@@ -261,7 +261,15 @@ export interface WalletBalance {
     /** Recoverable balance from subdust or expired (swept) virtual outputs. */
     recoverable: number;
 
-    /** Total balance across offchain, recoverable, and boarding funds. */
+    /**
+     * Funds under a now-deprecated signer past its cutoff (EXPIRED) that have not
+     * yet been swept by the server. NOT spendable until they recover, so excluded
+     * from `available`/`settled`/`preconfirmed` and from coin selection — but
+     * still the wallet's funds, so counted in `total`.
+     */
+    pendingRecovery: number;
+
+    /** Total balance across offchain, recoverable, pending-recovery, and boarding funds. */
     total: number;
 
     /** Asset balance entries (`assetId` & `amount`) */
 
@@ -1317,9 +1317,12 @@ export class WalletMessageHandler
     }
 
     private async handleGetBalance() {
-        const [boardingUtxos, allVtxos] = await Promise.all([
+        const [boardingUtxos, allVtxos, pendingOutpoints] = await Promise.all([
             this.getAllBoardingUtxos(),
             this.getVtxosFromRepo(),
+            this.readonlyWallet
+                ? this.readonlyWallet.pendingRecoveryOutpoints()
+                : Promise.resolve(new Set<string>()),
         ]);
 
         // boarding
@@ -1340,8 +1343,13 @@ export class WalletMessageHandler
         let settled = 0;
         let preconfirmed = 0;
         let recoverable = 0;
+        let pendingRecovery = 0;
+        // Past-cutoff (EXPIRED) deprecated-signer funds not yet swept are NOT
+        // spendable — bucket them under pendingRecovery, out of settled/preconfirmed.
         for (const vtxo of spendableVtxos) {
-            if (vtxo.virtualStatus.state === "settled") {
+            if (pendingOutpoints.has(`${vtxo.txid}:${vtxo.vout}`)) {
+                pendingRecovery += vtxo.value;
+            } else if (vtxo.virtualStatus.state === "settled") {
                 settled += vtxo.value;
             } else if (vtxo.virtualStatus.state === "preconfirmed") {
                 preconfirmed += vtxo.value;
@@ -1354,7 +1362,7 @@ export class WalletMessageHandler
         }
 
         const totalBoarding = confirmed + unconfirmed;
-        const totalOffchain = settled + preconfirmed + recoverable;
+        const totalOffchain = settled + preconfirmed + recoverable + pendingRecovery;
 
         // aggregate asset balances from spendable virtual outputs
         const assetBalances = new Map<string, bigint>();
@@ -1381,6 +1389,7 @@ export class WalletMessageHandler
             preconfirmed,
             available: settled + preconfirmed,
             recoverable,
+            pendingRecovery,
             total: totalBoarding + totalOffchain,
             assets,
         };
 
@@ -8,6 +8,7 @@ import {
     isSpendable,
     isSubdust,
     Outpoint,
+    VirtualCoin,
 } from ".";
 import { ArkInfo, ArkProvider, SettlementEvent } from "../providers/ark";
 import { maybeArkError } from "../providers/errors";
@@ -34,6 +35,41 @@ import type { Network } from "../networks";
 import type { DefaultVtxo } from "../script/default";
 import { getDustAmount } from "./utils";
 
+/**
+ * Outpoints (`txid:vout`) of VTXOs that are NOT cooperatively spendable because
+ * their contract's signer is past its cutoff (`EXPIRED`) and the VTXO has not
+ * yet been swept by the server. Such funds are unspendable until they recover
+ * (the server sweeps the batch at expiry, then the swept output re-settles under
+ * the active signer), so `getBalance` buckets them under `pendingRecovery` and
+ * coin selection skips them — otherwise a send would pick a VTXO the operator
+ * will not co-sign and fail at submit.
+ *
+ * Pure + offline: classification uses a cached {@link SignerSet}, never a fresh
+ * GetInfo. `MIGRATABLE` / `DUE_NOW` (still cooperatively spendable), already-
+ * swept (recoverable), `CURRENT`, and `UNKNOWN_SIGNER` rows are all left alone.
+ */
+export function selectPendingRecoveryOutpoints(
+    contractsWithVtxos: ReadonlyArray<{
+        contract: { params: { serverPubKey?: string } };
+        vtxos: ReadonlyArray<VirtualCoin>;
+    }>,
+    signerSet: SignerSet,
+    nowSeconds: number = Math.floor(Date.now() / 1000),
+): Set<string> {
+    const out = new Set<string>();
+    for (const { contract, vtxos } of contractsWithVtxos) {
+        const serverPubKey = contract.params.serverPubKey;
+        if (!serverPubKey) continue;
+        if (classifyAgainstSignerSet(serverPubKey, signerSet, nowSeconds).status !== "EXPIRED") {
+            continue;
+        }
+        for (const v of vtxos) {
+            if (isSpendable(v) && !isRecoverable(v)) out.add(`${v.txid}:${v.vout}`);
+        }
+    }
+    return out;
+}
+
 /**
  * Extended wallet interface for boarding input sweep operations.
  * These properties exist on the concrete Wallet class but not on IWallet.
 
