@serfab/cadre-core 0.10.0 → 0.12.0

package/dist/strand-membership-writer.d.ts

@@ -414,8 +414,8 @@ export interface RevokeMemberParams {
  * A manager must resign its `Manager` row before (or in the same transaction
  * as) losing membership — `Member.NotAManager` rejects un-membering a key that
  * still holds a Manager row. And the strand never drops to zero members
- * (`Member.MinOneMember`, a local-count floor with the same cross-node caveat
- * as `MinOneManager`).
+ * (`Member.MinOneMember`, a local-count floor with the cross-node caveat its
+ * schema NOTE states).
  *
  * @param db - The closed strand's database.
  * @param params - The revoking manager keypair and the target member key.
@@ -722,18 +722,26 @@ export interface RemoveManagerParams {
  * The caller selects the case purely by which keypair it passes; the only
  * branching here is the action tag, chosen by comparing the signer to the target.
  *
- * The optimystic bootstrap-mode transactor evaluates deferred (subquery-bearing)
- * CHECK constraints on DELETE as well as INSERT, so `Manager.Authorized` — deferred —
- * IS enforced here: a signer that is neither an existing manager nor the target
- * itself is rejected at commit.
- *
- * THE LAST MANAGER CANNOT BE REMOVED. `Manager.MinOneManager` (`check on delete`,
- * deferred, so it sees the POST-delete count) rejects any delete that would leave the
- * strand with zero managers — an admin-less closed strand could never admit anyone
- * again, since `Invite`, `addMemberByManager`, and `addManager` all require a
- * `Manager` row. The bootstrap branch of `Manager.Authorized` is gated to INSERTs
+ * Deferred (subquery-bearing) CHECK constraints are evaluated on DELETE as well
+ * as INSERT by Quereus plus the Optimystic vtab session — enforcement lives above
+ * the transactor (proven on the network transactor by
+ * `strand-membership-network-transactor-parity.spec.ts`), so `Manager.Authorized`
+ * — deferred — IS enforced here: a signer that is neither an existing manager nor
+ * the target itself is rejected at commit.
+ *
+ * THE SOLE MANAGER CANNOT ORDINARILY RESIGN — it SEALS instead. The `'resign'`
+ * branch of `Manager.Authorized` requires at least one manager in the POST-delete
+ * image, so a resignation that would empty the `Manager` table is schema-rejected;
+ * emptying it deliberately is a distinct, self-signed act — {@link sealStrand} —
+ * that permanently freezes admission. This writer refuses the sole-manager
+ * self-resignation up front with an error naming `sealStrand`; that TS guard is UX,
+ * not the trust boundary — the schema rejects a mis-counted `'resign'` approval
+ * regardless. Reading the count inside a caller-joined transaction is correct: an
+ * add-then-resign hand-off composed in one transaction sees 2 and passes, while
+ * the already-rejected delete-then-add swap sees 1 and is refused here as well as
+ * by the schema. The bootstrap branch of `Manager.Authorized` is gated to INSERTs
  * (`old.MemberKey is null`), so it does not waive the signature check on a delete
- * that drops the count toward the floor: a second-to-last removal is authorized
+ * that drops the count toward zero: a second-to-last removal is authorized
  * exactly like any other.
  *
  * HAND-OFF ORDER: a sole manager transferring control must ADD the successor FIRST
@@ -742,14 +750,100 @@ export interface RemoveManagerParams {
  * successor's insert has no other manager to authorize it once the sole manager's
  * row is gone.
  *
- * Cross-node caveat: `MinOneManager` counts rows visible to THIS transaction, so two
- * nodes concurrently removing different managers can each see a survivor and still
- * converge to zero. Noted in the schema; a cross-node floor is not attempted here.
+ * Cross-node caveat: the `'resign'`/`'seal'` branches count rows visible to THIS
+ * transaction, so two nodes concurrently removing different managers can each see
+ * a survivor and still converge to zero — an unintended seal. Noted in the schema
+ * (the `Manager` table's seal-propagation NOTE); a cross-node floor is not
+ * attempted here.
  *
  * @param db - The closed strand's database.
  * @param params - The authorizing keypair and the target manager key.
- * @throws If `Manager.Authorized` rejects (a signer that is neither another existing
- *   manager nor the target itself) or `Manager.MinOneManager` rejects (the removal
- *   would leave no managers); the whole delete+tombstone transaction rolls back.
