@serfab/cadre-core 0.11.0 → 0.12.0

package/dist/cadre-node.js

@@ -15,7 +15,7 @@ import { MemoryBootstrapPeerStore } from './bootstrap-peer-store.js';
 import { mergePeerAddrs, groupAddrsByPeerId } from './peer-addr-book.js';
 import { verifyCadrePeerVoucher } from './peer-authorization.js';
 import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
-import { signPeerRecord, verifyPeerRecordSignature, isPeerRecordFresh, orderSignalingFirst, isSignalingAddr, trailingPeerId, currentMemberTrustPolicy, DEFAULT_PEER_RECORD_MAX_AGE_MS, DEFAULT_PEER_RECORD_HEARTBEAT_MS } from './peer-record.js';
+import { signPeerRecord, verifyPeerRecordSignature, isPeerRecordFresh, orderSignalingFirst, isSignalingAddr, withTrailingPeerId, currentMemberTrustPolicy, DEFAULT_PEER_RECORD_MAX_AGE_MS, DEFAULT_PEER_RECORD_HEARTBEAT_MS } from './peer-record.js';
 import { signDeviceTokenRecord, verifyDeviceTokenSignature, isPushPlatform } from './device-token.js';
 import { StrandWatcher } from './strand-watcher.js';
 import { StrandInstanceManager } from './strand-instance-manager.js';
@@ -27,11 +27,12 @@ import { HibernationManager } from './hibernation-manager.js';
 import { ControlDatabase } from './control-database.js';
 import { SeedBootstrapService } from './seed-bootstrap.js';
 import { StrandSolicitationService } from './strand-solicitation.js';
-import { createMembershipConnectionGater, DEFAULT_ENROLLMENT_WINDOW_MS } from './membership-connection-gater.js';
+import { createMembershipConnectionGater, DEFAULT_ENROLLMENT_WINDOW_MS, UnauthorizedReservationBudget } from './membership-connection-gater.js';
 import { StrandWakeService, dialWake } from './strand-wake-protocol.js';
 import { StrandAddrService, collectStrandAddrs } from './strand-addr-protocol.js';
 import { DelegateAdmissionStore, extractCircuitRelayTargets, dueRelayAnnounces, pruneStoppedStrandAnnounces, peerStrandKey } from './delegate-admission.js';
-import { resolveListenAddrs } from './relay-addrs.js';
+import { relayCircuitAddrs, resolveListenAddrs, RelayReservationFailedError } from './relay-addrs.js';
+import { replacesAdvertisedAddrs, resolveAnnounceAddrs } from './announce-addrs.js';
 import { superviseRelayReservation, resolveRelayReservationState } from './relay-reservation.js';
 import { PushFanoutService } from './push-fanout.js';
 import { summarizeConnectionPaths, classifyTransport } from './diagnostics/connection-path.js';
@@ -148,10 +149,11 @@ export class CadreNode {
         this.windowWaiters = new Set();
         this.eventHandlers = new Map();
         /**
-         * Relay multiaddrs the caller asked {@link reserveRelays} to reserve through.
-         * Empty (the default) means nobody asked, so {@link getRelayReservationState}
-         * reports `none` — this whole surface is opt-in and dormant for the CLI/host
-         * nodes, which use the configured `network.relayAddrs` route instead.
+         * Relay multiaddrs the caller asked {@link reserveRelays} to reserve through —
+         * or, on a node that names `network.relayAddrs`, the ones
+         * {@link driveControlRelayReservation} asked for at the end of {@link start}.
+         * Empty (the default) means neither happened, so {@link getRelayReservationState}
+         * reports `none`.
          */
         this.relayReserveAddrs = [];
         /**
@@ -166,6 +168,23 @@ export class CadreNode {
          * supervisor to hold one — i.e. the pre-start `control node unavailable` case.
          */
         this.relayReserveError = null;
+        /**
+         * True from just before the control libp2p node is created until
+         * {@link ControlDatabase.initialize} has settled — the connection gate's
+         * BRING-UP QUIET PERIOD (`membership-connection-gater.ts`), during which this
+         * node refuses every control connection in both directions.
