@serfab/cadre-core 0.10.0 → 0.12.0

package/src/cadre-node.ts

@@ -2,7 +2,8 @@ import debug from 'debug';
 import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
 import type { Libp2p, PeerId, PrivateKey, Connection } from '@libp2p/interface';
 import { peerIdFromString, peerIdFromPrivateKey } from '@libp2p/peer-id';
-import { createLibp2pNode } from '@optimystic/db-p2p';
+import { createLibp2pNode, type IRawStorage } from '@optimystic/db-p2p';
+import { wrapStorageWithCache, disposeStorageCache } from '@serfab/quereus-plugin-sereus';
 import { multiaddr } from '@multiformats/multiaddr';
 import type { Multiaddr } from '@multiformats/multiaddr';
 import type {
@@ -22,7 +23,6 @@ import type {
   OpenInvitation,
   FormStrandResult,
   StrandFormationDisclosure,
-  StrandMode,
   ResolveOpts,
   SelfRegistrationOutcome,
   ServiceWakeResult,
@@ -42,6 +42,7 @@ import { DEFAULT_IDENTITY_KEY_ID } from './key-store.js';
 import { loadOrCreateIdentityKey } from './identity-key.js';
 import { MemoryTrustedOwnerStore, type TrustedOwnerStore, type TrustSource } from './trusted-owner-store.js';
 import { MemoryBootstrapPeerStore, type BootstrapPeerStore } from './bootstrap-peer-store.js';
+import { mergePeerAddrs, groupAddrsByPeerId, type MergeAddrsResult } from './peer-addr-book.js';
 import { verifyCadrePeerVoucher } from './peer-authorization.js';
 import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
 import {
@@ -50,7 +51,7 @@ import {
   isPeerRecordFresh,
   orderSignalingFirst,
   isSignalingAddr,
-  trailingPeerId,
+  withTrailingPeerId,
   currentMemberTrustPolicy,
   DEFAULT_PEER_RECORD_MAX_AGE_MS,
   DEFAULT_PEER_RECORD_HEARTBEAT_MS
@@ -62,13 +63,15 @@ import {
 } from './device-token.js';
 import { StrandWatcher, type StrandQueryable, type SAppIdLookup } from './strand-watcher.js';
 import { StrandInstanceManager } from './strand-instance-manager.js';
-import { deriveCohortMembers, selectStrandMode, type CohortSeed } from './strand-cohort.js';
+import { deriveCohortMembers } from './strand-cohort.js';
 import type { CohortPeerRow } from './strand-cohort.js';
 import {
   selectControlCohortDials,
+  DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS,
   DEFAULT_CONTROL_COHORT_RECONCILE_MS,
   DEFAULT_CONTROL_COHORT_TARGET_DEGREE
 } from './control-cohort.js';
+import { withDeadline } from './control-stream.js';
 import { EnrollmentService } from './enrollment.js';
 import { HibernationManager, type HibernationCallbacks } from './hibernation-manager.js';
 import { ControlDatabase, type RevokedRowRef } from './control-database.js';
@@ -78,7 +81,12 @@ import {
   StrandSolicitationService,
   type StrandSolicitationServiceOptions
 } from './strand-solicitation.js';
-import { createMembershipConnectionGater, DEFAULT_ENROLLMENT_WINDOW_MS } from './membership-connection-gater.js';
+import {
+  createMembershipConnectionGater,
+  DEFAULT_ENROLLMENT_WINDOW_MS,
+  UnauthorizedReservationBudget,
+  type InboundConnectionVerdict
+} from './membership-connection-gater.js';
 import { StrandWakeService, dialWake } from './strand-wake-protocol.js';
 import { StrandAddrService, collectStrandAddrs, type StrandAddrPeer } from './strand-addr-protocol.js';
 import {
@@ -89,7 +97,8 @@ import {
   peerStrandKey,
   type CircuitRelayTarget
 } from './delegate-admission.js';
-import { resolveListenAddrs } from './relay-addrs.js';
+import { relayCircuitAddrs, resolveListenAddrs, RelayReservationFailedError } from './relay-addrs.js';
+import { replacesAdvertisedAddrs, resolveAnnounceAddrs } from './announce-addrs.js';
 import {
   superviseRelayReservation,
   resolveRelayReservationState,
@@ -117,6 +126,19 @@ const timing = debug('sereus:cadre:timing');
  */
 const TURN_CONSUME_WINDOW_MS = 1000;
 
+/**
+ * How often a running strand re-resolves its siblings' strand-network addresses
+ * and re-merges them into its own libp2p address book
+ * ({@link CadreNode.refreshStrandPeerAddrs}). Overridable per node via
+ * `network.controlCohort.strandAddrRefreshMs`.
+ *
+ * Ten minutes sits comfortably inside the peerStore's one-hour address expiry
+ * (`MAX_ADDRESS_AGE`, see `peer-addr-book.ts`) with headroom for several missed
+ * passes, and far above the 15 s reconcile cadence the refresh rides on, so the
+ * strand-addr RPC fan-out stays cheap.
+ */
+export const STRAND_PEER_ADDR_REFRESH_MS = 10 * 60 * 1000;
+
 type EventHandler<T> = (data: T) => void;
 
 /**
@@ -204,6 +226,14 @@ export class CadreNode implements SAppIdLookup {
   private pushFanoutService: PushFanoutService | null = null;
   /** Backing field for the {@link running} / {@link isRunning} getters. */
   private _running = false;
+  /**
+   * The control database's own raw storage (cache-wrapped), resolved once per
+   * `start()` and released in {@link cleanup}. Owning it is what keeps
+   * `config.storage.provider('control')` a once-per-runtime call: a `stop()` then
+   * `start()` cycle on this object re-resolves against a live cache, and never
+   * orphans the previous wrapper's registration in the shared cache pool.
+   */
+  private controlStorage: IRawStorage | null = null;
   /**
    * In-flight {@link serviceWake} operations keyed by strandId. Coalesces
    * concurrent on-demand wakes for the same strand into one runtime build + one
@@ -220,10 +250,11 @@ export class CadreNode implements SAppIdLookup {
   private eventHandlers: Map<keyof CadreNodeEvents, Set<EventHandler<never>>> = new Map();
 
   /**
-   * Relay multiaddrs the caller asked {@link reserveRelays} to reserve through.
-   * Empty (the default) means nobody asked, so {@link getRelayReservationState}
-   * reports `none` — this whole surface is opt-in and dormant for the CLI/host
-   * nodes, which use the configured `network.relayAddrs` route instead.
+   * Relay multiaddrs the caller asked {@link reserveRelays} to reserve through —
+   * or, on a node that names `network.relayAddrs`, the ones
+   * {@link driveControlRelayReservation} asked for at the end of {@link start}.
+   * Empty (the default) means neither happened, so {@link getRelayReservationState}
+   * reports `none`.
    */
   private relayReserveAddrs: string[] = [];
   /**
@@ -239,6 +270,24 @@ export class CadreNode implements SAppIdLookup {
    */
   private relayReserveError: string | null = null;
 
+  /**
+   * True from just before the control libp2p node is created until
+   * {@link ControlDatabase.initialize} has settled — the connection gate's
+   * BRING-UP QUIET PERIOD (`membership-connection-gater.ts`), during which this
+   * node refuses every control connection in both directions.
+   *
+   * The invariant: the control database is built while this node holds zero
+   * control connections. Every same-party sibling connected in that window joins
+   * the Optimystic cohort the bring-up's block probes consult, and a sibling that
+   * has not yet replicated this node's `CadrePeer` row refuses them all — which
+   * fails `start()` outright and cannot be retried into convergence (writing the
+   * row that would clear the refusal needs the database being built).
+   *
+   * Cleared on FAILURE as well as success ({@link cleanup} clears it), so
+   * teardown is never gated.
+   */
+  private controlBringUpInFlight = false;
+
   /** Map of strandId -> sAppConfig for sAppId filtering and management */
   private sAppConfigs: Map<string, SAppConfig> = new Map();
 
@@ -305,13 +354,27 @@ export class CadreNode implements SAppIdLookup {
   /**
    * In-memory delegate admission grants (see `delegate-admission.ts`): the
    * strand-node transport peerIds this party's members have announced over the
-   * strand-addr RPC, admitted at the CONNECTION level so a member's NAT'd
-   * strand node can hold a circuit-relay reservation on this node. Consulted
-   * ONLY by {@link admitInboundControlConnection}; the fail-closed per-stream
-   * gate ({@link authorizeInboundControlStream}) never honors it.
+   * strand-addr RPC, admitted at the CONNECTION and RESERVATION levels so a
+   * member's NAT'd strand node can hold a circuit-relay reservation on this
+   * node (without spending the unauthorized-reservation budget). Consulted
+   * ONLY by {@link admitInboundControlConnection} and
+   * {@link admitControlRelayReservation}; the fail-closed per-stream gate
+   * ({@link authorizeInboundControlStream}) never honors it.
    */
   private readonly delegateAdmission = new DelegateAdmissionStore();
 
+  /**
+   * Bounded budget of concurrent circuit-relay reservations granted to peers
+   * this node cannot (yet) place as members — the boot-ordering window where a
+   * genuine sibling reserves before its `CadrePeer` row has replicated here.
+   * Consulted only by {@link admitControlRelayReservation} (the gater's
+   * `denyInboundRelayReservation` policy); authorized members and announced
+   * delegates are admitted before it and never counted. Cap from
+   * `network.unauthorizedRelayReservationCap` (default
+   * `MAX_UNAUTHORIZED_RELAY_RESERVATIONS`).
+   */
+  private readonly unauthorizedRelayReservations: UnauthorizedReservationBudget;
+
   /**
    * When this node last ANNOUNCED a delegate, keyed `<targetPeerId>\n<strandId>`
    * (the peer announced TO, not the delegate). Throttles
@@ -322,6 +385,17 @@ export class CadreNode implements SAppIdLookup {
    */
   private readonly delegateAnnounceAt = new Map<string, number>();
 
+  /**
+   * When each running strand last had its siblings' strand addresses re-resolved
+   * into its own address book, keyed by strandId. Throttles
+   * {@link refreshStrandPeerAddrs} to once per {@link STRAND_PEER_ADDR_REFRESH_MS}
+   * per strand so the 15 s reconcile tick never becomes per-tick RPC chatter.
+   * Entries for strands that are no longer running are pruned on each pass, so a
+   * hibernated-then-resumed strand refreshes immediately rather than inheriting a
+   * stale stamp.
+   */
+  private readonly strandPeerAddrRefreshAt = new Map<string, number>();
+
   /**
    * Cold-start bootstrap dial targets: the owner-flagged peers of every seed
    * this node has applied, keyed by peer id, valued by the seed's multiaddr
@@ -466,6 +540,9 @@ export class CadreNode implements SAppIdLookup {
     this.config = config;
     this.strandManager = new StrandInstanceManager();
     this.enrollmentService = new EnrollmentService();
+    this.unauthorizedRelayReservations = new UnauthorizedReservationBudget(
+      config.network?.unauthorizedRelayReservationCap
+    );
 
     // Create hibernation manager with callbacks
     const hibernationCallbacks: HibernationCallbacks = {
@@ -595,20 +672,14 @@ export class CadreNode implements SAppIdLookup {
 
     log('Starting CadreNode for party: %s', this.config.controlNetwork.partyId);
 