+ * @throws If the signer IS the target and it is the sole manager (before writing —
+ *   the operation the caller wants is {@link sealStrand}), or if `Manager.Authorized`
+ *   rejects (a signer that is neither another existing manager nor the target
+ *   itself, or a raw sole-manager `'resign'` whose post-image count is zero); the
+ *   whole delete+tombstone transaction rolls back.
  */
 export declare function removeManager(db: Database, params: RemoveManagerParams): Promise<void>;
+/** Parameters for {@link sealStrand}. */
+export interface SealStrandParams {
+    /**
+     * The SOLE manager's strand keypair. Its `publicKeyB64` must be the one live
+     * `Strand.Manager` row; it signs the seal-tagged digest over its own key and
+     * live stamp, and files the accompanying tombstone (it is still a committed
+     * member, which is what `Revocation.Authorized` checks).
+     */
+    managerKeyPair: Ed25519KeyPair;
+}
+/**
+ * Seal the strand: the SOLE manager deliberately steps down, permanently freezing
+ * membership.
+ *
+ * A sealed strand has zero `Manager` rows, and every admission path — issuing or
+ * cancelling an invitation, consuming one issued BEFORE the seal
+ * (`ConsumedInvite.NotSealed`), admitting a member, promoting a manager — requires
+ * one, so nobody can ever be let in again. That freeze is a privacy guarantee to
+ * everyone who contributed: no key holds the power to admit a party who would then
+ * read the strand's whole history. Sealing is irreversible — the founding branch
+ * of `Manager.Authorized` closes for good once any manager stamp is retired into
+ * `Strand.Revocation`. What remains possible: members may {@link leaveStrand}
+ * (floored by `MinOneMember`), manage their own `MemberPeer` rows, and file
+ * `Revocation` tombstones.
+ *
+ * The `'seal'` branch of `Manager.Authorized` accepts a self-signed delete only
+ * when the POST-image manager count is ZERO — a distinct action tag from
+ * `'resign'`, so a captured resignation approval can never seal and a raw writer
+ * cannot seal by accident. Like {@link removeManager}, the delete pairs with its
+ * `Strand.Revocation` tombstone in one transaction.
+ *
+ * The TS count/identity checks below are UX guards, not the trust boundary — the
+ * schema rejects a mis-tagged or mis-counted approval regardless of what this
+ * writer (or any raw writer) presents.
+ *
+ * NOTE: a seal approval is a bearer token for its row incarnation, like every other
+ * self-signed approval here — but the `'seal'` branch's post-image count of 0 is
+ * satisfied for EVERY row deleted in the same transaction, so N managers each
+ * presenting a valid `'seal'` approval seal jointly (pinned as an accepted case in
+ * `strand-seal.spec.ts`). Unreachable today: this writer mints a seal signature only
+ * while its caller is the SOLE manager, and spends it immediately, so a second
+ * manager never has one to combine. If seal-approval MINTING is ever split from
+ * spending — offline signing, a two-phase seal, a queued approval — one manager
+ * holding another's unspent seal approval could freeze the strand irreversibly
+ * without its current consent; re-gate here (or narrow the schema branch) then.
+ *
+ * @param db - The closed strand's database.
+ * @param params - The sole manager's own keypair.
+ * @throws If more than one manager exists (the caller wants {@link removeManager}),
+ *   or the supplied keypair holds no `Manager` row while one exists, or the strand
+ *   holds no `Manager` row and has never retired one (not founded yet — see
+ *   {@link isStrandSealed}), or any schema constraint rejects; the whole
+ *   delete+tombstone transaction rolls back. A strand that is ALREADY sealed logs
+ *   and returns quietly (restart-safe, matching {@link bootstrapFounderMembership}
+ *   and {@link removeManager}'s absent-row no-op).
+ */
+export declare function sealStrand(db: Database, params: SealStrandParams): Promise<void>;
+/**
+ * Whether the strand is sealed: a CLOSED strand that holds no `Manager` rows AND
+ * has retired at least one `Manager` stamp into `Strand.Revocation`.
+ *
+ * All three conjuncts are load-bearing:
+ * - `Header.Type` — an OPEN strand never holds `Manager` rows at all
+ *   (`Manager.OnlyClosed`), so a bare manager-count test would report every open
+ *   strand as sealed.
+ * - the manager count — sealing IS the empty `Manager` table.