@@ -63,6 +63,7 @@ import {
     MAX_VTXOS_PER_SETTLEMENT,
     SettlementConfig,
     VtxoManager,
+    selectPendingRecoveryOutpoints,
 } from "./vtxo-manager";
 import { ArkNote } from "../arknote";
 import { Intent } from "../intent";
@@ -392,25 +393,30 @@ export class ReadonlyWallet implements IReadonlyWallet {
      * current-signer-only (a deprecated-signer input in a plain settle() is
      * rejected; old-signer recovery goes through the migration API).
      */
-    protected _deprecatedSignerHexes: Set<string> = new Set();
+    protected _deprecatedSigners: Map<string, bigint> = new Map();
 
     /**
      * Refresh the cached deprecated-signer set from a fresh server-info
      * snapshot. Called by the create() factories at construction and by the
      * server-info-change handler mid-session. Lenient: a malformed deprecated
      * entry is skipped, never fatal to wallet creation.
      */
-    refreshDeprecatedSigners(info: { deprecatedSigners?: readonly { pubkey?: string }[] }): void {
-        const set = new Set<string>();
+    refreshDeprecatedSigners(info: {
+        deprecatedSigners?: readonly { pubkey?: string; cutoffDate?: bigint }[];
+    }): void {
+        const next = new Map<string, bigint>();
         for (const s of info.deprecatedSigners ?? []) {
             if (!s.pubkey) continue;
             try {
-                set.add(toXOnlySignerHex(s.pubkey));
+                // `0n` is arkd's sentinel for "no cutoff advertised" (→ DUE_NOW);
+                // a positive cutoff that has already passed is EXPIRED. The
+                // spendability split in getBalance / coin selection reads this.
+                next.set(toXOnlySignerHex(s.pubkey), s.cutoffDate ?? 0n);
             } catch (e) {
                 console.warn("Skipping malformed deprecated signer pubkey", s.pubkey, e);
             }
         }
-        this._deprecatedSignerHexes = set;
+        this._deprecatedSigners = next;
     }
 
     /**
@@ -421,7 +427,7 @@ export class ReadonlyWallet implements IReadonlyWallet {
     protected watchedBoardingSigners(): Set<string> {
         return new Set([
             toXOnlySignerHex(hex.encode(this.boardingTapscript.options.serverPubKey)),
-            ...this._deprecatedSignerHexes,
+            ...this._deprecatedSigners.keys(),
         ]);
     }
 
@@ -719,10 +725,13 @@ export class ReadonlyWallet implements IReadonlyWallet {
      * Return the wallet's combined onchain and offchain balances.
      */
     async getBalance(): Promise<WalletBalance> {
-        const [boardingUtxos, vtxos] = await Promise.all([
+        const [boardingUtxos, vtxos, pendingOutpoints] = await Promise.all([
             this.getBoardingUtxos(),
             this.getVtxos(),
+            this.pendingRecoveryOutpoints(),
         ]);
+        const isPendingRecovery = (coin: ExtendedVirtualCoin) =>
+            pendingOutpoints.has(`${coin.txid}:${coin.vout}`);
 
         // boarding
         let confirmed = 0;
@@ -739,18 +748,27 @@ export class ReadonlyWallet implements IReadonlyWallet {
         let settled = 0;
         let preconfirmed = 0;
         let recoverable = 0;
+        let pendingRecovery = 0;
+        // Funds under a past-cutoff (EXPIRED) deprecated signer that are not yet
+        // swept are NOT spendable — excluded from settled/preconfirmed/available
+        // and surfaced under `pendingRecovery` (they still count toward `total`).
         settled = vtxos
-            .filter((coin) => coin.virtualStatus.state === "settled")
+            .filter((coin) => coin.virtualStatus.state === "settled" && !isPendingRecovery(coin))
             .reduce((sum, coin) => sum + coin.value, 0);
         preconfirmed = vtxos
-            .filter((coin) => coin.virtualStatus.state === "preconfirmed")
+            .filter(
+                (coin) => coin.virtualStatus.state === "preconfirmed" && !isPendingRecovery(coin),
+            )
             .reduce((sum, coin) => sum + coin.value, 0);
         recoverable = vtxos
             .filter((coin) => isSpendable(coin) && coin.virtualStatus.state === "swept")
             .reduce((sum, coin) => sum + coin.value, 0);
+        pendingRecovery = vtxos
+            .filter(isPendingRecovery)
+            .reduce((sum, coin) => sum + coin.value, 0);
 
         const totalBoarding = confirmed + unconfirmed;
-        const totalOffchain = settled + preconfirmed + recoverable;
+        const totalOffchain = settled + preconfirmed + recoverable + pendingRecovery;
 
