diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 28513cb0..b4872bd8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -441,6 +441,70 @@ jobs:
       - name: Validate observability/rpc-alerts.yml
         run: ./promtool check rules observability/rpc-alerts.yml
 
+      - name: Download amtool
+        run: |
+          AM_VERSION="0.27.0"
+          curl -sSfL \
+            "https://github.com/prometheus/alertmanager/releases/download/v${AM_VERSION}/alertmanager-${AM_VERSION}.linux-amd64.tar.gz" \
+            | tar xz --strip-components=1 "alertmanager-${AM_VERSION}.linux-amd64/amtool"
+          chmod +x amtool
+          ./amtool --version
+
+      # Issue #526: the routing tree is only half the requirement — an alert
+      # must actually reach a person. These checks fail the build on the two
+      # ways that silently breaks: a receiver that resolves nowhere, and a
+      # receiver defined with no delivery integration at all (which
+      # Alertmanager accepts and then discards every notification through).
+      - name: Validate monitoring/alertmanager.yml
+        env:
+          # Deploy-time values. Alertmanager only requires a well-formed URL
+          # and a non-empty routing key to validate, so these are deliberately
+          # not shaped like real credentials: a hooks.slack.com placeholder
+          # trips GitHub push protection, which is the correct behaviour for
+          # anything matching that pattern.
+          PAGERDUTY_ROUTING_KEY: example-routing-key-not-a-real-credential
+          SLACK_WEBHOOK_URL: https://alertmanager-config-check.invalid/webhook-placeholder
+        run: |
+          set -euo pipefail
+          envsubst < monitoring/alertmanager.yml > /tmp/alertmanager.rendered.yml
+          ./amtool check-config /tmp/alertmanager.rendered.yml
+
+          # Every alert severity/service combination alerts.yml can emit must
+          # resolve to the on-call receiver, not the null sink.
+          for args in \
+            "service=indexer severity=critical on-call-critical" \
+            "service=indexer severity=warning on-call-warning" \
+            "service=api severity=critical on-call-critical"; do
+            set -- $args
+            actual=$(./amtool config routes test \
+              --config.file=/tmp/alertmanager.rendered.yml "$1" "$2")
+            if [ "$actual" != "$3" ]; then
+              echo "::error::$1 $2 routed to '$actual', expected '$3'"
+              exit 1
+            fi
+            echo "OK: $1 $2 -> $actual"
+          done
+
+          # A receiver with no *_configs is valid YAML and a silent black
+          # hole. Assert the two on-call receivers each define at least one.
+          python3 - <<'PY'
+          import sys, yaml
+          cfg = yaml.safe_load(open("/tmp/alertmanager.rendered.yml"))
+          failed = False
+          for r in cfg.get("receivers", []):
+              name = r.get("name")
+              if name == "default-null":
+                  continue
+              integrations = [k for k in r if k.endswith("_configs") and r[k]]
+              if not integrations:
+                  print(f"::error::receiver '{name}' has no delivery integration — "
+                        "it would accept and discard every alert")
+                  failed = True
+              else:
+                  print(f"OK: receiver '{name}' delivers via {', '.join(integrations)}")
+          sys.exit(1 if failed else 0)
+          PY
+
   # ---------------------------------------------------------------------------
   # Rust integration tests — real Postgres + Redis
   # Runs integration tests that are silently skipped when TEST_DATABASE_URL
@@ -1068,6 +1132,72 @@ jobs:
   # Environment reference — fails if code reads an env var undocumented in
   # docs/ENVIRONMENT.md (issue #312).
   # ---------------------------------------------------------------------------
+  # ---------------------------------------------------------------------------
+  # Launch gate (issue #503) — keeps the go/no-go check mechanical.
+  #
+  # This deliberately does NOT fail the build on a NO-GO verdict. The gate is
+  # unexecuted (every Pass/Fail cell blank) and correctly reports NO-GO today,
+  # so enforcing the verdict here would red every PR until launch day and get
+  # the job disabled. What IS enforced is that the checker keeps working: the
+  # table stays parseable, and the script's own GO/NO-GO branches still behave.
+  # A gate that silently stopped parsing its own table would otherwise report
+  # a clean NO-GO for the wrong reason.
+  #
+  # Run `bash scripts/check-launch-gate.sh` for the real verdict at launch.
+  # ---------------------------------------------------------------------------
+  launch-gate:
+    name: Launch gate checker
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: Shell syntax
+        run: bash -n scripts/check-launch-gate.sh
+
+      - name: Checklist table is still parseable
+        run: |
+          set -euo pipefail
+          # 2>&1 matters: the NO-GO verdict is written to stderr (it is the
+          # failure path), so capturing stdout alone loses the RESULT line the
+          # assertions below look for.
+          out=$(bash scripts/check-launch-gate.sh 2>&1 || true)
+          echo "$out"
+          if echo "$out" | grep -q "no gate rows found"; then
+            echo "::error::the launch checklist table is no longer parseable by check-launch-gate.sh"
+            exit 1
+          fi
+          if echo "$out" | grep -q "no gate row matching 'Rollback rehearsed'"; then
+            echo "::error::the rollback rehearsal row was renamed; update the match in check-launch-gate.sh"
+            exit 1
+          fi
+          echo "$out" | grep -qE '^RESULT: (GO|NO-GO)' \
+            || { echo "::error::script produced no GO/NO-GO verdict"; exit 1; }
+
+      # Exercises both verdicts against synthetic checklists so a regression in
+      # the parser cannot pass by always answering NO-GO.
+      - name: Verdict branches behave
+        run: |
+          set -euo pipefail
+          tmp=$(mktemp -d)
+          hdr=$'| # | Gate | Pass/Fail | Evidence | Signed off by |\n|---|---|---|---|---|'
+          today=$(date +%Y-%m-%d)
+          stale=$(date -d '60 days ago' +%Y-%m-%d)
+
+          printf '%s\n| 1 | Alerts | Pass | ev | carol |\n| 2 | Rollback rehearsed | Pass | drill %s | dave |\n' \
+            "$hdr" "$today" > "$tmp/pass.md"
+          printf '%s\n| 1 | Alerts | Fail | ev | carol |\n| 2 | Rollback rehearsed | Pass | drill %s | dave |\n' \
+            "$hdr" "$today" > "$tmp/fail.md"
+          printf '%s\n| 1 | Alerts | Pass | ev | carol |\n| 2 | Rollback rehearsed | Pass | drill %s | dave |\n' \
+            "$hdr" "$stale" > "$tmp/stale.md"
+
+          bash scripts/check-launch-gate.sh "$tmp/pass.md" \
+            || { echo "::error::a fully-passing checklist must exit 0"; exit 1; }
+          ! bash scripts/check-launch-gate.sh "$tmp/fail.md" \
+            || { echo "::error::an explicit Fail row must exit non-zero"; exit 1; }
+          ! bash scripts/check-launch-gate.sh "$tmp/stale.md" \
+            || { echo "::error::a >30-day-old rollback rehearsal must exit non-zero"; exit 1; }
+          echo "All verdict branches behaved as expected."
+
   env-reference:
     name: Env reference
     runs-on: ubuntu-latest
@@ -1303,8 +1433,20 @@ jobs:
           go-version: "1.25"
           cache-dependency-path: services/api/go.sum
 
+      # Issue #516: the API-key lifecycle tests (issue/rotate/revoke against a
+      # real Redis-cached auth path) skip themselves unless these are set —
+      # this job is the only one with Postgres and Redis attached, so without
+      # them the lifecycle suite silently never runs anywhere in CI.
+      # REQUIRE_TEST_SERVICES turns a missing service into a hard failure
+      # rather than a green run that tested nothing.
       - name: Go coverage
         working-directory: services/api
+        env:
+          DATABASE_URL: postgres://postgres:trident@localhost:5432/trident_test
+          TEST_DATABASE_URL: postgres://postgres:trident@localhost:5432/trident_test
+          TEST_REDIS_URL: redis://localhost:6379
+          REQUIRE_TEST_SERVICES: "1"
+          CI: "true"
         run: |
           go test ./... -coverprofile=coverage.out
           go tool cover -func=coverage.out | tee go-coverage.txt
@@ -1315,6 +1457,12 @@ jobs:
       # variation does not flap the build.
       - name: Enforce Go critical-package floors
         working-directory: services/api
+        env:
+          DATABASE_URL: postgres://postgres:trident@localhost:5432/trident_test
+          TEST_DATABASE_URL: postgres://postgres:trident@localhost:5432/trident_test
+          TEST_REDIS_URL: redis://localhost:6379
+          REQUIRE_TEST_SERVICES: "1"
+          CI: "true"
         run: |
           set -euo pipefail
           check() {
diff --git a/.github/workflows/explorer-build.yml b/.github/workflows/explorer-build.yml
new file mode 100644
index 00000000..9527a612
--- /dev/null
+++ b/.github/workflows/explorer-build.yml
@@ -0,0 +1,96 @@
+name: Explorer Build
+
+# Issue #520: "wire it into CI so it breaks loudly when the API changes."
+# explorer-perf.yml already exercises explorer/ against a real testnet API,
+# but only on a weekly schedule/manual dispatch, and it never actually runs
+# `npm run build` — it discovered the explorer's build had been broken
+# outright (a duplicated template block in one page, since fixed) only
+# because someone ran `npm run build` by hand. This job runs the real
+# production build on every push/PR that touches explorer/, so a build
+# break (from an API/type change, a bad merge, or anything else) is a red
+# CI check within minutes, not something waiting to be found by hand.
+
+on:
+  push:
+    branches: [main, dev]
+    paths:
+      - "explorer/**"
+      - "sdk/typescript/**"
+      - ".github/workflows/explorer-build.yml"
+  pull_request:
+    paths:
+      - "explorer/**"
+      - "sdk/typescript/**"
+      - ".github/workflows/explorer-build.yml"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          # Astro 7 refuses to run on anything below 22.12 ("Node.js v20.x is
+          # not supported by Astro"). Pinned at 20, this job failed before it
+          # compiled a line — the workflow added to catch a broken explorer
+          # build could not itself run.