+ * - the retired `Manager` stamp — "sealed" means admission is frozen FOREVER, and
+ *   what makes it permanent is the founding branch of `Manager.Authorized`
+ *   refusing to re-seat a generation-0 manager once any `Manager` stamp has been
+ *   retired. Without this conjunct a closed strand that is merely NOT FOUNDED YET
+ *   reads as sealed: {@link bootstrapFounderMembership} commits `Header`,
+ *   `Member` and `Manager` as three sequential statements, so the window between
+ *   the first and the last is exactly "closed, zero managers, still foundable".
+ *
+ * Reads locally visible rows — a node that has not yet converged on the seal
+ * still reports `false` (the schema's seal-propagation NOTE).
+ *
+ * @param db - The strand's database.
+ * @returns `true` iff the strand is closed, holds zero `Manager` rows, and has
+ *   permanently closed its founding branch.
+ */
+export declare function isStrandSealed(db: Database): Promise<boolean>;

package/dist/strand-membership-writer.js

@@ -175,8 +175,8 @@ async function inStrandTransaction(db, fn) {
  */
 async function insertRevocation(db, tableName, stampId, retiree) {
     const signature = signStrandApproval(['Strand.Revocation', 'retire', tableName, stampId], retiree.privateKeyB64);
-    await db.exec(`insert into Strand.Revocation (TableName, StampId)
-       with context MemberKey = ?, Signature = ?
+    await db.exec(`insert into Strand.Revocation (TableName, StampId)
+       with context MemberKey = ?, Signature = ?
        values (?, ?)`, [retiree.publicKeyB64, signature, tableName, stampId]);
 }
 /**
@@ -192,6 +192,27 @@ async function strandTableCount(db, table) {
     }
     return 0;
 }
+/**
+ * Whether any `Strand.Revocation` row has ever retired a `Manager` seat — the
+ * exact condition that permanently closes the founding branch of
+ * `Manager.Authorized` (see the schema's bootstrap-branch comment). Unfiltered
+ * scan + JavaScript comparison, the module's scan-not-seek idiom (rationale on
+ * {@link scanMemberPeers}).
+ *
+ * NOTE: walks the whole append-only `Strand.Revocation` table when no `Manager`
+ * tombstone is present (it returns on the first one it finds). Cheap at strand
+ * scale; if membership churn ever makes that table large — the growth the
+ * `Revocation` schema comment already flags, tracked by `debt-strand-tombstone-reap`
+ * — this wants a stored "founding closed" marker rather than a scan per call.
+ */
+async function strandHasManagerRevocation(db) {
+    for await (const row of db.eval('select TableName from Strand.Revocation')) {
+        if (row.TableName === 'Manager') {
+            return true;
+        }
+    }
+    return false;
+}
 /**
  * Insert the singleton `Strand.Header` if absent.
  *
@@ -206,8 +227,8 @@ async function insertHeaderIfAbsent(db, params) {
         log('Header already present for strand %s; skipping', params.strandId);
         return;
     }
-    await db.exec(`insert into Strand.Header
-       (Id, Type, sAppId, sAppVersion, sAppSchema, sAppSignature, Engine, EngineVersion)
+    await db.exec(`insert into Strand.Header
+       (Id, Type, sAppId, sAppVersion, sAppSchema, sAppSignature, Engine, EngineVersion)
        values (?, ?, ?, ?, ?, ?, ?, ?)`, [
         params.strandId,
         params.type,
@@ -237,8 +258,8 @@ async function insertFounderMemberIfAbsent(db, memberKey, strandId) {
         log('Member already present for strand %s; skipping founder Member', strandId);
         return;
     }
-    await db.exec(`insert into Strand.Member (Key, StampId)
-       with context ManagerKey = null, ManagerSignature = null, MemberSignature = null
+    await db.exec(`insert into Strand.Member (Key, StampId)
+       with context ManagerKey = null, ManagerSignature = null, MemberSignature = null
        values (?, ?)`, [memberKey, generateStrandStampId()]);
     log('Inserted founding Member for strand %s', strandId);
 }
@@ -260,14 +281,27 @@ async function insertFounderMemberIfAbsent(db, memberKey, strandId) {
  * `Manager.OnlyClosed` is a deferred (subquery) check evaluated at commit. The
  * sequential auto-commit Header→Member→Manager order in
  * {@link bootstrapFounderMembership} satisfies both.