-    // NOTE: the only direct `console.*` in this library — a boot-time operator warning, not a
-    // diagnostic trace (those use `debug`, which an operator never sees without `DEBUG=`). If a
-    // second such warning ever appears here, route both through a `CadreNodeEvents` entry the
-    // embedder surfaces instead of growing a console surface inside a library.
-    if (this.config.network?.announceAddrs && this.config.network.announceAddrs.length > 0) {
-      console.warn(
-        'network.announceAddrs is set but not yet supported (no upstream db-p2p option to apply it) ' +
-        '— this node will keep advertising its listen/relay addresses instead.'
-      );
-    }
-
     try {
       const tTotal = performance.now();
 
+      // Config pre-flight, inside the guarded region: resolving the listen addrs it reads
+      // throws on a malformed `relayAddrs` entry, and that failure belongs on the same
+      // logged-and-cleaned-up path as every other one in start().
+      this.warnIfAnnounceAddrsDiscardRelay();
+
       // Install the WebRTC TURN-relay tracker BEFORE any libp2p bring-up, so it
       // wraps globalThis.RTCPeerConnection before the control node can create one.
       // Inert on Node.js (no RTCPeerConnection); disposed in cleanup().
@@ -631,6 +702,25 @@ export class CadreNode implements SAppIdLookup {
       // loaded before the first reconcile pass could consult them.
       this.initializeBootstrapPeerStore();
 
+      // Arm the connection gate's BRING-UP QUIET PERIOD before the libp2p node
+      // exists, so no connection can form ahead of it: `@libp2p/bootstrap` emits
+      // its discovery events ~1 s after `libp2p.start()` and the connection
+      // manager auto-dials from there, which is INSIDE createControlNode below.
+      // The invariant being protected is "zero control connections during
+      // control-database bring-up" — see the field's doc and
+      // `membership-connection-gater.ts` → "The bring-up quiet period".
+      //
+      // NOTE: without this gate the bootstrap arm is a RACE, not a guarantee — its
+      // safety margin is bring-up duration versus @libp2p/bootstrap's 1 s discovery
+      // fuse, and bring-up duration is (raw-storage operations) × per-operation
+      // latency. The cold-start operation count and the 50-90 ms/op figure a loaded
+      // phone actually sees live in `control-database.ts`'s `loadSchema` note (and
+      // are pinned by `control-start-storage-op-budget.spec.ts`): at the top of that
+      // range bring-up is 9-15 s, far past the fuse. So if this gate is ever removed
+      // or bypassed, that arm reopens for exactly the nodes most likely to hit it —
+      // phones joining a party, whose membership row has not replicated yet.
+      this.controlBringUpInFlight = true;
+
       // Create the control network libp2p node
       let t0 = performance.now();
       this.controlNode = await this.createControlNode();
@@ -653,6 +743,21 @@ export class CadreNode implements SAppIdLookup {
       });
       await this.controlDatabase.initialize();
       timing('[start] controlDatabase.initialize: %dms', Math.round(performance.now() - t0));
+      // The database exists locally now, so the quiet period has done its job and
+      // this node can be in the conversation. A failure above never reaches here —
+      // `cleanup()` on the catch path opens the gate instead, so teardown (and a
+      // retry by the embedder) is not gated.
+      //
+      // NOTE: the window ends HERE, not at the end of start(), so the awaited control-DB
+      // work that follows — `strandWatcher.start()`'s first poll — can run against a
+      // cohort a connection just joined. Fine now: every block that poll reads was
+      // created locally by the initialize() above, so a refusing sibling has nothing to
+      // refuse. If a boot ever fails with `BlockUnavailableError` from BELOW this line,
+      // that assumption broke. Do not simply move this clear later without measuring:
+      // `handleStrandAdded` runs inside `strandWatcher.start()` and seeds each strand
+      // node from CONNECTED siblings (`resolveCohortSeed`), so a longer window trades a
+      // bring-up hazard for boot-time strand seeds that are always empty.
+      this.controlBringUpInFlight = false;
       log('Control database initialized');
 
       // Attach the per-stream gate to the control DB's membership hub, so every
@@ -736,12 +841,28 @@ export class CadreNode implements SAppIdLookup {
       // start and admits.
       void this.refreshMembershipGate('start');
 
+      // Reserve the configured relays LAST, so every step above ran against a
+      // cohort of one (see driveControlRelayReservation). Ahead of
+      // scheduleSelfRegistration, so this node's first published `CadrePeer` row
+      // already carries the `/p2p-circuit` address the reservation earns it.
+      // Throws on a relay that will not have us — start() is fail-fast for a node
+      // whose operator named a relay.
+      await this.driveControlRelayReservation();
+
       // Schedule self-registration in background
       this.scheduleSelfRegistration();
 
     } catch (error) {
       log('Failed to start CadreNode: %o', error);
+      // `driveControlRelayReservation` throws AFTER `control:connected` was emitted,
+      // so a subscriber can have seen this node come up. Balance the edge rather than
+      // leaving it dangling — `cleanup()` has torn the node down either way, and the
+      // events are what an embedder drives its "am I connected" UI from.
+      const wasConnected = this._running;
       await this.cleanup();
+      if (wasConnected) {
+        this.emit('control:disconnected', undefined);
+      }
       throw error;
     }
   }
@@ -782,19 +903,7 @@ export class CadreNode implements SAppIdLookup {
     }
 
     log('Stopping CadreNode');
-    // Stop the retry loop BEFORE tearing the node down, not after: `cleanup()`
-    // stops the control node partway through, and a tick that fires during it
-    // would dial and then poll a half-torn-down node for the whole reserve
-    // timeout — logging spurious dial failures and holding the process open.
-    this.relayReserveSupervisor?.stop();
-    this.relayReserveSupervisor = null;
     await this.cleanup();
-    // Drop the rest of the relay-reservation posture: a stopped node holds no
-    // reservation, so a restarted instance must not report the previous run's
-    // `reserved`.
-    this.relayReserveAddrs = [];
-    this.relayReserveError = null;
-    this._running = false;
     this.emit('control:disconnected', undefined);
     log('CadreNode stopped');
   }
@@ -989,6 +1098,76 @@ export class CadreNode implements SAppIdLookup {
     return await createLibp2pNode(this.buildControlNodeOptions());
   }
 
+  /**
+   * The control database's cache-wrapped raw storage, resolved from
+   * `config.storage.provider` on first use and then held in {@link controlStorage}
+   * for the rest of this runtime.
+   *
+   * Resolving once is the contract `RawStorageProvider` (types.ts) states: a provider is
+   * called once per scope per runtime lifetime. Re-entering it per call would mint a
+   * second store over one backend — a fresh, cold cache, with the previous wrapper's
+   * registration orphaned in the process-wide pool.
+   *
+   * Lazy rather than eager in `start()` so the pure-unit call path
+   * (`cadre-node-control-node-options.spec.ts` calls `buildControlNodeOptions` on a
+   * bare `new CadreNode`) still resolves — and, on that path too, only once.
+   *
+   * Wrapped in the write-through raw-storage cache (quereus-plugin-sereus's
+   * `cached-storage.ts`) because a control start's cost is its raw-storage
+   * operation count.
+   */
+  private resolveControlStorage(): IRawStorage | undefined {
+    if (this.controlStorage) {
+      return this.controlStorage;
+    }
+    const provider = this.config.storage?.provider;
+    if (!provider) {
+      return undefined;
+    }
+    const resolved = typeof provider === 'function' ? provider('control') : provider;
+    this.controlStorage = wrapStorageWithCache(resolved, 'control');
+    return this.controlStorage;
+  }
+
+  /**
+   * Warn the operator when `network.announceAddrs` will silently cost this node the
+   * relay reachability it also configured.
+   *
+   * A non-empty announce set REPLACES everything libp2p advertises, so the
+   * `/p2p-circuit` address earned by a relay reservation is dropped from the node's
+   * advertised addresses even though the reservation itself is still held — peers
+   * behind NAT stop being able to reach it through that relay. Not an error: an
+   * operator whose relay slot is decorative may genuinely want only the announced
+   * address, so this reports and proceeds.
+   *
+   * Keyed off the RESOLVED listen addrs rather than `relayAddrs` alone, so a
+   * hand-written `/p2p-circuit` entry in `listenAddrs` — the same reservation by the
+   * longer route — is caught too.
+   *
+   * NOTE: the only direct `console.*` in this library — a boot-time operator warning, not a
+   * diagnostic trace (those use `debug`, which an operator never sees without `DEBUG=`). If a
+   * second such warning ever appears here, route both through a `CadreNodeEvents` entry the
+   * embedder surfaces instead of growing a console surface inside a library.
+   */
+  private warnIfAnnounceAddrsDiscardRelay(): void {
+    const network = this.config.network;
+    if (!replacesAdvertisedAddrs(network)) {
+      return;
+    }
+    const listensOnCircuit = (resolveListenAddrs(network) ?? [])
+      .some((addr) => addr.includes('/p2p-circuit'));
+    if (!listensOnCircuit) {
+      return;
+    }
+    console.warn(
+      'network.announceAddrs is set alongside a circuit-relay listener (from network.relayAddrs, ' +
+      'or a /p2p-circuit entry in network.listenAddrs). A non-empty announce set REPLACES every ' +
+      'address this node advertises, so the /p2p-circuit address earned from the relay reservation ' +
+      'will not be advertised and peers will stop reaching this node through that relay. ' +
+      'Use network.appendAnnounceAddrs instead to advertise an extra address without discarding the rest.'
+    );
+  }
+
   /**
    * Map this node's config onto the control network's libp2p node options.
    *
@@ -998,21 +1177,19 @@ export class CadreNode implements SAppIdLookup {
    * only caller in production is `createControlNode`.
    */
   private buildControlNodeOptions(): Parameters<typeof createLibp2pNode>[0] {
-    const { controlNetwork, network, storage, profile } = this.config;
+    const { controlNetwork, network, profile } = this.config;
     const identityKey = this.identityKey;
-    const listenAddrs = resolveListenAddrs(network);
-
-    // Determine relay mode: if explicitly set in config, use that;
-    // otherwise default to true for storage profile nodes (better connectivity/uptime)
-    const enableRelay = network?.enableRelay ?? (profile === 'storage');
-
-    // Create storage provider for control network
-    // Uses the factory function pattern if provided to create control-network-specific storage
-    const controlStorageProvider = storage?.provider
-      ? (typeof storage.provider === 'function'
-          ? storage.provider('control')
-          : storage.provider)
-      : undefined;
+    // `'search'`: `network.relayAddrs` contributes the bare `/p2p-circuit` SEARCH
+    // entry, which opens no connection — the reservation is driven explicitly at
+    // the END of `start()`, so the control database is built while this node holds
+    // zero control connections. See `relay-addrs.ts` and `start()`.
+    const listenAddrs = resolveListenAddrs(network, 'search');
+
+    const enableRelay = this.relayServerEnabled();
+
+    // The control node's own storage, resolved once per runtime (see
+    // {@link resolveControlStorage}) rather than per call.
+    const controlStorageProvider = this.resolveControlStorage();
 
     const nodeOptions: Parameters<typeof createLibp2pNode>[0] = {
       port: 0,
@@ -1032,16 +1209,26 @@ export class CadreNode implements SAppIdLookup {
       arachnode: { enableRingZulu: profile === 'storage' },
       ...(identityKey && { privateKey: identityKey }),
       ...(network?.transports && { transports: network.transports }),
-      // Configured `listenAddrs`, plus a `/p2p-circuit` listener for every
-      // `network.relayAddrs` entry — that listener is what reserves the relay slot.
+      // Configured `listenAddrs`, plus the bare `/p2p-circuit` search listener when
+      // `network.relayAddrs` is set — that listener registers the pending reservation
+      // `driveControlRelayReservation` fills after bring-up.
       ...(listenAddrs && { listenAddrs }),
+      // What this node ADVERTISES, which is not the same question as what it binds.
+      // Either field is present only when configured non-empty; a non-empty
+      // `announceAddrs` replaces the advertised set (see warnIfAnnounceAddrsDiscardRelay).
+      ...resolveAnnounceAddrs(network),
       // The CONTROL node composes the membership admission gate onto any
-      // caller-supplied gater (deny from either wins on inbound; all other
-      // hooks pass through). Strand cohort nodes keep the raw configured gater
-      // (see strand-instance-manager.ts) — their peers are legitimately
+      // caller-supplied gater (deny from either wins on the inbound-encrypted
+      // and relay-reservation hooks; all other hooks pass through). Strand
+      // cohort nodes keep the raw configured gater (see
+      // strand-instance-manager.ts) — their peers are legitimately
       // cross-party, so cadre membership must not gate them.
       connectionGater: createMembershipConnectionGater(
-        { admitInbound: (remotePeerId) => this.admitInboundControlConnection(remotePeerId) },
+        {
+          admitInbound: (remotePeerId) => this.admitInboundControlConnection(remotePeerId),
+          admitRelayReservation: (remotePeerId) => this.admitControlRelayReservation(remotePeerId),
+          bringUpInFlight: () => this.controlBringUpInFlight
+        },
         network?.connectionGater
       ),
       // Fail-closed per-stream authorization for the four Optimystic control-DB
@@ -1055,6 +1242,18 @@ export class CadreNode implements SAppIdLookup {
     return nodeOptions;
   }
 
