@optimystic/db-p2p 0.14.0 → 0.16.2

package/src/cohort-topic/host.ts

@@ -31,8 +31,9 @@
  * driver to call.
  *
  * **Anti-DoS + cold-start (gaps 6–7).** Each {@link CoordEngine} is injected its own per-coord anti-DoS
- * guards — a `RegisterRateLimiter` (4/min per peer-topic), a `CorrelationReplayGuard` (60 s freshness),
- * and a `TopicBudget` (2048 topics, LRU) — so a budget/limit at one coord is independent of another. The
+ * guards — a `RegisterRateLimiter` (4/min per peer-topic), a `CorrelationReplayGuard` (60 s freshness,
+ * hard `maxKeys` LRU cap), and a `TopicBudget` (2048 topics, LRU) — so a budget/limit at one coord is
+ * independent of another. The
  * node-level {@link BootstrapEvidence} policy (one tier→verifier policy, no per-coord state) is built once
  * and shared. db-core embeds no PoW / reputation scheme, so the host supplies the real verifiers
  * ({@link createPoWVerifier} / {@link createReputationVerifier}) and the participant-side PoW minter
@@ -42,8 +43,8 @@
  * backing keeps T0/T1 permissive-but-logged so cold-root origination is not blocked
  * (`cohort-topic-bootstrap-coldstart-origination-regression`), and an entirely unconfigured host stays
  * permissive-but-logged at every tier (never an undefined gate). A cold-started tier-`d > 0` forwarder registers with
- * its tier-`(d − 1)` parent by routing a forwarder-link frame over the router (gap 7), staying
- * `awaiting_parent` until the ack.
+ * its tier-`(d − 1)` parent by routing a (child-cohort-signed) {@link ChildLinkV1} over the router; the parent
+ * authenticates + records the child and acks, and the forwarder stays `awaiting_parent` until that `linked` ack.
  *
  * **Scope.** `followOn` derivation for a promoted-redirect arrival is parked in backlog
  * (`cohort-topic-followon-derivation`); this milestone serves a **single tier-0 cohort**, so `followOn`
@@ -76,6 +77,7 @@ import {
 	createLoadBarometer,
 	createTierAddressing,
 	createRegisterRateLimiter,
+	DEFAULT_RATE_WINDOW_MS,
 	createCorrelationReplayGuard,
 	createTopicBudget,
 	createBootstrapEvidence,
@@ -84,18 +86,19 @@ import {
 	DEFAULT_MIN_SIGS,
 	DEFAULT_MAX_NO_POW_TIER,
 	DEFAULT_TRAFFIC_WINDOW_SECONDS,
-	DEFAULT_TTL_MS,
 	bytesToB64url,
 	b64urlToBytes,
 	bytesEqual,
-	compareBytes,
 	encodeCohortMessage,
 	decodeCohortMessage,
+	decodeCohortGossipV1,
 	membershipCertSignable,
 	membershipCertSigningPayload,
 	toCohortTopicSummary,
 	validateRegisterV1,
 	validateRenewV1,
+	validateChildLinkV1,
+	validateChildLinkReplyV1,
 	validateSignRequestV1,
 	validateSignReplyV1,
 	validatePromotionNoticeV1,
@@ -105,8 +108,12 @@ import {
 	cohortGossipSigningPayload,
 	promotionNoticeSigningPayload,
 	demotionNoticeSigningPayload,
+	childLinkSigningPayload,
 	type BootstrapEvidence,
 	type BootstrapEvidenceDeps,
+	type ChildLinkRefV1,
+	type ChildLinkV1,
+	type ChildLinkReplyV1,
 	type CohortGossipV1,
 	type CohortGossipSignable,
 	type CohortTopicService,
@@ -144,11 +151,10 @@ import {
 	type IMembershipSource,
 	type TrustRoot,
 } from "@optimystic/db-core";
-import { randomBytes } from "@libp2p/crypto";
 import { peerIdFromString } from "@libp2p/peer-id";
 import { FretTopicRouter } from "./topic-router.js";
 import { FretCohortGossipTransport, type CohortPeerResolver } from "./cohort-gossip-transport.js";
-import { buildCohortGossip, createPendingDeltas, DEFAULT_GOSSIP_INTERVAL_MS } from "./cohort-gossip-driver.js";
+import { buildCohortGossip, createPendingDeltas, DEFAULT_GOSSIP_INTERVAL_MS, DEFAULT_WILLINGNESS_HEARTBEAT_MS } from "./cohort-gossip-driver.js";
 import { FretMembershipSource } from "./membership-source.js";
 import { FretMembershipPublishSink } from "./membership-publish-sink.js";
 import { FretCohortThresholdCrypto, createVerifyOnlyThresholdCrypto } from "./threshold-crypto.js";
@@ -185,6 +191,16 @@ export interface CohortTopicHostOptions {
 	 * self-gate on elapsed time, so a fast tick is safe.
 	 */
 	readonly gossipIntervalMs?: number;
+	/**
+	 * `T_willingness_heartbeat` (ms): how often a genuinely-**idle but willing** {@link CoordEngine}
+	 * re-broadcasts a willingness-only heartbeat so a cold cohort can bootstrap (siblings hear it, instantiate
+	 * their own engine, and reciprocate — §Cold-start instantiation). Default
+	 * {@link DEFAULT_WILLINGNESS_HEARTBEAT_MS} (~30 s). The first idle round after an engine is created emits
+	 * immediately regardless of this interval; a record-carrying round resets the clock, so this only paces the
+	 * steady-state re-broadcast of an idle willing cohort. Independent of {@link gossipIntervalMs} (the tick
+	 * cadence): the tick can fire fast while heartbeats stay throttled.
+	 */
+	readonly willingnessHeartbeatMs?: number;
 	/**
 	 * The node's libp2p Ed25519 private key. Required for the live participant signer: register/renew
 	 * bodies are peer-key-signed over their canonical image, and inbound register/`reattach` signatures
@@ -264,6 +280,15 @@ export interface CohortTopicAntiDosOptions {
 	readonly replayGuard?: CorrelationReplayGuardConfig;
 	/** Per-cohort forwarder-state budget. Default `topics_max = 2048`, LRU by participant count. */
 	readonly topicBudget?: TopicBudgetConfig;
+	/**
+	 * Hard cap on the number of live per-coord cohort engines this node keeps. The served coord is a hash
+	 * over attacker-chosen `(treeTier, participantCoord, topicId)`, and an engine is created **before** the
+	 * per-coord anti-DoS gates run, so without this cap one peer spraying distinct coords forces unbounded
+	 * engine allocation. On overflow the registry evicts the least-recently-used **idle** engine (no records,
+	 * no cold-start forwarder) and tears it down; if every slot holds a live cohort it refuses the new coord.
+	 * Default {@link DEFAULT_COORD_ENGINES_MAX}.
+	 */
+	readonly coordEnginesMax?: number;
 	/**
 	 * Bootstrap-evidence verifiers for cold-root instantiation. db-core embeds no PoW / reputation /
 	 * committed-work scheme; inject the real checks here. Any verifier supplied wins over the defaults
@@ -332,6 +357,13 @@ export interface CoordEngine {
 	cohortIdentityAt(epoch: Uint8Array): readonly string[] | undefined;
 	/** True iff this engine currently holds any registration record (a cold probe leaves it empty). */
 	hasState(): boolean;
+	/**
+	 * True iff this engine currently holds any cold-start forwarder (possibly `awaiting_parent`). Together
+	 * with {@link hasState}, this is the "engine is idle / safe to reclaim" predicate the coord-engine
+	 * registry's LRU eviction reads: an engine with neither a record nor a forwarder is a throwaway (an
+	 * attacker-sprayed cold coord), an engine with either holds genuine cohort state and is never evicted.
+	 */
+	hasForwarders(): boolean;
 	/** True iff this engine holds the record for `(topicId, participantId)` — the renewal lookup key. */
 	holds(topicId: Uint8Array, participantId: Uint8Array): boolean;
 	/**
@@ -348,9 +380,19 @@ export interface CoordEngine {
 	 * lagging at most one gossip round (it reflects the last frozen summaries, never raw mid-round counts).
 	 */
 	topicTraffic(topicId: Uint8Array): TopicTrafficV1;
+	/**
+	 * Record that an application-level query (matchmaking `QueryV1`, and any future genuine cohort query
+	 * such as the `AggregateCountV1` sweep) was served against `topicId` at `now`. Feeds `queriesPerMin`.
+	 * Pure passthrough to this engine's `TrafficCounters` — no store lookup, no instantiation. The counter
+	 * surfaces in {@link topicTraffic} only after the next {@link gossipRound} freezes it (lags ≤ one round,
+	 * exactly like the arrivals counter). Non-fatal / synchronous — a separate mutating accessor from the
+	 * pure-read {@link topicTraffic}; the two are never overloaded.
+	 */
+	recordQuery(topicId: Uint8Array, now: number): void;
 	/**
 	 * Publish a fresh threshold-signed `MembershipCertV1` on a cohort-membership-change / stabilization
-	 * event (republishes only when the first `k − x` members changed). Returns the cert if published.
+	 * event (republishes only when the cohort epoch — `H(sorted members)` — changed, i.e. on any member
+	 * change, head or tail). Returns the cert if published.
 	 * Resolves `undefined` if no republish was needed or the quorum was unreachable this round.
 	 */
 	onStabilized(now: number): Promise<MembershipCertV1 | undefined>;
@@ -394,6 +436,24 @@ export interface CoordEngine {
 	 * Exposes the parent-link lifecycle (`awaiting_parent` → `serving`) for the cold-start wiring (gap 7).
 	 */
 	forwarder(topicId: Uint8Array): Forwarder | undefined;
+	/**
+	 * Record a verified child cohort (served at `childCohortCoord`) as this cohort's child for `topicId`.
+	 * Freshness-ordered per child coord (a stale replay cannot flip a newer state) and idempotent (re-linking
+	 * an already-linked coord is a no-op). Driven by the parent-side child-link dispatch. See
+	 * {@link CoordEngine.childCohortCount}.
+	 */
+	recordChild(topicId: Uint8Array, childCohortCoord: Uint8Array, effectiveAt: number): void;
+	/**
+	 * Release a child cohort (served at `childCohortCoord`) this cohort parented — driven by the demoting
+	 * child's threshold-signed demotion notice fanned to the parent coord. Freshness-ordered per child coord
+	 * and idempotent (a stale/duplicate release is a no-op); unrecording a never-seen child writes a
+	 * `linked = false` tombstone (never a negative count) so a later stale link cannot resurrect it. The child
+	 * set converges across the parent cohort via gossip, so once the last child is released the parent's
+	 * `childCohortCount` falls to 0 and it can demote in turn. See {@link CoordEngine.childCohortCount}.
+	 */
+	unrecordChild(topicId: Uint8Array, childCohortCoord: Uint8Array, effectiveAt: number): void;
+	/** Count of distinct linked child cohorts this engine parents for `topicId` (the demotion-gate input). */
+	childCohortCount(topicId: Uint8Array): number;
 	/** Whether `topicId` is in promoted mode here — reflects both locally-originated and remotely-applied state. */
 	isPromoted(topicId: Uint8Array): boolean;
 	/** Adopt a verified promotion notice into this cohort's local state (see {@link NoticeApplyTarget}). */
@@ -411,6 +471,12 @@ export interface CoordRegistry {
 	 * `participantCoord` seed a freshly-created engine's coord-derived tier inputs (ignored if the
 	 * engine already exists). Synchronous, so concurrent activity callbacks for the same coord share
 	 * one engine without a second being constructed.
+	 *
+	 * **Capacity.** The registry is hard-capped (see {@link CohortTopicAntiDosOptions.coordEnginesMax}). A
+	 * lookup that returns an already-resident engine always succeeds. A *creation* over a full registry
+	 * first evicts the least-recently-used idle engine; when every slot holds a live cohort it throws
+	 * {@link CoordEngineRegistryFullError} rather than growing unbounded — callers on the register /
+	 * child-link / cold-sibling paths catch it and answer a clean capacity refusal.
 	 */
 	forCoord(coord: RingCoord, treeTier: number, participantCoord: Uint8Array): CoordEngine;
 	/** The engine holding the record for `(topicId, participantId)`, or `undefined` (renewal dispatch). */
@@ -423,10 +489,16 @@ export interface CoordRegistry {
 	 */
 	findByCoord(coord: RingCoord): CoordEngine | undefined;
 	/**
-	 * The engine serving `topicId` at `treeTier`, or `undefined` (inbound promote/demote notice dispatch).
-	 * A served coord embeds `(tier, topic)`, so at most one engine matches — the cohort the notice's
-	 * signers belong to. `undefined` means this node serves no such cohort (e.g. a demotion arriving at a
-	 * parent that does not track the child), so the notice is dropped rather than applied.
+	 * The **first** engine serving `topicId` at `treeTier`, or `undefined`. Used by the tier-0 read paths —
+	 * matchmaking query serve and the reactivity direct-subscriber lookup — that resolve a served engine by
+	 * `(topic, tier)` rather than by an exact coord.
+	 *
+	 * **First-match caveat.** At `d ≥ 1` a node can serve several sibling cohorts for one `(topic, tier)` under
+	 * distinct served coords, and this returns whichever iterates first — exact at the single-cohort / tier-0
+	 * milestone, but not a coord-precise lookup. The promote/demote notice path deliberately does **not** use
+	 * this: it routes by the notice's signed `cohortCoord` via {@link findByCoord} so a multi-cohort node
+	 * applies each notice to the cohort that produced it. Reconciling these tier-0 readers with multi-cohort
+	 * serving is follow-on work (`cohort-topic-followon-derivation`).
 	 */
 	findServing(topicId: Uint8Array, treeTier: number): CoordEngine | undefined;
 	/** Every live engine (stop + sweep). */
@@ -460,6 +532,13 @@ export interface CohortTopicHost {
 	 * limiter's `size` and the `highWater` `LruMap` — and so the gossip-cadence sweep wiring is observable.
 	 */
 	readonly promoteGate: PromoteGate;
+	/**
+	 * The node's local membership-cert cache. Exposed for test/diagnostic introspection: seed an entry via
+	 * `cache(coord, encoded)` to prime the verifier's stale-refetch path over the real `/membership` protocol
+	 * without marking it trusted (unlike `verifier.cache()`, which records the cert as self-published), and
+	 * read it back via `current(coord)` to observe that a `/membership` refetch replaced a stale cached view.
+	 */
+	readonly membershipSource: { cache(coord: RingCoord, encoded: Uint8Array): void; current(coord: RingCoord): Promise<Uint8Array | undefined> };
 	/** Unregister the four protocols and tear down every coord engine. */
 	stop(): Promise<void>;
 }
@@ -476,6 +555,8 @@ interface CoordEngineContext {
 	readonly wantK: number;
 	readonly minSigs: number;
 	readonly maxBytes: number;
+	/** `T_willingness_heartbeat` (ms): idle-but-willing heartbeat throttle (§Cold-start instantiation). */
+	readonly willingnessHeartbeatMs: number;
 	/** Membership-cert sink the per-coord publisher serves through (node-wide; serves this node's cohort). */
 	readonly publishSink: FretMembershipPublishSink;
 	/**
@@ -544,6 +625,7 @@ export async function createCohortTopicHost(node: Libp2p, fret: FretService, opt
 	const fanout = options.fanout ?? 16;
 	const maxBytes = options.maxBytes ?? DEFAULT_STREAM_MAX_BYTES;
 	const gossipIntervalMs = options.gossipIntervalMs ?? DEFAULT_GOSSIP_INTERVAL_MS;
+	const willingnessHeartbeatMs = options.willingnessHeartbeatMs ?? DEFAULT_WILLINGNESS_HEARTBEAT_MS;
 
