
+                vec![
+                    (ROOT_KEY_ENV, key_b64(0)),
+                    (PREVIOUS_ROOT_KEY_ENV, key_b64(0)),
+                ],
+            ),
+        ];
+        for (config, pairs) in refused {
+            let shown = format!("{pairs:?}");
+            assert!(
+                Roots::read(&config, &node_root, &env(pairs)).is_err(),
+                "{shown}"
+            );
+        }
+        // Moving from an env root to the node root: the env key becomes the
+        // previous root.
+        let roots = Roots::read(
+            &AtRestConfig::default(),
+            &node_root,
+            &env(vec![(PREVIOUS_ROOT_KEY_ENV, key_b64(0))]),
+        )
+        .unwrap();
+        assert_eq!(roots.root(&node_root), &node_root[..]);
+        assert!(roots.previous.is_some());
+    }
+
+    fn env_root_compose(env: &str, allowed_envs: &[&str]) -> String {
+        let digest = "a".repeat(64);
+        serde_json::to_string(&serde_json::json!({
+            "manifest_version": 2,
+            "runner": "docker-compose",
+            "allowed_envs": allowed_envs,
+            "docker_compose_file": format!(
+                "services:\n  tinycloud:\n    image: n@sha256:{digest}\n    environment:\n{env}"
+            ),
+        }))
+        .unwrap()
+    }
+
+    /// An app-compose with the `tinycloud` service (environment `env`) and an
+    /// optional second service (environment `other_env`).
+    fn two_service_compose(env: &str, other_env: Option<&str>) -> String {
+        let digest = "a".repeat(64);
+        let other = other_env.map_or(String::new(), |e| {
+            format!("  other:\n    image: o@sha256:{digest}\n    environment:\n{e}")
+        });
+        serde_json::to_string(&serde_json::json!({
+            "manifest_version": 2,
+            "runner": "docker-compose",
+            "allowed_envs": ["K", "P"],
+            "docker_compose_file": format!(
+                "services:\n  tinycloud:\n    image: n@sha256:{digest}\n    environment:\n{env}{other}"
+            ),
+        }))
+        .unwrap()
+    }
+
+    #[test]
+    fn a_root_key_in_the_compose_is_only_ever_a_plain_reference_to_the_encrypted_env() {
+        let source = format!("      {ROOT_SOURCE_ENV}: env\n");
+        // Throwaway values, never real keys.
+        let (k, p) = (key_b64(11), key_b64(12));
+        let accepted = [
+            format!("{source}      {ROOT_KEY_ENV}: ${{K}}\n"),
+            format!("{source}      {ROOT_KEY_ENV}: \"${{K:?seal the key}}\"\n"),
+            format!("{source}      {ROOT_KEY_ENV}: ${{K?seal the key}}\n"),
+            format!(
+                "{source}      {ROOT_KEY_ENV}: ${{K}}\n      {PREVIOUS_ROOT_KEY_ENV}: ${{P}}\n"
+            ),
+            format!("      - {ROOT_SOURCE_ENV}=env\n      - {ROOT_KEY_ENV}=${{K}}\n"),
+        ];
+        for env in &accepted {
+            let doc = two_service_compose(env, None);
+            check_measured_env_root(&doc, &hash(&doc)).unwrap_or_else(|e| panic!("{env:?}: {e:#}"));
+        }
+        let refused = [
+            // A default publishes the real key in the measured compose.
+            (format!("{source}      {ROOT_KEY_ENV}: ${{UNSET:-{k}}}\n"), None),
+            (format!("{source}      {ROOT_KEY_ENV}: ${{UNSET-{k}}}\n"), None),
+            (format!("{source}      {ROOT_KEY_ENV}: ${{K}}\n      {PREVIOUS_ROOT_KEY_ENV}: ${{UNSET:-{p}}}\n"), None),
+            (format!("{source}      {ROOT_KEY_ENV}: ${{K:+{k}}}\n"), None),
+            // Not exactly one braced reference.
+            (format!("{source}      {ROOT_KEY_ENV}: $K\n"), None),
+            (format!("{source}      {ROOT_KEY_ENV}: x${{K}}\n"), None),
+            (format!("{source}      {ROOT_KEY_ENV}: ${{K}}${{P}}\n"), None),
+            (format!("{source}      {ROOT_KEY_ENV}: ${{K:?${{P}}}}\n"), None),
+            // Passed through from the runtime environment, or empty.
+            (format!("{source}      - {ROOT_KEY_ENV}\n"), None),
+            (format!("{source}      {ROOT_KEY_ENV}:\n"), None),
+            // A literal key in a second service.
+            (
+                format!("{source}      {ROOT_KEY_ENV}: ${{K}}\n"),
+                Some(format!("      {ROOT_KEY_ENV}: {k}\n")),
+            ),
+            (
+                format!("{source}      {ROOT_KEY_ENV}: ${{K}}\n"),
+                Some(format!("      {PREVIOUS_ROOT_KEY_ENV}: {p}\n")),
+            ),
+        ];
+        for (env, other) in refused {
+            let doc = two_service_compose(&env, other.as_deref());
+            let err = check_measured_env_root(&doc, &hash(&doc));
+            assert!(err.is_err(), "accepted {env:?} / {other:?}");
+            let shown = format!("{:#}", err.unwrap_err());
+            assert!(
+                !shown.contains(&k) && !shown.contains(&p),
+                "error shows a key: {shown}"
+            );
+        }
+    }
+
+    #[test]
+    fn an_env_root_needs_a_measured_literal_and_no_key_or_ssh_in_the_compose() {
+        let source = format!("      {ROOT_SOURCE_ENV}: env\n");
+        let key = format!("      {ROOT_KEY_ENV}: ${{AT_REST_ROOT_KEY}}\n");
+        let doc = env_root_compose(&format!("{source}{key}"), &["AT_REST_ROOT_KEY"]);
+        check_measured_env_root(&doc, &hash(&doc)).unwrap();
+
+        let refused = [
+            // Not declared in the measured compose, or not literally.
+            (env_root_compose(&key, &[]), "literal value env"),
+            (
+                env_root_compose(&format!("      {ROOT_SOURCE_ENV}: ${{SOURCE}}\n{key}"), &[]),
+                "literal value env",
+            ),
+            (
+                env_root_compose(&format!("      {ROOT_SOURCE_ENV}: escrow\n{key}"), &[]),
+                "literal value env",
+            ),
+            // A key published in the compose.
+            (
+                env_root_compose(
+                    &format!("{source}      {ROOT_KEY_ENV}: {}\n", key_b64(0)),
+                    &[],
+                ),
+                "encrypted environment",
+            ),
+            (
+                env_root_compose(
+                    &format!(
+                        "{source}{key}      {PREVIOUS_ROOT_KEY_ENV}: {}\n",
+                        key_b64(1)
+                    ),
+                    &[],
+                ),
+                "encrypted environment",
+            ),
+            // SSH keys may be provisioned into the CVM.
+            (
+                env_root_compose(
+                    &format!("{source}{key}"),
+                    &["AT_REST_ROOT_KEY", "DSTACK_AUTHORIZED_KEYS"],
+                ),
+                "SSH",
+            ),
+        ];
+        for (doc, needle) in refused {
+            let err = format!(
+                "{:#}",
+                check_measured_env_root(&doc, &hash(&doc)).unwrap_err()
+            );
+            assert!(err.contains(needle), "{needle}: {err}");
+        }
+        // Not the measured compose.
+        assert!(check_measured_env_root(&doc, &"0".repeat(64)).is_err());
+    }
+
+    #[test]
+    fn an_env_root_runs_only_on_a_production_os_image() {
+        let doc = env_root_compose(
+            &format!("      {ROOT_SOURCE_ENV}: env\n      {ROOT_KEY_ENV}: ${{K}}\n"),
+            &["K"],
+        );
+        let tee = TeeContext {
+            app_id: "a".into(),
+            compose_hash: hash(&doc),
+            instance_id: "i".into(),
+            enforcer_did: "did:key:z".into(),
+        };
+        let measured = |os: Result<String>| MeasuredInfo {
+            app_compose: Ok(doc.clone()),
+            os_image_hash: os,
+        };
+        check_tee_env_root(measured(Ok(PRODUCTION_OS_IMAGE_HASHES[0].into())), &tee).unwrap();
+        // dstack-dev-0.5.12, an unknown image, and no hash at all.
+        for os in [
+            Ok("e866e987221db357129ebc3f066b6706ef955889ea95e5510acbdf3d3055186b".to_string()),
+            Ok("0".repeat(64)),
+            Err(anyhow!("dstack Info has no os_image_hash")),
+        ] {
+            let err = format!("{:#}", check_tee_env_root(measured(os), &tee).unwrap_err());
+            assert!(err.starts_with("refusing to start"), "{err}");
+        }
+    }
+
+    #[test]
+    fn literal_compose_values_pass() {
+        let fp = "b".repeat(64);
+        let doc = app_compose(&format!(
+            "      {RECIPIENTS_ENV}: '{R}'\n      {VERIFIED_FP_ENV}: {fp}\n"
+        ));
+        check_measured_escrow(&doc, &hash(&doc), &escrow(R, Some(&fp.to_uppercase()))).unwrap();
+        // No pin yet (before the ceremony): only the recipients.
+        let doc = app_compose(&format!("      - {RECIPIENTS_ENV}={R}\n"));
+        check_measured_escrow(&doc, &hash(&doc), &escrow(R, None)).unwrap();
+    }
+
+    #[test]
+    fn escrow_values_from_anywhere_but_the_measured_compose_are_refused() {
+        let fp = "b".repeat(64);
+        let cases = [
+            // Recipients from the encrypted env (interpolated or passed through).
+            (
+                format!("      {RECIPIENTS_ENV}: ${{RECIPIENTS}}\n"),
+                escrow(R, None),
+                "literal",
+            ),
+            (
+                format!("      - {RECIPIENTS_ENV}\n"),
+                escrow(R, None),
+                "literal",
+            ),
+            // Configured, but not in the compose at all (env file, config file).
+            ("      A: '1'\n".to_string(), escrow(R, None), "literal"),
+            // The compose names other holders than the node uses.
+            (
+                format!("      {RECIPIENTS_ENV}: '{}'\n", R.replace("sam", "eve")),
+                escrow(R, None),
+                "differ",
+            ),
+            // A pin from the environment, or a different one.
+            (
+                format!("      {RECIPIENTS_ENV}: '{R}'\n"),
+                escrow(R, Some(&fp)),
+                "verified_fp must be set",
+            ),
+            (
+                format!(
+                    "      {RECIPIENTS_ENV}: '{R}'\n      {VERIFIED_FP_ENV}: {}\n",
+                    "c".repeat(64)
+                ),
+                escrow(R, Some(&fp)),
+                "differs",
+            ),
+            (
+                format!("      {RECIPIENTS_ENV}: '{R}'\n      {VERIFIED_FP_ENV}: {fp}\n"),
+                escrow(R, None),
+                "no at_rest.escrow.verified_fp",
+            ),
+        ];
+        for (env, config, needle) in cases {
+            let doc = app_compose(&env);
+            let err = format!(
+                "{:#}",
+                check_measured_escrow(&doc, &hash(&doc), &config).unwrap_err()
+            );
+            assert!(err.contains(needle), "{env:?}: {err}");
+        }
+        // An app-compose that isn't the measured one.