+         *
+         * The invariant: the control database is built while this node holds zero
+         * control connections. Every same-party sibling connected in that window joins
+         * the Optimystic cohort the bring-up's block probes consult, and a sibling that
+         * has not yet replicated this node's `CadrePeer` row refuses them all — which
+         * fails `start()` outright and cannot be retried into convergence (writing the
+         * row that would clear the refusal needs the database being built).
+         *
+         * Cleared on FAILURE as well as success ({@link cleanup} clears it), so
+         * teardown is never gated.
+         */
+        this.controlBringUpInFlight = false;
         /** Map of strandId -> sAppConfig for sAppId filtering and management */
         this.sAppConfigs = new Map();
         /**
@@ -226,10 +245,12 @@ export class CadreNode {
         /**
          * In-memory delegate admission grants (see `delegate-admission.ts`): the
          * strand-node transport peerIds this party's members have announced over the
-         * strand-addr RPC, admitted at the CONNECTION level so a member's NAT'd
-         * strand node can hold a circuit-relay reservation on this node. Consulted
-         * ONLY by {@link admitInboundControlConnection}; the fail-closed per-stream
-         * gate ({@link authorizeInboundControlStream}) never honors it.
+         * strand-addr RPC, admitted at the CONNECTION and RESERVATION levels so a
+         * member's NAT'd strand node can hold a circuit-relay reservation on this
+         * node (without spending the unauthorized-reservation budget). Consulted
+         * ONLY by {@link admitInboundControlConnection} and
+         * {@link admitControlRelayReservation}; the fail-closed per-stream gate
+         * ({@link authorizeInboundControlStream}) never honors it.
          */
         this.delegateAdmission = new DelegateAdmissionStore();
         /**
@@ -390,6 +411,7 @@ export class CadreNode {
         this.config = config;
         this.strandManager = new StrandInstanceManager();
         this.enrollmentService = new EnrollmentService();
+        this.unauthorizedRelayReservations = new UnauthorizedReservationBudget(config.network?.unauthorizedRelayReservationCap);
         // Create hibernation manager with callbacks
         const hibernationCallbacks = {
             onIdle: async (strandId) => this.handleStrandIdle(strandId),
@@ -501,16 +523,12 @@ export class CadreNode {
             return;
         }
         log('Starting CadreNode for party: %s', this.config.controlNetwork.partyId);
-        // NOTE: the only direct `console.*` in this library — a boot-time operator warning, not a
-        // diagnostic trace (those use `debug`, which an operator never sees without `DEBUG=`). If a
-        // second such warning ever appears here, route both through a `CadreNodeEvents` entry the
-        // embedder surfaces instead of growing a console surface inside a library.
-        if (this.config.network?.announceAddrs && this.config.network.announceAddrs.length > 0) {
-            console.warn('network.announceAddrs is set but not yet supported (no upstream db-p2p option to apply it) ' +
-                '— this node will keep advertising its listen/relay addresses instead.');
-        }
         try {
             const tTotal = performance.now();
+            // Config pre-flight, inside the guarded region: resolving the listen addrs it reads
+            // throws on a malformed `relayAddrs` entry, and that failure belongs on the same
+            // logged-and-cleaned-up path as every other one in start().
+            this.warnIfAnnounceAddrsDiscardRelay();
             // Install the WebRTC TURN-relay tracker BEFORE any libp2p bring-up, so it
             // wraps globalThis.RTCPeerConnection before the control node can create one.
             // Inert on Node.js (no RTCPeerConnection); disposed in cleanup().
@@ -529,6 +547,24 @@ export class CadreNode {
             // closed before any network bring-up, and the retained dial targets are
             // loaded before the first reconcile pass could consult them.
             this.initializeBootstrapPeerStore();
+            // Arm the connection gate's BRING-UP QUIET PERIOD before the libp2p node
+            // exists, so no connection can form ahead of it: `@libp2p/bootstrap` emits
+            // its discovery events ~1 s after `libp2p.start()` and the connection
+            // manager auto-dials from there, which is INSIDE createControlNode below.