 	const hash = new RingHash();
 	const selfPeerStr = node.peerId.toString();
@@ -637,6 +719,12 @@ export async function createCohortTopicHost(node: Libp2p, fret: FretService, opt
 	// transport's cohort peer resolution.
 	const broadcastNotice = (notice: PromotionNoticeV1 | DemotionNoticeV1, servedCoord: RingCoord): void => {
 		const frame = encodeCohortMessage(notice, maxBytes);
+		// A demotion fans to BOTH the demoting child's served coord (siblings adopt `promoted = false` via the
+		// `cohortCoord`-routed apply) and the parent coord (the parent unrecords the child). `handleInboundNotice`
+		// runs both apply semantics independently: the `cohortCoord` target does the sibling-adopt, and a demotion
+		// additionally resolves `parentCohortCoord` and — on the same threshold verify against the child cohort
+		// cert — calls `parent.unrecordChild(...)`. A parent-only node applies only the unlink; a node serving
+		// both coords applies both. See `noticeBroadcastCoords` / `handleInboundNotice`.
 		for (const coord of noticeBroadcastCoords(notice, servedCoord)) {
 			gossipTransport.broadcastOver(protocols.promote, coord, frame);
 		}
@@ -683,6 +771,7 @@ export async function createCohortTopicHost(node: Libp2p, fret: FretService, opt
 		wantK,
 		minSigs,
 		maxBytes,
+		willingnessHeartbeatMs,
 		publishSink,
 		privateKey: options.privateKey,
 		router,
@@ -703,9 +792,82 @@ export async function createCohortTopicHost(node: Libp2p, fret: FretService, opt
 		// Cache this node's own freshly-published cohort cert into the verifier, so an inbound notice
 		// signed by this node's cohort verifies locally without a network refetch. `verifier` is declared
 		// just below; the closure only runs on a (later) publish, after it is initialized.
+		//
+		// NOTE (stale trust-lock, drop-the-lock-on-demotion): `verifier.cache()` marks this coord *trusted*,
+		// which trust-LOCKS it (no un-anchored refetch can downgrade it). If this node later leaves the coord's
+		// cohort it stops republishing and its anchor goes `"unknown"`, so it can be stranded distrusting the
+		// coord's later-epoch messages. The verifier self-heals via bounded re-TOFU on a demonstrated chain gap
+		// (`staleGapRecoveryStrikes`, see `db-core/.../membership/verifier.ts` + `docs/cohort-topic.md`
+		// §Bootstrapping trust). The *root-cause* fix is for the host to drop the lock here on demotion, but
+		// that needs an engine-reclaim / demotion signal the host does not emit today. `createCoordRegistry`
+		// now evicts, but only IDLE engines (no records → never published a cert), so it never strands a
+		// trust-lock and does not resolve this on its own (see the NOTE at `evictOneIdle`). When a demotion /
+		// cert-publishing-engine reclaim signal lands, add a `verifier.forget(coord)` / downgrade call on
+		// demotion and prefer it over (or alongside) the strike-counter heuristic.
 		onCertPublished: (cert: MembershipCertV1): void => verifier.cache(cert),
 	};
-	const registry = createCoordRegistry(ctx);
+	const registry = createCoordRegistry(ctx, options.antiDos?.coordEnginesMax);
+
+	// --- cold-sibling engine instantiation on a verified co-member gossip frame (§Cold-start instantiation) ---
+	// A brand-new multi-node cohort deadlocks otherwise: FRET lands every register for a coord on the ONE
+	// nearest member, so its siblings are never independently woken by a routed register — they hold no engine,
+	// are not subscribed to the coord's gossip, and silently drop the willingness/record frames the served
+	// member sends. So replication/failover never materialise. This gate lets a co-member's frame (e.g. the
+	// idle-but-willing willingness heartbeat) instantiate the sibling engine, which then joins the gossip and
+	// reciprocates its own willingness. Called from the `/cohort-gossip` handler BEFORE `deliver`, so the fresh
+	// bus is subscribed in time to merge the very frame that woke it.
+	//
+	// Bounded to genuine co-members by the existing `verifyGossip` auth check (peer-key signature verifies for
+	// `fromMember` AND `fromMember` ∈ `cohortAround(coord).members`), so a peer can only make us instantiate an
+	// engine for a coord where FRET assembly agrees we are both members. Live-signer mode only: without a key
+	// there is no co-member gate, and unauthenticated engine creation would be a DoS vector, so key-less/interim
+	// mode keeps today's behaviour (drop gossip for an unknown coord).
+	//
+	// Scope: tier-0 only (`treeTier === 0`). A tier-`d > 0` frame carries no topic/participantCoord context a
+	// bare willingness heartbeat could seed the parent-coord derivation from, and overlaps the parent-child
+	// link work — so a tier-`d > 0` frame for an unknown coord falls through to today's drop (the bus has no
+	// engine subscribed to it). See `docs/cohort-topic.md` §Cold-start instantiation.
+	//
+	// The registry is hard-capped with LRU eviction of idle engines (`createCoordRegistry`), so a
+	// gossip-instantiated cold sibling is no longer a permanent per-co-member-coord cost: an idle one is
+	// reclaimed under memory pressure like any other cold engine, and a creation over a full-of-live registry
+	// is refused (`CoordEngineRegistryFullError`) and dropped here rather than crashing the gossip handler.
+	const maybeInstantiateColdSibling = (frame: Uint8Array): void => {
+		if (verifyGossip === undefined) {
+			return; // key-less / interim mode: no co-member gate, so never auto-instantiate
+		}
+		let g: CohortGossipV1;
+		try {
+			g = decodeCohortGossipV1(frame, maxBytes);
+		} catch {
+			return; // malformed → the normal deliver path drops it
+		}
+		if (g.treeTier !== 0) {
+			return; // tier-0 milestone only (a tier-d>0 unknown-coord frame falls through to drop)
+		}
+		const coord = b64urlToBytes(g.coord);
+		// NOTE: findByCoord bumps LRU recency as a side effect, and this runs BEFORE the verifyGossip
+		// co-member gate — so an unverified gossip frame naming a coord we already serve can pin that engine
+		// against idle-eviction. Marginal today (an outsider can only pin engines that already exist, bounded
+		// by real co-membership; it cannot create engines — that path is gated below). If gossip-flood
+		// recency-pinning ever matters, add a touch-free `has(coord)` lookup for this existence probe.
+		if (registry.findByCoord(coord) !== undefined) {
+			return; // already serving this coord — nothing to instantiate
+		}
+		if (!verifyGossip(g, coord)) {
+			return; // co-member gate: bad signature or non-member → do not instantiate
+		}
+		// The dummy `participantCoord` seeds only the tier-`d > 0` parent-coord derivation, which a tier-0
+		// engine never exercises (demotion is gated on `treeTier > 0`); self's member bytes are a safe filler.
+		try {
+			registry.forCoord(coord, g.treeTier, selfMemberBytes);
+		} catch (err) {
+			if (err instanceof CoordEngineRegistryFullError) {
+				return; // registry full of live cohorts — drop the cold-sibling instantiation (same as any drop)
+			}
+			throw err;
+		}
+	};
 