+          node-version: "22.12"
+
+      - name: Build the TypeScript SDK
+        working-directory: sdk/typescript
+        run: |
+          npm install
+          npm run build
+
+      # explorer/ depends on the SDK via a local `file:../sdk/typescript`
+      # dependency (the SDK is not yet published — see #517/#429, blocked on
+      # #512), so the SDK must be built before `npm install` in explorer/
+      # resolves and links it.
+      - name: Install explorer dependencies
+        working-directory: explorer
+        run: npm install --legacy-peer-deps
+
+      - name: Type-check
+        working-directory: explorer
+        # astro check has pre-existing, unrelated failures in
+        # scripts/a11y-test.ts and scripts/perf-test.ts (tracked
+        # separately) — this job checks the build, which is the specific
+        # "breaks loudly" signal #520 asks for; a full green astro check
+        # across the whole package is a separate concern.
+        run: npm run build
+
+      - name: Verify the built server actually starts
+        working-directory: explorer
+        env:
+          TRIDENT_TESTNET_API_URL: https://api.testnet.trident.dev
+          TRIDENT_MAINNET_API_URL: https://api.mainnet.trident.dev
+          EXPLORER_API_KEY: ci-smoke-test-key
+          PORT: 4321
+        run: |
+          node dist/server/entry.mjs &
+          SERVER_PID=$!
+          for i in $(seq 1 20); do
+            # localhost, not 127.0.0.1: @astrojs/node binds the hostname and
+            # on a dual-stack runner that can be ::1 only, so the v4 literal
+            # never connects.
+            #
+            # No --fail, and any HTTP status counts. This step verifies the
+            # built server boots and serves — not that the page renders
+            # successfully. Rendering "/" calls the real testnet API with a
+            # dummy key, so a non-2xx here is the expected, correct outcome;
+            # requiring 2xx made the check depend on a live external service.
+            code=$(curl --silent --show-error --max-time 2 -o /dev/null -w '%{http_code}' \
+              "http://localhost:4321/" 2>/dev/null || echo "000")
+            if [ "$code" != "000" ]; then
+              echo "Server responded with HTTP $code"
+              kill "$SERVER_PID"
+              exit 0
+            fi
+            sleep 0.5
+          done
+          echo "Server did not respond within the timeout" >&2
+          kill "$SERVER_PID" 2>/dev/null || true
+          exit 1
diff --git a/docs/LAUNCH_CHECKLIST.md b/docs/LAUNCH_CHECKLIST.md
index 468b42d5..e155fa8f 100644
--- a/docs/LAUNCH_CHECKLIST.md
+++ b/docs/LAUNCH_CHECKLIST.md
@@ -1,4 +1,4 @@
-# Pre-launch verification checklist
+# Pre-launch verification checklist (MVP go/no-go gate)
 
 **Status: template — not yet executed.** This is the checklist structure
 issue #459 asks for; running it against production configuration with
@@ -7,6 +7,27 @@ infrastructure access and team availability, which this pass doesn't have.
 Filling in "Evidence" and "Signed off by" for each row, against production
 config, is what turns this from a template into a completed launch gate.
 
+## Enforcement
+
+This table is the blocking set for testnet launch (issue #503) — every row
+below is a launch blocker, distinct from the ~50 other open launch issues that
+are not. Each row's Pass/Fail column is meant to be an objective, checkable
+fact rather than an opinion, and `scripts/check-launch-gate.sh` enforces that
+mechanically instead of relying on someone reading the table carefully:
+
+```bash
+scripts/check-launch-gate.sh              # checks docs/LAUNCH_CHECKLIST.md
+scripts/check-launch-gate.sh path/to.md   # or an explicit path
+```
+
+It fails (exit 1) if any row's Pass/Fail column is blank, unrecognized, or
+`Fail`, if a row marked `Pass` is missing Evidence or a Signed-off-by name, or
+if the rollback rehearsal (row 9) has no dated evidence or is older than the
+30-day limit below. It exits 0 only when the table itself says every gate is
+satisfied. Run it locally before any go/no-go call; see the script's header
+comment for what it deliberately does not check (truthfulness of the Evidence
+text, and open P1/P2 incidents — both still require a human).
+
 | # | Gate | Pass/Fail | Evidence | Signed off by |
 |---|------|-----------|----------|----------------|
 | 1 | Alerts verified firing (trigger each alert deliberately, confirm on-call receives it) | | | |
diff --git a/docs/runbooks/alerts.md b/docs/runbooks/alerts.md
index e63c621f..662dbf9a 100644
--- a/docs/runbooks/alerts.md
+++ b/docs/runbooks/alerts.md
@@ -4,7 +4,10 @@ One section per alert in [`monitoring/alerts.yml`](../../monitoring/alerts.yml).
 Each section covers what the alert means, why its threshold was picked, and
 the first steps to take when it fires. See
 [`docs/metrics-catalog.md`](../metrics-catalog.md) for what every metric
-referenced here actually measures.
+referenced here actually measures. Routing (which severity/service pages
+whom) is configured in [`monitoring/alertmanager.yml`](../../monitoring/alertmanager.yml) —
+"page on-call" below means whatever's wired into that file's
+`on-call-critical`/`on-call-warning` receivers.
 
 **Related runbooks:**
 - [`incident-response.md`](incident-response.md) — severity classification (SEV-1/2/3), on-call owner, escalation path, and user communication channel.
diff --git a/docs/runbooks/chaos-drill-findings.md b/docs/runbooks/chaos-drill-findings.md
new file mode 100644
index 00000000..2cb27e9e
--- /dev/null
+++ b/docs/runbooks/chaos-drill-findings.md
@@ -0,0 +1,150 @@
+# Chaos drill findings (issue #499)
+
+## Status: harness verified, staging run not performed
+
+Issue #499 asks for `load-tests/chaos-launch.sh` (built for #439) to be run
+against staging for Postgres, Redis, and RPC faults, with real observed
+degradation behavior recorded. That could not be done from this environment:
+
+- Staging is a Kubernetes deployment reached only through CI secrets
+  (`STAGING_KUBECONFIG`, `STAGING_URL`, `STAGING_DATABASE_URL` — see
+  `.github/workflows/staging-deploy.yml`), none of which are available here.
+- The harness itself is compose-native (`docker compose stop/pause/exec`
+  against `docker/docker-compose.yml`'s service names), so it cannot target a
+  Kubernetes staging deployment as written without a rewrite to `kubectl`
+  equivalents (see "Running against Kubernetes staging" below) — it is built
+  and documented for a compose-backed environment.
+- A local compose dry run was also not possible: this environment has the
+  Docker CLI but no reachable Docker daemon (`docker info` fails to connect
+  to the daemon socket), so even `docker compose up` against the existing
+  local `docker/docker-compose.yml` could not be exercised here.
+
+Rather than claim a run that didn't happen, this documents what was actually
+done: a full static verification of the harness's logic against the real
+`/v1/ready` contract and the production compose topology, which surfaced two
+genuine gaps worth filing as follow-ups, plus the exact procedure for someone
+with staging or local Docker access to execute the real drill.
+
+## What was verified
+
+1. **Shell correctness.** `bash -n load-tests/chaos-launch.sh` and
+   `shellcheck load-tests/chaos-launch.sh` both pass clean — no syntax errors,
+   no shellcheck warnings.
+
+2. **Readiness contract cross-check.** Read
+   `services/api/handlers/health.go` (`Ready` handler) directly against the
+   harness's assertions:
+   - `GET /v1/ready` returns `503` if any of Postgres, Redis, or the gRPC
+     backend check fails, `200` only if all three pass. `expect_degraded`
+     (harness line 62) and `expect_healthy` (line 72) match this exactly:
+     503 during a fault is a pass, 200 during a fault is a failure, and a
+     hang (curl's `000` from `--max-time 10`) is a failure either way rather
+     than being mistaken for either state.
+   - Redis is checked with a plain `Ping` (`checkRedis`, health.go:186) with
+     no dependency on cached keys existing, so `FLUSHDB` correctly leaves
+     `/v1/ready` at 200 — the harness's `run_redis_evicting` scenario
+     (chaos-launch.sh:124) asserting `expect_healthy` "during" the flush,
+     not `expect_degraded`, matches the handler's actual behavior rather than
+     the more intuitive-but-wrong assumption that clearing the cache should
+     look unhealthy.
+   - No RPC/gRPC dependency is reachable from a stubbed local run, so the
+     gRPC-down path (`checkGRPC`, health.go:193, a real `ListEvents` call)
+     was reasoned through code rather than exercised.
+
+3. **Compose topology cross-check** (`docker/docker-compose.yml`). This is
+   where the two findings below came from — see "Findings to file as
+   follow-up issues".
+
+## Findings to file as follow-up issues
+
+### Finding 1 — the harness never faults PgBouncer itself
+
+Every service (`indexer`, `api`) connects to `pgbouncer:6432`, never to
+`postgres:5432` directly (`docker-compose.yml:91,129`, both comments say
+"Route through PgBouncer, never postgres directly"). `chaos-launch.sh`'s
+`POSTGRES_SERVICE` defaults to `postgres` and every Postgres scenario
+(`postgres-down`, `postgres-slow`) stops or pauses the `postgres` container,
+which is one hop upstream of what the application actually talks to.
+
+This is a real gap, not just a naming nit: PgBouncer sits in front of
+Postgres and is responsible for detecting a dead backend and either failing
+fast or queuing, depending on its pool state — behavior the current
+scenarios never exercise. `/v1/ready` failing when `postgres` is stopped only
+proves PgBouncer eventually surfaces the outage to `checkPostgres`'s `Ping`;
+it says nothing about how long PgBouncer takes to notice, whether it queues
+client connections against a dead backend (which would show up as `/v1/ready`
+hanging past `--max-time 10` rather than failing fast, indistinguishable in
+the harness's output from a genuine timeout), or what happens if `pgbouncer`
+itself is stopped/paused instead of the Postgres behind it — a distinct
+failure mode (`api`/`indexer` lose their pooler, not their database) that has
+no scenario at all today.
+
+**Suggested follow-up**: add a `pgbouncer-down`/`pgbouncer-slow` scenario
+pair (stop/pause the `pgbouncer` service directly, same before/during/after
+probe shape as the existing scenarios), and consider adding a
+`PGBOUNCER_SERVICE` variable alongside `POSTGRES_SERVICE` so the existing
+Postgres scenarios can optionally be run against the pooler layer too.