+            // The invariant being protected is "zero control connections during
+            // control-database bring-up" — see the field's doc and
+            // `membership-connection-gater.ts` → "The bring-up quiet period".
+            //
+            // NOTE: without this gate the bootstrap arm is a RACE, not a guarantee — its
+            // safety margin is bring-up duration versus @libp2p/bootstrap's 1 s discovery
+            // fuse, and bring-up duration is (raw-storage operations) × per-operation
+            // latency. The cold-start operation count and the 50-90 ms/op figure a loaded
+            // phone actually sees live in `control-database.ts`'s `loadSchema` note (and
+            // are pinned by `control-start-storage-op-budget.spec.ts`): at the top of that
+            // range bring-up is 9-15 s, far past the fuse. So if this gate is ever removed
+            // or bypassed, that arm reopens for exactly the nodes most likely to hit it —
+            // phones joining a party, whose membership row has not replicated yet.
+            this.controlBringUpInFlight = true;
             // Create the control network libp2p node
             let t0 = performance.now();
             this.controlNode = await this.createControlNode();
@@ -549,6 +585,21 @@ export class CadreNode {
             });
             await this.controlDatabase.initialize();
             timing('[start] controlDatabase.initialize: %dms', Math.round(performance.now() - t0));
+            // The database exists locally now, so the quiet period has done its job and
+            // this node can be in the conversation. A failure above never reaches here —
+            // `cleanup()` on the catch path opens the gate instead, so teardown (and a
+            // retry by the embedder) is not gated.
+            //
+            // NOTE: the window ends HERE, not at the end of start(), so the awaited control-DB
+            // work that follows — `strandWatcher.start()`'s first poll — can run against a
+            // cohort a connection just joined. Fine now: every block that poll reads was
+            // created locally by the initialize() above, so a refusing sibling has nothing to
+            // refuse. If a boot ever fails with `BlockUnavailableError` from BELOW this line,
+            // that assumption broke. Do not simply move this clear later without measuring:
+            // `handleStrandAdded` runs inside `strandWatcher.start()` and seeds each strand
+            // node from CONNECTED siblings (`resolveCohortSeed`), so a longer window trades a
+            // bring-up hazard for boot-time strand seeds that are always empty.
+            this.controlBringUpInFlight = false;
             log('Control database initialized');
             // Attach the per-stream gate to the control DB's membership hub, so every
             // committed `CadrePeer` write re-materializes the authorized snapshot on its
@@ -614,12 +665,27 @@ export class CadreNode {
             // lands the snapshot is empty, which the stream gate treats as cold
             // start and admits.
             void this.refreshMembershipGate('start');
+            // Reserve the configured relays LAST, so every step above ran against a
+            // cohort of one (see driveControlRelayReservation). Ahead of
+            // scheduleSelfRegistration, so this node's first published `CadrePeer` row
+            // already carries the `/p2p-circuit` address the reservation earns it.
+            // Throws on a relay that will not have us — start() is fail-fast for a node
+            // whose operator named a relay.
+            await this.driveControlRelayReservation();
             // Schedule self-registration in background
             this.scheduleSelfRegistration();
         }
         catch (error) {
             log('Failed to start CadreNode: %o', error);
+            // `driveControlRelayReservation` throws AFTER `control:connected` was emitted,
+            // so a subscriber can have seen this node come up. Balance the edge rather than
+            // leaving it dangling — `cleanup()` has torn the node down either way, and the
+            // events are what an embedder drives its "am I connected" UI from.
+            const wasConnected = this._running;
             await this.cleanup();
+            if (wasConnected) {
+                this.emit('control:disconnected', undefined);
+            }
             throw error;
         }
     }
@@ -657,19 +723,7 @@ export class CadreNode {
             return;
         }
         log('Stopping CadreNode');
-        // Stop the retry loop BEFORE tearing the node down, not after: `cleanup()`
-        // stops the control node partway through, and a tick that fires during it
-        // would dial and then poll a half-torn-down node for the whole reserve
-        // timeout — logging spurious dial failures and holding the process open.