 	// --- intra-cohort sign endorsement (the `/sign` handler body) ---
 	// A member dials us to endorse a threshold-signed artifact; we sign the exact request payload iff we
@@ -805,22 +967,86 @@ export async function createCohortTopicHost(node: Libp2p, fret: FretService, opt
 		// `d` this equals the participant's `coord_d(self, topicId)` routing key by construction, i.e. the
 		// coordinate FRET routed to (§Tier addressing).
 		const servedCoord = addressing.coord(reg.treeTier, participantCoord, topicId);
-		const coordEngine = registry.forCoord(servedCoord, reg.treeTier, participantCoord);
+		let coordEngine: CoordEngine;
+		try {
+			coordEngine = registry.forCoord(servedCoord, reg.treeTier, participantCoord);
+		} catch (err) {
+			if (err instanceof CoordEngineRegistryFullError) {
+				// Every engine slot holds a live cohort — refuse this new coord cleanly. `unwilling_cohort`
+				// with a back-off is the walk's "retry in time / restart at d_max" signal (§Capacity barometer),
+				// the same shape the per-coord topic budget answers when full-of-populated.
+				log("cohort-topic: register refused — coord-engine registry full");
+				return { v: 1, result: "unwilling_cohort", retryAfterMs: DEFAULT_RATE_WINDOW_MS, reason: "coord-engine registry full" };
+			}
+			throw err;
+		}
 		if (fretCohort !== undefined) {
 			crossCheckCohort(fret, wantK, servedCoord, fretCohort);
 		}
 		// `parentCoord` for a cold-start forwarder's parent registration; undefined at the root.
 		const parentCoord = reg.treeTier > 0 ? addressing.coord(reg.treeTier - 1, participantCoord, topicId) : undefined;
-		return coordEngine.engine.handleRegister(reg, { followOn: false, treeTier: reg.treeTier, parentCoord }, now);
+		// Derive `followOn` straight from the participant-asserted wire flag. This is the information the
+		// child cohort genuinely cannot infer locally (the tier-addressing hash decorrelates parent/child
+		// coords, and FRET carries no breadcrumb of the redirect), so it must be carried on the frame. It is
+		// forgeable, so the engine's step-1 bootstrap-evidence gate — which demands the same proof for
+		// `followOn: true` as for a `bootstrap: true` cold-root — is what keeps it honest (§Anti-DoS).
+		const followOn = reg.followOn === true;
+		return coordEngine.engine.handleRegister(reg, { followOn, treeTier: reg.treeTier, parentCoord }, now);
+	};
+
+	// --- child-link dispatch: verify + record a child cohort (parent side) ---
+	// A routed `ChildLinkV1` reaches this node's parent engine through the SAME two entry points a register
+	// uses (the FRET activity handler + the direct-dial `register` handler). Live-key mode verifies the child
+	// cohort's threshold signature against the child cohort's cert; key-less mode is permissive (mirrors the
+	// `verifyRegisterSig` fallback) so unit/mock flows still link + record.
+	const verifyChildLinkSig = options.privateKey === undefined
+		? undefined
+		: async (link: ChildLinkV1, at: number): Promise<boolean> => {
+			// Live-key: an UNSIGNED link (misconfigured mixed mode) is never permissive-accepted — reject it,
+			// never a silent record.
+			if (link.thresholdSig.length === 0) {
+				return false;
+			}
+			let signers: Uint8Array[];
+			let sig: Uint8Array;
+			try {
+				signers = link.signers.map(b64urlToBytes);
+				sig = b64urlToBytes(link.thresholdSig);
+			} catch {
+				return false; // a signer / sig that is not valid base64url cannot verify
+			}
+			// Verify against the CHILD cohort's cert at the child coord/tier — identical to the notice verify at
+			// `verifyAndApplyNotice`, with the same bounded refetch so a link flood cannot amplify into dials.
+			const result = await verifier.verifyMessage(
+				signers,
+				b64urlToBytes(link.childCohortCoord),
+				link.childTier,
+				childLinkSigningPayload(link),
+				sig,
+				{ minRefetchIntervalMs: PROMOTE_REFETCH_MIN_INTERVAL_MS, now: at },
+			);
+			return result === "verified";
+		};
+	const childLinkDeps: DispatchChildLinkDeps = {
+		coord: (tier: number, pc: Uint8Array, topicId: Uint8Array): RingCoord => addressing.coord(tier, pc, topicId),
+		resolveParent: (parentServedCoord: RingCoord, parentTier: number, childParticipantCoord: Uint8Array): CoordEngine =>
+			registry.forCoord(parentServedCoord, parentTier, childParticipantCoord),
+		verifyChildLinkSig,
 	};
 
 	// --- protocol handlers + activity callback ---
 	// Await registration so the host is not returned (and dialed) before the five handlers are live —
 	// and, crucially, before the gossip driver below starts ticking (no tick may run on a half-wired node).
-	await registerProtocolHandlers(node, protocols, registry, dispatchRegister, signEndorse, verifier, promoteGate, gossipTransport, publishSink, membershipSource, selfCoord, maxBytes);
+	await registerProtocolHandlers(node, protocols, registry, dispatchRegister, childLinkDeps, minSigs, signEndorse, verifier, promoteGate, gossipTransport, maybeInstantiateColdSibling, publishSink, membershipSource, selfCoord, maxBytes);
 	fret.setActivityHandler(async (activity: string, cohort: string[]): Promise<{ commitCertificate: string }> => {
-		const reg = validateRegisterV1(decodeCohortMessage(b64urlToBytes(activity), maxBytes));
-		const reply = await dispatchRegister(reg, cohort, Date.now());
+		const decoded = decodeCohortMessage(b64urlToBytes(activity), maxBytes);
+		// Decode-and-branch: a `ChildLinkV1` (a child cohort registering with this parent) runs the child-link
+		// dispatch; everything else is an ordinary participant `RegisterV1`. The two shapes are disjoint (a
+		// child-link has no `treeTier`/`signature`; a register has no `childCohortCoord`/`childTier`).
+		const link = tryValidate(() => validateChildLinkV1(decoded, minSigs));
+		const reply = link !== undefined
+			? await dispatchChildLink(link, childLinkDeps, Date.now())
+			: await dispatchRegister(validateRegisterV1(decoded), cohort, Date.now());
 		return { commitCertificate: bytesToB64url(encodeCohortMessage(reply, maxBytes)) };
 	});
 
@@ -873,6 +1099,7 @@ export async function createCohortTopicHost(node: Libp2p, fret: FretService, opt
 		profile,
 		gossipTransport,
 		promoteGate,
+		membershipSource,
 		stop: async (): Promise<void> => {
 			stopped = true;
 			clearInterval(timer);
@@ -1047,39 +1274,57 @@ interface ForwarderLink {
 	readonly treeTier: number;
 	/** The topic's capacity tier (T0–T3); stamps the link frame's `tier`. Defaults to 0 if absent. */
 	readonly opTier?: number;
-	/** The participant coord that seeded this engine — keeps the link frame's recompute consistent. */
+	/** The participant coord that seeded this engine — the child-link's `childParticipantCoord`. */
 	readonly participantCoord: Uint8Array;
+	/** This child engine's served coord `coord_d(participantCoord, topicId)` — the link's `childCohortCoord`. */
+	readonly childCohortCoord: Uint8Array;
+	/** The child cohort's current epoch (raw bytes), stamped + signed into the link. */
+	readonly cohortEpoch: () => Uint8Array;
+	/**
+	 * The child cohort's `"childlink"` threshold signer, or `undefined` in the key-less interim (the link then
+	 * ships unsigned and the parent permissive-accepts it).
+	 */
+	readonly signChildLink?: CohortSigner;
 }
 
 /**
- * Route a forwarder→parent link to `parentCoord` and resolve on the round-trip (the parent ack).
+ * Route a child-cohort→parent link to `parentCoord` and resolve **only on a `linked` ack**.
  *
- * The link is a `RegisterV1`-style frame routed over {@link ITopicRouter.routeAndAct} keyed at the
- * parent coord: it rides the parent's serving tier (`treeTier − 1`) with this engine's seed
- * `participantCoord`, so the parent recomputes `servedCoord = coord_{d−1}(participantCoord, topicId) =
- * parentCoord`. A fresh CSPRNG `correlationId` keeps it clear of the parent's replay guard on retry.
- * Resolution of the route is treated as the ack (richer child-link confirmation — the parent recording
- * `childCohortCount` over a dedicated child-link frame — is the follow-on
- * `cohort-topic-parent-child-link`); a rejection propagates so the cold-start manager keeps the
- * forwarder `awaiting_parent`.
+ * The frame is a dedicated {@link ChildLinkV1} (not a participant `RegisterV1`) routed over
+ * {@link ITopicRouter.routeAndAct} keyed at the parent coord: it carries the child's served coord
+ * (`childCohortCoord`) and its seed `childParticipantCoord`, so the parent recomputes
+ * `coord_{d−1}(childParticipantCoord, topicId) == parentCoord` and `coord_d(...) == childCohortCoord`,
+ * binding the relationship. In live-key mode the child cohort threshold-signs the link over its own coord
+ * at its current epoch; key-less it ships unsigned (empty `thresholdSig`/`signers`). The parent authenticates
+ * + records the child and replies {@link ChildLinkReplyV1}; a `rejected` (or unreachable) reply propagates as
+ * a throw so the cold-start manager keeps the forwarder `awaiting_parent` for a later retry.
  */
 async function registerForwarderWithParent(ctx: CoordEngineContext, link: ForwarderLink): Promise<void> {
-	const frame: RegisterV1 = {
+	const childTier = link.treeTier;
+	const frame: ChildLinkV1 = {
 		v: 1,
 		topicId: bytesToB64url(link.topicId),
+		childCohortCoord: bytesToB64url(link.childCohortCoord),
+		childParticipantCoord: bytesToB64url(link.participantCoord),
+		childTier,
 		tier: clampTier(link.opTier ?? 0),
-		treeTier: Math.max(0, link.treeTier - 1),
-		participantCoord: bytesToB64url(link.participantCoord),
-		ttl: DEFAULT_TTL_MS,
-		// Not a root cold-start: a follow-on link to an already-promoted parent, so no bootstrap evidence.
-		bootstrap: false,
-		timestamp: Date.now(),
-		correlationId: bytesToB64url(randomBytes(16)),
-		// Interim: the forwarder cohort cannot sign as the participant; the dedicated child-link frame
-		// (follow-on) carries the cohort threshold signature instead.
-		signature: "",
+		effectiveAt: Date.now(),
+		thresholdSig: "",
+		signers: [],
+		cohortEpoch: bytesToB64url(link.cohortEpoch()),
 	};
-	await ctx.router.routeAndAct(link.parentCoord, encodeCohortMessage(frame, ctx.maxBytes), { wantK: ctx.wantK, minSigs: ctx.minSigs });
+	// Live-key: threshold-sign over the canonical child-link image (signature covers only the signable fields,
+	// so filling `thresholdSig`/`signers` after does not alter what was signed). Key-less: leave it unsigned.
+	if (link.signChildLink !== undefined) {
+		const { thresholdSig, signers } = await link.signChildLink.thresholdSign(childLinkSigningPayload(frame));
+		frame.thresholdSig = bytesToB64url(thresholdSig);
+		frame.signers = signers.map(bytesToB64url);
+	}
+	const replyBytes = await ctx.router.routeAndAct(link.parentCoord, encodeCohortMessage(frame, ctx.maxBytes), { wantK: ctx.wantK, minSigs: ctx.minSigs });
+	const reply = validateChildLinkReplyV1(decodeCohortMessage(replyBytes, ctx.maxBytes));
+	if (reply.result !== "linked") {
+		throw new Error(`cohort-topic child-link rejected by parent${reply.reason !== undefined ? `: ${reply.reason}` : ""}`);
+	}
 }
 
 /** Clamp an op tier to the valid T0–T3 range so the link frame validates at a (future) real parent. */
@@ -1092,9 +1337,87 @@ function clampTier(tier: number): number {
 
