diff --git a/apps/machine/electron/main.ts b/apps/machine/electron/main.ts
index faedf2b..9107951 100644
--- a/apps/machine/electron/main.ts
+++ b/apps/machine/electron/main.ts
@@ -27,6 +27,7 @@ import {
   getBootstrapPublishedAt,
   markBootstrapPublished,
   resetBootstrapGate,
+  resetForRepair,
   applyOperatorCassettesConfig,
   getFeeConfig,
   getLastKnownFeeConfigCreatedAt,
@@ -355,6 +356,9 @@ ipcMain.handle('state:clear-bunker-binding', (): void => {
 ipcMain.handle('state:reset-bootstrap-gate', (): void => {
   resetBootstrapGate()
 })
+ipcMain.handle('state:reset-for-repair', (): void => {
+  resetForRepair()
+})
 
 // QR-pairing wizard (aiolabs/bitspire#52): an unpaired machine scans a
 // spire-seed off its camera, and we persist it as VITE_SPIRE_SEED in the
diff --git a/apps/machine/electron/preload.ts b/apps/machine/electron/preload.ts
index ba53b62..a811eab 100644
--- a/apps/machine/electron/preload.ts
+++ b/apps/machine/electron/preload.ts
@@ -118,6 +118,7 @@ contextBridge.exposeInMainWorld('electronAPI', {
     ipcRenderer.invoke('state:save-bunker-binding', binding),
   clearBunkerBinding: (): Promise<void> => ipcRenderer.invoke('state:clear-bunker-binding'),
   resetBootstrapGate: (): Promise<void> => ipcRenderer.invoke('state:reset-bootstrap-gate'),
+  resetForRepair: (): Promise<void> => ipcRenderer.invoke('state:reset-for-repair'),
 
   // QR-pairing wizard (aiolabs/bitspire#52): persist a scanned spire-seed,
   // then relaunch so the normal boot flow pairs it.
@@ -239,6 +240,7 @@ declare global {
       saveBunkerBinding: (binding: BunkerBindingRecord) => Promise<void>
       clearBunkerBinding: () => Promise<void>
       resetBootstrapGate: () => Promise<void>
+      resetForRepair: () => Promise<void>
       saveSpireSeed: (seed: string) => Promise<void>
       relaunchApp: () => Promise<void>
       applyOperatorCassettesConfig: (
diff --git a/apps/machine/electron/state-store.ts b/apps/machine/electron/state-store.ts
index 7ea3e16..a274565 100644
--- a/apps/machine/electron/state-store.ts
+++ b/apps/machine/electron/state-store.ts
@@ -540,6 +540,32 @@ export function resetBootstrapGate(): void {
   db.prepare('UPDATE meta SET value = ? WHERE key = ?').run('', 'bootstrapPublishedAt')
 }
 
+/**
+ * Wipe operator-scoped CONFIG/TRUST state on a re-pair to a new operator/backend,
+ * so stale policy from the previous pairing can't linger or silently reject the
+ * new operator's config.
+ *
+ * Clears the fee config and resets BOTH replay watermarks to 0. The watermark
+ * reset is the load-bearing part: without it, a new backend whose first config
+ * event has a lower `created_at` than the old operator's last event is silently
+ * dropped as a replay — the exact remnant trap where re-pairing a long-lived
+ * install to a fresh backend appears to "work" but never picks up new config.
+ *
+ * Deliberately does NOT touch cassettes / cashbox / transactions: those track
+ * PHYSICAL cash, which survives an operator handover. A full wipe (decommission
+ * or a truly-fresh test) is the factory-reset path, not this.
+ */
+export function resetForRepair(): void {
+  if (!db) throw new Error('Database not initialized')
+  const database = db
+  database.transaction(() => {
+    database.prepare('DELETE FROM fee_config').run()
+    const setWatermark = database.prepare('UPDATE meta SET value = ? WHERE key = ?')
+    setWatermark.run('0', 'lastKnownFeeConfigCreatedAt')
+    setWatermark.run('0', 'lastKnownConfigCreatedAt')
+  })()
+}
+
 export type OperatorCassettesPayload = {
   positions: Record<string, { denomination: number; count: number }>
 }
diff --git a/apps/machine/src/services/signer-resolver.ts b/apps/machine/src/services/signer-resolver.ts
index 2d29ab6..f830073 100644
--- a/apps/machine/src/services/signer-resolver.ts
+++ b/apps/machine/src/services/signer-resolver.ts
@@ -144,6 +144,15 @@ export async function resolveSigner(opts: ResolveSignerOptions): Promise<Resolve
       clientSecretHex: transport.secretHex,
     })
     if (isElectron && window.electronAPI) {
+      // Re-pair (a NEW seed replacing a prior binding) → wipe the previous
+      // operator's config/trust state (fee config + replay watermarks) so it
+      // can't linger or silently replay-block the new operator's config. A
+      // first pair (no prior binding) has nothing to reset. Cash accounting is
+      // preserved — see resetForRepair; a full wipe is the factory-reset path.
+      if (binding) {
+        console.log('[Signer] Re-pair (new seed fingerprint) — clearing prior operator config state')
+        await window.electronAPI.resetForRepair()
+      }
       // Persist the seed's transport config alongside the binding so a later
       // seedless resume still reaches the backend without env provisioning.
       await window.electronAPI.saveBunkerBinding({
diff --git a/apps/machine/src/types/electron.d.ts b/apps/machine/src/types/electron.d.ts
index bca4d0f..b018a39 100644
--- a/apps/machine/src/types/electron.d.ts
+++ b/apps/machine/src/types/electron.d.ts
@@ -98,6 +98,7 @@ declare global {
       saveBunkerBinding: (binding: BunkerBindingRecord) => Promise<void>
       clearBunkerBinding: () => Promise<void>
       resetBootstrapGate: () => Promise<void>
+      resetForRepair: () => Promise<void>
       saveSpireSeed: (seed: string) => Promise<void>
       relaunchApp: () => Promise<void>
       applyOperatorCassettesConfig: (