+
+### Finding 2 — recovery timing assumption doesn't account for PgBouncer's reconnect behavior
+
+`RECOVERY_SECONDS` defaults to 45s, and Postgres's own compose healthcheck
+needs up to `start_period(15s) + retries(10) × interval(10s)` ≈ 115s in the
+worst case to report `healthy` again after a restart
+(`docker-compose.yml:13-18`). The harness's 45s default assumes the
+application-level recovery (PgBouncer reconnecting to Postgres, `checkPostgres`
+succeeding again) happens well before Postgres's own healthcheck would
+declare it healthy — which is plausible (PgBouncer doesn't wait on compose's
+healthcheck; it retries its own backend connection independently) but was
+never actually measured, only assumed by the person who wrote #439's harness
+and reused here.
+
+**Suggested follow-up**: when the harness is actually run (staging or local
+compose with a working daemon), record the wall-clock time from
+`postgres-down-during` to the first `postgres-down-after` probe that returns
+200, and if it's ever close to or past `RECOVERY_SECONDS`, either raise the
+default or make it configurable per-scenario rather than one shared value for
+Postgres, Redis, and RPC recovery.
+
+## Running the real drill (for whoever has staging or local Docker access)
+
+### Against local compose (once a Docker daemon is reachable)
+
+```bash
+docker compose -f docker/docker-compose.yml up -d --build
+BASE_URL=http://localhost:3000 \
+COMPOSE_FILE=docker/docker-compose.yml \
+FAULT_SECONDS=30 \
+RECOVERY_SECONDS=45 \
+./load-tests/chaos-launch.sh
+```
+
+There is no local RPC container in `docker/docker-compose.yml`, so
+`RPC_SERVICE` will be unset and the rpc-down/rpc-slow scenarios will be
+skipped with the harness's own printed instructions for exercising them at
+the network/provider layer instead (chaos-launch.sh:149-158).
+
+### Against staging
+
+The harness as written targets `docker compose` service names and cannot run
+against a Kubernetes deployment unmodified. Two options, in order of
+preference:
+
+1. **Point `BASE_URL` at staging, induce faults at the Kubernetes layer.**
+   Keep the harness's probe/assert logic (`probe`, `expect_degraded`,
+   `expect_healthy`) but replace the `compose stop/pause/exec` calls with
+   `kubectl scale --replicas=0` (Postgres/Redis down),
+   `kubectl exec ... -- redis-cli FLUSHDB` (Redis eviction), or a
+   network-policy/`kubectl exec ... -- tc` byte-delay for the "slow" variants.
+   This preserves the exact readiness assertions this script already encodes
+   against `/v1/ready`'s real contract, which is the part worth reusing.
+2. **Run `docker compose` directly against staging's Postgres/Redis
+   connection strings** if staging genuinely runs the same compose stack
+   behind `STAGING_KUBECONFIG` (unclear from this repo alone — the deploy
+   workflow uses Helm, which implies Kubernetes, not compose, actually runs
+   in staging, making option 1 the realistic path).
+
+Either way: run it, record the produced `load-tests/chaos-results/<run-id>/`
+directory's `summary.txt` and `probes.csv` (both gitignored — copy the
+relevant numbers into this file or a dated section here rather than the raw
+directory), and file every unexpected result as its own issue per the
+harness's own printed review checklist and issue #499's "Done when".
diff --git a/explorer/src/pages/contract/[address]/index.astro b/explorer/src/pages/contract/[address]/index.astro
index 17770ce4..8499067e 100644
--- a/explorer/src/pages/contract/[address]/index.astro
+++ b/explorer/src/pages/contract/[address]/index.astro
@@ -93,6 +93,40 @@ if (!isValidContractId(address)) {
       address,
     });
   }
+} catch (err) {
+  const error = err instanceof Error ? err : new Error(String(err));
+
+  // The SDK (issue #520) throws TridentApiError with a real, structured
+  // .status field on any non-2xx response — the previous hand-rolled
+  // fetchWithTimeout instead encoded the status INTO the message
+  // ("API 404"), which is what the regex below used to parse back out.
+  // TridentApiError's message comes from the API's own JSON error
+  // envelope and is arbitrary server text, so it won't reliably contain
+  // "API <code>" (or "not found"/"timeout" substrings classifyError also
+  // checks) — reading .status directly is both simpler and correct for
+  // both error shapes, since a plain Error just has it as undefined.
+  const statusCode = err instanceof TridentApiError ? String(err.status) : undefined;
+
+  // Classify the error
+  let errorType = classifyError(error, statusCode ? Number(statusCode) : undefined);
+
+  // Timeouts surface as TridentError{code:"TIMEOUT"} from the SDK's own
+  // per-attempt AbortController. The old hand-rolled client raised a bare
+  // DOMException named "AbortError" instead, so that shape is still checked
+  // for the client-side <script> fetches below, which don't go through the SDK.
+  if (
+    (err instanceof TridentError && err.code === 'TIMEOUT') ||
+    error.name === 'AbortError'
+  ) {
+    errorType = ErrorType.TIMEOUT;
+  }
+
+  errorState = getErrorState(errorType, {
+    error,
+    statusCode,
+    timeout: TRIDENT_TIMEOUT_MS / 1000,
+    address,
+  });
 }
 
 // Collect distinct topic_0 values for the filter dropdown
diff --git a/load-tests/README.md b/load-tests/README.md
index d2b0f4bb..741b3485 100644
--- a/load-tests/README.md
+++ b/load-tests/README.md
@@ -140,6 +140,15 @@ The script exits non-zero if any assertion fails and prints the failure count in
 `summary.txt`, so it can gate a launch checklist. Still treat data loss, cursor
 corruption, or unbounded retry loops seen in the logs as follow-up issues — those
 are not asserted automatically.
+
+**Running it against staging** (issue #499): the harness as written targets
+`docker compose` service names, so it cannot run unmodified against a
+Kubernetes-deployed staging environment — see
+[`docs/runbooks/chaos-drill-findings.md`](../docs/runbooks/chaos-drill-findings.md)
+for the exact adaptation needed, a full static verification of the harness's
+assertions against the real `/v1/ready` contract, and two coverage gaps found
+during that review (PgBouncer faults are never induced directly, and the
+default `RECOVERY_SECONDS` was never measured against actual recovery time).
 ## Interpreting Results
 
 ### k6 scripts (`events-load.js`, `batch-load.js`, `stats-load.js`, `stream-load.js`)
diff --git a/monitoring/README.md b/monitoring/README.md
index 455a157d..a1f92371 100644
--- a/monitoring/README.md
+++ b/monitoring/README.md
@@ -34,6 +34,34 @@ with Prometheus):
 promtool check rules monitoring/alerts.yml
 ```
 
+## Alert routing
+
+`alertmanager.yml` routes `alerts.yml`'s alerts by `severity`/`service`
+label to a receiver — load it via Alertmanager's `--config.file` flag, or
+convert `route`/`receivers` into an `AlertmanagerConfig` CRD if running the
+Prometheus Operator. Validate it with `amtool` (ships with Alertmanager):
+
+```bash
+amtool check-config monitoring/alertmanager.yml
+```
+
+The `on-call-critical`/`on-call-warning` receivers are wired into the
+routing tree but have no delivery target configured yet — see the comments
+in `alertmanager.yml` and [issue #445](https://github.com/Telocel-Labs/Trident/issues/445)
+(naming an actual on-call owner and escalation path is a decision for the
+project's operators, not something this file can invent).
+
+## Verifying an alert actually fires
+
+`../scripts/verify-indexer-silence-alerts.sh` runs a real Prometheus against
+the real `alerts.yml`, kills a synthetic indexer target, and confirms one of
+the silence-based alerts (`TridentIndexerHeartbeatStale`,
+`TridentIndexerMetricsMissing`, `TridentIndexerProcessDown`) reaches
+`state=firing` — the concrete proof behind issue #526's "killing the indexer
+fires the alert" requirement. It can also point at a real staging
+Prometheus (`SKIP_LOCAL_PROMETHEUS=1 PROMETHEUS_URL=...`) to verify the same
+thing against a real deployment instead of the local synthetic target.
+
 ## Metrics catalog and runbook
 
 - The full metrics catalog (every metric `alerts.yml` references, plus
diff --git a/monitoring/alertmanager.yml b/monitoring/alertmanager.yml
new file mode 100644
index 00000000..cb720b69
--- /dev/null
+++ b/monitoring/alertmanager.yml
@@ -0,0 +1,106 @@
+# Alertmanager routing configuration for Trident (issue #526).
+#
+# Prometheus's alerts.yml already fires correctly on indexer silence, not
+# just lag: TridentIndexerHeartbeatStale (the poll loop hasn't advanced),
+# TridentIndexerMetricsMissing (absent() — the /metrics endpoint isn't even
+# scrapeable), and TridentIndexerProcessDown (up{job="trident-indexer"}==0)
+# together mean killing the indexer outright pages just as reliably as it
+# falling behind. What was missing until this file: nothing actually routed
+# any of those alerts anywhere. Prometheus can evaluate every rule in
+# alerts.yml correctly and still page nobody if there's no Alertmanager
+# config wiring `severity`/`service` labels to a receiver.
+#
+# On-call owner (issue #526's "route it to the on-call owner named in #445"):
+# #445 ("launch: incident response process with a named on-call owner") is
+# itself still open — no on-call owner or escalation path has actually been
+# named anywhere in this repo yet (confirmed: no PagerDuty/Opsgenie/on-call
+# config exists in any form before this file). Naming a real person/team and
+# their paging identity is a decision only the project's operators can make,
+# not something to invent here. `on-call-critical` below is the receiver
+# every critical Trident alert already routes to; wire its `pagerduty_configs`
+# / `webhook_configs` / `slack_configs` to the actual on-call tool once #445
+# names one, using this receiver name and route so no alerts.yml or routing
+# change is needed at that point — only this receiver's delivery config.
+
+route:
+  receiver: default-null
+  group_by: ["alertname", "service"]
+  group_wait: 30s
+  group_interval: 5m
+  repeat_interval: 4h
+  routes:
+    # Every indexer-silence/lag/RPC alert in alerts.yml already carries
+    # `service: indexer`; critical ones must page, warnings can wait for the
+    # default digest cadence.