+        let doc = app_compose(&format!("      {RECIPIENTS_ENV}: '{R}'\n"));
+        let err = check_measured_escrow(&doc, &"0".repeat(64), &escrow(R, None)).unwrap_err();
+        assert!(err.to_string().contains("measured compose_hash"), "{err}");
+    }
+
+    #[test]
+    fn a_tee_node_refuses_to_start_without_a_readable_measured_compose() {
+        let doc = app_compose(&format!("      {RECIPIENTS_ENV}: '{R}'\n"));
+        let tee = TeeContext {
+            app_id: "a".into(),
+            compose_hash: hash(&doc),
+            instance_id: "i".into(),
+            enforcer_did: "did:key:z".into(),
+        };
+        // The guest agent's Info had no tcb_info.app_compose, or it isn't
+        // an app-compose at all: never start without the check.
+        for app_compose in [
+            Err(anyhow::anyhow!("dstack Info has no tcb_info")),
+            Ok("not json".to_string()),
+        ] {
+            let err = format!(
+                "{:#}",
+                check_tee_escrow(app_compose, &tee, &escrow(R, None)).unwrap_err()
+            );
+            assert!(err.starts_with("refusing to start"), "{err}");
+        }
+        // Readable and matching: the boot may continue.
+        check_tee_escrow(Ok(doc), &tee, &escrow(R, None)).unwrap();
+    }
+
+    #[test]
+    fn an_unreadable_dstack_info_refuses_at_rest_instead_of_booting_as_non_tee() {
+        let info_error = anyhow::anyhow!("dstack Info request: connection reset");
+        let configured = [
+            AtRestConfig {
+                mode: AtRestMode::Encrypt,
+                ..Default::default()
+            },
+            AtRestConfig {
+                escrow: escrow(R, None),
+                ..Default::default()
+            },
+            AtRestConfig {
+                escrow_none: true,
+                ..Default::default()
+            },
+        ];
+        for config in configured {
+            let err = refuse_unknown_tee(&config, &info_error)
+                .unwrap_err()
+                .to_string();
+            assert!(err.starts_with("refusing to start"), "{err}");
+        }
+        // Nothing at rest configured: the node keeps its old behaviour.
+        refuse_unknown_tee(&AtRestConfig::default(), &info_error).unwrap();
+    }
+
+    #[test]
+    fn the_share_failure_limiter_stays_bounded_and_fast() {
+        let limiter = ShareFailureLimiter::new();
+        let one: std::net::IpAddr = "203.0.113.7".parse().unwrap();
+        for _ in 0..ShareFailureLimiter::BURST as usize {
+            assert!(limiter.allows(one));
+            limiter.record_failure(one);
+        }
+        assert!(!limiter.allows(one));
+        // 100k distinct clients: O(1) each, and the map never grows past
+        // its cap (the review measured 10 s per 10k with the old map).
+        let started = std::time::Instant::now();
+        for i in 0..100_000u32 {
+            limiter.record_failure(std::net::IpAddr::from(i.to_be_bytes()));
+        }
+        assert!(started.elapsed() < std::time::Duration::from_secs(2));
+        assert_eq!(
+            limiter.clients.lock().len(),
+            ShareFailureLimiter::MAX_CLIENTS
+        );
+    }
+}
diff --git a/tinycloud-node-server/src/config.rs b/tinycloud-node-server/src/config.rs
index 48416d3d..01cecbf6 100644
--- a/tinycloud-node-server/src/config.rs
+++ b/tinycloud-node-server/src/config.rs
@@ -59,6 +59,8 @@ pub struct Config {
     pub encryption_network: EncryptionNetworkConfig,
     #[serde(default)]
     pub sql: SqlConfig,
+    #[serde(default)]
+    pub at_rest: AtRestConfig,
 }
 
 /// Release gates for the encryption network routes. `named_keys_v1`
@@ -110,6 +112,62 @@ pub struct SqlConfig {
     pub delegated_caveats_enforced: bool,
 }
 
+/// Encryption at rest (TC-887). Off by default; see `docs/at-rest-escrow.md`.
+#[derive(Serialize, Deserialize, Debug, Default, Clone, Hash, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct AtRestConfig {
+    /// `off` writes plaintext; `encrypt` and `strict` are refused at boot
+    /// unless the at-rest gate passes.
+    #[serde(default)]
+    pub mode: AtRestMode,
+    /// Where the root that seals the at-rest root key comes from.
+    #[serde(default)]
+    pub root_source: AtRestRootSource,
+    #[serde(default)]
+    pub escrow: AtRestEscrowConfig,
+    /// Self-hosted Static-root nodes only: acknowledge that no escrow exists,
+    /// so losing the root loses encrypted data. Refused inside a TEE.
+    #[serde(default)]
+    pub escrow_none: bool,
+}
+
+pub use tinycloud_core::at_rest::AtRestMode;
+
+/// The root under which the node seals its at-rest root key (ARK).
+#[derive(Serialize, Deserialize, Debug, Default, Clone, Copy, Hash, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum AtRestRootSource {
+    /// The node's own root key, with the escrow gate: `encrypt` and `strict`
+    /// need a verified escrow (or `escrow_none` on a self-hosted node).
+    #[default]
+    Escrow,
+    /// A 32-byte key from the environment (`TINYCLOUD_AT_REST_ROOT_KEY`,
+    /// standard base64). No escrow: whoever holds the key and the stored
+    /// key rows can open the ARK. See `docs/at-rest-escrow.md`.
+    Env,
+}
+
+#[derive(Serialize, Deserialize, Debug, Default, Clone, Hash, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct AtRestEscrowConfig {
+    /// Exactly three holders. Setting them provisions the at-rest root key
+    /// and its escrow bundle at boot, even with `mode = "off"`.
+    #[serde(default)]
+    pub recipients: Vec<tinycloud_at_rest_escrow::HolderRecipient>,
+    /// The escrow fingerprint a ceremony verified (`tinycloud-at-rest record-efp`).
+    #[serde(default)]
+    pub verified_fp: Option<String>,
+    /// Accept X25519 software-key holders (tests and self-host only).
+    #[serde(default)]
+    pub allow_software: bool,
+    /// Before the escrow ceremony only: let a corrected holder list re-split
+    /// the escrow at boot. The node allows it only while no fingerprint is
+    /// pinned, the escrow was never verified, and no data key was ever made;
+    /// otherwise a holder change still refuses the boot.
+    #[serde(default)]
+    pub allow_resplit_before_verify: bool,
+}
+
 /// Production exact-email composition.  The capability remains unavailable
 /// until every trust/key/dependency field is configured; there are no fake
 /// adapters or development credentials in this configuration surface.
diff --git a/tinycloud-node-server/src/dstack.rs b/tinycloud-node-server/src/dstack.rs
index edfdaef4..dcefdfa8 100644
--- a/tinycloud-node-server/src/dstack.rs
+++ b/tinycloud-node-server/src/dstack.rs
@@ -228,6 +228,77 @@ pub async fn get_info() -> Result<InfoResponse> {
     .context("parsing Info response")
 }
 
+/// What the guest agent's `/Info` reports about the running CVM, for the
+/// at-rest boot checks.
+pub struct MeasuredInfo {
+    /// The `app-compose.json` this CVM was launched with
+    /// (`tcb_info.app_compose`). The caller checks it against `compose_hash`.
+    pub app_compose: Result<String>,
+    /// The OS image hash, from `os_image_hash` at the top level, in
+    /// `tcb_info` or in `vm_config` (each a JSON string or object). An error
+    /// when none has it or two disagree.
+    pub os_image_hash: Result<String>,
+}
+
+pub async fn get_measured_info() -> Result<MeasuredInfo> {
+    let info = get_json(&socket_path(), "/Info")
+        .await
+        .context("dstack Info request")?;
+    Ok(MeasuredInfo {
+        app_compose: app_compose_from_info(&info),
+        os_image_hash: os_image_hash_from_info(&info),
+    })
+}
+
+/// `info[field]` as a JSON object; the guest agent sends some objects as
+/// JSON-encoded strings.
+fn json_field(info: &serde_json::Value, field: &str) -> Result<Option<serde_json::Value>> {
+    Ok(match info.get(field) {
+        Some(serde_json::Value::String(s)) => Some(
+            serde_json::from_str(s).with_context(|| format!("dstack Info {field} is not JSON"))?,
+        ),
+        Some(other) => Some(other.clone()),
+        None => None,
+    })
+}
+
+fn app_compose_from_info(info: &serde_json::Value) -> Result<String> {
+    let tcb =
+        json_field(info, "tcb_info")?.ok_or_else(|| anyhow!("dstack Info has no tcb_info"))?;
+    tcb.get("app_compose")
+        .and_then(|v| v.as_str())
+        .map(str::to_owned)
+        .ok_or_else(|| anyhow!("dstack Info tcb_info has no app_compose"))
+}
+
+fn os_image_hash_from_info(info: &serde_json::Value) -> Result<String> {
+    let mut found: Option<String> = None;
+    let places = [
+        Some(info.clone()),
+        json_field(info, "tcb_info")?,
+        json_field(info, "vm_config")?,
+    ];
+    for place in places.into_iter().flatten() {
+        let Some(value) = place.get("os_image_hash") else {
+            continue;
+        };
+        let hash = value
+            .as_str()
+            .filter(|h| !h.is_empty())
+            .ok_or_else(|| anyhow!("dstack Info os_image_hash is not a non-empty string"))?
+            .to_ascii_lowercase();
+        match &found {
+            Some(seen) if *seen != hash => {
+                return Err(anyhow!(
+                    "dstack Info reports two different os_image_hash values"
+                ))
+            }
+            _ => found = Some(hash),
+        }
+    }
+    found.ok_or_else(|| anyhow!("dstack Info has no os_image_hash"))
+}
+
 /// Check whether the dstack socket is reachable.