+  /**
+   * Does this node's CONTROL libp2p run the circuit-relay server? An explicit
+   * `network.enableRelay` wins; otherwise storage-profile nodes default to on
+   * (better connectivity/uptime). Shared by {@link buildControlNodeOptions}
+   * (which configures the server from it) and
+   * {@link admitInboundControlConnection} (whose deny/admit-for-relay branch
+   * must agree with whether a reservation is even servable here).
+   */
+  private relayServerEnabled(): boolean {
+    return this.config.network?.enableRelay ?? (this.config.profile === 'storage');
+  }
+
   /**
    * Decide whether an inbound CONTROL-network connection from `remotePeerId`
    * should be admitted — the policy behind the connection gater wired in
@@ -1064,7 +1263,7 @@ export class CadreNode implements SAppIdLookup {
    * `membership-connection-gater.ts` for the layer's rationale and the
    * stranger-open protocol allowlist).
    *
-   * Admits when ANY of:
+   * Returns `'admit'` when ANY of:
    *  1. a shared-baseline check admits ({@link admitControlPeerUnconditionally}
    *     — not running / DB torn down, absent-or-empty trusted-owner anchor, or
    *     configured bootstrap/relay infrastructure);
@@ -1101,43 +1300,119 @@ export class CadreNode implements SAppIdLookup {
    *    this node yet is denied even though the formation handler would have
    *    accepted it, exactly like the unreplicated-membership-row case below.
    *
+   * When every check falls through, the verdict depends on whether this node
+   * runs the circuit-relay server ({@link relayServerEnabled}): without one,
+   * `'deny'`; with one, `'admit-for-relay'` — a circuit-relay reservation is
+   * established by the reserving peer DIALING the relay, so a connection deny
+   * here kills the reservation, and that deny is NOT self-healing: an outbound
+   * reconcile re-dial re-establishes a data link, but no outbound dial can
+   * grant the remote peer a reservation, and a relay-only peer has no address
+   * of its own to dial back — the reservation IS its address. The gater admits
+   * such a connection, decides the reservation via
+   * {@link admitControlRelayReservation}, and drops the connection if no
+   * reservation is admitted in time (see `membership-connection-gater.ts` →
+   * "The relay-reservation seam").
+   *
    * NOTE: check 4/5 runs a control-DB read per inbound connection
    * (`listAuthorizedMembers`); connections are rare and cadres small, and this
    * layer is fail-open behind `ADMISSION_DECISION_TIMEOUT_MS`, so the live
    * read is safe here — unlike the per-stream gate, which must consult the
    * materialized {@link authorizedControlPeers} snapshot instead.
-   * NOTE: a sibling whose membership row has not yet replicated to
-   * this node is denied until the row converges (typically via the owner);
-   * either side's next outbound reconcile dial (outbound is never gated)
-   * re-establishes the link — self-healing, but visible as a transient deny.
-   */
-  private async admitInboundControlConnection(remotePeerId: string): Promise<boolean> {
+   * NOTE: on a relay-DISABLED node, a sibling whose membership row has not yet
+   * replicated here is denied until the row converges (typically via the
+   * owner); either side's next outbound reconcile dial (outbound is never
+   * gated) re-establishes the DATA link — self-healing for data, visible as a
+   * transient deny. That self-healing story never covered a reservation, which
+   * is exactly why the relay-enabled path above exists.
+   */
+  private async admitInboundControlConnection(remotePeerId: string): Promise<InboundConnectionVerdict> {
     if (this.admitControlPeerUnconditionally(remotePeerId)) {
-      return true;
+      return 'admit';
     }
     if (Date.now() < this.enrollmentWindowUntil) {
-      return true;
+      return 'admit';
     }
     if (this.delegateAdmission.has(remotePeerId)) {
-      return true;
+      return 'admit';
     }
     const authorized = await this.listAuthorizedMembers();
     if (authorized.length === 0) {
-      return true;
+      return 'admit';
     }
     if (authorized.some((m) => m.peerId === remotePeerId)) {
-      return true;
+      return 'admit';
     }
     try {
       if (await this.strandSolicitationService?.hasOutstandingInvitation()) {
-        return true;
+        return 'admit';
       }
     } catch (error) {
       log('admitInboundControlConnection: outstanding-invitation check threw for %s — admitting (fail-open): %o', remotePeerId, error);
-      return true;
+      return 'admit';
+    }
+    if (this.relayServerEnabled()) {
+      log('admitInboundControlConnection: admitting %s FOR RELAY ONLY — not an authorized member and no enrollment path open; the gater drops the connection unless a reservation is admitted', remotePeerId);
+      return 'admit-for-relay';
     }
     log('admitInboundControlConnection: DENYING inbound from %s — not an authorized member and no enrollment path open', remotePeerId);
-    return false;
+    return 'deny';
+  }
+
+  /**
+   * Should `remotePeerId` be granted a circuit-relay reservation slot on this
+   * node's relay server? The policy behind the gater's
+   * `denyInboundRelayReservation` hook (see `membership-connection-gater.ts` →
+   * "The relay-reservation seam"); the circuit-relay server consults it per
+   * RESERVE request, so it is never called on a node whose relay server is off.
+   *
+   * Admits when ANY of:
+   *  1. a shared-baseline check admits ({@link admitControlPeerUnconditionally}
+   *     — not running / DB torn down, absent-or-empty trusted-owner anchor, or
+   *     configured bootstrap/relay infrastructure);
+   *  2. the peer holds a live delegate admission grant — a member's strand
+   *     node reserving here (see `delegate-admission.ts`); never counted
+   *     against the unauthorized budget;
+   *  3. the authorized-member set is empty (cold start) or the peer IS an
+   *     authorized member — members are never counted against the budget; or
+   *  4. the peer takes (or already holds) a slot in the bounded
+   *     unauthorized-reservation budget — the boot-ordering window where a
+   *     genuine member reserves before its `CadrePeer` row replicates here.
+   *     Cap via `network.unauthorizedRelayReservationCap` (0 = refuse every
+   *     unauthorized reservation).
+   *
+   * Every uncounted admission also RELEASES the budget slot the peer may hold
+   * from an earlier reservation taken while it was still unplaceable — a member
+   * that boots, reserves, and only then has its row replicate here would
+   * otherwise keep that slot spent for the rest of the entry's TTL.
+   *
+   * The connection gate's stranger carve-outs (an open enrollment window, an
+   * outstanding formation invitation) deliberately do NOT extend here: they
+   * exist so a stranger's SEED or FORMATION stream can ride a connection, and
+   * neither needs relay capacity. A genuine invitee that does need a relay slot
+   * takes one from the budget like any other unplaced peer, so an open window
+   * never becomes an unbounded grant of this node's forwarding capacity.
+   */
+  private async admitControlRelayReservation(remotePeerId: string): Promise<boolean> {
+    if (this.admitControlPeerUnconditionally(remotePeerId)) {
+      return this.admitReservationUncounted(remotePeerId);
+    }
+    if (this.delegateAdmission.has(remotePeerId)) {
+      return this.admitReservationUncounted(remotePeerId);
+    }
+    const authorized = await this.listAuthorizedMembers();
+    if (authorized.length === 0 || authorized.some((m) => m.peerId === remotePeerId)) {
+      return this.admitReservationUncounted(remotePeerId);
+    }
+    const admitted = this.unauthorizedRelayReservations.tryAdmit(remotePeerId);
+    log('admitControlRelayReservation: %s %s under the unauthorized-reservation budget',
+      admitted ? 'admitting' : 'REFUSING', remotePeerId);
+    return admitted;
+  }
+
+  /** Admit a reservation on the peer's own merits, giving back any budget slot it still holds. */
+  private admitReservationUncounted(remotePeerId: string): true {
+    this.unauthorizedRelayReservations.release(remotePeerId);
+    return true;
   }
 
   /**
@@ -1155,7 +1430,8 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Record (or refresh) a delegate admission grant: `delegatePeerId` is the
    * transport peerId of `announcerPeerId`'s strand-`strandId` node, admitted
-   * at the CONNECTION level (all a circuit-relay reservation needs) for
+   * at the CONNECTION and RESERVATION levels (all a circuit-relay reservation
+   * needs, without spending the unauthorized-reservation budget) for
    * `DELEGATE_GRANT_TTL_MS`. Called by the strand-addr responder after its
    * authorized-membership gate has passed; public so tests can drive the
    * admission policy without a full strand launch. A re-announce for the same
@@ -1263,13 +1539,19 @@ export class CadreNode implements SAppIdLookup {
    *
    * The SOLE caller is {@link drainMembershipGate}, which serializes refreshes —
    * so two reads can no longer settle out of order.
+   *
+   * Reads WITHOUT the transient-failure retry, deliberately: `ControlDatabase` drives
+   * this listener with its write lock HELD (`notifyMembershipChanged`), so a retrying
+   * read here would sleep its backoff holding the lock and stall every other local
+   * writer. Nothing is lost — this refresh already keeps the previous snapshot on
+   * failure and is re-driven by the next membership write and by the timed reconcile.
    */
   private async refreshAuthorizedControlPeers(reason: string): Promise<void> {
     if (!this._running || !this.controlDatabase) {
       return;
     }
     try {
-      const members = await this.listAuthorizedMembers();
+      const members = await this.listAuthorizedMembers(false);
       this.authorizedControlPeers = new Set(members.map((m) => m.peerId));
       log('refreshAuthorizedControlPeers(%s): %d authorized peer(s)', reason, this.authorizedControlPeers.size);
     } catch (error) {
@@ -1407,7 +1689,11 @@ export class CadreNode implements SAppIdLookup {
 
     if (!existing) {
       if (!this.seedBootstrapService) {
-        log('registerSelf: not yet a CadrePeer member and no owner service to self-insert; skipping (an owner must add this peer first)');
+        // "No row" also covers "revoked": queryPeerRecord reads a row whose StampId is
+        // retired in Revocation as absent, so a removed node lands here every heartbeat
+        // and stops refreshing its own record — correct, but say so, or the message reads
+        // as "never added" for a node that was removed.
+        log('registerSelf: no readable CadrePeer row for self (never added, or removed and its stamp retired) and no owner service to self-insert; skipping');
         return 'skipped';
       }
       // First-time row: requires an owner signature (the node is its own
@@ -1429,9 +1715,10 @@ export class CadreNode implements SAppIdLookup {
       log('registerSelf: own CadrePeer row appeared mid-publish (concurrent authorize); self-updating to carry the signature');
     }
 