-        this.relayReserveSupervisor?.stop();
-        this.relayReserveSupervisor = null;
         await this.cleanup();
-        // Drop the rest of the relay-reservation posture: a stopped node holds no
-        // reservation, so a restarted instance must not report the previous run's
-        // `reserved`.
-        this.relayReserveAddrs = [];
-        this.relayReserveError = null;
-        this._running = false;
         this.emit('control:disconnected', undefined);
         log('CadreNode stopped');
     }
@@ -868,6 +922,42 @@ export class CadreNode {
         this.controlStorage = wrapStorageWithCache(resolved, 'control');
         return this.controlStorage;
     }
+    /**
+     * Warn the operator when `network.announceAddrs` will silently cost this node the
+     * relay reachability it also configured.
+     *
+     * A non-empty announce set REPLACES everything libp2p advertises, so the
+     * `/p2p-circuit` address earned by a relay reservation is dropped from the node's
+     * advertised addresses even though the reservation itself is still held — peers
+     * behind NAT stop being able to reach it through that relay. Not an error: an
+     * operator whose relay slot is decorative may genuinely want only the announced
+     * address, so this reports and proceeds.
+     *
+     * Keyed off the RESOLVED listen addrs rather than `relayAddrs` alone, so a
+     * hand-written `/p2p-circuit` entry in `listenAddrs` — the same reservation by the
+     * longer route — is caught too.
+     *
+     * NOTE: the only direct `console.*` in this library — a boot-time operator warning, not a
+     * diagnostic trace (those use `debug`, which an operator never sees without `DEBUG=`). If a
+     * second such warning ever appears here, route both through a `CadreNodeEvents` entry the
+     * embedder surfaces instead of growing a console surface inside a library.
+     */
+    warnIfAnnounceAddrsDiscardRelay() {
+        const network = this.config.network;
+        if (!replacesAdvertisedAddrs(network)) {
+            return;
+        }
+        const listensOnCircuit = (resolveListenAddrs(network) ?? [])
+            .some((addr) => addr.includes('/p2p-circuit'));
+        if (!listensOnCircuit) {
+            return;
+        }
+        console.warn('network.announceAddrs is set alongside a circuit-relay listener (from network.relayAddrs, ' +
+            'or a /p2p-circuit entry in network.listenAddrs). A non-empty announce set REPLACES every ' +
+            'address this node advertises, so the /p2p-circuit address earned from the relay reservation ' +
+            'will not be advertised and peers will stop reaching this node through that relay. ' +
+            'Use network.appendAnnounceAddrs instead to advertise an extra address without discarding the rest.');
+    }
     /**
      * Map this node's config onto the control network's libp2p node options.
      *
@@ -879,10 +969,12 @@ export class CadreNode {
     buildControlNodeOptions() {
         const { controlNetwork, network, profile } = this.config;
         const identityKey = this.identityKey;
-        const listenAddrs = resolveListenAddrs(network);
-        // Determine relay mode: if explicitly set in config, use that;
-        // otherwise default to true for storage profile nodes (better connectivity/uptime)
-        const enableRelay = network?.enableRelay ?? (profile === 'storage');
+        // `'search'`: `network.relayAddrs` contributes the bare `/p2p-circuit` SEARCH
+        // entry, which opens no connection — the reservation is driven explicitly at
+        // the END of `start()`, so the control database is built while this node holds
+        // zero control connections. See `relay-addrs.ts` and `start()`.
+        const listenAddrs = resolveListenAddrs(network, 'search');
+        const enableRelay = this.relayServerEnabled();
         // The control node's own storage, resolved once per runtime (see
         // {@link resolveControlStorage}) rather than per call.
         const controlStorageProvider = this.resolveControlStorage();
@@ -904,15 +996,25 @@ export class CadreNode {
             arachnode: { enableRingZulu: profile === 'storage' },
             ...(identityKey && { privateKey: identityKey }),
             ...(network?.transports && { transports: network.transports }),
-            // Configured `listenAddrs`, plus a `/p2p-circuit` listener for every
-            // `network.relayAddrs` entry — that listener is what reserves the relay slot.