 pub fn is_available() -> bool {
     std::path::Path::new(&socket_path()).exists()
@@ -327,6 +398,43 @@ pub(crate) mod stub {
 mod tests {
     use super::*;
 
+    #[test]
+    fn app_compose_comes_from_tcb_info_as_a_string_or_an_object() {
+        let tcb =
+            serde_json::json!({"mrtd": "00", "app_compose": "{\"runner\":\"docker-compose\"}"});
+        let as_string = serde_json::json!({"app_id": "a", "tcb_info": tcb.to_string()});
+        let as_object = serde_json::json!({"app_id": "a", "tcb_info": tcb});
+        for info in [as_string, as_object] {
+            assert_eq!(
+                app_compose_from_info(&info).unwrap(),
+                "{\"runner\":\"docker-compose\"}"
+            );
+        }
+        assert!(app_compose_from_info(&serde_json::json!({"app_id": "a"})).is_err());
+        assert!(app_compose_from_info(&serde_json::json!({"tcb_info": "{}"})).is_err());
+    }
+
+    #[test]
+    fn the_os_image_hash_must_be_reported_once_or_consistently() {
+        let h = "AB".repeat(32);
+        let vm_config = serde_json::json!({ "os_image_hash": h, "cpu_count": 2 }).to_string();
+        for info in [
+            serde_json::json!({ "os_image_hash": h }),
+            serde_json::json!({ "tcb_info": { "os_image_hash": h } }),
+            serde_json::json!({ "vm_config": vm_config }),
+            serde_json::json!({ "os_image_hash": h, "vm_config": vm_config }),
+        ] {
+            assert_eq!(os_image_hash_from_info(&info).unwrap(), "ab".repeat(32));
+        }
+        for info in [
+            serde_json::json!({ "app_id": "a" }),
+            serde_json::json!({ "os_image_hash": "" }),
+            serde_json::json!({ "os_image_hash": h, "tcb_info": { "os_image_hash": "cd" } }),
+        ] {
+            assert!(os_image_hash_from_info(&info).is_err(), "{info}");
+        }
+    }
+
     #[tokio::test]
     async fn get_quote_sends_exactly_64_bytes_of_report_data() {
         let agent = stub::serve_quote();
diff --git a/tinycloud-node-server/src/lib.rs b/tinycloud-node-server/src/lib.rs
index 681a85b8..a4d153c8 100644
--- a/tinycloud-node-server/src/lib.rs
+++ b/tinycloud-node-server/src/lib.rs
@@ -25,6 +25,7 @@ use std::{
 };
 
 pub mod allow_list;
+pub mod at_rest;
 pub mod auth_guards;
 pub mod authorization;
 pub mod cli;
@@ -257,6 +258,10 @@ use routes::tc_bench::{
 use routes::{
     admin::{delete_quota, get_quota, get_usage, list_quotas, set_quota},
     admin_stats::get_stats,
+    at_rest::{
+        at_rest_escrow, at_rest_escrow_record, at_rest_recovery, at_rest_recovery_share,
+        at_rest_status,
+    },
     attestation::attestation,
     create_signed_kv_url, delegate, delegation_query, delegation_status,
     encryption::{
@@ -600,6 +605,24 @@ pub fn resolve_runtime_config(tinycloud_config: &Config) -> Result<Config> {
     Ok(resolved)
 }
 
+/// The at-rest part of `--validate-config`: the same [`at_rest::check_config`]
+/// the node runs at startup, with the root variables `main` took
+/// ([`at_rest::RootEnv::take`]). It opens no key, database or socket, so the
+/// guest agent counts as absent: with a TEE indicated, at-rest is refused
+/// here, because its TEE checks run only at boot inside the TEE.
+pub fn validate_at_rest(tinycloud_config: &Config, root_env: &at_rest::RootEnv) -> Result<()> {
+    let roots = at_rest::Roots::read(&tinycloud_config.at_rest, &[], root_env)?;
+    at_rest::check_config(
+        &tinycloud_config.at_rest,
+        &roots,
+        at_rest::STORAGE_SEALS_EVERY_WRITE,
+        at_rest::TeeState {
+            indicated: dstack_indication(&tinycloud_config.tee),
+            present: false,
+        },
+    )
+}
+
 /// The named-key routes. Mounted only while `named_keys_v1` is on, so with it
 /// off these paths answer as any unmounted path does.
 fn named_key_routes() -> Vec<Route> {
@@ -641,6 +664,11 @@ fn production_routes(named_keys_v1: bool) -> Vec<Route> {
         public_kv_list,
         public_kv_options,
         attestation,
+        at_rest_status,
+        at_rest_escrow,
+        at_rest_escrow_record,
+        at_rest_recovery,
+        at_rest_recovery_share,
         set_quota,
         delete_quota,
         get_quota,
@@ -672,6 +700,9 @@ pub async fn app_with_control(
     tinycloud_config: &Config,
     control: Option<ControlPlaneHandle>,
 ) -> Result<Rocket<Build>> {
+    // TC-887: the at-rest root variables, out of the environment before
+    // anything else reads it (`main` already took them; tests haven't).
+    let root_env = at_rest::RootEnv::for_boot()?;
     let tinycloud_config = resolve_runtime_config(tinycloud_config)?;
     let request_id_origins =
         tracing::RequestIdOrigins::new(&tinycloud_config.log.request_id_first_party_origins)
@@ -774,6 +805,9 @@ pub async fn app_with_control(
                         })
                     }
                     Err(e) => {
+                        // TC-887: at-rest must not boot as non-TEE when it
+                        // can't tell; that would skip its TEE checks.
+                        at_rest::refuse_unknown_tee(&tinycloud_config.at_rest, &e)?;
                         ::tracing::warn!("dstack socket available but get_info failed: {}", e);
                         None
                     }
@@ -820,6 +854,10 @@ pub async fn app_with_control(
         encryption_backend,
     );
 
+    // TC-887: at-rest state, before block storage opens so storage can hold
+    // it; the keyring is installed after migrations (`at_rest::setup`).
+    let at_rest_runtime = at_rest::AtRestRuntime::new(&tinycloud_config.at_rest);
+
     // Migrate before opening S3: its one bucket listing both reconstructs
     // SpaceSizes and records which in-flight DELETE fences were counted.
     // Object sizes come from that listing; a separate HEAD afterwards could
@@ -946,6 +984,21 @@ pub async fn app_with_control(
     // space in the table one (existing byte counts are kept).
     let seeded_spaces = tinycloud.seed_store_sizes().await?;
     ::tracing::info!(spaces = seeded_spaces, "seeded block-store space sizes");
+    // TC-887: at-rest keys (after migrations). Off unless configured; an
+    // `encrypt`/`strict` mode whose escrow gate fails stops the boot here.
+    at_rest::setup(
+        &at_rest_runtime,
+        &tinycloud_config.at_rest,
+        &tinycloud_config.storage,
+        key_setup.as_bytes(),
+        &root_env,
+        seed_conn.clone(),
+        tinycloud.sqlite_writer_lock(),
+        tee_context.as_ref(),
+        dstack_indication(&tinycloud_config.tee),
+    )
+    .await?;
+    at_rest_runtime.spawn_gate_retry(std::time::Duration::from_secs(30));
     #[cfg(feature = "tc-bench-v1")]
     let bench_state = BenchState::new(
         &tinycloud_config.tc_bench,
@@ -1144,6 +1197,7 @@ pub async fn app_with_control(
         .manage(egress_policy)
         .manage(rate_limiter)
         .manage(tee_context)
+        .manage(at_rest_runtime)
         .manage(encryption_service)
         .manage(policy_v3_runtime)
         .manage(seed_conn.clone())
diff --git a/tinycloud-node-server/src/main.rs b/tinycloud-node-server/src/main.rs
index 361f22a0..68ec9bec 100644
--- a/tinycloud-node-server/src/main.rs
+++ b/tinycloud-node-server/src/main.rs
@@ -74,6 +74,15 @@ fn main() {
         }
         return;
     }
+    // TC-887: take the at-rest root variables out of the environment while
+    // this is the only thread, before the config loader reads `TINYCLOUD_*`.
+    match tinycloud::at_rest::RootEnv::take() {
+        Ok(root_env) => root_env.stash(),
+        Err(error) => {
+            eprintln!("\n✗ Failed to start tinycloud-node:\n\n  {error:#}");
+            std::process::exit(1);
+        }
+    }
     // The runtime `#[rocket::main]` used to set up: worker and blocking
     // thread counts come from ROCKET_WORKERS / ROCKET_MAX_BLOCKING.
     rocket::execute(start_server());
@@ -87,8 +96,12 @@ async fn start_server() {
         .skip(1)
         .any(|arg| arg == "--validate-config")
     {
-        match resolve_runtime_config(&tinycloud_config) {
-            Ok(_) => {
+        let checked = resolve_runtime_config(&tinycloud_config).and_then(|resolved| {
+            let root_env = tinycloud::at_rest::RootEnv::for_boot()?;
+            tinycloud::validate_at_rest(&resolved, &root_env)
+        });
+        match checked {
+            Ok(()) => {
                 eprintln!("tinycloud-node runtime configuration is valid");
                 return;
             }
diff --git a/tinycloud-node-server/src/routes/at_rest.rs b/tinycloud-node-server/src/routes/at_rest.rs
new file mode 100644
index 00000000..4aed44e0
--- /dev/null
+++ b/tinycloud-node-server/src/routes/at_rest.rs
@@ -0,0 +1,312 @@
+//! Escrow ceremony and recovery endpoints (TC-887 S1). All public data; see
+//! `docs/at-rest-escrow.md` and `tinycloud-at-rest` for the holder side.
+//!
+//! - `GET /at-rest/status`: mode, key state, escrow fingerprint, gate.
+//! - `GET /at-rest/escrow`: the escrow bundle holders decrypt from.
+//! - `GET /at-rest/escrow/record`: the ceremony verification record, only if
+//!   its MAC verifies under the live key.
+//! - `GET /at-rest/recovery?nonce=`: this boot's recovery recipient, bound
+//!   with the holder's nonce and the EFP into a TDX quote.
+//! - `POST /at-rest/recovery/shares`: one share sealed to that recipient.
+//!
+//! Share bodies are capped at 4 KiB and rate limited per IP. Shares that
+//! don't authenticate (don't decrypt, or match no commitment) are limited
+//! per client and never spend the node's per-boot share budget, which only
+//! genuine shares count against. Neither share bytes nor ciphertexts are
+//! logged.
+
+use rocket::data::{Data, ToByteUnit};
+use rocket::http::Status;
+use rocket::serde::json::Json;
+use rocket::State;
+use serde::Serialize;
+use tinycloud_at_rest_escrow::{
+    binding_digest, recovery_binding, validate_nonce, EscrowBundle, RecoveryInfo,
+    VerificationRecord, MAX_WRAPPED_SHARE, RECOVERY_INFO_VERSION,
+};
+use tinycloud_core::at_rest::keyring::{
+    AtRestError, EscrowView, KeyringState, ShareOutcome, ShareRefusal,
+};
+
+use crate::at_rest::{AtRestRuntime, AtRestState};
+use crate::routes::public::{ClientIp, RateLimiter};
+use crate::tee::TeeContext;
+
+type Refusal = (Status, String);
+
+fn not_enabled() -> Refusal {
+    (
+        Status::NotFound,
+        "at-rest keys are not enabled on this node".into(),
+    )
+}
+
+/// A keyring error as an answer: 503 when a retry may help (store or mirror
+/// unreachable, locked, a concurrent change), 500 when an operator must act.
+/// The body is a stable, non-secret reason; backend detail goes to the log.
+fn internal(e: AtRestError) -> Refusal {
+    ::tracing::error!(error = %e, "at-rest keyring error");
+    let status = if e.is_transient() {
+        Status::ServiceUnavailable
+    } else {
+        Status::InternalServerError
+    };
+    (status, format!("at-rest keyring error: {}", e.reason()))
+}
+
+async fn view(runtime: &AtRestRuntime) -> Result<EscrowView, Refusal> {
+    let keyring = runtime.keyring().ok_or_else(not_enabled)?;
+    keyring.escrow_view().await.map_err(internal)?.ok_or((
+        Status::NotFound,
+        "no escrow bundle is available (no recipients configured, or a locked node without a pinned at_rest.escrow.verified_fp)".into(),
+    ))
+}
+
+#[derive(Serialize)]
+pub struct AtRestStatus {
+    mode: &'static str,
+    state: &'static str,
+    encrypting: bool,
+    /// `escrow` (the node root) or `env` (`TINYCLOUD_AT_REST_ROOT_KEY`).