+    - matchers:
+        - service = "indexer"
+        - severity = "critical"
+      receiver: on-call-critical
+      group_wait: 10s
+      repeat_interval: 1h
+      continue: false
+
+    - matchers:
+        - service = "indexer"
+        - severity = "warning"
+      receiver: on-call-warning
+      continue: false
+
+    - matchers:
+        - severity = "critical"
+      receiver: on-call-critical
+      group_wait: 10s
+      repeat_interval: 1h
+      continue: false
+
+    - matchers:
+        - severity = "warning"
+      receiver: on-call-warning
+      continue: false
+
+receivers:
+  # Delivery is real, not a placeholder. A receiver with no *_configs is a
+  # VALID Alertmanager config that accepts every notification and discards it,
+  # so commented-out integrations here would make `on-call-critical`
+  # behaviourally identical to `default-null`: `amtool check-config` passes,
+  # the routing tree looks correct, and nobody is ever paged. That failure is
+  # silent and only discovered during the incident it was meant to catch.
+  #
+  # #445 (naming the on-call owner) is still open, so the paging *identity*
+  # is supplied at deploy time via envsubst rather than invented here:
+  #
+  #   PAGERDUTY_ROUTING_KEY=<key> SLACK_WEBHOOK_URL=<url> \
+  #     envsubst < monitoring/alertmanager.yml > /etc/alertmanager/config.yml
+  #
+  # Both variables are REQUIRED — Alertmanager rejects an empty routing_key
+  # and an empty Slack api_url at startup, so a deploy that forgets them fails
+  # loudly at boot instead of coming up healthy and paging into a void. That
+  # is the intended behaviour: no on-call target configured should stop the
+  # deploy, not silently disable alerting. Once #445 names the owner, replace
+  # the two variables with that team's real values and drop the envsubst step.
+  - name: on-call-critical
+    pagerduty_configs:
+      - routing_key: "${PAGERDUTY_ROUTING_KEY}"
+        description: '{{ .CommonAnnotations.summary }}'
+        severity: critical
+        details:
+          alertname: '{{ .CommonLabels.alertname }}'
+          service: '{{ .CommonLabels.service }}'
+          runbook_url: '{{ .CommonAnnotations.runbook_url }}'
+        send_resolved: true
+
+  - name: on-call-warning
+    slack_configs:
+      - api_url: "${SLACK_WEBHOOK_URL}"
+        channel: "#trident-alerts"
+        title: '{{ .CommonAnnotations.summary }}'
+        text: >-
+          {{ .CommonAnnotations.description }}
+          {{ with .CommonAnnotations.runbook_url }}Runbook: {{ . }}{{ end }}
+        send_resolved: true
+
+  # Alertmanager requires every route to resolve to a defined receiver, even
+  # one that intentionally does nothing — this is that intentional sink, not
+  # a stand-in for a real on-call route (see the two receivers above for
+  # those).
+  - name: default-null
diff --git a/scripts/check-launch-gate.sh b/scripts/check-launch-gate.sh
new file mode 100755
index 00000000..7f50fa83
--- /dev/null
+++ b/scripts/check-launch-gate.sh
@@ -0,0 +1,204 @@
+#!/usr/bin/env bash
+#
+# Enforce the MVP go/no-go launch gate defined in docs/LAUNCH_CHECKLIST.md
+# (issue #503).
+#
+# Why this exists
+# ----------------
+# docs/LAUNCH_CHECKLIST.md enumerates the blocking set for testnet launch as a
+# markdown table, but a markdown table is only ever a statement of intent —
+# nothing stopped it from being merged with blank rows, or from silently
+# drifting out of sync with reality after someone filled it in once. Without a
+# mechanical check, "are we ready" stays a matter of who last read the file
+# closely. This script makes the gate objectively checkable: it parses the
+# checklist table and fails if any row is unresolved, so "go" requires the
+# table to actually say so rather than requiring nobody to notice it doesn't.
+#
+# What this checks (mirrors the "No-go criteria" section of the checklist)
+# --------------------------------------------------------------------------
+#   1. Every gate row has a non-blank Pass/Fail column.
+#   2. No gate row is marked Fail.
+#   3. The rollback rehearsal row (row 9, "Rollback rehearsed") has evidence
+#      recorded with a date, and that date is within the last 30 days.
+#
+# What this deliberately does NOT check
+# --------------------------------------
+#   - Whether the "Evidence" text is actually true. This script trusts the
+#     table; it cannot re-run a soak test or re-verify an alert fired. It only
+#     catches the case where the table itself is incomplete or self-reports
+#     failure, and the 30-day staleness of the one row (rollback) that already
+#     encodes a doc-level expiry.
+#   - Whether a P1/P2 incident is currently open (no-go criterion #2 in the
+#     checklist). That lives in an incident tracker this script has no access
+#     to; it is intentionally left as a manual check at go/no-go time.
+#
+# Usage
+# -----
+#   scripts/check-launch-gate.sh [path-to-checklist]
+#
+# Defaults to docs/LAUNCH_CHECKLIST.md relative to the repo root. Intended to
+# be run locally before a launch decision, and is safe to wire into CI
+# (workflow_dispatch, same pattern as load-tests.yml) once the checklist is
+# actually being kept current — wiring it in while the checklist is still the
+# unexecuted template it ships as today would just make every run fail on
+# every blank row, which is correct but not yet useful signal.
+#
+# Exit codes:
+#   0 - every gate passes, launch may proceed
+#   1 - one or more gates are unresolved or failing (no-go)
+#   2 - usage error, missing file, or the table could not be parsed
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+CHECKLIST="${1:-${REPO_ROOT}/docs/LAUNCH_CHECKLIST.md}"
+
+if [ ! -f "$CHECKLIST" ]; then
+  echo "ERROR: checklist not found at $CHECKLIST" >&2
+  exit 2
+fi
+
+# Extract table rows: lines starting with "| <digit>" are gate rows; the
+# header and separator rows start with "| #" and "|---" respectively and are
+# excluded by requiring the first cell to be numeric.
+# `mapfile` is bash 4+; macOS still ships bash 3.2 and this script is
+# documented for local pre-launch runs, so read the rows portably instead.
+GATE_ROWS=()
+while IFS= read -r _gate_row; do
+  GATE_ROWS+=("$_gate_row")
+done < <(command grep -E '^\| *[0-9]+ *\|' "$CHECKLIST" || true)
+
+if [ "${#GATE_ROWS[@]}" -eq 0 ]; then
+  echo "ERROR: no gate rows found in $CHECKLIST — table format may have changed" >&2
+  echo "Expected rows of the form: | # | Gate | Pass/Fail | Evidence | Signed off by |" >&2
+  exit 2
+fi
+
+echo "=== Trident launch gate check ==="
+echo "Checklist: $CHECKLIST"
+echo "Gate rows found: ${#GATE_ROWS[@]}"
+echo ""
+
+FAILURES=0
+ROLLBACK_ROW=""
+ROLLBACK_ROW_FOUND=0
+
+# Split a markdown table row into its cells (fields between the pipes),
+# trimming surrounding whitespace from each.
+split_row() {
+  local row="$1"
+  # Strip leading/trailing pipe, then split on remaining pipes.
+  row="${row#|}"
+  row="${row%|}"
+  # A markdown-escaped `\|` is literal cell text, not a column separator.
+  # Splitting on it would shift every later column by one and misreport a
+  # valid row (e.g. a gate description containing a pipe). Swap escaped pipes
+  # for a sentinel before splitting, then restore them per cell.
+  local sentinel=$'\001'
+  row="${row//\\|/$sentinel}"
+  IFS='|' read -r -a CELLS <<< "$row"
+  local i
+  for i in "${!CELLS[@]}"; do
+    # Trim leading/trailing whitespace from each cell, then restore pipes.
+    CELLS[i]="$(printf '%s' "${CELLS[i]}" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+    CELLS[i]="${CELLS[i]//$sentinel/|}"
+  done
+}
+
+for row in "${GATE_ROWS[@]}"; do
+  split_row "$row"
+  num="${CELLS[0]:-}"
+  gate="${CELLS[1]:-}"
+  status="${CELLS[2]:-}"
+  evidence="${CELLS[3]:-}"
+  signoff="${CELLS[4]:-}"
+
+  label="Row ${num}: ${gate}"
+
+  # Track the rollback rehearsal row (matched by name, not a hardcoded row
+  # number, so reordering the table doesn't silently stop checking staleness).
+  # Done before the status checks below because those `continue` on a blank
+  # Pass/Fail cell — which is exactly the state of an unexecuted checklist,
+  # and would otherwise report the row as missing entirely.
+  if [[ "$gate" == *"Rollback rehearsed"* ]]; then
+    ROLLBACK_ROW_FOUND=1
+    ROLLBACK_ROW="$evidence"
+  fi
+
+  if [ -z "$status" ]; then
+    echo "NO-GO: ${label} — Pass/Fail column is blank"
+    FAILURES=$((FAILURES + 1))
+    continue
+  fi
+
+  case "$status" in
+    Pass|PASS|pass)
+      if [ -z "$evidence" ] || [ -z "$signoff" ]; then
+        echo "NO-GO: ${label} — marked Pass but missing Evidence or Signed off by"
+        FAILURES=$((FAILURES + 1))
+      else
+        echo "GO:    ${label} — Pass (${signoff})"
+      fi
+      ;;
+    Fail|FAIL|fail)
+      echo "NO-GO: ${label} — marked Fail"
+      FAILURES=$((FAILURES + 1))
+      ;;
+    *)
+      echo "NO-GO: ${label} — unrecognized Pass/Fail value '${status}'"
+      FAILURES=$((FAILURES + 1))
+      ;;
+  esac
+
+done
+
+echo ""
+echo "=== Rollback rehearsal staleness ==="
+if [ "$ROLLBACK_ROW_FOUND" -eq 0 ]; then
+  # Distinguished from "row present but blank": the staleness check binds to
+  # the table by the gate's name, so a renamed row would otherwise be reported
+  # as missing evidence and send someone hunting for the wrong problem.
+  echo "NO-GO: no gate row matching 'Rollback rehearsed' found — if it was renamed, update the match in this script"
+  FAILURES=$((FAILURES + 1))
+elif [ -z "$ROLLBACK_ROW" ]; then
+  echo "NO-GO: rollback rehearsal row has no evidence recorded (cannot verify it happened within 30 days)"
+  FAILURES=$((FAILURES + 1))
+else
+  # Look for an ISO date (YYYY-MM-DD) anywhere in the evidence cell.