+ *
+ * SEALED strands are skipped, not re-founded: a strand whose sole manager has
+ * {@link sealStrand}ed also has zero `Manager` rows, but its founding branch is
+ * closed for good (the schema's bootstrap branch requires no `Manager`-table
+ * `Revocation` row to exist). Attempting the founding insert here would be
+ * schema-rejected and turn every founder restart of a sealed strand into a
+ * loud failure — so this mirrors the schema's own gate and returns quietly.
+ * A crash BETWEEN the founding Member and Manager inserts leaves no Revocation
+ * rows at all, so that restart still completes the founding.
  */
 async function insertFounderManagerIfAbsent(db, memberKey, strandId) {
     if (await strandTableCount(db, 'Manager') > 0) {
         log('Manager already present for strand %s; skipping founder Manager', strandId);
         return;
     }
-    await db.exec(`insert into Strand.Manager (MemberKey, Generation, StampId)
-       with context ManagerKey = null, Signature = null
+    if (await strandHasManagerRevocation(db)) {
+        log('Strand %s has retired a manager seat (sealed); skipping founder Manager', strandId);
+        return;
+    }
+    await db.exec(`insert into Strand.Manager (MemberKey, Generation, StampId)
+       with context ManagerKey = null, Signature = null
        values (?, 0, ?)`, [memberKey, generateStrandStampId()]);
     log('Inserted founding Manager for strand %s', strandId);
 }
@@ -348,8 +382,8 @@ export async function issueInvite(db, params) {
     const payload = `${inviteKey}|${expirationSegment}`;
     const managerSignature = signStrandPayload(payload, managerKeyPair.privateKeyB64);
     const inviteSignature = signStrandPayload(payload, invitePrivateKey);
-    await db.exec(`insert into Strand.Invite (Key, Expiration)
-       with context ManagerKey = ?, ManagerSignature = ?, InviteSignature = ?
+    await db.exec(`insert into Strand.Invite (Key, Expiration)
+       with context ManagerKey = ?, ManagerSignature = ?, InviteSignature = ?
        values (?, ?)`, [managerKeyPair.publicKeyB64, managerSignature, inviteSignature, inviteKey, expirationColumn]);
     log('Issued invite %s (expires=%s)', inviteKey, expirationColumn ?? 'never');
     return { inviteKey, invitePrivateKey };
@@ -409,13 +443,13 @@ export async function consumeInvite(db, params) {
     await inStrandTransaction(db, async () => {
         // 1. Member — admitted by the deferred invite branch (the matching
         //    ConsumedInvite below), so no manager signature is supplied.
-        await db.exec(`insert into Strand.Member (Key, StampId)
-         with context ManagerKey = null, ManagerSignature = null, MemberSignature = null
+        await db.exec(`insert into Strand.Member (Key, StampId)
+         with context ManagerKey = null, ManagerSignature = null, MemberSignature = null
          values (?, ?)`, [memberKey, generateStrandStampId()]);
         // 2. ConsumedInvite — proves possession of the invite private key and that the
         //    invite has not expired (NotExpired gate against the canonical Now).
-        await db.exec(`insert into Strand.ConsumedInvite (InviteKey, MemberKey)
-         with context InviteSignature = ?, Now = ?
+        await db.exec(`insert into Strand.ConsumedInvite (InviteKey, MemberKey)
+         with context InviteSignature = ?, Now = ?
          values (?, ?)`, [inviteSignature, nowCanonical, inviteKey, memberKey]);
     });
     log('Consumed invite %s -> member %s', inviteKey, memberKey);
@@ -485,8 +519,8 @@ export async function cancelInvite(db, params) {
         return;
     }
     const signature = signStrandApproval(['Strand.CancelledInvite', 'cancel', inviteKey], managerKeyPair.privateKeyB64);
-    await db.exec(`insert into Strand.CancelledInvite (InviteKey)
-       with context ManagerKey = ?, ManagerSignature = ?
+    await db.exec(`insert into Strand.CancelledInvite (InviteKey)
+       with context ManagerKey = ?, ManagerSignature = ?