+    root_source: &'static str,
+    /// For an env root: the key's fingerprint, never the key.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    root_fingerprint: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    efp: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    generation: Option<u32>,
+    verified: bool,
+}
+
+#[get("/at-rest/status")]
+pub async fn at_rest_status(at_rest: AtRestState<'_>) -> Result<Json<AtRestStatus>, Refusal> {
+    let runtime = at_rest.0.ok_or_else(not_enabled)?;
+    let escrow = match runtime.keyring() {
+        Some(k) => k.escrow_view().await.map_err(internal)?,
+        None => None,
+    };
+    Ok(Json(AtRestStatus {
+        mode: runtime.mode_name(),
+        state: runtime.state_name(),
+        encrypting: runtime.encrypting(),
+        root_source: runtime.root_source_name(),
+        root_fingerprint: runtime.root_fingerprint().map(str::to_owned),
+        efp: escrow.as_ref().map(|v| v.efp.to_string()),
+        generation: escrow.as_ref().map(|v| v.generation),
+        verified: escrow.is_some_and(|v| v.verified),
+    }))
+}
+
+#[get("/at-rest/escrow")]
+pub async fn at_rest_escrow(at_rest: AtRestState<'_>) -> Result<Json<EscrowBundle>, Refusal> {
+    let runtime = at_rest.0.ok_or_else(not_enabled)?;
+    Ok(Json(view(runtime).await?.bundle))
+}
+
+#[get("/at-rest/escrow/record")]
+pub async fn at_rest_escrow_record(
+    at_rest: AtRestState<'_>,
+) -> Result<Json<VerificationRecord>, Refusal> {
+    let runtime = at_rest.0.ok_or_else(not_enabled)?;
+    let keyring = runtime.keyring().ok_or_else(not_enabled)?;
+    keyring
+        .verification_record()
+        .await
+        .map_err(internal)?
+        .map(Json)
+        .ok_or((
+            Status::NotFound,
+            "no verified ceremony record for the active escrow".into(),
+        ))
+}
+
+#[get("/at-rest/recovery?<nonce>")]
+pub async fn at_rest_recovery(
+    at_rest: AtRestState<'_>,
+    tee: &State<Option<TeeContext>>,
+    client_ip: ClientIp,
+    rate_limiter: &State<RateLimiter>,
+    nonce: String,
+) -> Result<Json<RecoveryInfo>, Refusal> {
+    rate_limiter
+        .check(client_ip.0)
+        .map_err(|s| (s, "Rate limit exceeded".to_string()))?;
+    validate_nonce(&nonce).map_err(|e| (Status::BadRequest, e.to_string()))?;
+    let runtime = at_rest.0.ok_or_else(not_enabled)?;
+    let view = view(runtime).await?;
+    let binding = recovery_binding(&view.recovery_recipient, &view.efp, &nonce);
+    let digest = binding_digest(&binding);
+    let (mode, quote, event_log) = quote_binding(tee.inner().as_ref(), &digest.0).await?;
+    Ok(Json(RecoveryInfo {
+        version: RECOVERY_INFO_VERSION,
+        mode: mode.into(),
+        state: match view.state {
+            KeyringState::Locked => "locked",
+            _ => "unlocked",
+        }
+        .into(),
+        ark_id: view.ark_id,
+        generation: view.generation,
+        efp: view.efp,
+        canary_fp: view.canary_fp,
+        recovery_recipient: view.recovery_recipient,
+        binding,
+        binding_sha256: digest,
+        quote,
+        event_log,
+        shares_held: view.shares_held,
+    }))
+}
+
+/// A TDX quote over `digest`, or `classic` with no quote outside a TEE (a
+/// holder's tool refuses to release a share then).
+async fn quote_binding(
+    tee: Option<&TeeContext>,
+    digest: &[u8; 32],
+) -> Result<(&'static str, Option<String>, Option<String>), Refusal> {
+    match tee {
+        #[cfg(feature = "dstack")]
+        Some(_) => {
+            let quote = crate::dstack::get_quote(&crate::dstack::socket_path(), digest)
+                .await
+                .map_err(|e| {
+                    ::tracing::error!(error_class = %e, "TDX quote unavailable for at-rest recovery");
+                    (
+                        Status::ServiceUnavailable,
+                        "quote generation failed".to_string(),
+                    )
+                })?;
+            Ok(("dstack", Some(quote.quote), Some(quote.event_log)))
+        }
+        _ => {
+            let _ = digest;
+            Ok(("classic", None, None))
+        }
+    }
+}
+
+#[derive(Debug, Serialize)]
+pub struct ShareAnswer {
+    outcome: &'static str,
+    shares_held: Vec<u8>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    efp: Option<String>,
+    /// After a recovery: whether encryption is enabled again (the gate
+    /// passed), or why not.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    gate: Option<String>,
+}
+
+#[post("/at-rest/recovery/shares", data = "<body>")]
+pub async fn at_rest_recovery_share(
+    at_rest: AtRestState<'_>,
+    // TC-1357: ClientIp trusts the proxy IP header from any peer; per-client
+    // limits are best effort until it is trusted only from the ingress.
+    client_ip: ClientIp,
+    rate_limiter: &State<RateLimiter>,
+    body: Data<'_>,
+) -> Result<Json<ShareAnswer>, Refusal> {
+    rate_limiter
+        .check(client_ip.0)
+        .map_err(|s| (s, "Rate limit exceeded".to_string()))?;
+    let runtime = at_rest.0.ok_or_else(not_enabled)?;
+    let keyring = runtime.keyring().ok_or_else(not_enabled)?;
+    let failures = runtime.share_failures();
+    if !failures.allows(client_ip.0) {
+        return Err((
+            Status::TooManyRequests,
+            "too many rejected shares from this client; retry later".into(),
+        ));
+    }
+    let wrapped = body
+        .open(MAX_WRAPPED_SHARE.bytes())
+        .into_bytes()
+        .await
+        .map_err(|_| {
+            failures.record_failure(client_ip.0);
+            (Status::BadRequest, "could not read the share".to_string())
+        })?;
+    if !wrapped.is_complete() {
+        failures.record_failure(client_ip.0);
+        return Err((
+            Status::PayloadTooLarge,
+            format!("a wrapped share is at most {MAX_WRAPPED_SHARE} bytes"),
+        ));
+    }
+    match keyring.submit_share(&wrapped).await {
+        Ok(ShareOutcome::Held { shares_held }) => Ok(Json(ShareAnswer {
+            outcome: "held",
+            shares_held,
+            efp: None,
+            gate: None,
+        })),
+        Ok(ShareOutcome::Verified { efp }) => {
+            let gate = runtime.reevaluate().await;
+            Ok(Json(ShareAnswer {
+                outcome: "verified",
+                shares_held: vec![],
+                efp: Some(efp.to_string()),
+                gate: Some(match gate {
+                    Ok(_) => "open".into(),
+                    Err(r) => r.to_string(),
+                }),
+            }))
+        }
+        Ok(ShareOutcome::Unlocked) => {
+            let gate = match runtime.reevaluate().await {
+                Ok(_) => "open".to_string(),
+                Err(r) => {
+                    ::tracing::error!(reason = %r, "at-rest keys recovered, but encryption stays off");
+                    r.to_string()
+                }
+            };
+            Ok(Json(ShareAnswer {
+                outcome: "unlocked",
+                shares_held: vec![],
+                efp: None,
+                gate: Some(gate),
+            }))
+        }
+        Err(ShareRefusal::RateLimited) => Err((
+            Status::TooManyRequests,
+            "too many share submissions this boot; retry later".into(),
+        )),
+        Err(ShareRefusal::NoBundle(why)) => Err((Status::Conflict, why.into())),
+        Err(ShareRefusal::Invalid(e)) => {
+            failures.record_failure(client_ip.0);
+            Err((Status::BadRequest, format!("share rejected: {e}")))
+        }
+        Err(ShareRefusal::Keyring(e)) => Err(internal(e)),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn keyring_errors_answer_with_a_status_and_a_non_secret_reason() {
+        let (status, body) = internal(AtRestError::Mirror(
+            "s3://bucket/secret-path: access denied".into(),
+        ));
+        assert_eq!(status, Status::ServiceUnavailable);
+        assert_eq!(body, "at-rest keyring error: mirror_unavailable");
+        let (status, body) = internal(AtRestError::Inconsistent(
+            "an older ARK generation's chain is missing or does not open",
+        ));
+        assert_eq!(status, Status::InternalServerError);
+        assert!(
+            body.contains("inconsistent: an older ARK generation"),
+            "{body}"
+        );
+        let (status, body) = internal(AtRestError::EscrowHoldersChanged);
+        assert_eq!(
+            (status, body.as_str()),
+            (
+                Status::InternalServerError,
+                "at-rest keyring error: escrow_holders_changed"
+            )
+        );
+    }
+}
diff --git a/tinycloud-node-server/src/routes/mod.rs b/tinycloud-node-server/src/routes/mod.rs
index bc5fadb9..a59c8055 100644
--- a/tinycloud-node-server/src/routes/mod.rs
+++ b/tinycloud-node-server/src/routes/mod.rs
@@ -73,6 +73,7 @@ use tinycloud_core::{
 
 pub mod admin;
 pub mod admin_stats;
+pub mod at_rest;
 pub mod attestation;
 pub mod encryption;
 pub mod hooks;
@@ -337,6 +338,18 @@ pub struct NodeInfo {
     /// when the node's database is not PostgreSQL.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub postgres: Option<PostgresInfo>,
+    /// Encryption at rest (TC-887): omitted unless the node is configured
+    /// for it. Details at `/at-rest/status`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub at_rest: Option<AtRestInfo>,
+}
+
+#[derive(Serialize)]
+pub struct AtRestInfo {
+    pub mode: &'static str,
+    /// `locked` means encrypted data is unavailable until recovery.
+    pub state: &'static str,
+    pub encrypting: bool,
 }
 
 /// Process-wide PostgreSQL connection counters in [`NodeInfo`].
@@ -354,6 +367,7 @@ fn build_info(
     encryption: &State<EncryptionService>,
     config: &State<crate::config::Config>,
     database: Option<&tinycloud_core::RecoveringConnection>,
+    at_rest: Option<&crate::at_rest::AtRestRuntime>,
 ) -> NodeInfo {
     #[allow(unused_mut)]
     let mut features = vec!["kv", "delegation", "sharing", "sql"];
@@ -396,6 +410,13 @@ fn build_info(
                 sockets_configured: sqlx_core::net::tcp_keepalive::sockets_configured(),
                 connections_opened: crate::postgres_connections_opened(),
             }),
+        at_rest: at_rest
+            .filter(|r| r.keyring().is_some())
+            .map(|r| AtRestInfo {
+                mode: r.mode_name(),
+                state: r.state_name(),
+                encrypting: r.encrypting(),
+            }),
     }
 }
 
@@ -425,8 +446,16 @@ pub fn info(
     encryption: &State<EncryptionService>,
     config: &State<crate::config::Config>,
     pool: NodePool<'_>,
+    at_rest: crate::at_rest::AtRestState<'_>,
 ) -> Json<NodeInfo> {
-    Json(build_info(tee, quota_cache, encryption, config, pool.0))
+    Json(build_info(
+        tee,
+        quota_cache,
+        encryption,
+        config,
+        pool.0,
+        at_rest.0,
+    ))
 }
 
 #[get("/version")]
@@ -436,8 +465,16 @@ pub fn version(
     encryption: &State<EncryptionService>,
     config: &State<crate::config::Config>,
     pool: NodePool<'_>,
+    at_rest: crate::at_rest::AtRestState<'_>,
 ) -> Json<NodeInfo> {
-    Json(build_info(tee, quota_cache, encryption, config, pool.0))
+    Json(build_info(
+        tee,
+        quota_cache,
+        encryption,
+        config,
+        pool.0,
+        at_rest.0,
+    ))
 }
 
 #[allow(clippy::let_unit_value)]
diff --git a/tinycloud-node-server/src/storage/at_rest_mirror.rs b/tinycloud-node-server/src/storage/at_rest_mirror.rs
new file mode 100644
index 00000000..8047ad61
--- /dev/null
+++ b/tinycloud-node-server/src/storage/at_rest_mirror.rs
@@ -0,0 +1,347 @@
+//! Where the at-rest keyring mirrors its sealed ARK rows and escrow bundles
+//! (TC-887): next to the blocks, so a database restored to before an ARK
+//! row was written can still open blocks stored after it.