-    // Null only on the fall-through above, where the pre-race read missed the row a
+    // Reached on the fall-through above, where the pre-race read missed the row a
     // concurrent authorize then seated — so re-read to get that row's `UpdatedAt`, which
-    // the strictly-greater self-update rule is measured against.
+    // the strictly-greater self-update rule is measured against. The re-read can still
+    // come back null (see the branch below).
     //
     // NOTE: when `existing` is set it predates this publish, so a removePeer(self) racing
     // in would leave the UPDATE below matching no rows while still reporting 'refreshed'.
@@ -1439,7 +1726,13 @@ export class CadreNode implements SAppIdLookup {
     // if removing self ever becomes something that happens concurrently in practice.
     const current = existing ?? await this.controlDatabase.queryPeerRecord(peerId);
     if (!current) {
-      log('registerSelf: own CadrePeer row vanished mid-publish; skipping (next refresh re-inserts)');
+      // Two causes, and the second is a steady state rather than a race: the row really
+      // vanished mid-publish (next refresh re-inserts), or this node was REVOKED — its row
+      // is physically present, so insertCadrePeer's in-lock existence check no-op'd above,
+      // but queryPeerRecord reads it as absent because its stamp is retired. The revoked
+      // case repeats every heartbeat and never re-inserts; that is intended (a revoked node
+      // has nothing to publish), so this stays a skip, not an error.
+      log('registerSelf: own CadrePeer row not readable (vanished mid-publish, or this node is revoked and its stamp retired); skipping');
       return 'skipped';
     }
     const record = this.signSelfRecord(peerId, signingKey, addrs, current);
@@ -1562,6 +1855,20 @@ export class CadreNode implements SAppIdLookup {
     };
     this.controlNode.addEventListener('self:peer:update', this.selfPeerUpdateHandler);
 
+    // NOTE: a node AUTHORIZED AFTER IT BOOTED can wait a whole heartbeat (7.5 min)
+    // to publish its address. `registerSelf` no-ops while a node has no readable
+    // `CadrePeer` row, so its boot-time publish does nothing, and the two triggers
+    // wired here are the only ones after that: `self:peer:update` needs an ADDRESS
+    // CHANGE, and a relay-only node's addresses stop changing the moment its
+    // reservation lands — inside `start()`, before this listener exists. Harmless
+    // where a late-authorized node's addresses keep churning (NAT/relay rotation
+    // fire the event anyway), and invisible while parties authorize members before
+    // they boot. If late enrollment becomes the normal path — an invited phone is
+    // exactly that — republish on the membership-change seam that already exists
+    // (`ControlDatabase.setMembershipChangeListener`) rather than lengthening this
+    // list of triggers. Measured while writing
+    // `relay-only-control-addr.integration.ts` case 4, which drives `registerSelf()`
+    // explicitly because neither trigger is dependable there.
     this.recordRefreshTimer = setInterval(() => republish('heartbeat'), DEFAULT_PEER_RECORD_HEARTBEAT_MS);
     (this.recordRefreshTimer as { unref?: () => void } | null)?.unref?.();
 
@@ -1642,6 +1949,10 @@ export class CadreNode implements SAppIdLookup {
    * Survivors are returned signaling (`/p2p-circuit`) first, filtered to
    * signaling-only when requested, as parsed `Multiaddr`s (unparsable addrs
    * dropped). Any gate failure yields an empty array rather than throwing.
+   *
+   * Every returned address is normalized to terminate in `/p2p/<peerId>` — see
+   * {@link normalizeDialAddrs} for why that invariant, not each dial site's own
+   * handling, is what keeps a mixed list from taking a whole peer offline.
    */
   async resolvePeerAddrs(peerId: string, opts: ResolveOpts = {}): Promise<Multiaddr[]> {
     if (!this.controlDatabase) {
@@ -1694,12 +2005,72 @@ export class CadreNode implements SAppIdLookup {
 
     // Order signaling-first (the on-record order was what we verified above),
     // optionally restrict to signaling addrs, then parse — dropping any addr
-    // that does not parse as a multiaddr.
+    // that does not parse as a multiaddr — and finally normalize every survivor
+    // onto `/p2p/<peerId>` so no caller ever sees a mixed list.
     let addrs = orderSignalingFirst(record.addrs);
     if (opts.signalingOnly) {
       addrs = addrs.filter(isSignalingAddr);
     }
-    return this.parseMultiaddrs(addrs);
+    return this.normalizeDialAddrs(this.parseMultiaddrs(addrs), peerId);
+  }
+
+  /**
+   * Guarantee every address handed to a control-network dial terminates in
+   * `/p2p/<peerId>`, with no duplicates — the invariant every dial path
+   * downstream relies on.
+   *
+   * `libp2p.dial(addrs)` requires that the addresses in ONE dial either all name
+   * a peer id or none do; a list mixing a circuit address (which ends in
+   * `/p2p/<target>`) with a bare direct one (which ends in `/tcp/…`) makes that
+   * call throw, and the whole peer is then silently skipped rather than one bad
+   * address.
+   *
+   * Applied by ALL THREE sources of control-dial candidates, so no call site
+   * invents its own rule and none can produce a mixed list: the signed record
+   * ({@link resolvePeerAddrs}), the libp2p address book
+   * ({@link peerStoreAddrs}), and a seed's retained owner addresses
+   * ({@link bootstrapDialAddrs}).
+   *
+   * An address naming a DIFFERENT trailing peer id is dropped: it does not reach
+   * `peerId`, so it does not belong in this peer's candidate list (libp2p's own
+   * dial queue filters the same shape out one layer lower).
+   */
+  private normalizeDialAddrs(addrs: Multiaddr[], peerId: string): Multiaddr[] {
+    // Keyed by the NORMALIZED string, so two entries differing only by the suffix
+    // (`/ip4/…/tcp/4001` and `/ip4/…/tcp/4001/p2p/<peerId>`) collapse into one.
+    // Normalization is what makes them equal; a surviving duplicate would cost a
+    // real dial attempt — a whole slice of `dialWake`'s budget — on an address
+    // already being tried.
+    const out = new Map<string, Multiaddr>();
+    for (const addr of addrs) {
+      const bound = this.bindAddrToPeer(addr, peerId);
+      if (bound) {
+        out.set(bound.toString(), bound);
+      }
+    }
+    return [...out.values()];
+  }
+
+  /**
+   * One address bound to `peerId`, or `null` when it cannot be — logged either
+   * way, never thrown, so every caller's list-shaping stays total.
+   *
+   * `withTrailingPeerId` encapsulates `/p2p/<peerId>`, which throws on a peer id
+   * that does not parse. Unreachable for a `CadrePeer` row (the binding gate
+   * above parsed it already), reachable for a seed-supplied one
+   * ({@link bootstrapDialAddrs}).
+   */
+  private bindAddrToPeer(addr: Multiaddr, peerId: string): Multiaddr | null {
+    try {
+      const bound = withTrailingPeerId(addr, peerId);
+      if (!bound) {
+        log('normalizeDialAddrs: dropping addr %s — it names a peer other than %s', addr.toString(), peerId);
+      }
+      return bound;
+    } catch (error) {
+      log('normalizeDialAddrs: cannot bind %s to %s: %o', addr.toString(), peerId, error);
+      return null;
+    }
   }
 
   /** Parse multiaddr strings, dropping (and logging) any that fail to parse. */
@@ -1767,8 +2138,11 @@ export class CadreNode implements SAppIdLookup {
     // than a local write) are picked up here, bounding the snapshot's staleness
     // to the reconcile interval.
     // NOTE: this refresh and the sibling enumeration below each run their own
-    // CadrePeer query (two reads per pass); if those reads ever get costly,
-    // share one row-set across both.
+    // CadrePeer query (two reads per pass), plus a third from
+    // `refreshStrandPeerAddrs` on the passes where a strand is due AND this node
+    // holds a control connection (one read for the whole pass, not one per
+    // strand); if those reads ever get costly, share one row-set across all
+    // three.
     await this.refreshMembershipGate('reconcile');
     if (!this._running || !this.controlNode || !this.controlDatabase) {
       return;
@@ -1781,6 +2155,14 @@ export class CadreNode implements SAppIdLookup {
     if (!this._running || !this.controlNode || !this.controlDatabase) {
       return;
     }
+    // Then re-warm each running strand's own address book from its siblings, on
+    // its own (much longer) throttle. Same reasoning as warmSiblingAddrBook
+    // below, one layer down: replication runs on the STRAND network, and every
+    // layer under cadre-core dials strand peers by bare peer id.
+    await this.refreshStrandPeerAddrs();
+    if (!this._running || !this.controlNode || !this.controlDatabase) {
+      return;
+    }
     const selfPeerId = this.controlNode.peerId.toString();
 
     // Reap guarded rows this node still holds for incarnations an already-committed
@@ -1863,10 +2245,18 @@ export class CadreNode implements SAppIdLookup {
         cappedNonOwner, targetDegree);
     }
 
-    // 3. Skip already-connected peers (no re-dial / churn for live connections).
+    // 3. Warm the libp2p address book with EVERY sibling's verified addresses,
+    //    keeping what resolved for the dial loop below.
+    const resolved = await this.warmSiblingAddrBook(siblings);
+    if (!this._running || !this.controlNode || !this.controlDatabase) {
+      return;
+    }
+
+    // 4. Skip already-connected peers (no re-dial / churn for live connections).
     const connected = new Set(this.controlNode.getConnections().map((c) => c.remotePeer.toString()));
 