+            // Configured `listenAddrs`, plus the bare `/p2p-circuit` search listener when
+            // `network.relayAddrs` is set — that listener registers the pending reservation
+            // `driveControlRelayReservation` fills after bring-up.
             ...(listenAddrs && { listenAddrs }),
+            // What this node ADVERTISES, which is not the same question as what it binds.
+            // Either field is present only when configured non-empty; a non-empty
+            // `announceAddrs` replaces the advertised set (see warnIfAnnounceAddrsDiscardRelay).
+            ...resolveAnnounceAddrs(network),
             // The CONTROL node composes the membership admission gate onto any
-            // caller-supplied gater (deny from either wins on inbound; all other
-            // hooks pass through). Strand cohort nodes keep the raw configured gater
-            // (see strand-instance-manager.ts) — their peers are legitimately
+            // caller-supplied gater (deny from either wins on the inbound-encrypted
+            // and relay-reservation hooks; all other hooks pass through). Strand
+            // cohort nodes keep the raw configured gater (see
+            // strand-instance-manager.ts) — their peers are legitimately
             // cross-party, so cadre membership must not gate them.
-            connectionGater: createMembershipConnectionGater({ admitInbound: (remotePeerId) => this.admitInboundControlConnection(remotePeerId) }, network?.connectionGater),
+            connectionGater: createMembershipConnectionGater({
+                admitInbound: (remotePeerId) => this.admitInboundControlConnection(remotePeerId),
+                admitRelayReservation: (remotePeerId) => this.admitControlRelayReservation(remotePeerId),
+                bringUpInFlight: () => this.controlBringUpInFlight
+            }, network?.connectionGater),
             // Fail-closed per-stream authorization for the four Optimystic control-DB
             // protocols — the members-only layer the connection gater's stranger
             // carve-outs cannot express (see authorizeInboundControlStream). Control
@@ -921,6 +1023,17 @@ export class CadreNode {
         };
         return nodeOptions;
     }
+    /**
+     * Does this node's CONTROL libp2p run the circuit-relay server? An explicit
+     * `network.enableRelay` wins; otherwise storage-profile nodes default to on
+     * (better connectivity/uptime). Shared by {@link buildControlNodeOptions}
+     * (which configures the server from it) and
+     * {@link admitInboundControlConnection} (whose deny/admit-for-relay branch
+     * must agree with whether a reservation is even servable here).
+     */
+    relayServerEnabled() {
+        return this.config.network?.enableRelay ?? (this.config.profile === 'storage');
+    }
     /**
      * Decide whether an inbound CONTROL-network connection from `remotePeerId`
      * should be admitted — the policy behind the connection gater wired in
@@ -930,7 +1043,7 @@ export class CadreNode {
      * `membership-connection-gater.ts` for the layer's rationale and the
      * stranger-open protocol allowlist).
      *
-     * Admits when ANY of:
+     * Returns `'admit'` when ANY of:
      *  1. a shared-baseline check admits ({@link admitControlPeerUnconditionally}
      *     — not running / DB torn down, absent-or-empty trusted-owner anchor, or
      *     configured bootstrap/relay infrastructure);
@@ -967,44 +1080,117 @@ export class CadreNode {
      *    this node yet is denied even though the formation handler would have
      *    accepted it, exactly like the unreplicated-membership-row case below.
      *
+     * When every check falls through, the verdict depends on whether this node
+     * runs the circuit-relay server ({@link relayServerEnabled}): without one,
+     * `'deny'`; with one, `'admit-for-relay'` — a circuit-relay reservation is
+     * established by the reserving peer DIALING the relay, so a connection deny
+     * here kills the reservation, and that deny is NOT self-healing: an outbound
+     * reconcile re-dial re-establishes a data link, but no outbound dial can
+     * grant the remote peer a reservation, and a relay-only peer has no address
+     * of its own to dial back — the reservation IS its address. The gater admits
+     * such a connection, decides the reservation via
+     * {@link admitControlRelayReservation}, and drops the connection if no
+     * reservation is admitted in time (see `membership-connection-gater.ts` →
+     * "The relay-reservation seam").