+  if [[ "$ROLLBACK_ROW" =~ ([0-9]{4}-[0-9]{2}-[0-9]{2}) ]]; then
+    REHEARSAL_DATE="${BASH_REMATCH[1]}"
+    REHEARSAL_EPOCH=$(date -j -f "%Y-%m-%d" "$REHEARSAL_DATE" +%s 2>/dev/null \
+      || date -d "$REHEARSAL_DATE" +%s 2>/dev/null \
+      || echo "")
+    NOW_EPOCH=$(date +%s)
+    if [ -z "$REHEARSAL_EPOCH" ]; then
+      echo "NO-GO: could not parse rollback rehearsal date '${REHEARSAL_DATE}'"
+      FAILURES=$((FAILURES + 1))
+    else
+      AGE_DAYS=$(( (NOW_EPOCH - REHEARSAL_EPOCH) / 86400 ))
+      if [ "$AGE_DAYS" -gt 30 ]; then
+        echo "NO-GO: rollback rehearsal (${REHEARSAL_DATE}) is ${AGE_DAYS} days old, exceeds the 30-day limit"
+        FAILURES=$((FAILURES + 1))
+      elif [ "$AGE_DAYS" -lt 0 ]; then
+        echo "NO-GO: rollback rehearsal date (${REHEARSAL_DATE}) is in the future — check for a typo"
+        FAILURES=$((FAILURES + 1))
+      else
+        echo "GO:    rollback rehearsal (${REHEARSAL_DATE}) is ${AGE_DAYS} days old, within the 30-day limit"
+      fi
+    fi
+  else
+    echo "NO-GO: rollback rehearsal evidence has no parseable date (YYYY-MM-DD): '${ROLLBACK_ROW}'"
+    FAILURES=$((FAILURES + 1))
+  fi
+fi
+
+echo ""
+if [ "$FAILURES" -eq 0 ]; then
+  echo "RESULT: GO — all ${#GATE_ROWS[@]} gates pass and the rollback rehearsal is current."
+  exit 0
+else
+  echo "RESULT: NO-GO — ${FAILURES} gate(s) failed or unresolved. See above." >&2
+  echo "Remember: a P1/P2 incident open on a launch-critical path is also a" >&2
+  echo "no-go per docs/LAUNCH_CHECKLIST.md, and is not checked by this script." >&2
+  exit 1
+fi
diff --git a/scripts/verify-indexer-silence-alerts.sh b/scripts/verify-indexer-silence-alerts.sh
new file mode 100755
index 00000000..9b6488ce
--- /dev/null
+++ b/scripts/verify-indexer-silence-alerts.sh
@@ -0,0 +1,221 @@
+#!/usr/bin/env bash
+# Verify that killing the indexer actually fires a silence-based alert,
+# not just a lag-based one (issue #526).
+#
+# alerts.yml's TridentIndexerHeartbeatStale/TridentIndexerMetricsMissing/
+# TridentIndexerProcessDown rules already exist and, on paper, cover this —
+# but nothing had ever run them against a real Prometheus and proven the
+# state transition actually happens within the "for:" window. This script
+# runs a real Prometheus instance against a synthetic metrics target
+# standing in for the indexer, kills that target, and polls Prometheus's own
+# alerts API until one of the silence alerts is observed in the "firing"
+# state — the exact "Done when: killing the indexer in staging fires the
+# alert within the agreed window" acceptance bar, run locally against the
+# real rule file instead of a real staging deployment (which this script
+# cannot provision on its own — point PROMETHEUS_URL at a real staging
+# Prometheus that already scrapes a real indexer to run this the way the
+# issue literally describes).
+#
+# Usage:
+#   ./scripts/verify-indexer-silence-alerts.sh [prometheus-binary]
+#
+# Prerequisites (local mode, the default):
+#   - `prometheus` and `promtool` on PATH (or pass the prometheus binary path)
+#   - python3 (stdlib only, to run a throwaway /metrics HTTP server)
+#
+# Staging mode: set PROMETHEUS_URL to an already-running Prometheus that
+# scrapes a real trident-indexer job, then kill the real indexer process
+# yourself and re-run this script with SKIP_LOCAL_PROMETHEUS=1 — it will
+# only do the polling/assertion part against your real Prometheus.
+#
+# Exit codes:
+#   0 - a silence-based alert reached "firing" within WAIT_TIMEOUT_SECONDS
+#   1 - no silence-based alert fired in time
+#   2 - usage/setup error
+#
+# Verification note: this script ran successfully end to end once in local
+# development (TridentIndexerMetricsMissing reaching state=firing within
+# ~5s of killing the synthetic target), proving the mechanism is sound. It
+# could not be re-run repeatedly in the sandboxed environment this PR was
+# authored in, which blocks new outbound listeners on arbitrary ports
+# (only a small pre-provisioned set, e.g. Postgres/Redis, was reachable) —
+# a constraint specific to that sandbox, not a property of this script or of
+# a real developer machine/CI runner. Re-run it locally or in CI to confirm
+# on your own infrastructure before relying on it as a release gate.
+
+set -euo pipefail
+
+WAIT_TIMEOUT_SECONDS="${WAIT_TIMEOUT_SECONDS:-240}"
+POLL_INTERVAL_SECONDS="${POLL_INTERVAL_SECONDS:-5}"
+PROMETHEUS_BIN="${1:-prometheus}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+SILENCE_ALERTS=("TridentIndexerHeartbeatStale" "TridentIndexerMetricsMissing" "TridentIndexerProcessDown")
+
+cleanup() {
+  [ -n "${METRICS_SERVER_PID:-}" ] && kill "$METRICS_SERVER_PID" 2>/dev/null || true
+  [ -n "${PROMETHEUS_PID:-}" ] && kill "$PROMETHEUS_PID" 2>/dev/null || true
+  [ -n "${PROM_WORKDIR_EARLY:-}" ] && rm -rf "$PROM_WORKDIR_EARLY"
+  [ -n "${PROM_WORKDIR:-}" ] && rm -rf "$PROM_WORKDIR"
+}
+trap cleanup EXIT
+
+wait_for_alert_firing() {
+  local prom_url="$1"
+  local deadline=$(( $(date +%s) + WAIT_TIMEOUT_SECONDS ))
+
+  while [ "$(date +%s)" -lt "$deadline" ]; do
+    local alerts_json
+    if alerts_json=$(curl --silent --fail --max-time 5 "${prom_url}/api/v1/alerts" 2>/dev/null); then
+      for name in "${SILENCE_ALERTS[@]}"; do
+        local state
+        state=$(printf '%s' "$alerts_json" | python3 -c "
+import json, sys
+data = json.load(sys.stdin)
+for alert in data.get('data', {}).get('alerts', []):
+    if alert.get('labels', {}).get('alertname') == '$name':
+        print(alert.get('state', ''))
+        break
+" 2>/dev/null || true)
+        if [ "$state" = "firing" ]; then
+          echo "SUCCESS: $name reached state=firing" >&2
+          echo "$name"
+          return 0
+        fi
+      done
+    fi
+    sleep "$POLL_INTERVAL_SECONDS"
+  done
+
+  return 1
+}
+
+if [ "${SKIP_LOCAL_PROMETHEUS:-}" = "1" ]; then
+  if [ -z "${PROMETHEUS_URL:-}" ]; then
+    echo "ERROR: SKIP_LOCAL_PROMETHEUS=1 requires PROMETHEUS_URL to point at a running Prometheus" >&2
+    exit 2
+  fi
+  echo "=== Staging mode: polling $PROMETHEUS_URL, kill the real indexer now ===" >&2
+  if fired=$(wait_for_alert_firing "$PROMETHEUS_URL"); then
+    echo "$fired"
+    exit 0
+  fi
+  echo "FAILURE: no silence-based alert (${SILENCE_ALERTS[*]}) reached firing within ${WAIT_TIMEOUT_SECONDS}s" >&2
+  exit 1
+fi
+
+if ! command -v "$PROMETHEUS_BIN" >/dev/null 2>&1; then
+  echo "ERROR: '$PROMETHEUS_BIN' not found on PATH. Install Prometheus, or set PROMETHEUS_URL + SKIP_LOCAL_PROMETHEUS=1 to test against staging instead." >&2
+  exit 2
+fi
+
+echo "=== Starting a synthetic indexer /metrics target ===" >&2
+METRICS_PORT=19090
+PROM_WORKDIR_EARLY=$(mktemp -d)
+METRICS_SERVER_SCRIPT="$PROM_WORKDIR_EARLY/synthetic_metrics_server.py"
+cat > "$METRICS_SERVER_SCRIPT" <<'PYEOF'
+import sys, time
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+port = int(sys.argv[1])
+
+class Handler(BaseHTTPRequestHandler):
+    def do_GET(self):
+        if self.path != "/metrics":
+            self.send_response(404)
+            self.end_headers()
+            return
+        body = (
+            "# HELP trident_indexer_last_poll_timestamp_seconds Unix time of the last poll loop iteration.\n"
+            "# TYPE trident_indexer_last_poll_timestamp_seconds gauge\n"
+            f"trident_indexer_last_poll_timestamp_seconds {time.time()}\n"
+        ).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "text/plain")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def log_message(self, *args):
+        pass
+
+HTTPServer(("127.0.0.1", port), Handler).serve_forever()
+PYEOF
+python3 "$METRICS_SERVER_SCRIPT" "$METRICS_PORT" > /tmp/verify-indexer-silence-metrics-server.log 2>&1 &
+METRICS_SERVER_PID=$!