         // aggregate asset balances from spendable virtual outputs
         const assetBalances = new Map<string, bigint>();
@@ -778,6 +796,7 @@ export class ReadonlyWallet implements IReadonlyWallet {
             preconfirmed,
             available: settled + preconfirmed,
             recoverable,
+            pendingRecovery,
             total: totalBoarding + totalOffchain,
             assets,
         };
@@ -809,6 +828,24 @@ export class ReadonlyWallet implements IReadonlyWallet {
             });
     }
 
+    /**
+     * Outpoints of VTXOs whose deprecated signer is past its cutoff (EXPIRED) and
+     * which have not yet been swept — unspendable until they recover. Offline:
+     * classifies the repo's contracts against the cached signer set (active +
+     * {@link _deprecatedSigners}, cutoffs included). Empty fast-path when no
+     * signer is deprecated. Consumed by {@link getBalance} (the `pendingRecovery`
+     * bucket) and the send coin-selection path so neither counts nor spends them.
+     */
+    async pendingRecoveryOutpoints(): Promise<Set<string>> {
+        if (this._deprecatedSigners.size === 0) return new Set();
+        const contractManager = await this.getContractManager();
+        const contractsWithVtxos = await contractManager.getContractsWithVtxos();
+        return selectPendingRecoveryOutpoints(contractsWithVtxos, {
+            active: toXOnlySignerHex(hex.encode(this.offchainTapscript.options.serverPubKey)),
+            deprecated: this._deprecatedSigners,
+        });
+    }
+
     /**
      * Return wallet transaction history derived from Arkade state and boarding transactions.
      */
@@ -2421,10 +2458,10 @@ export class Wallet extends ReadonlyWallet implements IWallet {
             this.watcherConfig,
             this.walletContractTimelocks,
         );
-        // Carry the cached deprecated-signer set so the clone's boarding watch
-        // path stays as wide as the source wallet's (same operator/info).
-        (readonly as unknown as { _deprecatedSignerHexes: Set<string> })._deprecatedSignerHexes =
-            new Set(this._deprecatedSignerHexes);
+        // Carry the cached deprecated-signer set (with cutoffs) so the clone's
+        // boarding watch path and spendability split match the source wallet's.
+        (readonly as unknown as { _deprecatedSigners: Map<string, bigint> })._deprecatedSigners =
+            new Map(this._deprecatedSigners);
         return readonly;
     }
 
@@ -3490,9 +3527,15 @@ export class Wallet extends ReadonlyWallet implements IWallet {
         // validate recipients and populate undefined amount with dust amount
         const recipients = validateRecipients(args, Number(this.dustAmount));
 
-        const virtualCoins = await this.getVtxos({
+        const allVirtualCoins = await this.getVtxos({
             withRecoverable: false,
         });
+        // Drop funds under a past-cutoff (EXPIRED) deprecated signer: the operator
+        // will not co-sign a spend of them, so selecting one would fail at submit.
+        const pendingRecovery = await this.pendingRecoveryOutpoints();
+        const virtualCoins = pendingRecovery.size
+            ? allVirtualCoins.filter((c) => !pendingRecovery.has(`${c.txid}:${c.vout}`))
+            : allVirtualCoins;
 
         // keep track of asset changes
         const assetChanges = new Map<string, bigint>();
 