 // --- registry + coord engine ---
 
-/** Build the lazy `servedCoord → CoordEngine` registry over the shared collaborators. */
-function createCoordRegistry(ctx: CoordEngineContext): CoordRegistry {
+/**
+ * Default hard cap on the number of live per-coord cohort engines (see
+ * {@link CohortTopicAntiDosOptions.coordEnginesMax}). Aligned in order of magnitude with the topic-budget
+ * `topics_max` (2048): the same "this many distinct served units before an anti-abuse ceiling bites" scale.
+ */
+export const DEFAULT_COORD_ENGINES_MAX = 2048;
+
+/**
+ * Thrown by {@link CoordRegistry.forCoord} when it must create a new engine but the registry is full of
+ * **live** cohorts (every slot holds records or a cold-start forwarder, so nothing is idle-evictable).
+ * Signals a capacity refusal, not a bug — the register / child-link / cold-sibling dispatch paths catch it
+ * and answer a clean refusal (`unwilling_cohort` / `rejected` / drop) rather than letting it escape.
+ */
+export class CoordEngineRegistryFullError extends Error {
+	constructor(maxEngines: number) {
+		super(`cohort-topic coord-engine registry full (max=${maxEngines}) — every slot holds a live cohort`);
+		this.name = "CoordEngineRegistryFullError";
+	}
+}
+
+/**
+ * Build the lazy `servedCoord → CoordEngine` registry over the shared collaborators, hard-capped at
+ * `maxEngines` with least-recently-used eviction of **idle** engines.
+ *
+ * The served coord is a hash over attacker-chosen `(treeTier, participantCoord, topicId)`, and `forCoord`
+ * runs on the register hot path **before** the per-coord anti-DoS gates — so, uncapped, one peer spraying
+ * distinct coords drives unbounded engine allocation (each engine owns a store, gossip bus, rate limiter,
+ * replay guard, topic budget, …). The cap bounds that: on a creation over a full registry we evict the
+ * least-recently-used **idle** engine (no records, no cold-start forwarder — a throwaway cold coord) and
+ * tear it down; when every slot holds a live cohort we refuse the new coord ({@link CoordEngineRegistryFullError})
+ * so a legitimate multi-cohort node keeps working while attacker-driven cold engines cannot pile up.
+ *
+ * Recency is bumped on every lookup that hands back an engine (`forCoord` / `findByCoord` / `findHolder` /
+ * `findServing`), so a hot cohort under load is never the eviction victim.
+ */
+function createCoordRegistry(ctx: CoordEngineContext, maxEngines: number = DEFAULT_COORD_ENGINES_MAX): CoordRegistry {
+	if (!Number.isInteger(maxEngines) || maxEngines <= 0) {
+		throw new RangeError(`coordEnginesMax must be a positive integer, got ${maxEngines}`);
+	}
 	const engines = new Map<string, CoordEngine>();
+	// LRU recency by engine key: a monotonic touch sequence (higher = more recently used). Every engine in
+	// `engines` has an entry; entries are dropped alongside their engine on eviction / close.
+	const recency = new Map<string, number>();
+	let seq = 0;
+	const touch = (key: string): void => { recency.set(key, ++seq); };
+
+	// An engine is idle-evictable iff it holds no registration record AND no cold-start forwarder — i.e. no
+	// genuine cohort state to lose. A live engine (records or a forwarder) is never a throwaway.
+	const isIdle = (engine: CoordEngine): boolean => !engine.hasState() && !engine.hasForwarders();
+
+	// Evict the least-recently-used idle engine to free a slot; returns true iff one was freed. Tears the
+	// victim down (`close()` drops its gossip-bus subscription) so eviction does not leak the subscription.
+	//
+	// NOTE (verifier trust-lock, cohort-topic-treetier-bound-engine-cap): only IDLE engines are evicted here,
+	// and an idle engine (`hasState() === false`) has never published a membership cert — so there is no
+	// verifier trust-lock (`onCertPublished` → `verifier.cache`, above) to drop for its coord. If this policy
+	// is ever widened to evict a cert-publishing engine, add a `verifier.forget(coord)` / downgrade here:
+	// otherwise the stale trust-lock strands the coord's later-epoch messages (the drop-the-lock tripwire the
+	// `onCertPublished` NOTE describes). Do NOT widen without that.
+	const evictOneIdle = (): boolean => {
+		let victimKey: string | undefined;
+		let victimSeq = Infinity;
+		for (const [key, engine] of engines) {
+			if (!isIdle(engine)) {
+				continue; // live cohort (records) or mid-link cold-start forwarder — never evicted
+			}
+			const s = recency.get(key) ?? 0;
+			if (s < victimSeq) {
+				victimSeq = s;
+				victimKey = key;
+			}
+		}
+		if (victimKey === undefined) {
+			return false;
+		}
+		engines.get(victimKey)!.close();
+		engines.delete(victimKey);
+		recency.delete(victimKey);
+		return true;
+	};
+
 	return {
 		forCoord(coord: RingCoord, treeTier: number, participantCoord: Uint8Array): CoordEngine {
 			const key = bytesToB64url(coord);
@@ -1102,25 +1425,39 @@ function createCoordRegistry(ctx: CoordEngineContext): CoordRegistry {
 			// share one engine rather than racing to construct a second.
 			let engine = engines.get(key);
 			if (engine === undefined) {
+				if (engines.size >= maxEngines && !evictOneIdle()) {
+					// Full of live cohorts — refuse rather than grow unbounded. Callers turn this into a clean
+					// capacity reply/drop (see the paths listed on `CoordEngineRegistryFullError`).
+					log("cohort-topic: coord-engine registry full (max=%d) — refusing new coord %s", maxEngines, key);
+					throw new CoordEngineRegistryFullError(maxEngines);
+				}
 				engine = createCoordEngine(ctx, coord, treeTier, participantCoord);
 				engines.set(key, engine);
 			}
+			touch(key);
 			return engine;
 		},
 		findByCoord(coord: RingCoord): CoordEngine | undefined {
-			return engines.get(bytesToB64url(coord));
+			const key = bytesToB64url(coord);
+			const engine = engines.get(key);
+			if (engine !== undefined) {
+				touch(key);
+			}
+			return engine;
 		},
 		findHolder(topicId: Uint8Array, participantId: Uint8Array): CoordEngine | undefined {
-			for (const engine of engines.values()) {
+			for (const [key, engine] of engines) {
 				if (engine.holds(topicId, participantId)) {
+					touch(key);
 					return engine;
 				}
 			}
 			return undefined;
 		},
 		findServing(topicId: Uint8Array, treeTier: number): CoordEngine | undefined {
-			for (const engine of engines.values()) {
+			for (const [key, engine] of engines) {
 				if (engine.treeTier === treeTier && engine.servesTopic(topicId)) {
+					touch(key);
 					return engine;
 				}
 			}
@@ -1134,6 +1471,7 @@ function createCoordRegistry(ctx: CoordEngineContext): CoordRegistry {
 				engine.close();
 			}
 			engines.clear();
+			recency.clear();
 		},
 	};
 }
@@ -1155,8 +1493,9 @@ interface CohortIdentity {
  * Two roles, one small object:
  *
  * - **Producer** — {@link predecessor} is the identity of the *last published* cert; a publish whose
- *   first `k − x` differ from it is a rotation, and the predecessor identity scopes the rotation `/sign`
- *   round (its epoch is `prevEpoch`, its members are the outgoing cohort to collect from).
+ *   epoch (`H(sorted members)`) differs from it is a rotation — any member change, head or tail — and the
+ *   predecessor identity scopes the rotation `/sign` round (its epoch is `prevEpoch`, its members are the
+ *   outgoing cohort to collect from).
  * - **Endorser** — {@link membersAt} answers "was I a member of the cohort at `epoch`?" over a two-deep
  *   observed-epoch history ({@link current} + {@link prior}), kept fresh by {@link observe} on every
  *   cohort assembly. A request for an epoch past that window is refused (the rapid-double-rotation gap).
@@ -1205,15 +1544,102 @@ class RotationState {
 	}
 }
 