+     *
      * NOTE: check 4/5 runs a control-DB read per inbound connection
      * (`listAuthorizedMembers`); connections are rare and cadres small, and this
      * layer is fail-open behind `ADMISSION_DECISION_TIMEOUT_MS`, so the live
      * read is safe here — unlike the per-stream gate, which must consult the
      * materialized {@link authorizedControlPeers} snapshot instead.
-     * NOTE: a sibling whose membership row has not yet replicated to
-     * this node is denied until the row converges (typically via the owner);
-     * either side's next outbound reconcile dial (outbound is never gated)
-     * re-establishes the link — self-healing, but visible as a transient deny.
+     * NOTE: on a relay-DISABLED node, a sibling whose membership row has not yet
+     * replicated here is denied until the row converges (typically via the
+     * owner); either side's next outbound reconcile dial (outbound is never
+     * gated) re-establishes the DATA link — self-healing for data, visible as a
+     * transient deny. That self-healing story never covered a reservation, which
+     * is exactly why the relay-enabled path above exists.
      */
     async admitInboundControlConnection(remotePeerId) {
         if (this.admitControlPeerUnconditionally(remotePeerId)) {
-            return true;
+            return 'admit';
         }
         if (Date.now() < this.enrollmentWindowUntil) {
-            return true;
+            return 'admit';
         }
         if (this.delegateAdmission.has(remotePeerId)) {
-            return true;
+            return 'admit';
         }
         const authorized = await this.listAuthorizedMembers();
         if (authorized.length === 0) {
-            return true;
+            return 'admit';
         }
         if (authorized.some((m) => m.peerId === remotePeerId)) {
-            return true;
+            return 'admit';
         }
         try {
             if (await this.strandSolicitationService?.hasOutstandingInvitation()) {
-                return true;
+                return 'admit';
             }
         }
         catch (error) {
             log('admitInboundControlConnection: outstanding-invitation check threw for %s — admitting (fail-open): %o', remotePeerId, error);
-            return true;
+            return 'admit';
+        }
+        if (this.relayServerEnabled()) {
+            log('admitInboundControlConnection: admitting %s FOR RELAY ONLY — not an authorized member and no enrollment path open; the gater drops the connection unless a reservation is admitted', remotePeerId);
+            return 'admit-for-relay';
         }
         log('admitInboundControlConnection: DENYING inbound from %s — not an authorized member and no enrollment path open', remotePeerId);
-        return false;
+        return 'deny';
+    }
+    /**
+     * Should `remotePeerId` be granted a circuit-relay reservation slot on this
+     * node's relay server? The policy behind the gater's
+     * `denyInboundRelayReservation` hook (see `membership-connection-gater.ts` →
+     * "The relay-reservation seam"); the circuit-relay server consults it per
+     * RESERVE request, so it is never called on a node whose relay server is off.
+     *
+     * Admits when ANY of:
+     *  1. a shared-baseline check admits ({@link admitControlPeerUnconditionally}
+     *     — not running / DB torn down, absent-or-empty trusted-owner anchor, or
+     *     configured bootstrap/relay infrastructure);
+     *  2. the peer holds a live delegate admission grant — a member's strand
+     *     node reserving here (see `delegate-admission.ts`); never counted
+     *     against the unauthorized budget;
+     *  3. the authorized-member set is empty (cold start) or the peer IS an
+     *     authorized member — members are never counted against the budget; or
+     *  4. the peer takes (or already holds) a slot in the bounded
+     *     unauthorized-reservation budget — the boot-ordering window where a
+     *     genuine member reserves before its `CadrePeer` row replicates here.
+     *     Cap via `network.unauthorizedRelayReservationCap` (0 = refuse every
+     *     unauthorized reservation).
+     *
+     * Every uncounted admission also RELEASES the budget slot the peer may hold
+     * from an earlier reservation taken while it was still unplaceable — a member
+     * that boots, reserves, and only then has its row replicate here would
+     * otherwise keep that slot spent for the rest of the entry's TTL.