+//!
+//! - S3: objects under `_tc/at-rest/` in the block bucket. The boot size scan
+//!   only counts `{space}/{hash}` keys, so these are never charged to a space.
+//! - Filesystem: files under `{datadir}/at-rest/`, outside the block
+//!   directory (whose size scan treats every subdirectory as a DID).
+
+use std::path::{Component, Path, PathBuf};
+
+use aws_sdk_s3::{
+    error::SdkError, operation::get_object::GetObjectError, primitives::ByteStream, Client,
+};
+use tinycloud_core::at_rest::{
+    store::{MirrorError, MirrorObjectTooLarge, MAX_MIRROR_OBJECT, MIRROR_PREFIX},
+    KeyMirror,
+};
+
+use super::s3::{new_client, S3BlockConfig};
+
+/// Control objects in the S3 block bucket.
+pub struct S3KeyMirror {
+    client: Client,
+    bucket: String,
+}
+
+impl S3KeyMirror {
+    pub async fn new(config: &S3BlockConfig) -> Self {
+        Self {
+            client: new_client(config).await,
+            bucket: config.bucket.clone(),
+        }
+    }
+}
+
+fn check_name(name: &str) -> Result<(), MirrorError> {
+    let ok = name.starts_with(MIRROR_PREFIX)
+        && name
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'_' | b'-' | b'.' | b'/'))
+        && !name.contains("..");
+    if ok {
+        Ok(())
+    } else {
+        Err(format!("invalid at-rest mirror name {name:?}").into())
+    }
+}
+
+#[async_trait::async_trait]
+impl KeyMirror for S3KeyMirror {
+    async fn put(&self, name: &str, bytes: Vec<u8>) -> Result<(), MirrorError> {
+        check_name(name)?;
+        self.client
+            .put_object()
+            .bucket(&self.bucket)
+            .key(name)
+            .body(ByteStream::from(bytes))
+            .send()
+            .await
+            .map_err(|e| aws_sdk_s3::Error::from(e).into())
+            .map(|_| ())
+    }
+
+    async fn get(&self, name: &str) -> Result<Option<Vec<u8>>, MirrorError> {
+        check_name(name)?;
+        match self
+            .client
+            .get_object()
+            .bucket(&self.bucket)
+            .key(name)
+            .send()
+            .await
+        {
+            Ok(mut o) => {
+                // A key object is a few hundred bytes; anything far larger
+                // is junk planted in the bucket, never read into memory.
+                if o.content_length().unwrap_or_default() > MAX_MIRROR_OBJECT as i64 {
+                    return Err(Box::new(MirrorObjectTooLarge));
+                }
+                let mut out = Vec::new();
+                while let Some(chunk) = o.body.try_next().await? {
+                    if out.len() + chunk.len() > MAX_MIRROR_OBJECT {
+                        return Err(Box::new(MirrorObjectTooLarge));
+                    }
+                    out.extend_from_slice(&chunk);
+                }
+                Ok(Some(out))
+            }
+            Err(SdkError::ServiceError(e)) if matches!(e.err(), GetObjectError::NoSuchKey(_)) => {
+                Ok(None)
+            }
+            Err(e) => Err(aws_sdk_s3::Error::from(e).into()),
+        }
+    }
+
+    async fn list(&self, prefix: &str) -> Result<Vec<String>, MirrorError> {
+        check_name(prefix)?;
+        let mut pages = self
+            .client
+            .list_objects_v2()
+            .bucket(&self.bucket)
+            .prefix(prefix)
+            .into_paginator()
+            .send();
+        let mut names = Vec::new();
+        while let Some(page) = pages.try_next().await.map_err(aws_sdk_s3::Error::from)? {
+            names.extend(
+                page.contents()
+                    .iter()
+                    .filter_map(|o| o.key().map(str::to_owned))
+                    // A name `get` would refuse can't be a key object;
+                    // listing it would let a bucket writer fail reads.
+                    .filter(|k| check_name(k).is_ok()),
+            );
+        }
+        Ok(names)
+    }
+
+    async fn delete(&self, name: &str) -> Result<(), MirrorError> {
+        check_name(name)?;
+        // S3 answers success for a key that doesn't exist.
+        self.client
+            .delete_object()
+            .bucket(&self.bucket)
+            .key(name)
+            .send()
+            .await
+            .map_err(|e| aws_sdk_s3::Error::from(e).into())
+            .map(|_| ())
+    }
+}
+
+/// Control files under a local directory.
+pub struct FsKeyMirror {
+    root: PathBuf,
+}
+
+impl FsKeyMirror {
+    pub fn new(root: PathBuf) -> Self {
+        Self { root }
+    }
+
+    fn path(&self, name: &str) -> Result<PathBuf, MirrorError> {
+        check_name(name)?;
+        let rel = Path::new(name);
+        if rel.components().any(|c| !matches!(c, Component::Normal(_))) {
+            return Err(format!("invalid at-rest mirror name {name:?}").into());
+        }
+        Ok(self.root.join(rel))
+    }
+}
+
+#[async_trait::async_trait]
+impl KeyMirror for FsKeyMirror {
+    async fn put(&self, name: &str, bytes: Vec<u8>) -> Result<(), MirrorError> {
+        let path = self.path(name)?;
+        let dir = path.parent().ok_or("mirror path has no parent")?;
+        tokio::fs::create_dir_all(dir).await?;
+        // Write, fsync, then rename, so a crash never leaves a half-written
+        // or unsynced key file under the final name. The temporary name is
+        // unique, so concurrent writers of one object never collide.
+        let file_name = path
+            .file_name()
+            .and_then(|n| n.to_str())
+            .ok_or("mirror path has no file name")?;
+        let tmp = dir.join(format!("{file_name}.{:016x}.tmp", rand::random::<u64>()));
+        let mut file = tokio::fs::File::create(&tmp).await?;
+        tokio::io::AsyncWriteExt::write_all(&mut file, &bytes).await?;
+        file.sync_all().await?;
+        drop(file);
+        tokio::fs::rename(&tmp, &path).await?;
+        tokio::fs::File::open(dir).await?.sync_all().await?;
+        Ok(())
+    }
+
+    /// A regular file only: a symlink is never followed (`O_NOFOLLOW`), the
+    /// open never blocks (`O_NONBLOCK`, so a FIFO can't hang it), and a
+    /// directory, FIFO or other non-file counts as absent (checked with
+    /// `fstat` on the open handle). The read is bounded by
+    /// [`MAX_MIRROR_OBJECT`] whatever the file claims its size is.
+    async fn get(&self, name: &str) -> Result<Option<Vec<u8>>, MirrorError> {
+        use tokio::io::AsyncReadExt as _;
+        let path = self.path(name)?;
+        let file = tokio::fs::OpenOptions::new()
+            .read(true)
+            .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK)
+            .open(&path)
+            .await;
+        let file = match file {
+            Ok(file) => file,
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+            Err(e) if e.raw_os_error() == Some(libc::ELOOP) => return Ok(None),
+            Err(e) => return Err(e.into()),
+        };
+        if !file.metadata().await?.is_file() {
+            return Ok(None);
+        }
+        let mut bytes = Vec::new();
+        file.take(MAX_MIRROR_OBJECT as u64 + 1)
+            .read_to_end(&mut bytes)
+            .await?;
+        if bytes.len() > MAX_MIRROR_OBJECT {
+            return Err(Box::new(MirrorObjectTooLarge));
+        }
+        Ok(Some(bytes))
+    }
+
+    async fn list(&self, prefix: &str) -> Result<Vec<String>, MirrorError> {
+        check_name(prefix)?;
+        // Names are "_tc/at-rest/<file>": one directory level to scan.
+        let (dir_name, file_prefix) = prefix.rsplit_once('/').ok_or("prefix has no directory")?;
+        let dir = self.path(&format!("{dir_name}/"))?;
+        let mut entries = match tokio::fs::read_dir(&dir).await {
+            Ok(entries) => entries,
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
+            Err(e) => return Err(e.into()),
+        };
+        let mut names = Vec::new();
+        while let Some(entry) = entries.next_entry().await? {
+            // Regular files only (`file_type` doesn't follow symlinks), and
+            // only names `get` accepts.
+            if !entry.file_type().await?.is_file() {
+                continue;
+            }
+            if let Ok(file) = entry.file_name().into_string() {
+                let name = format!("{dir_name}/{file}");
+                if file.starts_with(file_prefix)
+                    && !file.ends_with(".tmp")
+                    && check_name(&name).is_ok()
+                {
+                    names.push(name);
+                }
+            }
+        }
+        Ok(names)
+    }
+
+    async fn delete(&self, name: &str) -> Result<(), MirrorError> {
+        let path = self.path(name)?;
+        match tokio::fs::remove_file(&path).await {
+            Ok(()) => Ok(()),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+            Err(e) => Err(e.into()),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn fs_mirror_round_trips_lists_and_refuses_escapes() {
+        let dir = tempfile::tempdir().unwrap();
+        let m = FsKeyMirror::new(dir.path().to_path_buf());
+        assert!(m.list("_tc/at-rest/ark-").await.unwrap().is_empty());
+        m.put("_tc/at-rest/ark-0000000001-ab.json", b"one".to_vec())
+            .await
+            .unwrap();
+        m.put("_tc/at-rest/escrow-cd.json", b"two".to_vec())
+            .await
+            .unwrap();
+        assert_eq!(
+            m.get("_tc/at-rest/ark-0000000001-ab.json").await.unwrap(),
+            Some(b"one".to_vec())
+        );
+        assert_eq!(m.get("_tc/at-rest/missing.json").await.unwrap(), None);
+        assert_eq!(
+            m.list("_tc/at-rest/ark-").await.unwrap(),
+            vec!["_tc/at-rest/ark-0000000001-ab.json".to_string()]
+        );
+        m.delete("_tc/at-rest/ark-0000000001-ab.json")
+            .await
+            .unwrap();
+        m.delete("_tc/at-rest/ark-0000000001-ab.json")
+            .await
+            .unwrap();
+        assert!(m.list("_tc/at-rest/ark-").await.unwrap().is_empty());
+        assert!(m.delete("../x").await.is_err());
+        for bad in [
+            "../x",
+            "_tc/at-rest/../../etc",
+            "other/x",
+            "_tc/at-rest/a b",
+        ] {
+            assert!(m.put(bad, vec![]).await.is_err(), "{bad}");
+        }
+    }
+
+    #[tokio::test]
+    async fn fs_mirror_lists_only_readable_regular_files_and_never_follows_links() {
+        let dir = tempfile::tempdir().unwrap();
+        let m = FsKeyMirror::new(dir.path().to_path_buf());
+        m.put("_tc/at-rest/ark-0000000001-ab.json", b"one".to_vec())
+            .await
+            .unwrap();
+        let at_rest = dir.path().join("_tc/at-rest");
+        // Planted by a datadir writer: names `get` refuses, a directory, a
+        // symlink to a huge stream and one to a secret file.