@@ -0,0 +1,55 @@
+import { describe, it, expect } from "vitest";
+import { selectPendingRecoveryOutpoints } from "../src/wallet/vtxo-manager";
+import type { SignerSet } from "../src/wallet/signerRotation";
+
+const NOW = 1_700_000_000;
+const ACTIVE = "aa".repeat(32);
+const EXPIRED_SIGNER = "bb".repeat(32);
+const MIGRATABLE_SIGNER = "cc".repeat(32);
+const DUE_NOW_SIGNER = "dd".repeat(32);
+const UNKNOWN_SIGNER = "ee".repeat(32);
+
+const signerSet: SignerSet = {
+    active: ACTIVE,
+    deprecated: new Map([
+        [EXPIRED_SIGNER, BigInt(NOW - 100)], // cutoff passed → EXPIRED
+        [MIGRATABLE_SIGNER, BigInt(NOW + 10_000)], // cutoff ahead → MIGRATABLE
+        [DUE_NOW_SIGNER, 0n], // no cutoff → DUE_NOW
+    ]),
+};
+
+// Minimal VirtualCoin-shaped stub: selectPendingRecoveryOutpoints only reads
+// txid/vout (outpoint), isSpent (isSpendable), and virtualStatus.state (swept).
+const vtxo = (txid: string, vout: number, state: string, isSpent = false) =>
+    ({ txid, vout, value: 1000, isSpent, virtualStatus: { state } }) as never;
+
+const row = (serverPubKey: string, vtxos: unknown[]) =>
+    ({ contract: { params: { serverPubKey } }, vtxos }) as never;
+
+describe("selectPendingRecoveryOutpoints", () => {
+    it("returns only EXPIRED-signer VTXOs that are spendable but not yet swept", () => {
+        const out = selectPendingRecoveryOutpoints(
+            [
+                row(ACTIVE, [vtxo("active", 0, "settled")]), // CURRENT → no
+                row(EXPIRED_SIGNER, [vtxo("exp-settled", 0, "settled")]), // EXPIRED awaiting sweep → YES
+                row(EXPIRED_SIGNER, [vtxo("exp-swept", 0, "swept")]), // EXPIRED swept → no (recoverable)
+                row(EXPIRED_SIGNER, [vtxo("exp-spent", 1, "settled", true)]), // spent → no (!spendable)
+                row(MIGRATABLE_SIGNER, [vtxo("mig", 0, "settled")]), // MIGRATABLE → still spendable
+                row(DUE_NOW_SIGNER, [vtxo("due", 0, "settled")]), // DUE_NOW → still spendable
+                row(UNKNOWN_SIGNER, [vtxo("unk", 0, "settled")]), // UNKNOWN_SIGNER → untouched
+            ],
+            signerSet,
+            NOW,
+        );
+        expect([...out]).toEqual(["exp-settled:0"]);
+    });
+
+    it("is empty when there are no deprecated signers", () => {
+        const out = selectPendingRecoveryOutpoints(
+            [row(ACTIVE, [vtxo("a", 0, "settled")])],
+            { active: ACTIVE, deprecated: new Map() },
+            NOW,
+        );
+        expect(out.size).toBe(0);
+    });
+});
@@ -1389,6 +1389,7 @@ describe("WalletMessageHandler repo-backed reads", () => {
                 commitmentsToIgnore: new Set(),
             }),
             dustAmount: 546n,
+            pendingRecoveryOutpoints: vi.fn().mockResolvedValue(new Set<string>()),
             getContractManager: vi.fn().mockResolvedValue({
                 getContracts: vi.fn().mockResolvedValue(contracts),
                 onContractEvent: vi.fn().mockReturnValue(vi.fn()),
@@ -1490,6 +1491,43 @@ describe("WalletMessageHandler repo-backed reads", () => {
         });
     });
 
+    it("GET_BALANCE excludes pending-recovery (past-cutoff) VTXOs from available", async () => {
+        setupHandler();
+        const settled = createMockExtendedVtxo({
+            txid: "aa".repeat(32),
+            value: 100000,
+            virtualStatus: { state: "settled" },
+        });
+        const pendingExpired = createMockExtendedVtxo({
+            txid: "cc".repeat(32),
+            value: 70000,
+            virtualStatus: { state: "settled" },
+        });
+        await walletRepo.saveVtxos(TEST_DEFAULT_ARK_ADDRESS, [settled, pendingExpired]);
+
+        // The wallet reports the past-cutoff (EXPIRED) VTXO as pending recovery.
+        (updater as any).readonlyWallet.pendingRecoveryOutpoints = vi
+            .fn()
+            .mockResolvedValue(new Set([`${pendingExpired.txid}:${pendingExpired.vout}`]));
+
+        const response = await updater.handleMessage({
+            ...baseMessage(),
+            type: "GET_BALANCE",
+        } as any);
+
+        // Excluded from the spendable buckets, surfaced under pendingRecovery,
+        // still counted in total.
+        expect(response).toMatchObject({
+            type: "BALANCE",
+            payload: {
+                settled: 100000,
+                available: 100000,
+                pendingRecovery: 70000,
+                total: 170000,
+            },
+        });
+    });
+
     it("GET_TRANSACTION_HISTORY reads from repository, not indexer", async () => {
         setupHandler();
         const vtxo = createMockExtendedVtxo({