-    // 4. Resolve + dial each selected, not-yet-connected sibling, best-effort.
+    // 5. Dial each selected, not-yet-connected sibling, best-effort, from the
+    //    addresses step 3 already resolved for it.
     let dialed = 0;
     for (const sibling of dials) {
       if (!this._running || !this.controlNode) {
@@ -1875,7 +2265,7 @@ export class CadreNode implements SAppIdLookup {
       if (connected.has(sibling.peerId)) {
         continue;
       }
-      if (await this.dialControlSibling(sibling)) {
+      if (await this.dialControlSibling(sibling, resolved.get(sibling.peerId) ?? [])) {
         dialed++;
       }
     }
@@ -1884,27 +2274,109 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Resolve one sibling's control-network dial addresses and dial it, best-effort.
-   * Returns whether a dial was attempted (false when no address resolves).
+   * Resolve every sibling's signed address record once and merge what resolves
+   * into the control node's libp2p **address book** (peerStore). Returns the
+   * resolved addresses per sibling so the dial loop reuses them rather than
+   * re-resolving — one `queryPeerRecord` per sibling per pass, not two.
+   *
+   * Deliberately every sibling, not the {@link selectControlCohortDials} subset,
+   * and deliberately including already-connected ones: everything below
+   * cadre-core dials by bare peer id (Optimystic's cluster/repo clients, FRET
+   * ping/announce), so the address book has to be warm BEFORE a live connection
+   * drops, and a sibling the out-degree cap declines to dial is still one those
+   * layers may need to reach.
+   *
+   * Only `resolvePeerAddrs` output is merged — never the cold-start
+   * `peerStoreAddrs` fallback, which came out of the address book to begin with
+   * and would restamp unverified seed addresses indefinitely. A sibling that
+   * resolves to nothing (revoked, stale, untrusted) is not written at all, so its
+   * existing entry ages out on its own.
+   *
+   * NOTE: this resolves EVERY sibling serially before the dial loop below runs,
+   * so it costs one record query per sibling per reconcile pass (~15s) and each
+   * one delays the pass's first dial. A cadre is a handful of devices, so today
+   * that is a few extra local reads; if cadres ever grow large, batch the records
+   * into one query, merge only on change, or move the warm pass after the dials.
+   */
+  private async warmSiblingAddrBook(siblings: CohortPeerRow[]): Promise<Map<string, Multiaddr[]>> {
+    const resolved = new Map<string, Multiaddr[]>();
+    const counts: Record<MergeAddrsResult, number> = { merged: 0, restamped: 0, skipped: 0, failed: 0 };
+    for (const sibling of siblings) {
+      if (!this._running || !this.controlNode) {
+        break;
+      }
+      const addrs = await this.resolveSiblingAddrs(sibling.peerId);
+      resolved.set(sibling.peerId, addrs);
+      // Re-guarded after the resolve await as well as before it: the write is
+      // the half that matters, and a torn-down node must never be written to.
+      const controlNode = this.controlNode;
+      if (!this._running || !controlNode) {
+        break;
+      }
+      // `mergePeerAddrs` owns the whole best-effort contract — including parsing
+      // a malformed `CadrePeer.PeerId` — so one bad row cannot abort the pass.
+      counts[await mergePeerAddrs(controlNode, sibling.peerId, addrs)]++;
+    }
+    log('reconcileControlCohort: address book warmed (siblings=%d, merged=%d, restamped=%d, skipped=%d, failed=%d)',
+      resolved.size, counts.merged, counts.restamped, counts.skipped, counts.failed);
+    return resolved;
+  }
+
+  /**
+   * {@link resolvePeerAddrs} for one sibling, best-effort: a control-DB read
+   * failure yields `[]` (and the cold-start fallback then gets its turn) rather
+   * than aborting the whole pass, like every other step here.
+   */
+  private async resolveSiblingAddrs(peerId: string): Promise<Multiaddr[]> {
+    try {
+      return await this.resolvePeerAddrs(peerId);
+    } catch (error) {
+      log('reconcileControlCohort: resolving addrs for %s failed (continuing): %o', peerId, error);
+      return [];
+    }
+  }
+
+  /**
+   * Budget for ONE proactive dial of the reconcile pass — steady-state sibling
+   * ({@link dialControlSibling}) and cold-start bootstrap peer
+   * ({@link dialBootstrapPeer}) alike, since both feed a whole address list to
+   * one `dial()` and both run in a sequential loop that the next entry waits on.
    *
-   * A per-peer failure (NAT, offline, relay down, connection-gater denial) is
-   * logged and swallowed so one unreachable sibling never aborts the pass —
-   * exactly like {@link SeedBootstrapService.applySeed}'s owner-dial loop. A
-   * failed dial is simply retried on the next pass.
+   * See {@link DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS} for why the pass bounds
+   * this itself rather than inheriting each address's libp2p attempt timeout.
    */
-  private async dialControlSibling(sibling: CohortPeerRow): Promise<boolean> {
+  private controlDialTimeoutMs(): number {
+    return this.config.network?.controlCohort?.dialTimeoutMs
+      ?? DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS;
+  }
+
+  /**
+   * Dial one sibling from its already-resolved addresses, best-effort. Returns
+   * whether a dial was attempted (false when no address resolves).
+   *
+   * A per-peer failure (NAT, offline, relay down, connection-gater denial, or
+   * the {@link controlDialTimeoutMs} budget expiring) is logged and swallowed so
+   * one unreachable sibling never aborts the pass — exactly like
+   * {@link SeedBootstrapService.applySeed}'s owner-dial loop. A failed dial is
+   * simply retried on the next pass.
+   */
+  private async dialControlSibling(sibling: CohortPeerRow, resolved: Multiaddr[]): Promise<boolean> {
     const controlNode = this.controlNode;
     if (!controlNode) {
       return false;
     }
-    const addrs = await this.resolveControlDialAddrs(sibling.peerId);
+    const addrs = await this.resolveControlDialAddrs(sibling.peerId, resolved);
     if (addrs.length === 0) {
       log('reconcileControlCohort: no dialable control address for sibling %s; skipping', sibling.peerId);
       return false;
     }
     try {
       log('reconcileControlCohort: dialing sibling %s (%d addr(s))', sibling.peerId, addrs.length);
-      await controlNode.dial(addrs);
+      await withDeadline(
+        this.controlDialTimeoutMs(),
+        `reconcileControlCohort dial of sibling ${sibling.peerId}`,
+        (signal) => controlNode.dial(addrs, { signal })
+      );
       return true;
     } catch (error) {
       log('reconcileControlCohort: dial of sibling %s failed (continuing): %o', sibling.peerId, error);
@@ -1913,16 +2385,16 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Resolve a sibling's control-network dial addresses for the reconcile pass.
+   * A sibling's control-network dial addresses for the reconcile pass.
    *
-   * Primary (steady state): the signed, fresh, trust-gated control addresses from
-   * the converged `CadrePeer` record via {@link resolvePeerAddrs}. Fallback (cold
-   * start): the libp2p peerStore entries `applySeed` populated, used only while the
-   * record is not yet resolvable. Returns `[]` (never throws) when neither yields
-   * an address — that sibling is skipped this pass.
-   */
-  private async resolveControlDialAddrs(peerId: string): Promise<Multiaddr[]> {
-    const resolved = await this.resolvePeerAddrs(peerId);
+   * Primary (steady state): the signed, fresh, trust-gated control addresses
+   * `resolved` for it by {@link warmSiblingAddrBook} — passed in rather than
+   * re-resolved, so the pass makes one record query per sibling. Fallback (cold
+   * start): the libp2p peerStore entries `applySeed` populated, used only while
+   * the record is not yet resolvable. Returns `[]` (never throws) when neither
+   * yields an address — that sibling is skipped this pass.
+   */
+  private async resolveControlDialAddrs(peerId: string, resolved: Multiaddr[]): Promise<Multiaddr[]> {
     if (resolved.length > 0) {
       return resolved;
     }
@@ -1933,6 +2405,16 @@ export class CadreNode implements SAppIdLookup {
    * Cold-start fallback: the libp2p peerStore multiaddrs for `peerId` (seeded by
    * {@link SeedBootstrapService.applySeed}). Returns `[]` on a missing entry or any
    * parse/lookup failure — never throws.
+   *
+   * Normalized through {@link normalizeDialAddrs} for the same reason
+   * {@link resolvePeerAddrs} is, and with more cause: the address book hands back
+   * a list that is inherently MIXED. `@libp2p/peer-store`'s
+   * `dedupeFilterAndSortAddresses` strips a trailing `/p2p/<peerId>` only when
+   * that id is the address's FIRST `/p2p/` component, so a direct address
+   * round-trips bare while a relayed one — whose first `/p2p/` names the relay —
+   * keeps its suffix (the same asymmetry `peer-addr-book.ts`'s `addrKey` exists
+   * to absorb). Feeding both to one `dial()` is exactly the
+   * `InvalidParametersError` that skipped the whole peer.
    */
   private async peerStoreAddrs(peerId: string): Promise<Multiaddr[]> {
     if (!this.controlNode) {
@@ -1942,7 +2424,10 @@ export class CadreNode implements SAppIdLookup {
       const peer = await this.controlNode.peerStore.get(peerIdFromString(peerId));
       // Re-parse through the top-level multiaddr parser so the returned type matches
       // resolvePeerAddrs (the peerStore bundles its own @multiformats/multiaddr copy).
-      return this.parseMultiaddrs(peer.addresses.map((a) => a.multiaddr.toString()));
+      return this.normalizeDialAddrs(
+        this.parseMultiaddrs(peer.addresses.map((a) => a.multiaddr.toString())),
+        peerId
+      );
     } catch (error) {
       log('reconcileControlCohort: peerStore lookup for %s failed: %o', peerId, error);
       return [];
@@ -2033,6 +2518,13 @@ export class CadreNode implements SAppIdLookup {
       if (!this._running || !this.controlNode) {
         return;
       }
+      // NOTE: a connection this node still holds in `status: 'open'` after the remote
+      // has already aborted it counts as connected here, so the cold-start retry stays
+      // suppressed for that peer until the connection monitor's next ping notices the
+      // abort — measured at ~9 s in `control-cohort-cold-start-retry.integration.ts`.
+      // Bounded and self-healing today; it would start to matter if the connection
+      // monitor's ping interval were lengthened, or if recovery ever had to meet a
+      // deadline tighter than one ping interval.
       if (connected.has(peerId)) {
         continue;
       }
@@ -2048,32 +2540,15 @@ export class CadreNode implements SAppIdLookup {
    * Bind a bootstrap peer's seed addresses to its peer id, so the dial
    * authenticates the peer it is aiming at rather than trusting whoever answers.
    *
-   * An address that already carries `/p2p/<id>` must carry THIS peer's id or it
-   * is dropped (a seed that disagrees with itself is not a dial target); one
-   * that carries none — an `addressOverrides`-published record, say — gets the
-   * id encapsulated. Unencapsulatable addresses are dropped rather than dialed
-   * bare.
+   * The same {@link normalizeDialAddrs} rule the resolved and address-book paths
+   * use, on the third and last source of control-dial candidates: an address that
+   * already terminates in `/p2p/<id>` must carry THIS peer's id or it is dropped
+   * (a seed that disagrees with itself is not a dial target); one that does not —
+   * a bare listen addr, or a relay hop with the destination missing — gets the id
+   * encapsulated; an unencapsulatable one is dropped rather than dialed bare.
    */
   private bootstrapDialAddrs(peerId: string, addrs: string[]): Multiaddr[] {
-    const out: Multiaddr[] = [];
-    for (const addr of this.parseMultiaddrs(addrs)) {
-      const embedded = trailingPeerId(addr);
-      if (embedded === peerId) {
-        out.push(addr);
-        continue;
-      }
-      if (embedded !== null) {
-        log('reconcileControlCohort(cold-start): addr %s names peer %s, not %s; dropping',
-          addr.toString(), embedded, peerId);
-        continue;
-      }
-      try {
-        out.push(addr.encapsulate(`/p2p/${peerId}`));
-      } catch (error) {
-        log('reconcileControlCohort(cold-start): cannot bind %s to %s: %o', addr.toString(), peerId, error);
-      }
-    }
-    return out;
+    return this.normalizeDialAddrs(this.parseMultiaddrs(addrs), peerId);
   }
 
   /** Dial one cold-start bootstrap peer, best-effort. Returns whether it connected. */
@@ -2089,7 +2564,11 @@ export class CadreNode implements SAppIdLookup {
     }
     try {
       log('reconcileControlCohort(cold-start): dialing bootstrap peer %s (%d addr(s))', peerId, parsed.length);
-      await controlNode.dial(parsed);
+      await withDeadline(
+        this.controlDialTimeoutMs(),
+        `reconcileControlCohort cold-start dial of bootstrap peer ${peerId}`,
+        (signal) => controlNode.dial(parsed, { signal })
+      );
       return true;
     } catch (error) {
       log('reconcileControlCohort(cold-start): dial of bootstrap peer %s failed (continuing): %o', peerId, error);
@@ -2802,7 +3281,6 @@ export class CadreNode implements SAppIdLookup {
     }
 
     try {
-      // Discovery path: no explicit mode — infer from cohort membership.
       await this.launchStrand(strand, sAppConfig);
     } catch (error) {
       log('Error starting strand %s: %o', strand.Id, error);
@@ -2836,7 +3314,32 @@ export class CadreNode implements SAppIdLookup {
     }
   }
 