+        for name in [
+            "ark-0000000002-x y.json",
+            "ark-..json",
+            "ark-0000000002-x+y.json",
+        ] {
+            std::fs::write(at_rest.join(name), b"junk").unwrap();
+        }
+        std::fs::create_dir(at_rest.join("ark-0000000002-d.json")).unwrap();
+        std::os::unix::fs::symlink("/dev/zero", at_rest.join("ark-0000000002-z.json")).unwrap();
+        let secret = dir.path().join("secret");
+        std::fs::write(&secret, b"not a mirror object").unwrap();
+        std::os::unix::fs::symlink(&secret, at_rest.join("ark-0000000002-s.json")).unwrap();
+        // A FIFO under a name the node reads directly (escrow and record
+        // names are public): opening it used to block forever.
+        let fifo =
+            std::ffi::CString::new(at_rest.join("escrow-ff.json").to_str().unwrap().as_bytes())
+                .unwrap();
+        assert_eq!(unsafe { libc::mkfifo(fifo.as_ptr(), 0o600) }, 0);
+
+        assert_eq!(
+            m.list("_tc/at-rest/ark-").await.unwrap(),
+            vec!["_tc/at-rest/ark-0000000001-ab.json".to_string()]
+        );
+        for planted in [
+            "_tc/at-rest/ark-0000000002-d.json",
+            "_tc/at-rest/ark-0000000002-z.json",
+            "_tc/at-rest/ark-0000000002-s.json",
+            "_tc/at-rest/escrow-ff.json",
+        ] {
+            let got = tokio::time::timeout(std::time::Duration::from_secs(5), m.get(planted))
+                .await
+                .unwrap_or_else(|_| panic!("{planted}: get hung"));
+            assert_eq!(got.unwrap(), None, "{planted}");
+        }
+        // A regular file over the cap is refused without reading it all.
+        std::fs::write(
+            at_rest.join("ark-0000000003-big.json"),
+            vec![b' '; MAX_MIRROR_OBJECT + 1],
+        )
+        .unwrap();
+        let err = m
+            .get("_tc/at-rest/ark-0000000003-big.json")
+            .await
+            .unwrap_err();
+        assert!(err.is::<MirrorObjectTooLarge>(), "{err}");
+    }
+}
diff --git a/tinycloud-node-server/src/storage/mod.rs b/tinycloud-node-server/src/storage/mod.rs
index 439b0b2d..a9bcbce1 100644
--- a/tinycloud-node-server/src/storage/mod.rs
+++ b/tinycloud-node-server/src/storage/mod.rs
@@ -1,3 +1,4 @@
+pub mod at_rest_mirror;
 pub mod file_system;
 pub mod s3;
 pub mod size;
diff --git a/tinycloud-node-server/tests/at_rest_ceremony.rs b/tinycloud-node-server/tests/at_rest_ceremony.rs
new file mode 100644
index 00000000..0e9de195
--- /dev/null
+++ b/tinycloud-node-server/tests/at_rest_ceremony.rs
@@ -0,0 +1,372 @@
+//! TC-887 S1 through the real app: provisioning, the ceremony test-unlock,
+//! the encrypt gate at boot, and recovery of a node booted under a new root.
+//! SQLite file and filesystem blocks in a temp dir, so restarts keep state.
+
+use std::io::Read;
+use std::net::SocketAddr;
+use std::path::Path;
+
+use rocket::{
+    figment::{providers::Serialized, Figment},
+    http::{ContentType, Status},
+    local::asynchronous::Client,
+};
+use serde_json::{json, Value};
+use tinycloud_at_rest_escrow::{
+    binding_digest, recovery_binding, wrap_share, EscrowBundle, RecoveryInfo,
+};
+
+const NONCE: &str = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+
+struct Holders(Vec<age::x25519::Identity>);
+
+impl Holders {
+    fn new() -> Self {
+        Self((0..3).map(|_| age::x25519::Identity::generate()).collect())
+    }
+
+    fn recipients(&self) -> Value {
+        json!(["sam", "hunter", "safe"]
+            .iter()
+            .zip(&self.0)
+            .map(|(h, id)| json!({"holder": h, "recipient": id.to_public().to_string()}))
+            .collect::<Vec<_>>())
+    }
+
+    /// Holder `i`: `age -d` their share, then seal it to the node's recovery key.
+    fn wrapped(&self, bundle: &EscrowBundle, info: &RecoveryInfo, i: usize) -> String {
+        let armored = &bundle.shares[i].ciphertext;
+        let decryptor =
+            age::Decryptor::new_buffered(age::armor::ArmoredReader::new(armored.as_bytes()))
+                .unwrap();
+        let mut plain = Vec::new();
+        decryptor
+            .decrypt(std::iter::once(&self.0[i] as &dyn age::Identity))
+            .unwrap()
+            .read_to_end(&mut plain)
+            .unwrap();
+        let share = bundle.open_share(&plain).unwrap();
+        wrap_share(&info.recovery_recipient, &share).unwrap()
+    }
+}
+
+async fn app(dir: &Path, root: u8, at_rest: Value) -> anyhow::Result<Client> {
+    let mut config = tinycloud::config::Config::default();
+    config.storage.datadir = dir.into();
+    config.storage.database = Some(format!("sqlite:{}?mode=rwc", dir.join("caps.db").display()));
+    config.keys = serde_json::from_value(json!({
+        "type": "static",
+        "secret": base64::encode_config([root; 32], base64::URL_SAFE_NO_PAD),
+    }))?;
+    config.at_rest = serde_json::from_value(at_rest)?;
+    let figment = Figment::from(rocket::Config {
+        address: "127.0.0.1".parse()?,
+        log_level: rocket::config::LogLevel::Off,
+        ..rocket::Config::default()
+    })
+    .merge(Serialized::defaults(&config));
+    let rocket = tinycloud::app(&figment).await?;
+    Ok(Client::untracked(rocket).await?)
+}
+
+/// The boot must fail; returns the full error chain.
+async fn refused(dir: &Path, root: u8, at_rest: Value) -> String {
+    match app(dir, root, at_rest).await {
+        Ok(_) => panic!("the node started, but this configuration must be refused"),
+        Err(e) => format!("{e:#}"),
+    }
+}
+
+fn remote() -> SocketAddr {
+    "127.0.0.1:40000".parse().unwrap()
+}
+
+async fn get_json(client: &Client, uri: &str) -> (Status, Value) {
+    let res = client
+        .get(uri.to_string())
+        .remote(remote())
+        .dispatch()
+        .await;
+    let status = res.status();
+    let body = res.into_string().await.unwrap_or_default();
+    (
+        status,
+        serde_json::from_str(&body).unwrap_or(Value::String(body)),
+    )
+}
+
+async fn post_share(client: &Client, body: impl Into<Vec<u8>>) -> (Status, Value) {
+    let res = client
+        .post("/at-rest/recovery/shares")
+        .remote(remote())
+        .header(ContentType::Plain)
+        .body(body.into())
+        .dispatch()
+        .await;
+    let status = res.status();
+    let body = res.into_string().await.unwrap_or_default();
+    (
+        status,
+        serde_json::from_str(&body).unwrap_or(Value::String(body)),
+    )
+}
+
+async fn recovery(client: &Client) -> RecoveryInfo {
+    let (status, body) = get_json(client, &format!("/at-rest/recovery?nonce={NONCE}")).await;
+    assert_eq!(status, Status::Ok, "{body}");
+    let info: RecoveryInfo = serde_json::from_value(body).unwrap();
+    // No TEE here: no quote, and the holder tool would refuse to release.
+    assert_eq!(info.mode, "classic");
+    assert!(info.quote.is_none());
+    assert_eq!(
+        info.binding,
+        recovery_binding(&info.recovery_recipient, &info.efp, NONCE)
+    );
+    assert_eq!(info.binding_sha256, binding_digest(&info.binding));
+    info
+}
+
+#[tokio::test]
+async fn ceremony_gate_and_recovery_through_the_app() {
+    let dir = tempfile::tempdir().unwrap();
+    let h = Holders::new();
+    let escrow = |fp: Option<&str>| json!({"recipients": h.recipients(), "allow_software": true, "verified_fp": fp});
+
+    // Default config: nothing at rest, and /info says nothing about it.
+    let client = app(dir.path(), 1, json!({})).await.unwrap();
+    let (_, info) = get_json(&client, "/info").await;
+    assert!(info.get("at_rest").is_none(), "{info}");
+    let (_, status) = get_json(&client, "/at-rest/status").await;
+    assert_eq!(status["state"], "disabled");
+    assert_eq!(
+        get_json(&client, "/at-rest/escrow").await.0,
+        Status::NotFound
+    );
+    drop(client);
+    assert!(!dir.path().join("at-rest").exists());
+
+    // Release A: recipients pinned, mode off. The ARK and escrow are made.
+    let client = app(dir.path(), 1, json!({"escrow": escrow(None)}))
+        .await
+        .unwrap();
+    let (_, info) = get_json(&client, "/info").await;
+    assert_eq!(
+        info["at_rest"],
+        json!({"mode":"off","state":"unlocked","encrypting":false})
+    );
+    let (_, bundle) = get_json(&client, "/at-rest/escrow").await;
+    let bundle: EscrowBundle = serde_json::from_value(bundle).unwrap();
+    let efp = bundle.fingerprint().to_string();
+    assert!(std::fs::read_dir(dir.path().join("at-rest/_tc/at-rest"))
+        .unwrap()
+        .any(|e| e.unwrap().file_name().to_string_lossy().starts_with("ark-")));
+
+    // Ceremony test-unlock: junk and oversize are refused, two shares are
+    // held, the third verifies.
+    assert_eq!(post_share(&client, "junk").await.0, Status::BadRequest);
+    assert_eq!(
+        post_share(&client, vec![b'a'; 8192]).await.0,
+        Status::PayloadTooLarge
+    );
+    let info = recovery(&client).await;
+    assert_eq!(info.state, "unlocked");
+    let (s, a) = post_share(&client, h.wrapped(&bundle, &info, 0)).await;
+    assert_eq!(
+        (s, &a["outcome"], &a["shares_held"]),
+        (Status::Ok, &json!("held"), &json!([1]))
+    );
+    let (_, a) = post_share(&client, h.wrapped(&bundle, &info, 2)).await;
+    assert_eq!(a["shares_held"], json!([1, 3]));
+    assert_eq!(recovery(&client).await.shares_held, vec![1, 3]);
+    let (_, a) = post_share(&client, h.wrapped(&bundle, &info, 1)).await;
+    assert_eq!(a["outcome"], "verified");
+    assert_eq!(a["efp"], json!(efp));
+    let (status, record) = get_json(&client, "/at-rest/escrow/record").await;
+    assert_eq!(status, Status::Ok);
+    assert_eq!(record["efp"], json!(efp));
+    let (_, st) = get_json(&client, "/at-rest/status").await;
+    assert_eq!(
+        (st["verified"].clone(), st["encrypting"].clone()),
+        (json!(true), json!(false))
+    );
+    drop(client);
+
+    // No seal path in this build: encrypt and strict are refused at boot,
+    // even with the escrow pinned and verified, so nothing ever claims to
+    // encrypt while storage writes plaintext.