        values (?)`, [managerKeyPair.publicKeyB64, signature, inviteKey]);
     log('Cancelled invite %s by manager %s', inviteKey, managerKeyPair.publicKeyB64);
 }
@@ -581,8 +615,8 @@ export async function addMemberByManager(db, params) {
     const { managerKeyPair, memberKey } = params;
     const stampId = generateStrandStampId();
     const signature = signStrandApproval(['Strand.Member', 'add', memberKey, stampId], managerKeyPair.privateKeyB64);
-    await db.exec(`insert into Strand.Member (Key, StampId)
-       with context ManagerKey = ?, ManagerSignature = ?, MemberSignature = null
+    await db.exec(`insert into Strand.Member (Key, StampId)
+       with context ManagerKey = ?, ManagerSignature = ?, MemberSignature = null
        values (?, ?)`, [managerKeyPair.publicKeyB64, signature, memberKey, stampId]);
     log('Admitted member %s by manager %s', memberKey, managerKeyPair.publicKeyB64);
 }
@@ -619,8 +653,8 @@ export async function addMemberByManager(db, params) {
  * A manager must resign its `Manager` row before (or in the same transaction
  * as) losing membership — `Member.NotAManager` rejects un-membering a key that
  * still holds a Manager row. And the strand never drops to zero members
- * (`Member.MinOneMember`, a local-count floor with the same cross-node caveat
- * as `MinOneManager`).
+ * (`Member.MinOneMember`, a local-count floor with the cross-node caveat its
+ * schema NOTE states).
  *
  * @param db - The closed strand's database.
  * @param params - The revoking manager keypair and the target member key.
@@ -638,8 +672,8 @@ export async function revokeMember(db, params) {
     }
     const signature = signStrandApproval(['Strand.Member', 'remove', memberKey, stampId], managerKeyPair.privateKeyB64);
     await inStrandTransaction(db, async () => {
-        await db.exec(`delete from Strand.Member
-         with context ManagerKey = ?, ManagerSignature = ?, MemberSignature = null
+        await db.exec(`delete from Strand.Member
+         with context ManagerKey = ?, ManagerSignature = ?, MemberSignature = null
          where Key = ?`, [managerKeyPair.publicKeyB64, signature, memberKey]);
         await insertRevocation(db, 'Member', stampId, managerKeyPair);
     });
@@ -674,8 +708,8 @@ export async function leaveStrand(db, params) {
     }
     const signature = signStrandApproval(['Strand.Member', 'leave', memberKey, stampId], memberKeyPair.privateKeyB64);
     await inStrandTransaction(db, async () => {
-        await db.exec(`delete from Strand.Member
-         with context ManagerKey = null, ManagerSignature = null, MemberSignature = ?
+        await db.exec(`delete from Strand.Member
+         with context ManagerKey = null, ManagerSignature = null, MemberSignature = ?
          where Key = ?`, [signature, memberKey]);
         await insertRevocation(db, 'Member', stampId, memberKeyPair);
     });
@@ -723,8 +757,8 @@ export async function registerMemberPeer(db, params) {
     }
     const stampId = generateStrandStampId();
     const signature = signStrandApproval(['Strand.MemberPeer', 'add', memberKey, peerId, stampId], memberKeyPair.privateKeyB64);
-    await db.exec(`insert into Strand.MemberPeer (MemberKey, PeerId, StampId)
-       with context Signature = ?, ManagerKey = null, ManagerSignature = null
+    await db.exec(`insert into Strand.MemberPeer (MemberKey, PeerId, StampId)
+       with context Signature = ?, ManagerKey = null, ManagerSignature = null
        values (?, ?, ?)`, [signature, memberKey, peerId, stampId]);
     log('Registered MemberPeer (%s, %s)', memberKey, peerId);
 }
@@ -869,8 +903,8 @@ async function deleteOwnMemberPeer(db, params, stampId) {
     const { memberKeyPair, peerId } = params;
     const memberKey = memberKeyPair.publicKeyB64;
     const signature = signStrandApproval(['Strand.MemberPeer', 'remove', memberKey, peerId, stampId], memberKeyPair.privateKeyB64);
-    await db.exec(`delete from Strand.MemberPeer
-       with context Signature = ?, ManagerKey = null, ManagerSignature = null
+    await db.exec(`delete from Strand.MemberPeer
+       with context Signature = ?, ManagerKey = null, ManagerSignature = null
        where MemberKey = ? and PeerId = ?`, [signature, memberKey, peerId]);
     await insertRevocation(db, 'MemberPeer', stampId, memberKeyPair);
 }
@@ -878,8 +912,8 @@ async function deleteOwnMemberPeer(db, params, stampId) {
 async function deleteMemberPeerByManager(db, params, stampId) {
     const { managerKeyPair, memberKey, peerId } = params;
     const signature = signStrandApproval(['Strand.MemberPeer', 'manager-remove', memberKey, peerId, stampId], managerKeyPair.privateKeyB64);
-    await db.exec(`delete from Strand.MemberPeer
-       with context Signature = null, ManagerKey = ?, ManagerSignature = ?