+/**
+ * A per-{@link CoordEngine} registry of the child cohorts this cohort parents, keyed by topic then by child
+ * served coord. Both mutators are freshness-ordered per child coord (a stale/out-of-order replay cannot flip a
+ * newer state) and idempotent (re-applying the same state is a no-op), mirroring `PromotionState.lastEffectiveAt`:
+ * `recordChild` links, `unrecordChild` releases (on a child demotion). Each returns whether it actually changed
+ * state, so the caller re-gossips only real changes. `count` feeds the demotion gate / gossip summary / traffic
+ * snapshot.
+ *
+ * **Cohort-wide convergence.** FRET routes a child-link to ONE parent member, so a per-member count is a shard,
+ * not the total. Every member gossips its own link/unlink deltas ({@link CohortGossipV1.childLinks} /
+ * `childUnlinks`) and merges inbound ones straight into this registry (via the gossip bus `onChildDeltas`
+ * callback), so after a round every parent member holds the same **converged union** and `count` is consistent
+ * cohort-wide. Because merge is last-writer-wins by `effectiveAt`, a link and a later unlink converge in any
+ * arrival order, and a never-seen unlink writes a `linked = false` tombstone that a subsequently-arriving stale
+ * link cannot resurrect. The union is keyed by child coord, never the parent epoch, so a parent membership
+ * rotation does not reset it. NOTE: a link/unlink is broadcast once (drained from the pending delta queue);
+ * a parent member that joins the cohort *after* the delta drained (rotation cold-start) learns the child set
+ * only on the next local record/unrecord for that child — see `debt-cohort-topic-child-set-late-joiner-resync`.
+ */
+interface ChildRegistry {
+	/** Link the child; returns true iff this advanced the state (a fresh link or a strictly-newer effectiveAt). */
+	recordChild(topicId: Uint8Array, childCohortCoord: Uint8Array, effectiveAt: number): boolean;
+	/** Release the child (linked = false); returns true iff this advanced the state. A never-seen child writes a tombstone. */
+	unrecordChild(topicId: Uint8Array, childCohortCoord: Uint8Array, effectiveAt: number): boolean;
+	count(topicId: Uint8Array): number;
+}
+
+interface ChildEntry {
+	linked: boolean;
+	lastEffectiveAt: number;
+}
+
+function createChildRegistry(): ChildRegistry {
+	const byTopic = new Map<string, Map<string, ChildEntry>>();
+	// Freshness-ordered write shared by link/unlink: apply `linked` only if `effectiveAt` is strictly newer than
+	// the entry's high-water (or the entry is new), so a stale/out-of-order replay is dropped and an idempotent
+	// re-apply is a no-op. Returns whether the state actually advanced (so the caller re-gossips only real changes).
+	const apply = (topicId: Uint8Array, childCohortCoord: Uint8Array, effectiveAt: number, linked: boolean): boolean => {
+		const topicKey = bytesToB64url(topicId);
+		let children = byTopic.get(topicKey);
+		if (children === undefined) {
+			children = new Map<string, ChildEntry>();
+			byTopic.set(topicKey, children);
+		}
+		const childKey = bytesToB64url(childCohortCoord);
+		const existing = children.get(childKey);
+		if (existing === undefined) {
+			// A never-seen unlink writes a `linked = false` tombstone (never a negative count), so a later stale
+			// link with an earlier effectiveAt cannot resurrect a demoted child.
+			children.set(childKey, { linked, lastEffectiveAt: effectiveAt });
+			return true;
+		}
+		if (effectiveAt <= existing.lastEffectiveAt) {
+			return false;
+		}
+		const changed = existing.linked !== linked;
+		existing.linked = linked;
+		existing.lastEffectiveAt = effectiveAt;
+		return changed;
+	};
+	return {
+		recordChild(topicId: Uint8Array, childCohortCoord: Uint8Array, effectiveAt: number): boolean {
+			return apply(topicId, childCohortCoord, effectiveAt, true);
+		},
+		unrecordChild(topicId: Uint8Array, childCohortCoord: Uint8Array, effectiveAt: number): boolean {
+			return apply(topicId, childCohortCoord, effectiveAt, false);
+		},
+		count(topicId: Uint8Array): number {
+			const children = byTopic.get(bytesToB64url(topicId));
+			if (children === undefined) {
+				return 0;
+			}
+			let n = 0;
+			for (const entry of children.values()) {
+				if (entry.linked) {
+					n++;
+				}
+			}
+			return n;
+		},
+	};
+}
+
 /**
  * Compose one {@link CoordEngine} bound to `servedCoord`. The cohort it threshold-signs / shards with
  * is the FRET assembly around `servedCoord` (not the node's own ring position). The promotion tier
  * inputs are coord-derived: `treeTier` is fixed at instantiation; `parentCoord` is
  * `coord_{d-1}(participantCoord, topicId)` (the shard's parent shares the prefix, so any participant
- * routed here yields the same parent); `childCohortCount` is `0` for the single-cohort milestone.
+ * routed here yields the same parent); `childCohortCount` is the converged union of recorded child cohorts
+ * (per-cohort child registry, gossip-replicated), `0` until this cohort parents a child.
  */
 function createCoordEngine(ctx: CoordEngineContext, servedCoord: RingCoord, treeTier: number, participantCoord: Uint8Array): CoordEngine {
 	const store = createRegistrationStore();
+	// The child cohorts this cohort parents (recorded by the parent-side child-link dispatch). Its `count`
+	// feeds the demotion gate, the gossip summary, and the traffic snapshot below (was hardcoded 0).
+	const childRegistry = createChildRegistry();
 	// Epoch-rotation bookkeeping. `cohort()` observes every assembly so the endorser history stays fresh
 	// (the gossip-cadence driver assembles each round); the producer reads `predecessor()` on publish.
 	const rotationState = new RotationState();
@@ -1251,6 +1677,19 @@ function createCoordEngine(ctx: CoordEngineContext, servedCoord: RingCoord, tree
 				topicBudget.touch(topicId, store.directParticipants(topicId));
 			}
 		},
+		// Cross-member child-set convergence: merge inbound child link/unlink deltas straight into this engine's
+		// child registry (last-writer-wins by effectiveAt), so every parent member reads the same converged union
+		// — not only the FRET-routed member that recorded the child. A direct write (no re-enqueue) so a received
+		// delta is not re-gossiped; one broadcast already reaches the whole cohort. (`childRegistry` is declared
+		// just above, so it is fully initialized by the time this callback fires on an inbound merge.)
+		onChildDeltas: (childLinks: readonly ChildLinkRefV1[], childUnlinks: readonly ChildLinkRefV1[]): void => {
+			for (const ref of childLinks) {
+				childRegistry.recordChild(b64urlToBytes(ref.topicId), b64urlToBytes(ref.childCohortCoord), ref.effectiveAt);
+			}
+			for (const ref of childUnlinks) {
+				childRegistry.unrecordChild(b64urlToBytes(ref.topicId), b64urlToBytes(ref.childCohortCoord), ref.effectiveAt);
+			}
+		},
 	});
 	const view = bus.view();
 	const selfMember = bytesToB64url(ctx.selfMemberBytes);
@@ -1281,6 +1720,10 @@ function createCoordEngine(ctx: CoordEngineContext, servedCoord: RingCoord, tree
 	};
 	const noticeSigner = makeCoordSigner("promotion");
 	const membershipSigner = makeCoordSigner("membership");
+	// The child cohort threshold-signs its own child-link exactly as it signs a promotion notice — over its
+	// own served coord at its current epoch (a sibling of `noticeSigner`). Verify-only key-less (the child
+	// then emits an UNSIGNED link and the parent permissive-accepts it, matching the register-sig fallback).
+	const childLinkSigner = makeCoordSigner("childlink");
 
 	// Cohort-side membership-cert publisher: threshold-signs a MembershipCertV1 over this coord's cohort
 	// and serves it through the node's publish sink. Driven by the onStabilized / pumpMembership hooks.
@@ -1301,12 +1744,16 @@ function createCoordEngine(ctx: CoordEngineContext, servedCoord: RingCoord, tree
 	const canPublish = ctx.privateKey !== undefined;
 
 	// --- epoch-rotation attestation production (cohort-topic-trust-anchor-rotation-production) ---
-	// The first `k − x` members of the cert's ascending order; a change across a publish is a rotation
-	// (mirrors the publisher's own republish gate — same inputs, so the two agree on what is a rotation).
-	const firstKx = (members: readonly Uint8Array[]): string[] =>
-		[...members].sort(compareBytes).slice(0, ctx.minSigs).map(bytesToB64url);
-	const firstKxChanged = (a: CohortIdentity, b: CohortIdentity): boolean =>
-		!sameStringOrder(firstKx(a.memberBytes), firstKx(b.memberBytes));
+	// Any change to the cohort identity (`epochKey = H(sorted members)`) is a rotation — head OR tail
+	// (mirrors the publisher's own republish gate — both now key on the epoch, so the two agree on what is
+	// a rotation).
+	// NOTE: the `/sign` "rotation" endorsement gate remembers only the current + immediately-prior observed
+	// epoch (RotationState.membersAt). That two-deep bound is orthogonal to attesting on any epoch change —
+	// RotationState.observe already shifts on every observed epoch change (any member change rotates the
+	// epoch), so rapid churn could age a predecessor epoch out of the window regardless. If rapid multi-step
+	// churn ever makes rotation attestations frequently unproducible, that is a history-depth concern in
+	// RotationState, not this trigger.
+	const epochChanged = (a: CohortIdentity, b: CohortIdentity): boolean => a.epochKey !== b.epochKey;
 
 	/**
 	 * Threshold-sign the new cert's canonical payload under the **predecessor** cohort identity, producing the
@@ -1341,10 +1788,10 @@ function createCoordEngine(ctx: CoordEngineContext, servedCoord: RingCoord, tree
 	};
 
 	/**
-	 * Publish (or refresh) this cohort's membership cert, attaching a rotation attestation when the first
-	 * `k − x` changed since the last publish. `refresh` selects the publisher path: `false` for a
+	 * Publish (or refresh) this cohort's membership cert, attaching a rotation attestation when the cohort
+	 * identity (epoch) changed since the last publish. `refresh` selects the publisher path: `false` for a
 	 * stabilization event ({@link CoordEngine.onStabilized}), `true` for the periodic refresh
-	 * ({@link CoordEngine.pumpMembership}). A first-`k − x` change is a stabilization regardless of which hook
+	 * ({@link CoordEngine.pumpMembership}). An epoch change is a stabilization regardless of which hook
 	 * fired, so it routes through `onStabilized` (which republishes promptly on the change) carrying the
 	 * attestation; the `/sign` round runs only on that change, so it costs one round per rotation, never per
 	 * tick. Key-less interim mode no-ops (the verify-only signer cannot assemble).
@@ -1356,7 +1803,7 @@ function createCoordEngine(ctx: CoordEngineContext, servedCoord: RingCoord, tree
 		const snapshot = snapshotAt(now); // also observes the current identity (snapshotAt → cohort())
 		const current = identityOf(snapshot);
 		const predecessor = rotationState.predecessor();
-		const rotating = predecessor !== undefined && firstKxChanged(predecessor, current);
+		const rotating = predecessor !== undefined && epochChanged(predecessor, current);
 		let published: MembershipCertV1 | undefined;
 		if (rotating) {
 			const rotation = await produceRotation(snapshot, predecessor!);
@@ -1378,16 +1825,23 @@ function createCoordEngine(ctx: CoordEngineContext, servedCoord: RingCoord, tree
 		primaryTopicCount: (tier: Tier): number => countPrimaryTopics(store, ctx.selfMemberBytes, tier),
 		config: { cohortSize: ctx.wantK },
 	});
-	const traffic = createTrafficCounters({ view, store, selfMember });
+	const traffic = createTrafficCounters({ view, store, selfMember, childCohortCount: (topicId: Uint8Array): number => childRegistry.count(topicId) });
 	const promotion = createPromotionLifecycle({
 		store,
 		loadBucket: (topicId: Uint8Array): number => ctx.barometer.bucket(tierOfTopic(store, topicId)),
-		// Single-cohort milestone: a tier-0 cohort with no children. Child-cohort tracking is a follow-on.
-		childCohortCount: (): number => 0,
+		// Real child count off this engine's local registry — a converged union across the parent cohort (the
+		// FRET-routed member that records a child gossips a child-link delta; every member merges inbound ones),
+		// so this count is consistent cohort-wide. Blocks demotion while any child is linked; once the last
+		// child demotes (its notice unlinks it here and cohort-wide) the count falls to 0 and the parent can
+		// demote in turn (`promotion.ts` demotionTriggered).
+		childCohortCount: (topicId: Uint8Array): number => childRegistry.count(topicId),
 		treeTier: (): number => treeTier,
 		// `coord_{d-1}(P, topicId)`; never invoked at the root (demotion is gated on `treeTier > 0`), so
 		// the `d = 0` branch (clamped to `coord_0`) is a well-formed placeholder that the lifecycle skips.
 		parentCoord: (topicId: Uint8Array): Uint8Array => ctx.addressing.coord(Math.max(0, treeTier - 1), participantCoord, topicId),
+		// The served coord this engine was instantiated at — stamped on every notice as `cohortCoord` and
+		// covered by its threshold signature, so a receiver routes + verifies the notice by exactly this coord.
+		cohortCoord: (): Uint8Array => servedCoord,
 		cohortEpoch: localEpoch,
 		signer: noticeSigner,
 		// Production defaults (cap_promote = 64, …) unless the host was given a promotion override — the
@@ -1408,7 +1862,20 @@ function createCoordEngine(ctx: CoordEngineContext, servedCoord: RingCoord, tree
 	const coldStart = createColdStartManager({
 		parentRegistrar: {
 			registerWithParent: (topicId: Uint8Array, parentCoord: Uint8Array, tier: number, opTier?: number): Promise<void> =>
-				registerForwarderWithParent(ctx, { topicId, parentCoord, treeTier: tier, opTier, participantCoord }),
+				registerForwarderWithParent(ctx, {
+					topicId,
+					parentCoord,
+					treeTier: tier,
+					opTier,
+					participantCoord,
+					// This engine's served coord IS `coord_d(participantCoord, topicId)` — the child cohort coord the
+					// parent verifies + records against.
+					childCohortCoord: servedCoord,
+					cohortEpoch: localEpoch,
+					// Live-key: the child threshold-signs the link over its own coord/epoch. Key-less interim: no
+					// signer, so the link ships unsigned and the parent permissive-accepts it.
+					signChildLink: canPublish ? childLinkSigner : undefined,
+				}),
 		},
 	});
 