+    for mode in ["encrypt", "strict"] {
+        let err = refused(
+            dir.path(),
+            1,
+            json!({"mode": mode, "escrow": escrow(Some(&efp))}),
+        )
+        .await;
+        assert!(err.contains("no at-rest seal path"), "{err}");
+    }
+
+    // Pinned and verified, mode off: the gate passes, nothing is encrypted.
+    let client = app(dir.path(), 1, json!({"escrow": escrow(Some(&efp))}))
+        .await
+        .unwrap();
+    let (_, info) = get_json(&client, "/info").await;
+    assert_eq!(
+        info["at_rest"],
+        json!({"mode":"off","state":"unlocked","encrypting":false})
+    );
+    drop(client);
+
+    // New root (new app id / KMS): boots LOCKED, not refused.
+    let client = app(dir.path(), 2, json!({"escrow": escrow(Some(&efp))}))
+        .await
+        .unwrap();
+    let (_, info) = get_json(&client, "/info").await;
+    assert_eq!(
+        info["at_rest"],
+        json!({"mode":"off","state":"locked","encrypting":false})
+    );
+    let (status, _) = get_json(&client, "/at-rest/escrow/record").await;
+    assert_eq!(status, Status::NotFound);
+    let info = recovery(&client).await;
+    assert_eq!(info.state, "locked");
+    // One share, even twice, does nothing.
+    let one = h.wrapped(&bundle, &info, 1);
+    assert_eq!(
+        post_share(&client, one.clone()).await.1["shares_held"],
+        json!([2])
+    );
+    assert_eq!(post_share(&client, one).await.1["shares_held"], json!([2]));
+    let (_, st) = get_json(&client, "/at-rest/status").await;
+    assert_eq!(st["state"], "locked");
+    // A second holder unlocks it and the escrow gate passes again.
+    let (_, a) = post_share(&client, h.wrapped(&bundle, &info, 2)).await;
+    assert_eq!(
+        (a["outcome"].clone(), a["gate"].clone()),
+        (json!("unlocked"), json!("open"))
+    );
+    let (_, info) = get_json(&client, "/info").await;
+    assert_eq!(
+        info["at_rest"],
+        json!({"mode":"off","state":"unlocked","encrypting":false})
+    );
+    drop(client);
+
+    // Resealed under the new root: it now boots unlocked.
+    let client = app(dir.path(), 2, json!({"escrow": escrow(Some(&efp))}))
+        .await
+        .unwrap();
+    let (_, info) = get_json(&client, "/info").await;
+    assert_eq!(info["at_rest"]["state"], json!("unlocked"));
+}
+
+async fn post_share_from(client: &Client, ip: &str, body: impl Into<Vec<u8>>) -> (Status, Value) {
+    let res = client
+        .post("/at-rest/recovery/shares")
+        .remote(format!("{ip}:4000").parse().unwrap())
+        .header(ContentType::Plain)
+        .body(body.into())
+        .dispatch()
+        .await;
+    let status = res.status();
+    let body = res.into_string().await.unwrap_or_default();
+    (
+        status,
+        serde_json::from_str(&body).unwrap_or(Value::String(body)),
+    )
+}
+
+/// The review's starvation probe, inverted: junk from one client, at about
+/// ten requests a minute, never keeps a genuine holder from recovering a
+/// locked node.
+#[tokio::test]
+async fn junk_from_one_client_does_not_block_a_genuine_share() {
+    let dir = tempfile::tempdir().unwrap();
+    let h = Holders::new();
+    let escrow = |fp: Option<&str>| json!({"recipients": h.recipients(), "allow_software": true, "verified_fp": fp});
+    let client = app(dir.path(), 1, json!({"escrow": escrow(None)}))
+        .await
+        .unwrap();
+    let (_, bundle) = get_json(&client, "/at-rest/escrow").await;
+    let bundle: EscrowBundle = serde_json::from_value(bundle).unwrap();
+    let efp = bundle.fingerprint().to_string();
+    drop(client);
+
+    let client = app(dir.path(), 2, json!({"escrow": escrow(Some(&efp))}))
+        .await
+        .unwrap();
+    let info = recovery(&client).await;
+    assert_eq!(info.state, "locked");
+    // Ten junk bodies from one address: rejected, then that client is
+    // throttled; the node's share budget is untouched.
+    let mut statuses = Vec::new();
+    for _ in 0..10 {
+        statuses.push(post_share_from(&client, "203.0.113.7", "junk").await.0);
+    }
+    assert!(statuses.contains(&Status::BadRequest), "{statuses:?}");
+    assert_eq!(statuses.last(), Some(&Status::TooManyRequests));
+    // Two genuine holders from other addresses recover the node.
+    let (s, a) = post_share_from(&client, "198.51.100.1", h.wrapped(&bundle, &info, 0)).await;
+    assert_eq!((s, &a["shares_held"]), (Status::Ok, &json!([1])), "{a}");
+    let (s, a) = post_share_from(&client, "198.51.100.2", h.wrapped(&bundle, &info, 2)).await;
+    assert_eq!((s, &a["outcome"]), (Status::Ok, &json!("unlocked")), "{a}");
+}
+
+/// The round-3 security probe, inverted: one planted file whose name or
+/// type the mirror refuses used to stop the node booting.
+#[tokio::test]
+async fn planted_mirror_files_never_stop_a_node_from_booting() {
+    let dir = tempfile::tempdir().unwrap();
+    let h = Holders::new();
+    let escrow = json!({"escrow": {"recipients": h.recipients(), "allow_software": true}});
+    drop(app(dir.path(), 1, escrow.clone()).await.unwrap());
+    let mirror = dir.path().join("at-rest/_tc/at-rest");
+    for name in [
+        "ark-0000000002-x y.json",
+        "ark-..json",
+        "ark-0000000002-x+y.json",
+        "record-x y.json",
+    ] {
+        std::fs::write(mirror.join(name), b"junk").unwrap();
+    }
+    std::fs::create_dir(mirror.join("ark-0000000002-d.json")).unwrap();
+    std::os::unix::fs::symlink("/dev/zero", mirror.join("ark-0000000002-z.json")).unwrap();
+
+    let client = app(dir.path(), 1, escrow).await.unwrap();
+    let (_, info) = get_json(&client, "/info").await;
+    assert_eq!(
+        info["at_rest"],
+        json!({"mode":"off","state":"unlocked","encrypting":false})
+    );
+}
+
+#[tokio::test]
+async fn misconfigurations_are_refused_at_boot() {
+    let dir = tempfile::tempdir().unwrap();
+    let h = Holders::new();
+    // Software holders without the opt-in.
+    let err = refused(
+        dir.path(),
+        1,
+        json!({"escrow": {"recipients": h.recipients()}}),
+    )
+    .await;
+    assert!(err.contains("software keys"), "{err}");
+    // Both escrow and escrow_none.
+    let err = refused(
+        dir.path(),
+        1,
+        json!({"escrow_none": true, "escrow": {"recipients": h.recipients(), "allow_software": true}}),
+    )
+    .await;
+    assert!(err.contains("not both"), "{err}");
+    // No seal path: encrypt is refused even on a self-hosted Static root
+    // that acknowledges having no escrow.
+    let err = refused(
+        dir.path(),
+        1,
+        json!({"mode": "encrypt", "escrow_none": true}),
+    )
+    .await;
+    assert!(err.contains("no at-rest seal path"), "{err}");
+    // Unknown keys in the section are refused, not ignored.
+    refused(dir.path(), 1, json!({"escrow_nonee": true})).await;
+}
diff --git a/tinycloud-node-server/tests/at_rest_env.rs b/tinycloud-node-server/tests/at_rest_env.rs
new file mode 100644
index 00000000..d399497e
--- /dev/null
+++ b/tinycloud-node-server/tests/at_rest_env.rs
@@ -0,0 +1,53 @@
+//! The compose env lines `tinycloud-at-rest recipients` prints parse into
+//! `at_rest` exactly as the node loads them (main.rs's provider chain).
+//! One test in its own process, since it sets process environment.
+
+use rocket::figment::{
+    providers::{Env, Serialized},
+    Figment,
+};
+use tinycloud::config::{AtRestMode, AtRestRootSource, Config};
+
+#[test]
+fn compose_env_lines_configure_at_rest() {
+    let recipients = "[{holder=\"sam\",recipient=\"age1yubikey1q2w7u3vpya839jxxuq8g0sedh3d740d4xvn639sqhr95ejj8vu3hyfumptt\"},\
+{holder=\"hunter\",recipient=\"age1qthuv2xtsp2nrz0apnfmj49fkdwp46zygpy4vv8ellvh47203psse695k4\"},\
+{holder=\"safe\",recipient=\"age1tag1qt8lw0ual6avlwmwatk888yqnmdamm7xfd0wak53ut6elz5c4swx2yqdj4e\"}]";
+    let fp = "ab".repeat(32);
+    std::env::set_var("TINYCLOUD_AT_REST__MODE", "encrypt");
+    std::env::set_var("TINYCLOUD_AT_REST__ESCROW__RECIPIENTS", recipients);
+    std::env::set_var("TINYCLOUD_AT_REST__ESCROW__VERIFIED_FP", &fp);
+    std::env::set_var("TINYCLOUD_AT_REST__ROOT_SOURCE", "env");
+    // The root keys are read by the at-rest setup, never by the config
+    // loader: these names must not reach the `at_rest` section, which
+    // refuses unknown fields.
+    std::env::set_var("TINYCLOUD_AT_REST_ROOT_KEY", "a".repeat(44));
+    std::env::set_var("TINYCLOUD_AT_REST_PREVIOUS_ROOT_KEY", "b".repeat(44));
+
+    let config: Config = Figment::from(rocket::Config::default())
+        .merge(Serialized::defaults(Config::default()))
+        .merge(Env::prefixed("TINYCLOUD_").split("_").global())
+        .merge(Env::prefixed("TINYCLOUD_").split("__").global())
+        .extract()
+        .expect("at_rest env parses");
+
+    assert_eq!(config.at_rest.mode, AtRestMode::Encrypt);
+    assert_eq!(config.at_rest.root_source, AtRestRootSource::Env);
+    let holders: Vec<_> = config
+        .at_rest
+        .escrow
+        .recipients
+        .iter()
+        .map(|h| h.holder.as_str())
+        .collect();
+    assert_eq!(holders, ["sam", "hunter", "safe"]);
+    assert!(config.at_rest.escrow.recipients[0]
+        .recipient
+        .starts_with("age1yubikey1q2w7"));
+    assert_eq!(
+        config.at_rest.escrow.verified_fp.as_deref(),
+        Some(fp.as_str())
+    );
+    assert!(!config.at_rest.escrow.allow_software);
+    assert!(!config.at_rest.escrow_none);
+}
diff --git a/tinycloud-node-server/tests/at_rest_env_root.rs b/tinycloud-node-server/tests/at_rest_env_root.rs
new file mode 100644
index 00000000..e292a906
--- /dev/null
+++ b/tinycloud-node-server/tests/at_rest_env_root.rs
@@ -0,0 +1,175 @@
+//! TC-887: an at-rest root from the environment, through the real app.
+//! Boots, refusals, and root changes with `TINYCLOUD_AT_REST_PREVIOUS_ROOT_KEY`.
+//! One test in its own process, since it sets process environment.