+    await db.exec(`delete from Strand.MemberPeer
+       with context Signature = null, ManagerKey = ?, ManagerSignature = ?
        where MemberKey = ? and PeerId = ?`, [managerKeyPair.publicKeyB64, signature, memberKey, peerId]);
     await insertRevocation(db, 'MemberPeer', stampId, managerKeyPair);
 }
@@ -947,8 +981,8 @@ export async function addManager(db, params) {
     const generation = authorizer == null ? 1 : authorizer.generation + 1;
     const stampId = generateStrandStampId();
     const signature = signStrandApproval(['Strand.Manager', 'add', newManagerKey, generation, stampId], byManagerKeyPair.privateKeyB64);
-    await db.exec(`insert into Strand.Manager (MemberKey, Generation, StampId)
-       with context ManagerKey = ?, Signature = ?
+    await db.exec(`insert into Strand.Manager (MemberKey, Generation, StampId)
+       with context ManagerKey = ?, Signature = ?
        values (?, ?, ?)`, [byManagerKeyPair.publicKeyB64, signature, newManagerKey, generation, stampId]);
     log('Added manager %s (generation %d) by %s', newManagerKey, generation, byManagerKeyPair.publicKeyB64);
 }
@@ -1020,18 +1054,26 @@ export async function admitManager(db, params) {
  * The caller selects the case purely by which keypair it passes; the only
  * branching here is the action tag, chosen by comparing the signer to the target.
  *
- * The optimystic bootstrap-mode transactor evaluates deferred (subquery-bearing)
- * CHECK constraints on DELETE as well as INSERT, so `Manager.Authorized` — deferred —
- * IS enforced here: a signer that is neither an existing manager nor the target
- * itself is rejected at commit.
- *
- * THE LAST MANAGER CANNOT BE REMOVED. `Manager.MinOneManager` (`check on delete`,
- * deferred, so it sees the POST-delete count) rejects any delete that would leave the
- * strand with zero managers — an admin-less closed strand could never admit anyone
- * again, since `Invite`, `addMemberByManager`, and `addManager` all require a
- * `Manager` row. The bootstrap branch of `Manager.Authorized` is gated to INSERTs
+ * Deferred (subquery-bearing) CHECK constraints are evaluated on DELETE as well
+ * as INSERT by Quereus plus the Optimystic vtab session — enforcement lives above
+ * the transactor (proven on the network transactor by
+ * `strand-membership-network-transactor-parity.spec.ts`), so `Manager.Authorized`
+ * — deferred — IS enforced here: a signer that is neither an existing manager nor
+ * the target itself is rejected at commit.
+ *
+ * THE SOLE MANAGER CANNOT ORDINARILY RESIGN — it SEALS instead. The `'resign'`
+ * branch of `Manager.Authorized` requires at least one manager in the POST-delete
+ * image, so a resignation that would empty the `Manager` table is schema-rejected;
+ * emptying it deliberately is a distinct, self-signed act — {@link sealStrand} —
+ * that permanently freezes admission. This writer refuses the sole-manager
+ * self-resignation up front with an error naming `sealStrand`; that TS guard is UX,
+ * not the trust boundary — the schema rejects a mis-counted `'resign'` approval
+ * regardless. Reading the count inside a caller-joined transaction is correct: an
+ * add-then-resign hand-off composed in one transaction sees 2 and passes, while
+ * the already-rejected delete-then-add swap sees 1 and is refused here as well as
+ * by the schema. The bootstrap branch of `Manager.Authorized` is gated to INSERTs
  * (`old.MemberKey is null`), so it does not waive the signature check on a delete
- * that drops the count toward the floor: a second-to-last removal is authorized
+ * that drops the count toward zero: a second-to-last removal is authorized
  * exactly like any other.
  *
  * HAND-OFF ORDER: a sole manager transferring control must ADD the successor FIRST
@@ -1040,15 +1082,19 @@ export async function admitManager(db, params) {
  * successor's insert has no other manager to authorize it once the sole manager's
  * row is gone.
  *
- * Cross-node caveat: `MinOneManager` counts rows visible to THIS transaction, so two
- * nodes concurrently removing different managers can each see a survivor and still
- * converge to zero. Noted in the schema; a cross-node floor is not attempted here.