@@ -1420,7 +1887,19 @@ function createCoordEngine(ctx: CoordEngineContext, servedCoord: RingCoord, tree
 	// so a probe flood cannot exhaust a participant's register budget at this coord, or vice-versa.
 	const probeRateLimiter = createRegisterRateLimiter(ctx.antiDos.rateLimiter);
 	const replayGuard = createCorrelationReplayGuard(ctx.antiDos.replayGuard);
-	const topicBudget = createTopicBudget(ctx.antiDos.topicBudget);
+	// Reconcile the cold-start forwarder set + traffic window with the topic budget on eviction. When the
+	// budget is full and evicts the coldest (zero-participant) resident to make room for a new topic, tear
+	// down the evicted topic's forwarder and traffic counters too — otherwise `servesTopic` stays true off
+	// the leftover forwarder, the topic is served forever with no budget slot, and the forwarder map grows
+	// unbounded. `coldStart` (declared above at the createColdStartManager call) and `traffic` are both
+	// initialized before this point, so the callback closes over live instances.
+	const topicBudget = createTopicBudget({
+		...ctx.antiDos.topicBudget,
+		onEvict: (topicId: Uint8Array): void => {
+			coldStart.remove(topicId);
+			traffic.forget(topicId);
+		},
+	});
 	const renewal = createRenewalCohortSide({
 		store,
 		self: ctx.selfMemberBytes,
@@ -1434,6 +1913,10 @@ function createCoordEngine(ctx: CoordEngineContext, servedCoord: RingCoord, tree
 			evicted: (rec): void => pending.evicted(rec),
 		},
 		verifyParticipantSig: ctx.verifyParticipantSig,
+		// Freshness gate for the privileged withdraw/reattach paths. Share the register path's skew config
+		// (`ctx.antiDos.replayGuard`, the same `{ maxAgeMs, maxFutureSkewMs }` `createCorrelationReplayGuard`
+		// consumes above) so an operator tuning the window moves the register and renew paths together.
+		freshness: ctx.antiDos.replayGuard,
 	});
 
 	const engine = createCohortMemberEngine({
@@ -1476,9 +1959,19 @@ function createCoordEngine(ctx: CoordEngineContext, servedCoord: RingCoord, tree
 		return [...byKey.values()];
 	};
 
+	// Timestamp of the last frame this engine actually emitted (any frame carries willingness). Drives the
+	// idle-but-willing heartbeat throttle: an idle round heartbeats only if this engine has never emitted
+	// (first idle round → immediate, so bootstrap converges fast) or `T_willingness_heartbeat` has elapsed.
+	// A record-carrying round emits every round and updates this clock, so the throttle governs only
+	// genuinely-idle engines. `undefined` until the first emit.
+	// NOTE: re-broadcasts willingness for every idle-but-willing cohort every T_willingness_heartbeat; if a
+	// node ever serves very many idle cohorts, batch the heartbeats or lengthen the interval.
+	let lastGossipAt: number | undefined;
+
 	// One gossip round: sweep stale records (firing the `evicted` deltas), freeze each resident topic's
-	// traffic summary, drain the touch/evicted deltas, then assemble + sign + broadcast the frame. Idle
-	// empty engines (no topics, no deltas) build no frame and skip the broadcast.
+	// traffic summary, drain the touch/evicted deltas, then assemble + sign + broadcast the frame. An idle
+	// engine (no topics, no deltas) normally builds no frame — except a willingness heartbeat, where an idle
+	// but willing engine still emits a willingness/load-only frame so a cold cohort can bootstrap.
 	const gossipRound = async (now: number): Promise<CohortGossipV1 | undefined> => {
 		engine.sweepStale(now);
 		const topicSummaries = residentTopics().map((topicId) =>
@@ -1486,26 +1979,36 @@ function createCoordEngine(ctx: CoordEngineContext, servedCoord: RingCoord, tree
 				tier: tierOfTopic(store, topicId),
 				directParticipants: store.directParticipants(topicId),
 				promoted: promotion.isPromoted(topicId),
-				// Single-cohort milestone: no child cohorts tracked. Child-cohort tracking is a follow-on.
-				childCohortCount: 0,
+				// Real child count off this engine's local registry — a converged union across the parent cohort
+				// (every member gossips its child link/unlink deltas; inbound ones merge here), so this is
+				// consistent cohort-wide, not a single-member shard.
+				childCohortCount: childRegistry.count(topicId),
 			}),
 		);
-		const { records, evicted } = pending.drain();
+		const { records, evicted, childLinks, childUnlinks } = pending.drain();
+		const idle = topicSummaries.length === 0 && records.length === 0 && evicted.length === 0
+			&& childLinks.length === 0 && childUnlinks.length === 0;
+		const heartbeat = idle && (lastGossipAt === undefined || now - lastGossipAt >= ctx.willingnessHeartbeatMs);
 		const g = buildCohortGossip({
 			fromMember: selfMember,
 			coord: bytesToB64url(servedCoord),
 			cohortEpoch: bytesToB64url(localEpoch()),
+			treeTier,
+			heartbeat,
 			profile: ctx.profile,
 			barometer: ctx.barometer,
 			windowSeconds: DEFAULT_TRAFFIC_WINDOW_SECONDS,
 			topicSummaries,
 			records,
 			evicted,
+			childLinks,
+			childUnlinks,
 			timestamp: now,
 		});
 		if (g === undefined) {
 			return undefined;
 		}
+		lastGossipAt = now;
 		if (ctx.signGossip !== undefined) {
 			g.signature = await ctx.signGossip(g);
 		}
@@ -1541,16 +2044,42 @@ function createCoordEngine(ctx: CoordEngineContext, servedCoord: RingCoord, tree
 		cohort,
 		cohortIdentityAt: (epoch: Uint8Array): readonly string[] | undefined => rotationState.membersAt(bytesToB64url(epoch)),
 		hasState: (): boolean => store.listAll().length > 0,
+		hasForwarders: (): boolean => coldStart.hasForwarders(),
 		holds: (topicId: Uint8Array, participantId: Uint8Array): boolean =>
 			store.getByParticipant(topicId, participantId) !== undefined,
 		records: (topicId: Uint8Array): readonly RegistrationRecord[] => store.listByTopic(topicId),
 		topicTraffic: (topicId: Uint8Array): TopicTrafficV1 => traffic.snapshot(topicId),
+		// NOTE: the only production caller today is the matchmaking QueryV1 serve handler
+		// (matchmaking-query-accounting-seam). When the AggregateCountV1 sweep RPC lands it is another
+		// genuine cohort query and should bump the same seam — reuse `engine.recordQuery` at that call site.
+		// NOTE: unlike `recordArrival` (whose topic always becomes resident via the store), a query can be
+		// recorded against a NON-resident topic (the recordless `findByCoord` serve fallback). `gossipRound`
+		// only `publish`es `residentTopics()`, and `traffic.forget` fires only on topic-budget eviction, so
+		// such a topic's query window prunes only at epoch `reset`. Harmless now (bounded by epoch lifetime +
+		// the serve gate; a few timestamps per query). If a node ever serves high-volume queries for topics it
+		// holds no records for, prune non-resident windows on a timer or forget them when their engine idles.
+		recordQuery: (topicId: Uint8Array, now: number): void => traffic.recordQuery(topicId, now),
 		cohortView: (): CohortView => view,
 		servesTopic: (topicId: Uint8Array): boolean =>
 			store.directParticipants(topicId) > 0 || coldStart.get(topicId) !== undefined,
 		budgetHasTopic: (topicId: Uint8Array): boolean => topicBudget.has(topicId),
 		budgetParticipantCount: (topicId: Uint8Array): number | undefined => topicBudget.participantCount(topicId),
 		forwarder: (topicId: Uint8Array): Forwarder | undefined => coldStart.get(topicId),
+		// A local record/unrecord (parent-side child-link dispatch / demotion-notice unlink) also enqueues the
+		// corresponding gossip delta on a real state change, so the child set converges across the parent cohort.
+		// A gossip-merged delta writes the registry directly (via the bus `onChildDeltas` callback) and is NOT
+		// re-enqueued here — one broadcast reaches the whole cohort.
+		recordChild: (topicId: Uint8Array, childCohortCoord: Uint8Array, effectiveAt: number): void => {
+			if (childRegistry.recordChild(topicId, childCohortCoord, effectiveAt)) {
+				pending.childLink(topicId, childCohortCoord, effectiveAt);
+			}
+		},
+		unrecordChild: (topicId: Uint8Array, childCohortCoord: Uint8Array, effectiveAt: number): void => {
+			if (childRegistry.unrecordChild(topicId, childCohortCoord, effectiveAt)) {
+				pending.childUnlink(topicId, childCohortCoord, effectiveAt);
+			}
+		},
+		childCohortCount: (topicId: Uint8Array): number => childRegistry.count(topicId),
 		isPromoted: (topicId: Uint8Array): boolean => promotion.isPromoted(topicId),
 		applyPromotionNotice: (notice, now): void => promotion.applyPromotionNotice(notice, now),
 		applyDemotionNotice: (notice, now): void => promotion.applyDemotionNotice(notice, now),
@@ -1579,6 +2108,78 @@ export function resolveRenew(registry: CoordRegistry, renew: RenewV1, now: numbe
 	return holder.engine.handleRenew(renew, now);
 }
 
+// --- parent-side child-link dispatch (record a verified child cohort) ---
+
+/**
+ * Dependencies for {@link dispatchChildLink}. Small seam so the parent-side child-link handling is unit-
+ * testable without a live node (mirrors {@link handleSignRequest} / {@link verifyAndApplyNotice}).
+ */
+export interface DispatchChildLinkDeps {
+	/** Recompute a served coord for a tier — `addressing.coord(tier, participantCoord, topicId)`. */
+	readonly coord: (tier: number, participantCoord: Uint8Array, topicId: Uint8Array) => RingCoord;
+	/**
+	 * Resolve (creating if absent) the parent {@link CoordEngine} for its served coord — `registry.forCoord`.
+	 * Only its {@link CoordEngine.recordChild} is used. May throw {@link CoordEngineRegistryFullError} when
+	 * creating over a full-of-live registry; {@link dispatchChildLink} catches it and replies `rejected`.
+	 */
+	readonly resolveParent: (parentServedCoord: RingCoord, parentTier: number, childParticipantCoord: Uint8Array) => Pick<CoordEngine, "recordChild">;
+	/**
+	 * Verify the child cohort threshold signature against the child cohort's cert (live-key mode). `undefined`
+	 * → key-less-permissive: the link is recorded without a signature check (matching the register-sig
+	 * fallback). A live-key host supplies this, and an unsigned link then fails it (never a silent record).
+	 */
+	readonly verifyChildLinkSig?: (link: ChildLinkV1, now: number) => Promise<boolean>;
+}
+
+/**
+ * Parent-side handling of an inbound {@link ChildLinkV1}: bind the parent-child relationship, verify the
+ * child cohort's threshold signature, record the child, and ack. Steps:
+ *
+ * 1. **Bind.** Recompute `coord_childTier(childParticipantCoord, topicId)` and reject unless it equals the
+ *    signed `childCohortCoord`; `coord_(childTier−1)(...)` is this parent's served coord. An attacker cannot
+ *    point the link at an unrelated parent without a `childParticipantCoord` that also hashes to the signed
+ *    child coord (which it cannot, absent the prefix-class membership).
+ * 2. **Verify** (live-key) the child cohort threshold sig against the child cohort's cert; key-less-permissive
+ *    short-circuits it. A non-verified result → `rejected`.
+ * 3. **Record** the child on the parent engine (freshness-ordered, idempotent).
+ * 4. Reply `linked`.
+ */
+export async function dispatchChildLink(link: ChildLinkV1, deps: DispatchChildLinkDeps, now: number): Promise<ChildLinkReplyV1> {
+	const topicId = b64urlToBytes(link.topicId);
+	const childParticipantCoord = b64urlToBytes(link.childParticipantCoord);
+	const childCohortCoord = b64urlToBytes(link.childCohortCoord);
+	// Step 1 — bind the relationship. `validateChildLinkV1` already enforced `childTier >= 1`, so `childTier − 1`
+	// is a well-formed parent tier.
+	const recomputedChild = deps.coord(link.childTier, childParticipantCoord, topicId);
+	if (!bytesEqual(recomputedChild, childCohortCoord)) {
+		return { v: 1, result: "rejected", reason: "coord mismatch" };
+	}
+	const parentServedCoord = deps.coord(link.childTier - 1, childParticipantCoord, topicId);
+	// Step 2 — verify the child cohort threshold signature (live-key). Key-less-permissive short-circuits.
+	if (deps.verifyChildLinkSig !== undefined) {
+		const verified = await deps.verifyChildLinkSig(link, now);
+		if (!verified) {
+			return { v: 1, result: "rejected", reason: "child cohort signature not verified" };
+		}
+	}
+	// Step 3 — record on the parent engine (resolving it by its served coord). Resolving may create the parent
+	// engine, so it can hit the registry cap: a full-of-live registry refuses, which we turn into a clean
+	// `rejected` (the child re-links on a later round / after the cohort drains an idle engine) rather than an
+	// unhandled throw on the stream.
+	let parent: Pick<CoordEngine, "recordChild">;
+	try {
+		parent = deps.resolveParent(parentServedCoord, link.childTier - 1, childParticipantCoord);
+	} catch (err) {
+		if (err instanceof CoordEngineRegistryFullError) {
+			return { v: 1, result: "rejected", reason: "parent cohort capacity" };
+		}
+		throw err;
+	}
+	parent.recordChild(topicId, childCohortCoord, link.effectiveAt);
+	// Step 4 — ack.
+	return { v: 1, result: "linked" };
+}
+
 // --- intra-cohort sign endorsement ---
 