+
+use std::path::Path;
+
+use rocket::{
+    figment::{providers::Serialized, Figment},
+    local::asynchronous::Client,
+};
+use serde_json::{json, Value};
+use sha2::Digest as _;
+
+const ROOT_KEY: &str = "TINYCLOUD_AT_REST_ROOT_KEY";
+const PREVIOUS: &str = "TINYCLOUD_AT_REST_PREVIOUS_ROOT_KEY";
+
+fn key(seed: u8) -> String {
+    let bytes: Vec<u8> = (0..32u8)
+        .map(|b| b.wrapping_mul(7).wrapping_add(seed))
+        .collect();
+    base64::encode_config(bytes, base64::STANDARD)
+}
+
+/// What an operator computes offline to match a key copy.
+fn fingerprint(b64: &str) -> String {
+    let mut h = sha2::Sha256::new();
+    h.update(b"tinycloud/at-rest/root-fingerprint/v1");
+    h.update(base64::decode_config(b64, base64::STANDARD).unwrap());
+    hex::encode(h.finalize())[..16].to_string()
+}
+
+fn set_env(root: Option<&str>, previous: Option<&str>) {
+    for (name, value) in [(ROOT_KEY, root), (PREVIOUS, previous)] {
+        match value {
+            Some(v) => std::env::set_var(name, v),
+            None => std::env::remove_var(name),
+        }
+    }
+}
+
+async fn app(dir: &Path, at_rest: Value) -> anyhow::Result<Client> {
+    let mut config = tinycloud::config::Config::default();
+    config.storage.datadir = dir.into();
+    config.storage.database = Some(format!("sqlite:{}?mode=rwc", dir.join("caps.db").display()));
+    config.keys = serde_json::from_value(json!({
+        "type": "static",
+        "secret": base64::encode_config([1u8; 32], base64::URL_SAFE_NO_PAD),
+    }))?;
+    config.at_rest = serde_json::from_value(at_rest)?;
+    let figment = Figment::from(rocket::Config {
+        address: "127.0.0.1".parse()?,
+        log_level: rocket::config::LogLevel::Off,
+        ..rocket::Config::default()
+    })
+    .merge(Serialized::defaults(&config));
+    let rocket = tinycloud::app(&figment).await?;
+    Ok(Client::untracked(rocket).await?)
+}
+
+async fn refused(dir: &Path, at_rest: Value) -> String {
+    match app(dir, at_rest).await {
+        Ok(_) => panic!("the node started, but this configuration must be refused"),
+        Err(e) => format!("{e:#}"),
+    }
+}
+
+async fn status(client: &Client) -> Value {
+    let res = client.get("/at-rest/status").dispatch().await;
+    serde_json::from_str(&res.into_string().await.unwrap()).unwrap()
+}
+
+#[tokio::test]
+async fn an_env_root_boots_refuses_and_changes_without_losing_keys() {
+    let dir = tempfile::tempdir().unwrap();
+    let env_root = json!({"root_source": "env"});
+    let (a, b) = (key(1), key(2));
+
+    // No key, or a malformed one: refused, and the value is never echoed.
+    set_env(None, None);
+    let err = refused(dir.path(), env_root.clone()).await;
+    assert!(err.contains(ROOT_KEY), "{err}");
+    let bad = format!("{}A", &a[..43]);
+    set_env(Some(&bad), None);
+    let err = refused(dir.path(), env_root.clone()).await;
+    assert!(err.contains("is invalid") && !err.contains(&bad), "{err}");
+
+    // Key A provisions the keys; the status names it by fingerprint only.
+    set_env(Some(&a), None);
+    let client = app(dir.path(), env_root.clone()).await.unwrap();
+    let s = status(&client).await;
+    assert_eq!(s["root_source"], "env");
+    assert_eq!(s["state"], "unlocked");
+    assert_eq!(s["encrypting"], false);
+    assert_eq!(s["root_fingerprint"], fingerprint(&a));
+    assert!(!s.to_string().contains(&a));
+    drop(client);
+    // The node took the key out of the process environment, and with a key
+    // present it turned core dumps off.
+    assert!(std::env::var_os(ROOT_KEY).is_none());
+    #[cfg(target_os = "linux")]
+    {
+        assert_eq!(unsafe { libc::prctl(libc::PR_GET_DUMPABLE) }, 0);
+        let mut limit = libc::rlimit {
+            rlim_cur: 1,
+            rlim_max: 1,
+        };
+        assert_eq!(unsafe { libc::getrlimit(libc::RLIMIT_CORE, &mut limit) }, 0);
+        assert_eq!(limit.rlim_cur, 0);
+    }
+
+    // A declared TEE whose guest agent is absent: the TEE checks can't run,
+    // so the node refuses rather than booting as if there were no TEE.
+    set_env(Some(&a), None);
+    std::env::set_var("TINYCLOUD_TEE_MODE", "dstack");
+    std::env::set_var("DSTACK_SIMULATOR_ENDPOINT", "/nonexistent/dstack.sock");
+    let err = refused(dir.path(), env_root.clone()).await;
+    std::env::remove_var("TINYCLOUD_TEE_MODE");
+    std::env::remove_var("DSTACK_SIMULATOR_ENDPOINT");
+    assert!(err.contains("TEE"), "{err}");
+
+    // Another key alone doesn't open them: refused, never booted locked.
+    set_env(Some(&b), None);
+    let err = refused(dir.path(), env_root.clone()).await;
+    assert!(
+        err.contains("does not open") && err.contains(&fingerprint(&b)),
+        "{err}"
+    );
+
+    // B with A as the previous root re-seals; afterwards B alone opens them
+    // and A no longer does.
+    set_env(Some(&b), Some(&a));
+    let client = app(dir.path(), env_root.clone()).await.unwrap();
+    assert_eq!(status(&client).await["root_fingerprint"], fingerprint(&b));
+    drop(client);
+    set_env(Some(&b), None);
+    let client = app(dir.path(), env_root.clone()).await.unwrap();
+    assert_eq!(status(&client).await["state"], "unlocked");
+    drop(client);
+    set_env(Some(&a), None);
+    refused(dir.path(), env_root.clone()).await;
+
+    // Misplaced or combined settings.
+    set_env(Some(&b), Some(&b));
+    let err = refused(dir.path(), env_root.clone()).await;
+    assert!(err.contains("is the current at-rest root"), "{err}");
+    set_env(Some(&b), None);
+    let err = refused(dir.path(), json!({"escrow_none": true})).await;
+    assert!(err.contains("root_source is \"escrow\""), "{err}");
+    // Each boot takes the variables out of the environment; set them again.
+    set_env(Some(&b), None);
+    let err = refused(
+        dir.path(),
+        json!({"root_source": "env", "escrow_none": true}),
+    )
+    .await;
+    assert!(err.contains("has no escrow"), "{err}");
+
+    // Moving to the node's own root: the env key becomes the previous root.
+    set_env(None, Some(&b));
+    let client = app(dir.path(), json!({"escrow_none": true})).await.unwrap();
+    let s = status(&client).await;
+    assert_eq!(
+        (s["root_source"].as_str(), s["state"].as_str()),
+        (Some("escrow"), Some("unlocked"))
+    );
+    assert!(s.get("root_fingerprint").is_none());
+    drop(client);
+    set_env(None, None);
+    let client = app(dir.path(), json!({"escrow_none": true})).await.unwrap();
+    assert_eq!(status(&client).await["state"], "unlocked");
+    drop(client);
+    set_env(Some(&b), None);
+    refused(dir.path(), env_root).await;
+    set_env(None, None);
+}
diff --git a/tinycloud-node-server/tests/at_rest_validate_config.rs b/tinycloud-node-server/tests/at_rest_validate_config.rs
new file mode 100644
index 00000000..a2808d2d
--- /dev/null
+++ b/tinycloud-node-server/tests/at_rest_validate_config.rs
@@ -0,0 +1,86 @@
+//! TC-887: `tinycloud --validate-config` (the deploy preflight) refuses every
+//! at-rest configuration that the node's startup refuses, without opening a
+//! key, database or socket. Runs the real binary.
+
+use std::process::Command;
+
+/// Throwaway root keys, never real ones.
+fn key(seed: u8) -> String {
+    let bytes: Vec<u8> = (0..32u8)
+        .map(|b| b.wrapping_mul(5).wrapping_add(seed))
+        .collect();
+    base64::encode_config(bytes, base64::STANDARD)
+}
+
+/// Runs `--validate-config` with only `vars` (plus PATH) in the environment.
+fn validate(vars: &[(&str, &str)]) -> (bool, String) {
+    let dir = tempfile::tempdir().unwrap();
+    let output = Command::new(env!("CARGO_BIN_EXE_tinycloud"))
+        .arg("--validate-config")
+        .current_dir(dir.path())
+        .env_clear()
+        .env("PATH", "/usr/bin:/bin")
+        .env("TINYCLOUD_STORAGE__DATADIR", dir.path().join("data"))
+        .envs(vars.iter().copied())
+        .output()
+        .unwrap();
+    let text = String::from_utf8_lossy(&output.stdout).into_owned()
+        + &String::from_utf8_lossy(&output.stderr);
+    (output.status.success(), text)
+}
+
+#[test]
+fn validate_config_refuses_what_startup_refuses() {
+    let k = key(3);
+    let env_root = [
+        ("TINYCLOUD_AT_REST__ROOT_SOURCE", "env"),
+        ("TINYCLOUD_AT_REST_ROOT_KEY", k.as_str()),
+    ];
+    let (ok, out) = validate(&env_root);
+    assert!(ok, "a valid env root must validate: {out}");
+
+    // Encrypt validates exactly when this build's storage seals every write.
+    let encrypt: Vec<(&str, &str)> = env_root
+        .iter()
+        .copied()
+        .chain([("TINYCLOUD_AT_REST__MODE", "encrypt")])
+        .collect();
+    let (ok, out) = validate(&encrypt);
+    assert_eq!(
+        ok,
+        tinycloud::at_rest::STORAGE_SEALS_EVERY_WRITE,
+        "encrypt: {out}"
+    );
+    if !ok {
+        assert!(out.contains("seal path"), "{out}");
+    }
+
+    type Case<'a> = (&'a str, Vec<(&'a str, &'a str)>, &'a str);
+    let refused: [Case; 3] = [
+        (
+            "env root with escrow_none",
+            vec![("TINYCLOUD_AT_REST__ESCROW_NONE", "true")],
+            "has no escrow",
+        ),
+        (
+            "env root with software escrow holders",
+            vec![("TINYCLOUD_AT_REST__ESCROW__ALLOW_SOFTWARE", "true")],
+            "has no escrow",
+        ),
+        (
+            "a TEE declared by the TEE mode, whose guest agent is absent",
+            vec![
+                ("TINYCLOUD_TEE__MODE", "Dstack"),
+                ("DSTACK_SIMULATOR_ENDPOINT", "/nonexistent/dstack.sock"),
+            ],
+            "TEE",
+        ),
+    ];
+    for (case, extra, needle) in refused {
+        let vars: Vec<(&str, &str)> = env_root.iter().copied().chain(extra).collect();
+        let (ok, out) = validate(&vars);
+        assert!(!ok, "{case}: --validate-config accepted it: {out}");
+        assert!(out.contains(needle), "{case}: {out}");
+        assert!(!out.contains(&k), "{case}: the key was printed");
+    }
+}