+  /**
+   * Return this node to its pre-{@link start} state. The ONE teardown — `stop()` and
+   * a failed `start()` both come here, so anything a stopped node must not still be
+   * doing belongs in this method and not in `stop()`. `stop()` adds only the
+   * `control:disconnected` emit, which a never-connected start has no edge for.
+   */
   private async cleanup(): Promise<void> {
+    // Open the connection gate's bring-up quiet period unconditionally: teardown
+    // must never be gated, and this is the path a FAILED start() takes.
+    this.controlBringUpInFlight = false;
+
+    // Stop the relay retry loop BEFORE tearing the node down, not after: the control
+    // node is stopped partway through below, and a tick that fires during it would
+    // dial and then poll a half-torn-down node for the whole reserve timeout —
+    // logging spurious dial failures on a `.unref()`'d timer that nothing ever
+    // clears. `driveControlRelayReservation` starts this supervisor from inside
+    // `start()`, so a start that fails ON the reservation leaves one running unless
+    // it is stopped here.
+    this.relayReserveSupervisor?.stop();
+    this.relayReserveSupervisor = null;
+    // Drop the rest of the relay-reservation posture: a torn-down node holds no
+    // reservation, so neither a restarted instance nor a caller inspecting a failed
+    // start reports the previous attempt's `reserved`.
+    this.relayReserveAddrs = [];
+    this.relayReserveError = null;
+
     // Resolve + clear any in-flight wake windows first, so an in-flight check-in
     // or serviceWake unblocks and tears down cleanly rather than firing a stale
     // window timer (or hanging) after the strand manager is stopped below.
@@ -2918,6 +3421,27 @@ export class CadreNode implements SAppIdLookup {
       await this.controlNode.stop();
       this.controlNode = null;
     }
+
+    // Release the control store's claim on its cache LAST — after the database and
+    // node that write through it are down. The wrapper counts holders, so this empties
+    // and unregisters the cache only if no other scope still holds it. Dropping the
+    // field is what lets a stop()/start() cycle re-resolve the provider against a live
+    // cache instead of handing the restarted node a retired wrapper. Logged, never
+    // thrown: a cache-bookkeeping failure must not abort a teardown.
+    if (this.controlStorage) {
+      const controlStorage = this.controlStorage;
+      this.controlStorage = null;
+      await disposeStorageCache(controlStorage).catch(
+        (err) => log('Failed to dispose control storage cache: %o', err)
+      );
+    }
+
+    // LAST, so every step above still ran against a node that considered itself up
+    // (several of them early-return while `_running` is false). A failed `start()`
+    // that had already flipped it — the reservation drive throws after that point —
+    // must not leave `isRunning` true over a torn-down node, which would report
+    // healthy and make the embedder's retry a no-op ("already running").
+    this._running = false;
   }
 
   // Hibernation callbacks
@@ -2961,7 +3485,7 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Wake a strand. If it was hibernating (quiesced — no libp2p node), re-resolve
-   * the cohort discovery seed and mode exactly as `launchStrand` does and rebuild
+   * the cohort discovery seed exactly as `launchStrand` does and rebuild
    * its runtime via the strand manager. If it is still live (e.g. waking an idle
    * strand, which retains its resources), just flip the status. Overlapping wake
    * triggers are coalesced upstream by `HibernationManager`, so this runs once
@@ -2983,8 +3507,8 @@ export class CadreNode implements SAppIdLookup {
       return;
     }
 
-    // Quiesced: re-resolve volatile cohort inputs (the seed may have grown, the
-    // mode may have shifted bootstrap → networked) and rebuild the runtime.
+    // Quiesced: re-resolve the volatile cohort input (the seed may have grown)
+    // and rebuild the runtime.
     log('Waking strand %s — rebuilding strand-network resources', strandId);
     await this.resumeStrandRuntime(strandId);
     instance.lastActivity = new Date();
@@ -2993,11 +3517,10 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Rebuild a quiesced strand's runtime, re-resolving the volatile cohort inputs
-   * first: the discovery seed may have grown and cohort membership may have
-   * shifted the mode `bootstrap → networked` since the strand last ran. Shared by
+   * Rebuild a quiesced strand's runtime, re-resolving the volatile cohort input
+   * first: the discovery seed may have grown since the strand last ran. Shared by
    * the wake (`handleStrandWake`) and check-in (`handleStrandCheckIn`) paths so
-   * both apply the same fresh seed/mode resolution. `resumeStrand` is idempotent
+   * both apply the same fresh seed resolution. `resumeStrand` is idempotent
    * (returns the live instance unchanged) as a backstop against double-resume.
    */
   private async resumeStrandRuntime(strandId: string): Promise<void> {
@@ -3007,12 +3530,13 @@ export class CadreNode implements SAppIdLookup {
     const delegatePeerId = this.identityKey
       ? peerIdFromPrivateKey(await strandTransportKey(this.identityKey, strandId)).toString()
       : undefined;
-    const seed = await this.resolveCohortSeed(strandId, delegatePeerId);
-    const mode = selectStrandMode(undefined, seed.hasOtherPeers);
-    await this.strandManager.resumeStrand(strandId, {
-      bootstrapNodes: seed.bootstrapNodes,
-      mode
-    });
+    const bootstrapNodes = await this.resolveCohortSeed(strandId, delegatePeerId);
+    const instance = await this.strandManager.resumeStrand(strandId, { bootstrapNodes });
+    // Same reason as the launch path: `bootstrapNodes` only reaches the address
+    // book through @libp2p/bootstrap discovery, so merge it directly as well.
+    if (instance.libp2pNode) {
+      await this.mergeStrandPeerAddrs(instance.libp2pNode, bootstrapNodes, strandId);
+    }
   }
 
   /**
@@ -3024,7 +3548,7 @@ export class CadreNode implements SAppIdLookup {
    * realized as a resume → bounded window → re-hibernate-if-idle cycle that
    * reuses the existing quiesce/resume primitives rather than a bespoke probe:
    *
-   *   1. Resume the strand (rebuild node + db, re-resolve cohort seed/mode) so
+   *   1. Resume the strand (rebuild node + db, re-resolve the cohort seed) so
    *      its strand network can reach cohort peers — exactly as a wake does.
    *   2. Hold it resumed for a bounded window, during which the app may drive
    *      reads (pull-on-read) and record activity.
@@ -3049,7 +3573,7 @@ export class CadreNode implements SAppIdLookup {
 
     try {
       // 1. Resume exactly as a wake does: re-resolve the (possibly grown) cohort
-      //    seed + mode, then rebuild the runtime.
+      //    seed, then rebuild the runtime.
       log('Check-in: resuming strand %s to probe the cohort for pending activity', strandId);
       await this.resumeStrandRuntime(strandId);
 
@@ -3161,18 +3685,16 @@ export class CadreNode implements SAppIdLookup {
       throw new Error('CadreNode not running');
     }
 
-    const { strandRow, sAppConfig, mode, founder } = config;
+    const { strandRow, sAppConfig, founder } = config;
 
     // Store sApp config for this strand
     this.sAppConfigs.set(strandRow.Id, sAppConfig);
-    log('Registered sAppConfig for strand %s (sApp: %s, mode: %s, founder: %s)',
-      strandRow.Id, sAppConfig.id, mode ?? 'inferred', founder ?? false);
+    log('Registered sAppConfig for strand %s (sApp: %s, founder: %s)',
+      strandRow.Id, sAppConfig.id, founder ?? false);
 
-    // Pass `mode` (possibly undefined) through: an explicit mode wins, while a
-    // caller that omits it gets the same cohort-inferred mode as the discovery path.
     // `founder` only flows from the explicit addStrand path — the control-discovered
     // join path never founds, so its rows arrive via sync (see handleStrandAdded).
-    return await this.launchStrand(strandRow, sAppConfig, mode, founder);
+    return await this.launchStrand(strandRow, sAppConfig, founder);
   }
 
   /**
@@ -3449,8 +3971,8 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Shared strand launch path for both the explicit (`addStrand`) and the
    * control-discovered (`handleStrandAdded`) entry points. Resolves the cohort
-   * seed, selects the mode, starts the strand, and registers it with the
-   * hibernation manager before emitting `strand:started`.
+   * seed, starts the strand, and registers it with the hibernation manager
+   * before emitting `strand:started`.
    *
    * Idempotent no-op when the strand manager already tracks `strand.Id` — the
    * ordinary founding sequence is `addStrand` (starts it locally) followed by
@@ -3464,7 +3986,6 @@ export class CadreNode implements SAppIdLookup {
   private async launchStrand(
     strand: StrandRow,
     sAppConfig: SAppConfig,
-    explicitMode?: StrandMode,
     founder?: boolean
   ): Promise<StrandInstance> {
     const existing = this.strandManager.getInstance(strand.Id);
@@ -3497,8 +4018,7 @@ export class CadreNode implements SAppIdLookup {
     // `libp2p.start()` (the responder records the grant before replying; the
     // client awaits the replies).
     const delegatePeerId = transportKey ? peerIdFromPrivateKey(transportKey).toString() : undefined;
-    const seed = await this.resolveCohortSeed(strand.Id, delegatePeerId);
-    const mode = selectStrandMode(explicitMode, seed.hasOtherPeers);
+    const bootstrapNodes = await this.resolveCohortSeed(strand.Id, delegatePeerId);
 
     const instance = await this.strandManager.startStrand({
       strandRow: strand,
@@ -3508,32 +4028,40 @@ export class CadreNode implements SAppIdLookup {
       profile: this.config.profile,
       defaultLatencyHint: this.config.hibernation?.defaultLatencyHint ?? 'interactive',
       privateKey: transportKey,
-      bootstrapNodes: seed.bootstrapNodes,
-      mode,
+      bootstrapNodes,
       requireSignedSchemas: this.config.requireSignedSchemas,
       clusterSize: this.config.strandClusterSize,
       backfill: this.config.strandBackfill,
       founder
     });
 
+    // The seed reached the node as `bootstrapNodes`, which only enters the
+    // address book via @libp2p/bootstrap discovery. Merge it directly too, so a
+    // sibling is dialable by bare peer id from the first moment (see
+    // mergeStrandPeerAddrs; refreshStrandPeerAddrs keeps it warm from here on).
+    if (instance.libp2pNode) {
+      await this.mergeStrandPeerAddrs(instance.libp2pNode, bootstrapNodes, strand.Id);
+    }
+
     this.hibernationManager.trackStrand(instance);
     this.emit('strand:started', { strandId: strand.Id });
     return instance;
   }
 