 /** Dependencies for the `/sign` endorsement policy ({@link handleSignRequest}). */
@@ -1624,6 +2225,7 @@ const SIGNABLE_IMAGE_TAG: Record<Exclude<SignKind, "rotation">, string> = {
 	membership: "MembershipCertV1",
 	promotion: "PromotionNoticeV1",
 	demotion: "DemotionNoticeV1",
+	childlink: "ChildLinkV1",
 };
 
 /**
@@ -1743,6 +2345,9 @@ export async function handleSignRequest(request: SignRequestV1, fromPeerStr: str
 	// All kinds — bind the payload-internal `cohortEpoch` to our own current epoch (closes the falsified-internal
 	// -epoch hole, for promotion / demotion too). It is `image[2]` for a MembershipCertV1 image and the last
 	// element for promotion / demotion (see `sig/payloads.ts`).
+	// NOTE: this reads the notice epoch positionally as the LAST element — `sig/payloads.ts` deliberately keeps
+	// `cohortEpoch` last (with the newer `cohortCoord` inserted just before it) to preserve this. Do not append
+	// a field after `cohortEpoch` in those images without updating this read.
 	const currentEpochB64 = bytesToB64url(deps.currentEpoch(coord));
 	const embeddedEpoch = request.kind === "membership" ? image[2] : image[image.length - 1];
 	if (embeddedEpoch !== currentEpochB64) {
@@ -1792,10 +2397,13 @@ export type NoticeOutcome = "applied" | "untrusted" | "dropped";
  *
  * - `"undecodable"`  — the frame is neither a promotion nor a demotion notice.
  * - `"rate-limited"` — the dialing `(peer, topic)` is over its `register_rate_per_peer` ceiling.
- * - `"stale"`        — the notice's `effectiveAt` is at or below the last *applied* notice for its
- *   `(topic, tier)` (a replay / out-of-order frame); dropped before `verifyMessage`.
+ * - `"stale"`        — the notice's `effectiveAt` is at or below the last *applied* notice for its served
+ *   cohort coord (a replay / out-of-order frame); dropped before `verifyMessage`.
+ * - `"unlinked"`     — a demotion notice that did not sibling-adopt on this node (no local child-coord engine,
+ *   or that path was stale) but **did** verify + unrecord the demoting child at its parent cohort here (the
+ *   parent-unlink path). Distinct from `"applied"` (a sibling-adopt) so a test can assert the parent-only case.
  */
-export type InboundNoticeResult = NoticeOutcome | "undecodable" | "rate-limited" | "stale";
+export type InboundNoticeResult = NoticeOutcome | "undecodable" | "rate-limited" | "stale" | "unlinked";
 
 /**
  * Node-level anti-abuse state for the `promote` handler (`cohort-topic-promote-handler-verify-amplification`).
@@ -1809,10 +2417,12 @@ export interface PromoteGate {
 	 */
 	readonly rateLimiter: RegisterRateLimiter;
 	/**
-	 * Per-`(topicId, tier)` high-water of the last *applied* notice's `effectiveAt`. A notice at or below the
-	 * water is a replay / out-of-order frame and is dropped before verification. Updated **only** on an
-	 * `"applied"` outcome (never on an unverified frame), so a forged notice carrying `effectiveAt = Infinity`
-	 * cannot poison the water and lock out legitimate notices.
+	 * Per-served-coord high-water (key: `` `${cohortCoord}|${tier}` ``) of the last *applied* notice's
+	 * `effectiveAt`. A notice at or below the water is a replay / out-of-order frame and is dropped before
+	 * verification. Keyed by the served coord — not `(topic, tier)` — so two sibling cohorts a node serves for
+	 * one `(topic, tier)` do not share an entry (an applied notice for one must not stale-drop a legitimate
+	 * notice for the other). Updated **only** on an `"applied"` outcome (never on an unverified frame), so a
+	 * forged notice carrying `effectiveAt = Infinity` cannot poison the water and lock out legitimate notices.
 	 *
 	 * **Bounded.** An {@link LruMap} capped at {@link PROMOTE_HIGHWATER_MAX_KEYS} so the retain-forever shape
 	 * cannot leak on a long-lived node. Unlike the limiter this is *not* attacker-growable (it is written only
@@ -1827,7 +2437,7 @@ export interface PromoteGate {
 }
 
 /**
- * Hard cap on tracked `(topicId, tier)` high-water entries; the least-recently-touched are evicted beyond
+ * Hard cap on tracked per-served-coord high-water entries; the least-recently-touched are evicted beyond
  * this. A modest bound is plenty — only verified applies grow the map, so it never evicts under legitimate
  * load — but it caps the otherwise retain-forever shape on a long-lived node.
  */
@@ -1840,13 +2450,15 @@ export function createPromoteGate(rateLimiterConfig?: RegisterRateLimiterConfig)
 
 /**
  * The slice of a {@link CoordEngine} the inbound notice path needs: the cohort coord the signers should
- * belong to (for verification) and the apply hooks. {@link CoordEngine} satisfies this; tests can pass a
- * minimal stand-in.
+ * belong to (for verification), the sibling-adopt apply hooks, and — for the demotion parent-unlink path
+ * ({@link applyDemotionUnlinkAtParent}) — {@link CoordEngine.unrecordChild}. {@link CoordEngine} satisfies
+ * this; tests can pass a minimal stand-in.
  */
 export interface NoticeApplyTarget {
 	readonly servedCoord: RingCoord;
 	applyPromotionNotice(notice: PromotionNoticeV1, now: number): void;
 	applyDemotionNotice(notice: DemotionNoticeV1, now: number): void;
+	unrecordChild(topicId: Uint8Array, childCohortCoord: Uint8Array, effectiveAt: number): void;
 }
 
 /**
@@ -1880,8 +2492,8 @@ export const PROMOTE_REFETCH_MIN_INTERVAL_MS = 60_000;
  * Verify an inbound notice's threshold signature against the cohort `MembershipCertV1` for
  * `target.servedCoord` and, on success, apply it to the target's promotion lifecycle. Returns:
  *
- * - `"dropped"`  — no local engine serves the notice's `(topic, tier)` (e.g. a demotion arriving at a
- *   parent that does not track the child); nothing to apply to.
+ * - `"dropped"`  — no local engine serves the notice's carried `cohortCoord` (e.g. a demotion arriving at a
+ *   parent-only node that does not serve the demoting child's coord); nothing to apply to.
  * - `"untrusted"` — the `signers` are not a `≥ minSigs` subset of the cohort cert, or the multisig does
  *   not verify (a forged single-signer / short-quorum notice); local state is left unchanged.
  * - `"applied"`  — verified and applied.
@@ -1934,6 +2546,60 @@ export async function verifyAndApplyNotice(
 	return "applied";
 }
 
+/** Outcome of {@link applyDemotionUnlinkAtParent}. */
+export type ParentUnlinkOutcome = "unlinked" | "no-parent" | "untrusted";
+
+/**
+ * Parent-side apply of a demotion notice: release (unrecord) the demoting child at its parent cohort. A
+ * demoting child threshold-signs its {@link DemotionNoticeV1} and fans it to **both** its own served coord
+ * (siblings adopt `promoted = false` via {@link verifyAndApplyNotice}) and its `parentCohortCoord`. This is the
+ * second, independent apply semantics at the parent: resolve the parent engine at `parentCohortCoord`, verify
+ * the notice's threshold signature against the **child** cohort cert (identical verify to the sibling-adopt —
+ * signers ⊆ the child cohort cert at the notice's `tier`, keyed by the child's `cohortCoord`), and on
+ * `verified` call `parent.unrecordChild(topicId, cohortCoord, effectiveAt)`.
+ *
+ * Returns:
+ * - `"no-parent"` — this node does not serve `parentCohortCoord`; nothing to unrecord (a pure sibling-adopt node).
+ * - `"untrusted"` — the signature does not verify against the child cohort cert (a forged / under-quorum notice).
+ * - `"unlinked"`  — verified; the child was unrecorded (or was already released — the child registry's own
+ *   per-`(topic, childCoord)` freshness makes a replay an idempotent no-op).
+ *
+ * **Freshness is the child registry's, not the promote-gate high-water.** The sibling-adopt high-water is keyed
+ * by the child coord and advanced only on a sibling-adopt `"applied"`; the unlink is ordered independently by
+ * the child registry's per-child `lastEffectiveAt`, so a demotion that is a stale no-op for the sibling-adopt
+ * target still applies the unlink at the parent, and vice-versa. The verify carries the same
+ * {@link PROMOTE_REFETCH_MIN_INTERVAL_MS} bound as the sibling-adopt, so it cannot amplify into dials.
+ */
+export async function applyDemotionUnlinkAtParent(
+	notice: DemotionNoticeV1,
+	registry: CoordRegistry,
+	verifier: MembershipVerifier,
+	now: number,
+): Promise<ParentUnlinkOutcome> {
+	const parent = registry.findByCoord(b64urlToBytes(notice.parentCohortCoord));
+	if (parent === undefined) {
+		return "no-parent";
+	}
+	let signers: Uint8Array[];
+	let sig: Uint8Array;
+	try {
+		signers = notice.signers.map(b64urlToBytes);
+		sig = b64urlToBytes(notice.thresholdSig);
+	} catch {
+		return "untrusted"; // a signer / sig that is not valid base64url cannot verify
+	}
+	// Verify against the CHILD cohort cert (the demoting cohort's served coord `notice.cohortCoord`), NOT the
+	// parent's — the demotion is threshold-signed by the child cohort. Same bounded refetch as the sibling-adopt.
+	const payload = demotionNoticeSigningPayload(notice);
+	const result = await verifier.verifyMessage(signers, b64urlToBytes(notice.cohortCoord), notice.tier, payload, sig, { minRefetchIntervalMs: PROMOTE_REFETCH_MIN_INTERVAL_MS, now });
+	if (result !== "verified") {
+		return "untrusted";
+	}
+	// `cohortCoord` is the child's served coord — the key the parent recorded the child under.
+	parent.unrecordChild(b64urlToBytes(notice.topicId), b64urlToBytes(notice.cohortCoord), notice.effectiveAt);
+	return "unlinked";
+}
+
 /**
  * Full inbound `promote`-frame pipeline with the anti-abuse gate, exported so it is unit-testable without a
  * live node (`cohort-topic-promote-handler-verify-amplification`). Runs the cheapest checks first — each
@@ -1941,14 +2607,27 @@ export async function verifyAndApplyNotice(
  * work:
  *
  * ```
- *   decode → per-(peer,topic) rate limit → findServing → effectiveAt high-water → verify+apply
+ *   decode → per-(peer,topic) rate limit → resolve engine by carried cohortCoord → effectiveAt high-water → verify+apply
+ *                                                                                                          ↘ (demotion) parent-unlink at parentCohortCoord
  * ```
  *
+ * A **demotion** carries a second, independent apply semantics: beyond the sibling-adopt above, it also
+ * releases the demoting child at its parent cohort ({@link applyDemotionUnlinkAtParent}). Both paths may fire
+ * on one node (one that serves both the child coord and the parent coord). The parent-unlink runs OUTSIDE the
+ * sibling-adopt high-water (which is keyed by the child coord and would otherwise stale-drop the parent-coord
+ * frame after the child-coord frame advanced it); its freshness is the child registry's own per-child key.
+ * `"unlinked"` is returned when the unlink fired but the sibling-adopt did not (a parent-only node).
+ *
  * - **Rate limit** (`gate.rateLimiter`) keys on `(from, topicId)`; an over-rate peer is dropped before the
- *   `findServing` map scan and the verify, so a peer cannot amplify junk into verify/network work.
- * - **High-water** (`gate.highWater`, per `(topicId, tier)`) drops a notice whose `effectiveAt` is at or
- *   below the last *applied* one — a replay / out-of-order frame — before `verifyMessage`. It is advanced
- *   **only** on an `"applied"` outcome, so a forged frame (which never verifies) cannot poison it.
+ *   coord lookup and the verify, so a peer cannot amplify junk into verify/network work.
+ * - **Resolve engine by `cohortCoord`** ({@link CoordRegistry.findByCoord}) — the exact served coord the
+ *   notice was decided for, covered by its signature. A node serving several sibling cohorts for one
+ *   `(topic, tier)` applies the notice to the cohort that produced it, never a first-match `(topic, tier)`
+ *   scan; a coord this node does not serve is dropped.
+ * - **High-water** (`gate.highWater`, keyed per served `cohortCoord`) drops a notice whose `effectiveAt` is
+ *   at or below the last *applied* one — a replay / out-of-order frame — before `verifyMessage`. It is
+ *   advanced **only** on an `"applied"` outcome, so a forged frame (which never verifies) cannot poison it.
+ *   Keying by coord (not `(topic, tier)`) keeps two sibling cohorts on one node from sharing a water.
  * - The receiver-side `cohortEpoch` is intentionally **not** gated on: the epoch rotates on every
  *   membership change, so a legitimately in-flight notice can briefly carry the prior epoch right after a
  *   rotation — making an epoch check a brittle, false-positive-prone filter. The rate limiter + high-water
@@ -1975,34 +2654,68 @@ export async function handleInboundNotice(
 	const tier = inbound.kind === "promotion" ? inbound.notice.fromTier : inbound.notice.tier;
 	const topicId = b64urlToBytes(inbound.notice.topicId);
 