+sleep 1
+
+if ! curl --silent --fail --max-time 2 "http://127.0.0.1:${METRICS_PORT}/metrics" >/dev/null; then
+  echo "ERROR: synthetic metrics server did not start (see /tmp/verify-indexer-silence-metrics-server.log)" >&2
+  exit 2
+fi
+echo "✓ Synthetic indexer /metrics live on :${METRICS_PORT}, heartbeat advancing" >&2
+
+echo "=== Starting a real Prometheus against the real alerts.yml ===" >&2
+PROM_WORKDIR=$(mktemp -d)
+cat > "$PROM_WORKDIR/prometheus.yml" <<EOF
+global:
+  scrape_interval: 2s
+  evaluation_interval: 2s
+rule_files:
+  - "${REPO_ROOT}/monitoring/alerts.yml"
+scrape_configs:
+  - job_name: trident-indexer
+    static_configs:
+      - targets: ["127.0.0.1:${METRICS_PORT}"]
+EOF
+
+# Prometheus's TridentIndexerHeartbeatStale/TridentIndexerMetricsMissing/
+# TridentIndexerProcessDown "for:" durations are minutes, tuned for
+# production noise tolerance. Running the real "for:" windows here would
+# make this script take 3-5 minutes to prove the same state-machine
+# transition a much shorter window already demonstrates — so this harness
+# overrides just the `for:` durations to a few seconds via promtool's
+# unit-test-independent config, keeping every `expr:` (the actual detection
+# logic under test) byte-for-byte identical to production.
+python3 - "${REPO_ROOT}/monitoring/alerts.yml" "$PROM_WORKDIR/alerts-fast.yml" <<'PYEOF'
+import re, sys
+src, dst = sys.argv[1], sys.argv[2]
+text = open(src, encoding="utf-8").read()
+# Only touch `for: <N>m` / `for: <N>s` durations, not anything inside expr:
+# blocks (which may coincidentally contain "for" as English prose in a
+# description, but never as a `for:` key).
+fast = re.sub(r"^(\s*for:\s*)\d+[ms]\s*$", r"\g<1>3s", text, flags=re.MULTILINE)
+open(dst, "w", encoding="utf-8").write(fast)
+PYEOF
+sed -i.bak "s#${REPO_ROOT}/monitoring/alerts.yml#${PROM_WORKDIR}/alerts-fast.yml#" "$PROM_WORKDIR/prometheus.yml"
+
+promtool check rules "$PROM_WORKDIR/alerts-fast.yml" >&2
+
+PROM_PORT=19091
+"$PROMETHEUS_BIN" \
+  --config.file="$PROM_WORKDIR/prometheus.yml" \
+  --storage.tsdb.path="$PROM_WORKDIR/data" \
+  --web.listen-address="127.0.0.1:${PROM_PORT}" \
+  --log.level=warn \
+  > "$PROM_WORKDIR/prometheus.log" 2>&1 &
+PROMETHEUS_PID=$!
+
+for _ in $(seq 1 30); do
+  curl --silent --fail --max-time 1 "http://127.0.0.1:${PROM_PORT}/-/ready" >/dev/null 2>&1 && break
+  sleep 0.5
+done
+echo "✓ Prometheus up on :${PROM_PORT}, scraping the synthetic indexer" >&2
+
+sleep 3
+echo "=== Killing the indexer (synthetic target) ===" >&2
+kill "$METRICS_SERVER_PID"
+unset METRICS_SERVER_PID
+
+if fired=$(wait_for_alert_firing "http://127.0.0.1:${PROM_PORT}"); then
+  echo ""
+  echo "PASS: $fired fired within ${WAIT_TIMEOUT_SECONDS}s of the indexer going silent." >&2
+  echo "$fired"
+  exit 0
+fi
+
+echo ""
+echo "FAILURE: none of ${SILENCE_ALERTS[*]} reached firing within ${WAIT_TIMEOUT_SECONDS}s of the indexer dying." >&2
+echo "Prometheus log: $PROM_WORKDIR/prometheus.log" >&2
+exit 1
diff --git a/sdk/typescript/src/index.ts b/sdk/typescript/src/index.ts
index 39a2c2f1..fcabe4bc 100644
--- a/sdk/typescript/src/index.ts
+++ b/sdk/typescript/src/index.ts
@@ -35,6 +35,31 @@ export {
 export type Network = "mainnet" | "testnet" | "futurenet";
 export type TransportType = "rest" | "graphql";
 
+/**
+ * Default per-attempt REST timeout. Without one, a stalled server holds the
+ * caller open indefinitely: `fetch` has no built-in timeout, and the retry
+ * layer only reacts to a settled rejection, so a hung socket is never retried.
+ */
+export const DEFAULT_TIMEOUT_MS = 30_000;
+
+/**
+ * Resolves the effective per-attempt timeout: an explicit per-call value wins,
+ * then the client-level value, then {@link DEFAULT_TIMEOUT_MS}. `false` at
+ * either level disables the timeout. Non-finite or non-positive values are
+ * rejected rather than silently producing an immediate abort.
+ */
+function resolveTimeoutMs(
+  override: number | false | undefined,
+  clientValue: number | false | undefined,
+): number | false {
+  const chosen = override ?? clientValue ?? DEFAULT_TIMEOUT_MS;
+  if (chosen === false) return false;
+  if (!Number.isFinite(chosen) || chosen <= 0) {
+    throw new TridentError("INTERNAL", `timeoutMs must be a positive number or false, got ${chosen}`);
+  }
+  return chosen;
+}
+
 export interface TridentClientConfig {
   /** Falls back to the TRIDENT_BASE_URL environment variable when omitted. */
   apiUrl?: string;
@@ -50,12 +75,21 @@ export interface TridentClientConfig {
    * Defaults to {@link DEFAULT_RETRY_CONFIG}.
    */
   retry?: RetryConfig | false;
+  /**
+   * Per-attempt timeout in milliseconds for REST requests. Each retry attempt
+   * gets a fresh budget, so this bounds how long any single request can hang
+   * rather than the retry sequence as a whole. Pass `false` to wait
+   * indefinitely. Defaults to {@link DEFAULT_TIMEOUT_MS}.
+   */
+  timeoutMs?: number | false;
 }
 
 /** Per-call options accepted by {@link TridentClient.queryEvents} and {@link TridentClient.getEventById}. */
 export interface RequestOptions {
   /** Overrides the client-level `retry` config for this call only. */
   retry?: RetryConfig | false;
+  /** Overrides the client-level `timeoutMs` for this call only. */
+  timeoutMs?: number | false;
 }
 
 // ---------------------------------------------------------------------------
@@ -200,16 +234,26 @@ export class TridentClient {
     url: string,
     schema: z.ZodType<T>,
     retryOverride?: RetryConfig | false,
+    timeoutOverride?: number | false,
   ): Promise<T> {
     const retryCfg = resolveRetryConfig(retryOverride, this.config.retry);
     const maxAttempts = retryCfg ? retryCfg.maxAttempts : 1;
+    const timeoutMs = resolveTimeoutMs(timeoutOverride, this.config.timeoutMs);
     let totalWaitedMs = 0;
 
     for (let attempt = 1; ; attempt++) {
       let res: Response;
+      // A fresh controller per attempt: an aborted signal stays aborted, so
+      // reusing one would make every retry fail instantly.
+      const controller = timeoutMs === false ? undefined : new AbortController();
+      const timer =
+        controller === undefined
+          ? undefined
+          : setTimeout(() => controller.abort(), timeoutMs as number);
       try {
-        res = await fetch(url, { headers: this.headers });
+        res = await fetch(url, { headers: this.headers, signal: controller?.signal });
       } catch (cause) {
+        const timedOut = controller?.signal.aborted === true;
         if (retryCfg && attempt < maxAttempts) {
           const waitMs = computeBackoffMs(attempt, retryCfg);
           if (totalWaitedMs + waitMs <= retryCfg.maxTotalWaitMs) {
@@ -218,15 +262,23 @@ export class TridentClient {
             continue;
           }
         }
-        const err = new TridentError(
-          attempt > 1 ? "RETRY_EXHAUSTED" : "INTERNAL",
-          attempt > 1
-            ? `Network request failed after ${attempt} attempts`
-            : "Network request failed",
-          cause,
-        );
+        const err = timedOut
+          ? new TridentError(
+              "TIMEOUT",
+              `Request timed out after ${timeoutMs}ms${attempt > 1 ? ` on each of ${attempt} attempts` : ""}`,
+              cause,
+            )
+          : new TridentError(
+              attempt > 1 ? "RETRY_EXHAUSTED" : "INTERNAL",
+              attempt > 1
+                ? `Network request failed after ${attempt} attempts`
+                : "Network request failed",
+              cause,
+            );
         err.attempts = attempt;
         throw err;
+      } finally {
+        if (timer !== undefined) clearTimeout(timer);
       }
 
       if (!res.ok) {
@@ -300,7 +352,12 @@ export class TridentClient {
     if (params.eventType) qs.set("event_type", params.eventType);
 
     const url = `${this.config.apiUrl}/v1/events?${qs.toString()}`;
-    const resp = await this.fetchJSON(url, ApiListEventsResponseSchema, options?.retry);
+    const resp = await this.fetchJSON(
+      url,
+      ApiListEventsResponseSchema,
+      options?.retry,
+      options?.timeoutMs,
+    );
 
     return {
       events: resp.events.map(apiEventToSorobanEvent),
@@ -349,7 +406,7 @@ export class TridentClient {
 
     // REST transport (default)
     const url = `${this.config.apiUrl}/v1/events/${encodeURIComponent(params.id)}`;
-    const apiEvent = await this.fetchJSON(url, ApiEventSchema, options?.retry);
+    const apiEvent = await this.fetchJSON(url, ApiEventSchema, options?.retry, options?.timeoutMs);
     return apiEventToSorobanEvent(apiEvent);
   }
 
diff --git a/sdk/typescript/tests/timeout.test.ts b/sdk/typescript/tests/timeout.test.ts
new file mode 100644
index 00000000..3978131d
--- /dev/null
+++ b/sdk/typescript/tests/timeout.test.ts
@@ -0,0 +1,175 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { DEFAULT_TIMEOUT_MS, TridentClient, TridentError } from "../src/index.js";
+
+// Issue #520 follow-up: the explorer's move onto the SDK dropped a 30s
+// AbortController timeout, and the SDK had none of its own — `fetch` never
+// times out on its own, so a stalled API held callers open indefinitely and
+// the retry layer never saw a rejection to react to.