+     *
+     * The connection gate's stranger carve-outs (an open enrollment window, an
+     * outstanding formation invitation) deliberately do NOT extend here: they
+     * exist so a stranger's SEED or FORMATION stream can ride a connection, and
+     * neither needs relay capacity. A genuine invitee that does need a relay slot
+     * takes one from the budget like any other unplaced peer, so an open window
+     * never becomes an unbounded grant of this node's forwarding capacity.
+     */
+    async admitControlRelayReservation(remotePeerId) {
+        if (this.admitControlPeerUnconditionally(remotePeerId)) {
+            return this.admitReservationUncounted(remotePeerId);
+        }
+        if (this.delegateAdmission.has(remotePeerId)) {
+            return this.admitReservationUncounted(remotePeerId);
+        }
+        const authorized = await this.listAuthorizedMembers();
+        if (authorized.length === 0 || authorized.some((m) => m.peerId === remotePeerId)) {
+            return this.admitReservationUncounted(remotePeerId);
+        }
+        const admitted = this.unauthorizedRelayReservations.tryAdmit(remotePeerId);
+        log('admitControlRelayReservation: %s %s under the unauthorized-reservation budget', admitted ? 'admitting' : 'REFUSING', remotePeerId);
+        return admitted;
+    }
+    /** Admit a reservation on the peer's own merits, giving back any budget slot it still holds. */
+    admitReservationUncounted(remotePeerId) {
+        this.unauthorizedRelayReservations.release(remotePeerId);
+        return true;
     }
     /**
      * Hold the control-network inbound gate open for not-yet-authorized peers
@@ -1020,7 +1206,8 @@ export class CadreNode {
     /**
      * Record (or refresh) a delegate admission grant: `delegatePeerId` is the
      * transport peerId of `announcerPeerId`'s strand-`strandId` node, admitted
-     * at the CONNECTION level (all a circuit-relay reservation needs) for
+     * at the CONNECTION and RESERVATION levels (all a circuit-relay reservation
+     * needs, without spending the unauthorized-reservation budget) for
      * `DELEGATE_GRANT_TTL_MS`. Called by the strand-addr responder after its
      * authorized-membership gate has passed; public so tests can drive the
      * admission policy without a full strand launch. A re-announce for the same
@@ -1123,13 +1310,19 @@ export class CadreNode {
      *
      * The SOLE caller is {@link drainMembershipGate}, which serializes refreshes —
      * so two reads can no longer settle out of order.
+     *
+     * Reads WITHOUT the transient-failure retry, deliberately: `ControlDatabase` drives
+     * this listener with its write lock HELD (`notifyMembershipChanged`), so a retrying
+     * read here would sleep its backoff holding the lock and stall every other local
+     * writer. Nothing is lost — this refresh already keeps the previous snapshot on
+     * failure and is re-driven by the next membership write and by the timed reconcile.
      */
     async refreshAuthorizedControlPeers(reason) {
         if (!this._running || !this.controlDatabase) {
             return;
         }
         try {
-            const members = await this.listAuthorizedMembers();
+            const members = await this.listAuthorizedMembers(false);
             this.authorizedControlPeers = new Set(members.map((m) => m.peerId));
             log('refreshAuthorizedControlPeers(%s): %d authorized peer(s)', reason, this.authorizedControlPeers.size);
         }
@@ -1411,6 +1604,20 @@ export class CadreNode {
             reconcile('self:peer:update');
         };
         this.controlNode.addEventListener('self:peer:update', this.selfPeerUpdateHandler);
+        // NOTE: a node AUTHORIZED AFTER IT BOOTED can wait a whole heartbeat (7.5 min)
+        // to publish its address. `registerSelf` no-ops while a node has no readable
+        // `CadrePeer` row, so its boot-time publish does nothing, and the two triggers
+        // wired here are the only ones after that: `self:peer:update` needs an ADDRESS
+        // CHANGE, and a relay-only node's addresses stop changing the moment its
+        // reservation lands — inside `start()`, before this listener exists. Harmless
+        // where a late-authorized node's addresses keep churning (NAT/relay rotation
+        // fire the event anyway), and invisible while parties authorize members before
+        // they boot. If late enrollment becomes the normal path — an invited phone is
+        // exactly that — republish on the membership-change seam that already exists
+        // (`ControlDatabase.setMembershipChangeListener`) rather than lengthening this
+        // list of triggers. Measured while writing
+        // `relay-only-control-addr.integration.ts` case 4, which drives `registerSelf()`
+        // explicitly because neither trigger is dependable there.