-	// Per-(peer, topic) rate limit — before the findServing scan and the verify.
+	// Per-(peer, topic) rate limit — before the coord lookup and the verify.
 	if (gate.rateLimiter.check(from, topicId, now).ok === false) {
 		log("promote: rate-limited %s notice for topic %s tier %d", inbound.kind, inbound.notice.topicId, tier);
 		return "rate-limited";
 	}
 
-	const target = registry.findServing(topicId, tier);
+	// --- Sibling-adopt path: apply to the cohort that produced the notice (its signed `cohortCoord`). ---
+	// Route by the notice's signed `cohortCoord` — the exact served coord the deciding cohort sits at. A node
+	// serving several sibling cohorts for one `(topic, tier)` (possible at `d ≥ 1`) thus applies the notice to
+	// the cohort that produced it, and `verifyAndApplyNotice` verifies against that same coord's cert. The coord
+	// is covered by the threshold signature, so it cannot be rewritten to hijack a sibling. A coord this node
+	// does not serve → `dropped` here (e.g. a demotion fanned to a parent-only node — the parent-unlink path
+	// below still runs).
+	const target = registry.findByCoord(b64urlToBytes(inbound.notice.cohortCoord));
+	let siblingOutcome: InboundNoticeResult;
 	if (target === undefined) {
-		log("promote: dropped %s notice for topic %s tier %d (no serving engine)", inbound.kind, inbound.notice.topicId, tier);
-		return "dropped";
+		siblingOutcome = "dropped";
+	} else {
+		// Freshness / replay gate: drop an at-or-below-high-water notice before the expensive verify. Keyed by the
+		// served coord (which uniquely identifies the cohort) so two sibling cohorts on one node do not share a
+		// high-water — an applied notice for cohort A must not stale-drop a legitimate cohort-B notice. `tier` is
+		// kept in the key only for readability.
+		const waterKey = `${inbound.notice.cohortCoord}|${tier}`;
+		const water = gate.highWater.get(waterKey);
+		if (water !== undefined && inbound.notice.effectiveAt <= water) {
+			log("promote: stale %s notice for topic %s tier %d (effectiveAt %d <= high-water %d)", inbound.kind, inbound.notice.topicId, tier, inbound.notice.effectiveAt, water);
+			siblingOutcome = "stale";
+		} else {
+			siblingOutcome = await verifyAndApplyNotice(inbound, target, verifier, now);
+			if (siblingOutcome === "applied") {
+				// Advance the high-water only on a *verified-and-applied* notice, so a forged frame cannot poison it.
+				gate.highWater.set(waterKey, inbound.notice.effectiveAt);
+			} else {
+				log("promote: %s %s notice for topic %s tier %d", siblingOutcome, inbound.kind, inbound.notice.topicId, tier);
+			}
+		}
 	}
 
-	// Freshness / replay gate: drop an at-or-below-high-water notice before the expensive verify.
-	const waterKey = `${inbound.notice.topicId}|${tier}`;
-	const water = gate.highWater.get(waterKey);
-	if (water !== undefined && inbound.notice.effectiveAt <= water) {
-		log("promote: stale %s notice for topic %s tier %d (effectiveAt %d <= high-water %d)", inbound.kind, inbound.notice.topicId, tier, inbound.notice.effectiveAt, water);
-		return "stale";
+	if (inbound.kind !== "demotion") {
+		return siblingOutcome;
 	}
 
-	const outcome = await verifyAndApplyNotice(inbound, target, verifier, now);
-	if (outcome === "applied") {
-		// Advance the high-water only on a *verified-and-applied* notice, so a forged frame cannot poison it.
-		gate.highWater.set(waterKey, inbound.notice.effectiveAt);
-	} else {
-		log("promote: %s %s notice for topic %s tier %d", outcome, inbound.kind, inbound.notice.topicId, tier);
+	// --- Parent-unlink path (demotion only): additionally release the demoting child at its parent cohort. ---
+	// A demotion is fanned to BOTH the child coord (sibling-adopt, above) and the parent coord (this unlink),
+	// arriving as two independent frames. This path is deliberately OUTSIDE the sibling-adopt high-water: that
+	// water is keyed by the child coord and advanced only on a sibling-adopt apply, so — on a node serving both
+	// coords — the child-coord frame would advance the water and stale-drop the parent-coord frame before it
+	// could unrecord. The child registry's own per-`(topic, childCoord)` freshness orders the unlink instead, so
+	// a replay is an idempotent no-op. The verify is against the child cohort cert (same as the sibling-adopt),
+	// so a forged demotion cannot unrecord.
+	const unlink = await applyDemotionUnlinkAtParent(inbound.notice, registry, verifier, now);
+	if (siblingOutcome === "applied") {
+		return "applied"; // a node serving both coords: the sibling-adopt is the primary reported outcome
 	}
-	return outcome;
+	if (unlink === "unlinked") {
+		return "unlinked";
+	}
+	if (unlink === "untrusted") {
+		log("promote: untrusted demotion notice at parent for topic %s tier %d", inbound.notice.topicId, tier);
+		return "untrusted";
+	}
+	return siblingOutcome;
 }
 
 /**
@@ -2036,7 +2749,7 @@ function crossCheckCohort(fret: FretService, wantK: number, servedCoord: RingCoo
 	}
 }
 
-/** Positional equality over two string lists (the first-`k − x` rotation-change check). */
+/** Positional equality over two string lists (the endorser's sorted-member-list image check). */
 function sameStringOrder(a: readonly string[], b: readonly string[]): boolean {
 	if (a.length !== b.length) {
 		return false;
@@ -2080,23 +2793,33 @@ async function registerProtocolHandlers(
 	protocols: CohortTopicProtocols,
 	registry: CoordRegistry,
 	dispatchRegister: (reg: RegisterV1, fretCohort: readonly string[] | undefined, now: number) => Promise<RegisterReplyV1>,
+	/** Parent-side child-link dispatch deps + the quorum bound used to structurally validate an inbound link. */
+	childLinkDeps: DispatchChildLinkDeps,
+	minSigs: number,
 	signEndorse: (request: SignRequestV1, fromPeerStr: string) => Promise<SignReplyV1>,
 	verifier: MembershipVerifier,
 	promoteGate: PromoteGate,
 	gossipTransport: FretCohortGossipTransport,
+	/** Instantiate a cold sibling's coord engine off a verified co-member frame (§Cold-start instantiation). */
+	maybeInstantiateColdSibling: (frame: Uint8Array) => void,
 	publishSink: FretMembershipPublishSink,
 	membershipSource: FretMembershipSource,
 	selfCoord: RingCoord,
 	maxBytes: number,
 ): Promise<void> {
 	await Promise.all([
-		// register: a direct dial carries either a RegisterV1 (re-attach walk fallback) or a RenewV1 (ping).
+		// register: a direct dial carries a RenewV1 (ping), a ChildLinkV1 (a child cohort registering with this
+		// parent), or a RegisterV1 (re-attach walk fallback). The three shapes are disjoint, so try each in turn.
 		node.handle(protocols.register, makeFrameHandler(async (frame): Promise<Uint8Array | undefined> => {
 			const decoded = decodeCohortMessage(frame, maxBytes);
 			const renew = tryValidate(() => validateRenewV1(decoded));
 			if (renew !== undefined) {
 				return encodeCohortMessage(resolveRenew(registry, renew, Date.now()), maxBytes);
 			}
+			const link = tryValidate(() => validateChildLinkV1(decoded, minSigs));
+			if (link !== undefined) {
+				return encodeCohortMessage(await dispatchChildLink(link, childLinkDeps, Date.now()), maxBytes);
+			}
 			const reg = validateRegisterV1(decoded);
 			// Direct dial (not FRET-routed): no cohort member list to cross-check against.
 			const reply = await dispatchRegister(reg, undefined, Date.now());
@@ -2105,7 +2828,10 @@ async function registerProtocolHandlers(
 
 		// cohort-gossip: feed inbound gossip into the shared transport (one-way). It fans the frame to
 		// every coord engine's bus; per-bus epoch matching governs which engine merges the record deltas.
+		// First, if this is a verified co-member frame for a coord we hold no engine for, instantiate that
+		// engine (§Cold-start instantiation) so its freshly-subscribed bus merges this very frame on `deliver`.
 		node.handle(protocols.gossip, makeFrameHandler(async (frame, from): Promise<Uint8Array | undefined> => {
+			maybeInstantiateColdSibling(frame);
 			gossipTransport.deliver(from.toString(), frame);
 			return undefined;
 		}, maxBytes)),