+ * Cross-node caveat: the `'resign'`/`'seal'` branches count rows visible to THIS
+ * transaction, so two nodes concurrently removing different managers can each see
+ * a survivor and still converge to zero — an unintended seal. Noted in the schema
+ * (the `Manager` table's seal-propagation NOTE); a cross-node floor is not
+ * attempted here.
  *
  * @param db - The closed strand's database.
  * @param params - The authorizing keypair and the target manager key.
- * @throws If `Manager.Authorized` rejects (a signer that is neither another existing
- *   manager nor the target itself) or `Manager.MinOneManager` rejects (the removal
- *   would leave no managers); the whole delete+tombstone transaction rolls back.
+ * @throws If the signer IS the target and it is the sole manager (before writing —
+ *   the operation the caller wants is {@link sealStrand}), or if `Manager.Authorized`
+ *   rejects (a signer that is neither another existing manager nor the target
+ *   itself, or a raw sole-manager `'resign'` whose post-image count is zero); the
+ *   whole delete+tombstone transaction rolls back.
  */
 export async function removeManager(db, params) {
     const { byManagerKeyPair, targetManagerKey } = params;
@@ -1058,13 +1104,135 @@ export async function removeManager(db, params) {
         return;
     }
     const tag = byManagerKeyPair.publicKeyB64 === targetManagerKey ? 'resign' : 'remove';
+    if (tag === 'resign' && await strandTableCount(db, 'Manager') === 1) {
+        throw new Error('Cannot resign as the SOLE manager: an ordinary resignation never empties the '
+            + 'Manager table. To permanently freeze admission instead, call sealStrand.');
+    }
     const signature = signStrandApproval(['Strand.Manager', tag, targetManagerKey, target.stampId], byManagerKeyPair.privateKeyB64);
     await inStrandTransaction(db, async () => {
-        await db.exec(`delete from Strand.Manager
-         with context ManagerKey = ?, Signature = ?
+        await db.exec(`delete from Strand.Manager
+         with context ManagerKey = ?, Signature = ?
          where MemberKey = ?`, [byManagerKeyPair.publicKeyB64, signature, targetManagerKey]);
         await insertRevocation(db, 'Manager', target.stampId, byManagerKeyPair);
     });
     log('Removed manager %s by %s', targetManagerKey, byManagerKeyPair.publicKeyB64);
 }
+/**
+ * Seal the strand: the SOLE manager deliberately steps down, permanently freezing
+ * membership.
+ *
+ * A sealed strand has zero `Manager` rows, and every admission path — issuing or
+ * cancelling an invitation, consuming one issued BEFORE the seal
+ * (`ConsumedInvite.NotSealed`), admitting a member, promoting a manager — requires
+ * one, so nobody can ever be let in again. That freeze is a privacy guarantee to
+ * everyone who contributed: no key holds the power to admit a party who would then
+ * read the strand's whole history. Sealing is irreversible — the founding branch
+ * of `Manager.Authorized` closes for good once any manager stamp is retired into
+ * `Strand.Revocation`. What remains possible: members may {@link leaveStrand}
+ * (floored by `MinOneMember`), manage their own `MemberPeer` rows, and file
+ * `Revocation` tombstones.
+ *
+ * The `'seal'` branch of `Manager.Authorized` accepts a self-signed delete only
+ * when the POST-image manager count is ZERO — a distinct action tag from
+ * `'resign'`, so a captured resignation approval can never seal and a raw writer
+ * cannot seal by accident. Like {@link removeManager}, the delete pairs with its
+ * `Strand.Revocation` tombstone in one transaction.
+ *
+ * The TS count/identity checks below are UX guards, not the trust boundary — the
+ * schema rejects a mis-tagged or mis-counted approval regardless of what this
+ * writer (or any raw writer) presents.
+ *
+ * NOTE: a seal approval is a bearer token for its row incarnation, like every other
+ * self-signed approval here — but the `'seal'` branch's post-image count of 0 is
+ * satisfied for EVERY row deleted in the same transaction, so N managers each
+ * presenting a valid `'seal'` approval seal jointly (pinned as an accepted case in
+ * `strand-seal.spec.ts`). Unreachable today: this writer mints a seal signature only
+ * while its caller is the SOLE manager, and spends it immediately, so a second
+ * manager never has one to combine. If seal-approval MINTING is ever split from
+ * spending — offline signing, a two-phase seal, a queued approval — one manager
+ * holding another's unspent seal approval could freeze the strand irreversibly
+ * without its current consent; re-gate here (or narrow the schema branch) then.
+ *
+ * @param db - The closed strand's database.