   /**
-   * Resolve a strand's discovery seed. Membership (and thus mode) comes from the
-   * control network's CadrePeer rows; the **strand-network** bootstrap addresses
-   * are resolved on demand over the control mesh via the strand-addr RPC —
-   * deliberately NOT from `CadrePeer.Multiaddr`, which carries *control*
-   * addresses that must not seed the strand mesh.
+   * Resolve a strand's discovery seed — the dialable strand-network multiaddr
+   * strings for cohort siblings. Membership comes from the control network's
+   * CadrePeer rows; the **strand-network** bootstrap addresses are resolved on
+   * demand over the control mesh via the strand-addr RPC — deliberately NOT
+   * from `CadrePeer.Multiaddr`, which carries *control* addresses that must not
+   * seed the strand mesh.
    *
    * Only siblings we already hold an open control connection to are RPC'd: they
    * are the ones that can answer right now, and dialing them by peerId reuses the
    * live connection. When no connected sibling yet runs the strand the seed is
-   * empty (`[]`) — mode still follows membership, and the empty seed self-heals
-   * on the next resume / check-in pass. Returns an empty seed when the control DB
-   * or node is absent (not yet started / torn down).
+   * empty (`[]`) — the empty seed self-heals on the next resume / check-in pass.
+   * Returns an empty seed when the control DB or node is absent (not yet
+   * started / torn down).
    *
    * When `delegatePeerId` is given (a strand launch/resume is imminent), the
    * pass doubles as the delegate ANNOUNCEMENT: our circuit relays are merged
@@ -3546,20 +4074,11 @@ export class CadreNode implements SAppIdLookup {
    * needs no grant. The relay's direct addr rides along as the dial fallback
    * for a relay we are not yet connected to.
    */
-  private async resolveCohortSeed(strandId: string, delegatePeerId?: string): Promise<CohortSeed> {
+  private async resolveCohortSeed(strandId: string, delegatePeerId?: string): Promise<string[]> {
     if (!this.controlDatabase || !this.controlNode) {
-      return { bootstrapNodes: [], hasOtherPeers: false };
+      return [];
     }
-    const peers = await this.controlDatabase.queryCadrePeers();
-    const { otherPeerIds, hasOtherPeers } =
-      deriveCohortMembers(peers, this.controlNode.peerId.toString());
-
-    // RPC only siblings we already have a control connection to — they can answer
-    // now, and `dialProtocol` by peerId reuses the open connection.
-    const connected = new Set(this.controlNode.getConnections().map((c) => c.remotePeer.toString()));
-    const targets: StrandAddrPeer[] = otherPeerIds
-      .filter((id) => connected.has(id))
-      .map((peerId) => ({ peerId }));
+    const targets = await this.connectedSiblingTargets();
     const relays = delegatePeerId === undefined ? [] : this.circuitRelayTargets();
     for (const relay of relays) {
       if (!targets.some((t) => t.peerId === relay.relayPeerId)) {
@@ -3572,16 +4091,72 @@ export class CadreNode implements SAppIdLookup {
     // Throttle state for the RELAY targets only — refreshDelegateGrants never
     // looks up a sibling key, so recording one would only be dead weight.
     this.recordDelegateAnnounces(relays.map((r) => r.relayPeerId), strandId);
-    return { bootstrapNodes, hasOtherPeers };
+    return bootstrapNodes;
+  }
+
+  /**
+   * The co-cadre siblings worth sending a strand-addr RPC to right now: cohort
+   * members (self excluded) we already hold an open control connection to. They
+   * are the ones that can answer immediately, and dialing them by peerId reuses
+   * the live connection instead of opening a second one.
+   *
+   * Shared by {@link resolveCohortSeed} (launch/resume) and
+   * {@link refreshStrandPeerAddrs} (the periodic pass) so both ask the same set.
+   * Empty when the control DB or node is absent (not yet started / torn down).
+   *
+   * The read below is issued even when the node holds no control connection and
+   * the answer is therefore empty by construction. That is deliberate on the
+   * launch path: `control-database-solo-warm-start.spec.ts` exists to prove this
+   * exact read does not stall as an embedder's FIRST awaited control operation,
+   * on a warm cohort no one can reach. A caller that re-enters often enough for
+   * the read to matter should skip the call itself, as
+   * {@link refreshStrandPeerAddrs} does.
+   *
+   * NOTE: this read is UNBOUNDED and sits on the critical path an embedding app
+   * awaits during startup — `addStrand` cannot resolve until it does, and it is
+   * the first control operation an embedder's boot order issues (before genesis,
+   * before seed bootstrap). Measured fine today: the warm-start-alone shape a
+   * report pointed at — a `CadrePeer` list naming peers that are all gone, read
+   * off real files after a restart — completes in milliseconds, and
+   * `control-database-solo-warm-start.spec.ts` covers it under a deadline. If a
+   * control read ever CAN stall (a transactor change that consults the network
+   * for a local row, a storage backend with blocking I/O), give this one a
+   * timeout — and decide then whether the breach fails `addStrand` or degrades
+   * to an empty seed, because those promise callers different things.
+   */
+  private async connectedSiblingTargets(): Promise<StrandAddrPeer[]> {
+    const controlNode = this.controlNode;
+    if (!this.controlDatabase || !controlNode) {
+      return [];
+    }
+    const peers = await this.controlDatabase.queryCadrePeers();
+    const connected = new Set(controlNode.getConnections().map((c) => c.remotePeer.toString()));
+    return deriveCohortMembers(peers, controlNode.peerId.toString())
+      .filter((id) => connected.has(id))
+      .map((peerId) => ({ peerId }));
   }
 
   /**
    * The circuit relays this node's strand nodes would reserve through: the
-   * union of the RESOLVED listen addrs' circuits — a hand-written
-   * `network.listenAddrs` circuit entry or a `network.relayAddrs` entry, which
-   * the strand node inherits verbatim either way — and the control node's own
-   * live `/p2p-circuit` multiaddrs (a reservation this node discovered rather
-   * than configured).
+   * union of CONFIGURED relays — `network.relayAddrs`, plus any hand-written
+   * `network.listenAddrs` circuit entry, both of which a strand node inherits
+   * verbatim — and the control node's own live `/p2p-circuit` multiaddrs (a
+   * reservation this node discovered rather than configured).
+   *
+   * The CONFIGURED half reads `network.relayAddrs` and `network.listenAddrs`
+   * directly rather than going through {@link resolveListenAddrs}: the control
+   * node's resolution takes the `'search'` route, whose bare `/p2p-circuit` entry
+   * names no relay, so a configured relay would be unannounceable here until this
+   * node's own reservation landed — and the announce must be in place BEFORE a
+   * strand node dials its reservation, since the relay's membership gate does not
+   * know the strand's derived peerId (see delegate-admission.ts). Configuration is
+   * authoritative; the live multiaddrs only ADD relays nobody configured.
+   *
+   * The `listenAddrs` half is now unreachable on a control node — `relay-addrs.ts`
+   * rejects a hand-written `<relay>/p2p-circuit` listen entry outright, because the
+   * bring-up quiet period denies the dial that listener makes from inside
+   * `libp2p.start()`. Kept because it costs one spread and this is the one place
+   * that would silently stop announcing if that rejection is ever relaxed.
    *
    * NOTE: a relay the STRAND node discovers on its own (autorelay — in neither
    * source) gets no announcement, and a membership-gated one will deny it; fine
@@ -3589,7 +4164,8 @@ export class CadreNode implements SAppIdLookup {
    */
   private circuitRelayTargets(): CircuitRelayTarget[] {
     return extractCircuitRelayTargets([
-      ...(resolveListenAddrs(this.config.network) ?? []),
+      ...relayCircuitAddrs(this.config.network?.relayAddrs ?? []),
+      ...(this.config.network?.listenAddrs ?? []),
       ...(this.controlNode?.getMultiaddrs().map(String) ?? [])
     ]);
   }
@@ -3669,6 +4245,166 @@ export class CadreNode implements SAppIdLookup {
     this.recordDelegateAnnounces(due.map((relay) => relay.relayPeerId), strandId, now);
   }
 
+  /**
+   * Re-resolve each running strand's SIBLING addresses over the control mesh and
+   * merge them into that strand's own libp2p address book, throttled to once per
+   * {@link STRAND_PEER_ADDR_REFRESH_MS} per strand.
+   *
+   * Without this, a strand's address book is written exactly once — the
+   * launch/resume seed — and everything below cadre-core that dials a strand peer
+   * by bare peer id (Optimystic's cluster and repo clients, FRET ping/announce)
+   * loses its address for any sibling it is not currently connected to: a sibling
+   * that restarted its strand node or rotated its relay reservation is never
+   * re-resolved, and even the original seed addresses fall off at the peerStore's
+   * one-hour expiry (see `peer-addr-book.ts`).
+   *
+   * Distinct from {@link refreshDelegateGrants}, deliberately: that pass covers
+   * RELAYS on a `DELEGATE_GRANT_TTL_MS / 2` throttle to keep circuit-relay
+   * admission grants alive, this one covers SIBLINGS on an address-expiry
+   * throttle to keep the address book warm. They overlap only in that both carry
+   * `delegatePeerId`, so a sibling that also runs a relay gets its grant
+   * refreshed here as a side effect. Merging them would tie an admission-grant
+   * TTL to an address-expiry window that has nothing to do with it.
+   *
+   * Strands refresh CONCURRENTLY, like `refreshDelegateGrants`, so one
+   * unreachable sibling's dial timeout does not stack up per strand.
+   */
+  private async refreshStrandPeerAddrs(now = Date.now()): Promise<void> {
+    if (!this._running || !this.controlNode) {
+      return;
+    }
+    // A hibernating / quiescing strand has no node to seed, so it is not running
+    // for this pass's purposes even though its instance is still tracked.
+    const running = new Set<string>();
+    for (const [strandId, instance] of this.strandManager.getInstances()) {
+      if (instance.libp2pNode) {
+        running.add(strandId);
+      }
+    }
+    // Drop stamps for strands no longer running: the map must not grow for the
+    // node's lifetime, and a resumed strand should refresh immediately rather
+    // than inherit the stamp its previous incarnation left.
+    for (const strandId of this.strandPeerAddrRefreshAt.keys()) {
+      if (!running.has(strandId)) {
+        this.strandPeerAddrRefreshAt.delete(strandId);
+      }
+    }
+    const refreshMs = this.config.network?.controlCohort?.strandAddrRefreshMs ?? STRAND_PEER_ADDR_REFRESH_MS;
+    const due = [...running].filter(
+      (strandId) => now - (this.strandPeerAddrRefreshAt.get(strandId) ?? 0) >= refreshMs
+    );
+    if (due.length === 0) {
+      return;
+    }
+    // A due strand with nobody to ask leaves its throttle unstamped (see below),
+    // so this pass re-enters on EVERY 15 s reconcile tick for as long as the node
+    // is alone — which is the steady state of a solo node running a strand.
+    // `connectedSiblingTargets`' membership read is unbounded, and with zero
+    // connections its answer is empty whatever the table holds, so decide it here
+    // from the connection list instead of paying for the read once a tick.
+    if (this.controlNode.getConnections().length === 0) {
+      return;
+    }
+    // NOTE: one strand-addr RPC per (due strand × connected sibling) per refresh
+    // interval — each a tiny request/response on an already-open control
+    // connection. If a node ever runs MANY strands at once, batch the RPC to
+    // carry several strand ids per request rather than one fan-out per strand.
+    const targets = await this.connectedSiblingTargets().catch((error): StrandAddrPeer[] => {
+      log('refreshStrandPeerAddrs: sibling enumeration failed (skipping pass): %o', error);
+      return [];
+    });
+    // No sibling to ask (or a shutdown landed mid-enumeration): leave every stamp
+    // untouched so the next reconcile tick retries, rather than sitting out the
+    // whole refresh interval having asked nobody.
+    if (targets.length === 0 || !this._running || !this.controlNode) {
+      return;
+    }
+    await Promise.all(due.map((strandId) => this.refreshOneStrandPeerAddrs(strandId, targets, now)));
+  }
+
+  /**
+   * One strand's share of {@link refreshStrandPeerAddrs}: RPC the siblings, then
+   * merge their answers into this strand's address book. Errors are logged and
+   * swallowed so one strand's failure never costs the others their refresh.
+   */
+  private async refreshOneStrandPeerAddrs(
+    strandId: string,
+    targets: readonly StrandAddrPeer[],
+    now: number
+  ): Promise<void> {
+    const controlNode = this.controlNode;
+    const strandNode = this.strandManager.getInstance(strandId)?.libp2pNode;
+    if (!controlNode || !strandNode) {
+      return;
+    }
+    try {
+      // The running strand node's own peerId is the delegate to announce — see
+      // the relationship note on refreshStrandPeerAddrs.
+      const addrs = await collectStrandAddrs(controlNode, [...targets], strandId, {
+        delegatePeerId: strandNode.peerId.toString()
+      });
+      // Stamped on the RPC having happened, not on its answer: the fan-out is
+      // what the throttle exists to bound, and an all-empty round is a normal
+      // steady state for a strand no connected sibling currently runs.
+      this.strandPeerAddrRefreshAt.set(strandId, now);
+      // Re-read the instance after the await — a strand stopped mid-pass (or one
+      // already restarted onto a new node) must never have its store written to.
+      if (!this._running || this.strandManager.getInstance(strandId)?.libp2pNode !== strandNode) {
+        return;
+      }
+      await this.mergeStrandPeerAddrs(strandNode, addrs, strandId);
+    } catch (error) {
+      log('refreshStrandPeerAddrs: strand %s refresh failed (continuing): %o', strandId, error);
+    }
+  }
+
+  /**
+   * Merge strand-network addresses into ONE strand node's libp2p address book,
+   * attributed per peer. Best-effort throughout: an address-book write must never
+   * fail a launch, a resume, or a reconcile pass.
+   *
+   * `addrs` is the peer-agnostic union the strand-addr RPC returns, so
+   * {@link groupAddrsByPeerId} attributes each entry to the **strand transport**
+   * peerId in its final `/p2p/` component — never the sibling's control peerId,
+   * which names a different libp2p node entirely. Entries that name no peer are
+   * dropped there and counted here, once per pass.
+   *
+   * NOTE: a member could answer with arbitrary multiaddrs bound to arbitrary peer
+   * ids and poison this address book. That is the same exposure the launch-time
+   * `bootstrapNodes` seeding already accepts, and the cost is bounded: an address
+   * grants no authority, the dialed peer authenticates by peer id at the
+   * handshake, and a bad entry costs one failed dial that ages out at the
+   * peerStore's one-hour expiry. No new gating here — cross-party strand trust is
+   * `backlog/strand-network-nat-relay-reachability`.
+   */
+  private async mergeStrandPeerAddrs(strandNode: Libp2p, addrs: string[], strandId: string): Promise<void> {
+    const counts: Record<MergeAddrsResult, number> = { merged: 0, restamped: 0, skipped: 0, failed: 0 };
+    let grouped = 0;
+    let peers = 0;
+    try {
+      const groups = groupAddrsByPeerId(addrs);
+      peers = groups.size;
+      const selfId = strandNode.peerId.toString();
+      for (const [peerId, peerAddrs] of groups) {
+        grouped += peerAddrs.length;
+        // We never RPC ourselves, so self should never appear — belt and braces:
+        // a node must not write its own addresses into its own address book.
+        if (peerId === selfId) {
+          continue;
+        }
+        counts[await mergePeerAddrs(strandNode, peerId, peerAddrs)]++;
+      }
+    } catch (error) {
+      // `mergePeerAddrs` folds its own failures, so reaching here means the node
+      // itself is unusable (torn down mid-merge). Never fail a launch/resume or a
+      // reconcile pass over an address book.
+      log('strand %s address book merge failed (continuing): %o', strandId, error);
+    }
+    log('strand %s address book merged (peers=%d, merged=%d, restamped=%d, skipped=%d, failed=%d, dropped=%d)',
+      strandId, peers, counts.merged, counts.restamped, counts.skipped, counts.failed,
+      addrs.length - grouped);
+  }
+
   /**
    * The local strand instance's dialable strand-network multiaddrs for the
    * strand-addr RPC, ordered signaling-first (reusing the control node's
@@ -3913,16 +4649,61 @@ export class CadreNode implements SAppIdLookup {
     return this.controlNode;
   }
 