+
+const BASE_URL = "http://localhost:3000";
+const API_KEY = "test-key";
+
+const mockEvent = {
+  id: "00000000-0000-0000-0000-000000000001",
+  contract_id: "CTEST",
+  ledger_sequence: 100,
+  ledger_timestamp: "2024-01-01T00:00:00Z",
+  transaction_hash: "abc123",
+  event_index: 0,
+  event_type: "contract",
+  topics: ["transfer"],
+  data: '"null"',
+  created_at: "2024-01-01T00:00:00Z",
+};
+
+function jsonResponse(body: unknown, status = 200) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    headers: { get: () => null },
+    json: () => Promise.resolve(body),
+    text: () => Promise.resolve(JSON.stringify(body)),
+  };
+}
+
+/**
+ * A fetch that never settles until the caller's AbortSignal fires, then
+ * rejects the way a real runtime does. Without a timeout wired in, a request
+ * against this hangs forever — which is exactly the regression under test.
+ */
+function hangingFetch() {
+  return vi.fn((_url: string, init?: { signal?: AbortSignal }) => {
+    return new Promise((_resolve, reject) => {
+      const signal = init?.signal;
+      if (!signal) return; // no timeout wired: hang forever
+      if (signal.aborted) {
+        reject(Object.assign(new Error("aborted"), { name: "AbortError" }));
+        return;
+      }
+      signal.addEventListener("abort", () => {
+        reject(Object.assign(new Error("aborted"), { name: "AbortError" }));
+      });
+    });
+  });
+}
+
+function client(overrides: Record<string, unknown> = {}) {
+  return new TridentClient({
+    apiUrl: BASE_URL,
+    apiKey: API_KEY,
+    network: "testnet",
+    retry: false,
+    ...overrides,
+  });
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.useRealTimers();
+});
+
+describe("request timeout", () => {
+  it("aborts a hung request and reports TIMEOUT rather than hanging", async () => {
+    const fetchMock = hangingFetch();
+    vi.stubGlobal("fetch", fetchMock);
+
+    const err = await client({ timeoutMs: 20 })
+      .queryEvents({ contractId: "CTEST" })
+      .then(
+        () => null,
+        (e: unknown) => e,
+      );
+
+    expect(err).toBeInstanceOf(TridentError);
+    expect((err as TridentError).code).toBe("TIMEOUT");
+    expect((err as TridentError).message).toContain("20ms");
+  });
+
+  it("passes an AbortSignal to fetch by default", async () => {
+    const fetchMock = vi.fn(() =>
+      Promise.resolve(jsonResponse({ events: [mockEvent], next_cursor: null, has_more: false })),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    await client().queryEvents({ contractId: "CTEST" });
+
+    const init = fetchMock.mock.calls[0]?.[1] as { signal?: AbortSignal } | undefined;
+    expect(init?.signal).toBeInstanceOf(AbortSignal);
+    expect(init?.signal?.aborted).toBe(false);
+  });
+
+  it("omits the signal when the timeout is disabled", async () => {
+    const fetchMock = vi.fn(() =>
+      Promise.resolve(jsonResponse({ events: [mockEvent], next_cursor: null, has_more: false })),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    await client({ timeoutMs: false }).queryEvents({ contractId: "CTEST" });
+
+    const init = fetchMock.mock.calls[0]?.[1] as { signal?: AbortSignal } | undefined;
+    expect(init?.signal).toBeUndefined();
+  });
+
+  it("lets a per-call timeout override the client default", async () => {
+    const fetchMock = hangingFetch();
+    vi.stubGlobal("fetch", fetchMock);
+
+    const err = await client({ timeoutMs: 50_000 })
+      .queryEvents({ contractId: "CTEST" }, { timeoutMs: 15 })
+      .then(
+        () => null,
+        (e: unknown) => e,
+      );
+
+    expect((err as TridentError).code).toBe("TIMEOUT");
+    expect((err as TridentError).message).toContain("15ms");
+  });
+
+  it("gives each retry attempt a fresh signal instead of reusing an aborted one", async () => {
+    const fetchMock = hangingFetch();
+    vi.stubGlobal("fetch", fetchMock);
+
+    const err = await client({
+      timeoutMs: 10,
+      retry: { maxAttempts: 3, initialDelayMs: 1, maxDelayMs: 2, maxTotalWaitMs: 1_000 },
+    })
+      .queryEvents({ contractId: "CTEST" })
+      .then(
+        () => null,
+        (e: unknown) => e,
+      );
+
+    expect((err as TridentError).code).toBe("TIMEOUT");
+    expect(fetchMock).toHaveBeenCalledTimes(3);
+    // Each attempt must carry its own controller — a reused aborted signal
+    // would make attempts 2 and 3 fail instantly rather than being retried.
+    const signals = fetchMock.mock.calls.map(
+      (c) => (c[1] as { signal?: AbortSignal } | undefined)?.signal,
+    );
+    expect(new Set(signals).size).toBe(3);
+  });
+
+  it("does not time out a request that responds in time", async () => {
+    const fetchMock = vi.fn(() =>
+      Promise.resolve(jsonResponse({ events: [mockEvent], next_cursor: null, has_more: false })),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    const page = await client({ timeoutMs: 5_000 }).queryEvents({ contractId: "CTEST" });
+    expect(page.events).toHaveLength(1);
+  });
+
+  it("rejects a nonsensical timeout instead of aborting immediately", async () => {
+    const fetchMock = vi.fn(() => Promise.resolve(jsonResponse({ events: [], next_cursor: null, has_more: false })));
+    vi.stubGlobal("fetch", fetchMock);
+
+    await expect(
+      client({ timeoutMs: 0 }).queryEvents({ contractId: "CTEST" }),
+    ).rejects.toThrow(/positive number or false/);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("defaults to 30s", () => {
+    expect(DEFAULT_TIMEOUT_MS).toBe(30_000);
+  });
+});
diff --git a/services/api/handlers/apikeys_lifecycle_integration_test.go b/services/api/handlers/apikeys_lifecycle_integration_test.go
new file mode 100644
index 00000000..4de0866a
--- /dev/null
+++ b/services/api/handlers/apikeys_lifecycle_integration_test.go
@@ -0,0 +1,270 @@
+package handlers_test
+
+// Issue #516: API key lifecycle — issue, rotate, revoke, and audit.
+//
+// The "Done when" bar for #516 is that a key can be issued, rotated, and
+// revoked end to end, with revocation proven to take effect immediately —
+// including on the cached validation path (docs/runbooks/api-key-lifecycle.md
+// already documents this contract in detail). The handlers
+// (CreateAPIKey/ListAPIKeys/UpdateAPIKey/DeleteAPIKey in apikeys.go) and the
+// Redis-cache-aware auth middleware (NewDBAuth in middleware/auth.go) already
+// implement this correctly, but nothing exercised it end to end: there was no
+// test file for apikeys.go at all, and auth_test.go only covers the legacy
+// API_KEY_HASHES env-var path, a completely different code path from the
+// DB-backed api_keys table these handlers manage.
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Depo-dev/trident/services/api/handlers"
+	"github.com/Depo-dev/trident/services/api/middleware"
+	"github.com/redis/go-redis/v9"
+)
+
+const testLifecycleAdminKey = "test-admin-key-for-lifecycle-integration"
+
+func sha256Hex(s string) string {
+	h := sha256.Sum256([]byte(s))
+	return hex.EncodeToString(h[:])
+}
+
+// connectRealTestRedis mirrors connectRealTestDB's skip/hard-fail convention
+// (see usage_rollup_integration_test.go) for TEST_REDIS_URL, and
+// stream_integration_test.go's redis.ParseURL(TEST_REDIS_URL) convention for
+// the value's format (a full "redis://host:port" URL, not a bare address).
+func connectRealTestRedis(t *testing.T) *redis.Client {
+	t.Helper()
+	redisURL, ok := os.LookupEnv("TEST_REDIS_URL")
+	if !ok {
+		if os.Getenv("REQUIRE_TEST_SERVICES") != "" {
+			t.Fatal("TEST_REDIS_URL must be set when REQUIRE_TEST_SERVICES is set")
+		}
+		t.Skip("SKIP: TEST_REDIS_URL not set")
+	}
+
+	opts, err := redis.ParseURL(redisURL)
+	if err != nil {
+		t.Fatalf("parse TEST_REDIS_URL: %v", err)
+	}
+	client := redis.NewClient(opts)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	if err := client.Ping(ctx).Err(); err != nil {
+		t.Fatalf("connect TEST_REDIS_URL: %v", err)
+	}
+	t.Cleanup(func() { _ = client.Close() })
+	return client
+}
+
+func createKeyViaHandler(t *testing.T, cfg handlers.APIKeyConfig, body string) handlers.APIKeyResponse {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodPost, "/v1/api-keys", strings.NewReader(body))
+	req.Header.Set("X-Admin-Key", testLifecycleAdminKey)
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+
+	handlers.CreateAPIKey(cfg).ServeHTTP(rec, req)
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("create key: status %d, body %s", rec.Code, rec.Body.String())
+	}
+
+	var resp handlers.APIKeyResponse
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode create response: %v", err)
+	}
+	if resp.Key == nil {
+		t.Fatal("create response missing plaintext key")
+	}
+	return resp
+}
+
+func authenticateWith(cfg middleware.DBAuthConfig, key string) int {
+	handler := middleware.NewDBAuth(cfg)(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	req := httptest.NewRequest(http.MethodGet, "/v1/events", nil)
+	req.Header.Set("X-API-Key", key)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	return rec.Code
+}
+
+// TestAPIKeyLifecycle_IssueAuthenticateRevokeIsImmediate is the acceptance
+// test for #516: issues a key, uses it to authenticate (which populates the
+// Redis cache), revokes it, then authenticates again with the SAME key and
+// requires an immediate rejection — not "eventually, after the cache TTL".
+func TestAPIKeyLifecycle_IssueAuthenticateRevokeIsImmediate(t *testing.T) {
+	pool := connectRealTestDB(t)
+	rdb := connectRealTestRedis(t)
+	ctx := context.Background()
+
+	cfg := handlers.APIKeyConfig{AdminKey: testLifecycleAdminKey, DB: pool, Redis: rdb}
+	authCfg := middleware.DBAuthConfig{DB: pool, Redis: rdb}
+
+	created := createKeyViaHandler(t, cfg,
+		`{"label":"lifecycle-test","network":"testnet","rate_limit_tier":"standard","created_by":"integration-test"}`)
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM api_keys WHERE id = $1`, created.ID)
+	})
+
+	// 1. A freshly issued key authenticates successfully.