+ * @param params - The sole manager's own keypair.
+ * @throws If more than one manager exists (the caller wants {@link removeManager}),
+ *   or the supplied keypair holds no `Manager` row while one exists, or the strand
+ *   holds no `Manager` row and has never retired one (not founded yet — see
+ *   {@link isStrandSealed}), or any schema constraint rejects; the whole
+ *   delete+tombstone transaction rolls back. A strand that is ALREADY sealed logs
+ *   and returns quietly (restart-safe, matching {@link bootstrapFounderMembership}
+ *   and {@link removeManager}'s absent-row no-op).
+ */
+export async function sealStrand(db, params) {
+    const { managerKeyPair } = params;
+    const managerCount = await strandTableCount(db, 'Manager');
+    if (managerCount === 0) {
+        // Zero managers is NOT by itself a seal — a closed strand between its Header
+        // and Manager founding inserts looks identical. The retired `Manager` stamp is
+        // what separates "frozen forever" from "still foundable"; returning quietly on
+        // the latter would report a seal that never happened.
+        if (await strandHasManagerRevocation(db)) {
+            log('Strand already sealed (no Manager rows, manager stamp retired); skipping seal');
+            return;
+        }
+        throw new Error('Cannot seal: the strand holds no Manager row and has never retired one — it is '
+            + 'not founded yet, not sealed. Bootstrap the founding manager first.');
+    }
+    if (managerCount > 1) {
+        throw new Error(`Cannot seal: ${managerCount} managers exist and sealing is the SOLE manager's act. `
+            + 'The other managers must step down first (removeManager).');
+    }
+    const self = await managerRow(db, managerKeyPair.publicKeyB64);
+    if (self == null) {
+        throw new Error('Cannot seal: the supplied keypair does not hold the sole Manager row.');
+    }
+    const signature = signStrandApproval(['Strand.Manager', 'seal', managerKeyPair.publicKeyB64, self.stampId], managerKeyPair.privateKeyB64);
+    await inStrandTransaction(db, async () => {
+        await db.exec(`delete from Strand.Manager
+         with context ManagerKey = ?, Signature = ?
+         where MemberKey = ?`, [managerKeyPair.publicKeyB64, signature, managerKeyPair.publicKeyB64]);
+        await insertRevocation(db, 'Manager', self.stampId, managerKeyPair);
+    });
+    log('Sealed strand: sole manager %s stepped down', managerKeyPair.publicKeyB64);
+}
+/**
+ * Whether the strand is `Type = 'c'` (closed). Reads the singleton `Header` via
+ * the same `db.eval` scan idiom as {@link strandTableCount}; a strand with no
+ * `Header` row yet reports `false`.
+ */
+async function strandIsClosed(db) {
+    for await (const row of db.eval('select Type from Strand.Header')) {
+        return row.Type === 'c';
+    }
+    return false;
+}
+/**
+ * Whether the strand is sealed: a CLOSED strand that holds no `Manager` rows AND
+ * has retired at least one `Manager` stamp into `Strand.Revocation`.
+ *
+ * All three conjuncts are load-bearing:
+ * - `Header.Type` — an OPEN strand never holds `Manager` rows at all
+ *   (`Manager.OnlyClosed`), so a bare manager-count test would report every open
+ *   strand as sealed.
+ * - the manager count — sealing IS the empty `Manager` table.
+ * - the retired `Manager` stamp — "sealed" means admission is frozen FOREVER, and
+ *   what makes it permanent is the founding branch of `Manager.Authorized`
+ *   refusing to re-seat a generation-0 manager once any `Manager` stamp has been
+ *   retired. Without this conjunct a closed strand that is merely NOT FOUNDED YET
+ *   reads as sealed: {@link bootstrapFounderMembership} commits `Header`,
+ *   `Member` and `Manager` as three sequential statements, so the window between
+ *   the first and the last is exactly "closed, zero managers, still foundable".
+ *
+ * Reads locally visible rows — a node that has not yet converged on the seal
+ * still reports `false` (the schema's seal-propagation NOTE).
+ *
+ * @param db - The strand's database.
+ * @returns `true` iff the strand is closed, holds zero `Manager` rows, and has
+ *   permanently closed its founding branch.
+ */
+export async function isStrandSealed(db) {
+    return await strandIsClosed(db)
+        && await strandTableCount(db, 'Manager') === 0
+        && await strandHasManagerRevocation(db);
+}
 //# sourceMappingURL=strand-membership-writer.js.map