+  /**
+   * The boot-path half of {@link reserveRelays}: reserve through every
+   * `network.relayAddrs` entry, or fail `start()`.
+   *
+   * WHY IT RUNS HERE, AT THE END. `network.relayAddrs` used to resolve to a
+   * CONFIGURED circuit listener, which libp2p dials from inside `libp2p.start()`
+   * — so the relay was already a connected peer, and therefore already in this
+   * node's Optimystic cohort, before `ControlDatabase.initialize()` ran. Building
+   * that database is a long chain of cohort-consulting block probes (catalog
+   * hydration, then one per table, then the indexes), and a sibling that has not
+   * yet replicated this node's `CadrePeer` row correctly refuses every one of
+   * them, so bring-up died on `BlockUnavailableError` — deterministically, on
+   * every boot of a relay-only node. Retrying could not converge either: the
+   * condition that clears the refusal is this node's own row reaching the
+   * sibling, and writing that row needs the database the retry is building.
+   *
+   * So the invariant is ordering, not retrying: the control database is built
+   * while this node holds ZERO control connections (a cohort of one, entirely
+   * local), and only then does it reach out. Everything above in {@link start}
+   * has completed by the time this runs.
+   *
+   * BUDGET: the supervisor's first attempt — `relay-reservation.ts`'s
+   * `DEFAULT_RELAY_RESERVE_TIMEOUT_MS`, 10 s — is what `start()` waits on — deliberately the module default rather
+   * than a boot-specific one. A healthy dial-plus-reserve is sub-second even over
+   * a WAN, so 10 s is slack for a slow link; going much longer would make a dead
+   * relay indistinguishable from a hung start, and much shorter would fail nodes
+   * on links that were merely slow. The retries carry on in the background after
+   * this resolves, exactly as they do for a {@link reserveRelays} caller.
+   */
+  private async driveControlRelayReservation(): Promise<void> {
+    const relayAddrs = this.config.network?.relayAddrs ?? [];
+    if (relayAddrs.length === 0) {
+      return;
+    }
+    const t0 = performance.now();
+    const state = await this.reserveRelays([...relayAddrs]);
+    timing('[start] reserveRelays: %dms', Math.round(performance.now() - t0));
+    if (state.status !== 'reserved') {
+      throw new RelayReservationFailedError(relayAddrs, state);
+    }
+    log('Reserved a relay slot: %o', state.circuitAddrs);
+  }
+
   /**
    * Start keeping a relay reservation: dial the given relay(s) from the control
    * node, ask the first one that answers for a reservation slot, wait until the
    * resulting `/p2p-circuit` address makes this node dialable — and keep a
    * supervisor running that re-drives whenever the reservation is later lost.
    *
-   * For nodes that listen on the bare `/p2p-circuit` SEARCH addr (a browser tab)
-   * rather than a configured `network.relayAddrs` circuit listener — see
-   * `relay-reservation.ts` for why the two are alternatives and why configuring
-   * both is a regression. Opt-in: nothing calls this for the CLI/host nodes.
+   * The FAIL-SOFT entry point, for a caller that discovers its relay at runtime
+   * (a browser tab, a host UI). A node that names `network.relayAddrs` gets the
+   * same drive from {@link driveControlRelayReservation} at the end of
+   * {@link start}, which is fail-fast instead. Both fill the pending reservation
+   * the bare `/p2p-circuit` search listener registered; calling this afterwards
+   * simply replaces the supervisor with one over the new list.
    *
    * Resolves once the FIRST attempt has settled, exactly as it did when it drove
    * once; the retries continue in the background until {@link stop} or the next
@@ -4076,6 +4857,10 @@ export class CadreNode implements SAppIdLookup {
    * Push the multiaddrs that future invites should advertise. Pass `null` to
    * revert to the libp2p-reported addresses (the default). The host calls this
    * at spawn and on every NAT change.
+   *
+   * Entries need NOT carry a `/p2p/<peerId>` suffix — {@link resolveInviteAddresses}
+   * appends this node's own before anything publishes or dials them (see
+   * {@link normalizeSelfAddrs}). Passing them suffixed is equally fine.
    */
   setInviteAddresses(addresses: string[] | null): void {
     this.latestInviteAddresses = addresses;
@@ -4084,18 +4869,60 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Resolve the addresses to embed in invites. Prefers pushed addresses, then
-   * any config-supplied resolver, then the libp2p-observed multiaddrs.
+   * any config-supplied resolver, then the libp2p-observed multiaddrs. The two
+   * app-supplied sources are normalized onto `/p2p/<self>` (see
+   * {@link normalizeSelfAddrs}) so neither hook has to remember the suffix;
+   * libp2p's own addresses already carry it.
    */
   private async resolveInviteAddresses(): Promise<string[]> {
     if (this.latestInviteAddresses !== null) {
-      return this.latestInviteAddresses;
+      return this.normalizeSelfAddrs(this.latestInviteAddresses);
     }
     if (this.config.network?.inviteAddressResolver) {
-      return this.config.network.inviteAddressResolver();
+      return this.normalizeSelfAddrs(await this.config.network.inviteAddressResolver());
     }
+    // Not normalized: this branch is libp2p's own output, which already
+    // encapsulates the peer id into every address it reports. Only the two app
+    // hooks above take arbitrary strings and therefore need the guarantee.
     return this.getMultiaddrs();
   }
 
+  /**
+   * Normalize addresses an app handed us for THIS node onto `/p2p/<self>`, the
+   * same invariant {@link normalizeDialAddrs} enforces on the way out.
+   *
+   * `setInviteAddresses` (the admin API `PUT /admin/invite-addresses`) and
+   * `network.inviteAddressResolver` both take arbitrary strings, and whatever
+   * they return ends up in this node's published `CadrePeer` record — so ONE
+   * unsuffixed entry from either hook is enough to give every sibling in the
+   * party a mixed candidate list for this peer. Establishing the suffix here,
+   * where those strings enter the system, means neither hook has to know the
+   * rule; `cadre-host`'s `buildInviteAddresses` already appends it, and
+   * re-normalizing an already-suffixed address is a no-op.
+   *
+   * Unparsable and other-peer-addressed entries are passed through untouched
+   * rather than dropped: publication is not the place to police an address's
+   * validity, and {@link resolvePeerAddrs} already drops both on the read side.
+   * Before `start()` resolves an identity there is no peer id to append, so the
+   * list is returned as given.
+   */
+  private normalizeSelfAddrs(addrs: string[]): string[] {
+    const selfPeerId = this.peerId?.toString();
+    if (!selfPeerId) {
+      return addrs;
+    }
+    return addrs.map((addr) => {
+      let parsed: Multiaddr;
+      try {
+        parsed = multiaddr(addr);
+      } catch (error) {
+        log('normalizeSelfAddrs: leaving unparsable multiaddr %s as-is: %o', addr, error);
+        return addr;
+      }
+      return withTrailingPeerId(parsed, selfPeerId)?.toString() ?? addr;
+    });
+  }
+
   /**
    * Enumerate the cadre's `CadrePeer` membership — the ADDRESSABLE surface (see
    * {@link isMember}). Rows whose stamp is retired in `CadreControl.Revocation`
@@ -4159,13 +4986,18 @@ export class CadreNode implements SAppIdLookup {
    * legit member goes un-authorized on readers that only pin the new key. Full
    * rotation handling (re-vouch on rotate) is the
    * `flip-strand-membership-rotation-known-gap` work, not this predicate's.
+   *
+   * @param retry - Whether the underlying membership read may retry a transient cluster
+   *   failure. Only {@link refreshAuthorizedControlPeers} passes `false`, because it runs
+   *   as the control database's membership listener with that database's write lock held;
+   *   see its comment.
    */
-  async listAuthorizedMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
+  async listAuthorizedMembers(retry = true): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
     if (!this.controlDatabase) {
       throw new Error('CadreNode must be started before listing members');
     }
     const selfPeerId = this.peerId?.toString();
-    const rows = await this.controlDatabase.queryCadrePeers();
+    const rows = await this.controlDatabase.queryCadrePeers(retry);
     const authorized = rows
       .filter(row => row.peerId !== selfPeerId && this.hasAnchoredVoucher(row))
       .map(({ peerId, multiaddr }) => ({ peerId, multiaddr }));