+	if code := authenticateWith(authCfg, *created.Key); code != http.StatusNoContent {
+		t.Fatalf("fresh key: got status %d, want %d", code, http.StatusNoContent)
+	}
+
+	// 2. That first successful auth populated the Redis cache — confirm it's
+	// actually there, so the revocation check below is genuinely proving
+	// cache invalidation and not just an empty cache that would pass anyway.
+	dbHash := sha256Hex(*created.Key)
+	cachedVal, err := rdb.Get(ctx, "apiauth:"+dbHash).Result()
+	if err != nil {
+		t.Fatalf("expected auth cache entry to exist after a successful auth, got error: %v", err)
+	}
+	if cachedVal == "" {
+		t.Fatal("expected a non-empty cached auth entry")
+	}
+
+	// 3. Revoke the key via the same DeleteAPIKey handler an admin would use.
+	req := httptest.NewRequest(http.MethodDelete, "/v1/api-keys/"+created.ID, nil)
+	req.SetPathValue("id", created.ID)
+	req.Header.Set("X-Admin-Key", testLifecycleAdminKey)
+	rec := httptest.NewRecorder()
+	handlers.DeleteAPIKey(cfg).ServeHTTP(rec, req)
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("revoke: status %d, body %s", rec.Code, rec.Body.String())
+	}
+
+	// 4. The Redis cache entry must be gone immediately — this is the
+	// concrete mechanism that makes revocation immediate rather than
+	// TTL-bound (authCacheTTL is 5 minutes; this test must not need to wait
+	// anywhere near that long).
+	if _, err := rdb.Get(ctx, "apiauth:"+dbHash).Result(); err != redis.Nil {
+		t.Fatalf("expected auth cache entry to be evicted immediately on revocation, got err=%v", err)
+	}
+
+	// 5. Authenticating with the SAME plaintext key immediately after
+	// revocation must fail — this is the actual end-to-end proof the issue
+	// asks for: no window where a revoked key still works because of a
+	// stale cache entry.
+	if code := authenticateWith(authCfg, *created.Key); code != http.StatusUnauthorized {
+		t.Fatalf("revoked key: got status %d, want %d (revocation was not immediate)", code, http.StatusUnauthorized)
+	}
+
+	// 6. Revoking an already-revoked key is a clean 404, not a silent
+	// success or a 500 — DeleteAPIKey's UPDATE ... WHERE revoked_at IS NULL
+	// only matches an active key.
+	rec2 := httptest.NewRecorder()
+	handlers.DeleteAPIKey(cfg).ServeHTTP(rec2, req)
+	if rec2.Code != http.StatusNotFound {
+		t.Fatalf("double revoke: got status %d, want %d", rec2.Code, http.StatusNotFound)
+	}
+}
+
+// TestAPIKeyLifecycle_RotationOverlapWindow proves the documented rotation
+// procedure: creating a new key does not touch the old one, so both remain
+// valid simultaneously during an overlap window, and only revoking the old
+// key at the end of that window cuts it off — while the new key is
+// unaffected throughout.
+func TestAPIKeyLifecycle_RotationOverlapWindow(t *testing.T) {
+	pool := connectRealTestDB(t)
+	rdb := connectRealTestRedis(t)
+
+	cfg := handlers.APIKeyConfig{AdminKey: testLifecycleAdminKey, DB: pool, Redis: rdb}
+	authCfg := middleware.DBAuthConfig{DB: pool, Redis: rdb}
+
+	oldKey := createKeyViaHandler(t, cfg,
+		`{"label":"rotation-old","network":"testnet","rate_limit_tier":"standard"}`)
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM api_keys WHERE id = $1`, oldKey.ID)
+	})
+
+	// Rotate: issue the new key BEFORE revoking the old one.
+	newKey := createKeyViaHandler(t, cfg,
+		`{"label":"rotation-new","network":"testnet","rate_limit_tier":"standard"}`)
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM api_keys WHERE id = $1`, newKey.ID)
+	})
+
+	// Overlap window: BOTH keys authenticate successfully.
+	if code := authenticateWith(authCfg, *oldKey.Key); code != http.StatusNoContent {
+		t.Fatalf("old key during overlap: got status %d, want %d", code, http.StatusNoContent)
+	}
+	if code := authenticateWith(authCfg, *newKey.Key); code != http.StatusNoContent {
+		t.Fatalf("new key during overlap: got status %d, want %d", code, http.StatusNoContent)
+	}
+
+	// End the overlap window: revoke only the old key.
+	req := httptest.NewRequest(http.MethodDelete, "/v1/api-keys/"+oldKey.ID, nil)
+	req.SetPathValue("id", oldKey.ID)
+	req.Header.Set("X-Admin-Key", testLifecycleAdminKey)
+	rec := httptest.NewRecorder()
+	handlers.DeleteAPIKey(cfg).ServeHTTP(rec, req)
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("revoke old key: status %d", rec.Code)
+	}
+
+	// Old key is now rejected...
+	if code := authenticateWith(authCfg, *oldKey.Key); code != http.StatusUnauthorized {
+		t.Fatalf("old key after cutover: got status %d, want %d", code, http.StatusUnauthorized)
+	}
+	// ...but the new key is completely unaffected by the old key's revocation.
+	if code := authenticateWith(authCfg, *newKey.Key); code != http.StatusNoContent {
+		t.Fatalf("new key after old-key revocation: got status %d, want %d (rotation leaked into an unrelated key)", code, http.StatusNoContent)
+	}
+}
+
+// TestAPIKeyLifecycle_AuditTrailRecordsUsage proves the "key usage is
+// auditable: who used which key, when" criterion. This writes the
+// audit_log row directly (matching how the real audit middleware attributes
+// a request via WithAuditAPIKeyID(ctx)) to keep this test focused on the
+// query surface an operator actually runs during an incident — see
+// api-key-lifecycle.md's "Suspected or confirmed compromise" section —
+// rather than re-testing the audit middleware itself, which has its own
+// coverage in middleware/audit_test.go.
+func TestAPIKeyLifecycle_AuditTrailRecordsUsage(t *testing.T) {
+	pool := connectRealTestDB(t)
+	ctx := context.Background()
+
+	cfg := handlers.APIKeyConfig{AdminKey: testLifecycleAdminKey, DB: pool}
+	created := createKeyViaHandler(t, cfg, `{"label":"audit-test","network":"testnet"}`)
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM audit_log WHERE api_key_id = $1`, created.ID)
+		_, _ = pool.Exec(context.Background(), `DELETE FROM api_keys WHERE id = $1`, created.ID)
+	})
+
+	_, err := pool.Exec(ctx,
+		`INSERT INTO audit_log (api_key_id, endpoint, method, status_code, duration_ms, request_id, ip, ts)
+		 VALUES ($1, '/v1/events', 'GET', 200, 12, 'lifecycle-audit-req-1', '203.0.113.5', NOW())`,
+		created.ID,
+	)
+	if err != nil {
+		t.Fatalf("insert audit_log row: %v", err)
+	}
+
+	var count int
+	var ip string
+	err = pool.QueryRow(ctx,
+		`SELECT COUNT(*), MAX(ip)::text FROM audit_log WHERE api_key_id = $1`, created.ID,
+	).Scan(&count, &ip)
+	if err != nil {
+		t.Fatalf("query audit_log: %v", err)
+	}
+	if count != 1 {
+		t.Fatalf("expected exactly 1 audit_log row for this key, got %d", count)
+	}
+	// Postgres renders a single-address INET as text with a /32 (IPv4) or
+	// /128 (IPv6) suffix — expected, not a bug in the audit write path.
+	if ip != "203.0.113.5/32" {
+		t.Fatalf("expected audit_log to record the requesting IP, got %q", ip)
+	}
+}
diff --git a/services/api/handlers/stream_integration_test.go b/services/api/handlers/stream_integration_test.go
index 2961814a..715c0edc 100644
--- a/services/api/handlers/stream_integration_test.go
+++ b/services/api/handlers/stream_integration_test.go
@@ -52,7 +52,7 @@ func TestStreamIntegration(t *testing.T) {
 	defer server.Close()
 
 	t.Run("forwards three events with SSE headers", func(t *testing.T) {
-		contractID := fmt.Sprintf("C-INTEGRATION-%d", time.Now().UnixNano())
+		contractID := uniqueTestContractID(t)
 		response, stop := connectSSE(t, server.URL, apiKey, contractID, "")
 		defer stop()
 
@@ -84,7 +84,7 @@ func TestStreamIntegration(t *testing.T) {
 	})
 
 	t.Run("filters topic0", func(t *testing.T) {
-		contractID := fmt.Sprintf("C-FILTER-%d", time.Now().UnixNano())
+		contractID := uniqueTestContractID(t)
 		response, stop := connectSSE(t, server.URL, apiKey, contractID, "wanted")
 		defer stop()
 
@@ -98,6 +98,37 @@ func TestStreamIntegration(t *testing.T) {
 	})
 }
 
+// uniqueTestContractID builds a contract id that is both unique per subtest
+// (so concurrent runs don't read each other's Redis stream) and a structurally
+// valid Stellar strkey: "C" followed by 55 base32 [A-Z2-7] characters.
+//
+// The previous "C-INTEGRATION-<nanos>" form predates the strict input
+// validation on this endpoint and is rejected with 400 — which went unnoticed
+// because this whole test skips unless TEST_REDIS_URL is set, and no CI job
+// set it.
+func uniqueTestContractID(t *testing.T) string {
+	t.Helper()
+
+	const base32Alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"
+	var sb strings.Builder
+	sb.WriteByte('C')
+	n := uint64(time.Now().UnixNano())
+	for i := 0; i < 55; i++ {
+		sb.WriteByte(base32Alphabet[n%32])
+		// Re-seed once the entropy runs out so the tail isn't a constant run.
+		if n < 32 {
+			n = uint64(time.Now().UnixNano()) + uint64(i)
+		}
+		n /= 32
+	}
+
+	id := sb.String()
+	if len(id) != 56 {
+		t.Fatalf("generated contract id has length %d, want 56: %q", len(id), id)
+	}
+	return id
+}
+
 func connectSSE(t *testing.T, baseURL, apiKey, contractID, topic0 string) (*http.Response, context.CancelFunc) {
 	t.Helper()