         this.recordRefreshTimer = setInterval(() => republish('heartbeat'), DEFAULT_PEER_RECORD_HEARTBEAT_MS);
         this.recordRefreshTimer?.unref?.();
         const reconcileMs = this.config.network?.controlCohort?.reconcileMs ?? DEFAULT_CONTROL_COHORT_RECONCILE_MS;
@@ -1485,6 +1692,10 @@ export class CadreNode {
      * Survivors are returned signaling (`/p2p-circuit`) first, filtered to
      * signaling-only when requested, as parsed `Multiaddr`s (unparsable addrs
      * dropped). Any gate failure yields an empty array rather than throwing.
+     *
+     * Every returned address is normalized to terminate in `/p2p/<peerId>` — see
+     * {@link normalizeDialAddrs} for why that invariant, not each dial site's own
+     * handling, is what keeps a mixed list from taking a whole peer offline.
      */
     async resolvePeerAddrs(peerId, opts = {}) {
         if (!this.controlDatabase) {
@@ -1529,12 +1740,71 @@ export class CadreNode {
         }
         // Order signaling-first (the on-record order was what we verified above),
         // optionally restrict to signaling addrs, then parse — dropping any addr
-        // that does not parse as a multiaddr.
+        // that does not parse as a multiaddr — and finally normalize every survivor
+        // onto `/p2p/<peerId>` so no caller ever sees a mixed list.
         let addrs = orderSignalingFirst(record.addrs);
         if (opts.signalingOnly) {
             addrs = addrs.filter(isSignalingAddr);
         }
-        return this.parseMultiaddrs(addrs);
+        return this.normalizeDialAddrs(this.parseMultiaddrs(addrs), peerId);
+    }
+    /**
+     * Guarantee every address handed to a control-network dial terminates in
+     * `/p2p/<peerId>`, with no duplicates — the invariant every dial path
+     * downstream relies on.
+     *
+     * `libp2p.dial(addrs)` requires that the addresses in ONE dial either all name
+     * a peer id or none do; a list mixing a circuit address (which ends in
+     * `/p2p/<target>`) with a bare direct one (which ends in `/tcp/…`) makes that
+     * call throw, and the whole peer is then silently skipped rather than one bad
+     * address.
+     *
+     * Applied by ALL THREE sources of control-dial candidates, so no call site
+     * invents its own rule and none can produce a mixed list: the signed record
+     * ({@link resolvePeerAddrs}), the libp2p address book
+     * ({@link peerStoreAddrs}), and a seed's retained owner addresses
+     * ({@link bootstrapDialAddrs}).
+     *
+     * An address naming a DIFFERENT trailing peer id is dropped: it does not reach
+     * `peerId`, so it does not belong in this peer's candidate list (libp2p's own
+     * dial queue filters the same shape out one layer lower).
+     */
+    normalizeDialAddrs(addrs, peerId) {
+        // Keyed by the NORMALIZED string, so two entries differing only by the suffix
+        // (`/ip4/…/tcp/4001` and `/ip4/…/tcp/4001/p2p/<peerId>`) collapse into one.
+        // Normalization is what makes them equal; a surviving duplicate would cost a
+        // real dial attempt — a whole slice of `dialWake`'s budget — on an address
+        // already being tried.
+        const out = new Map();
+        for (const addr of addrs) {
+            const bound = this.bindAddrToPeer(addr, peerId);
+            if (bound) {
+                out.set(bound.toString(), bound);
+            }
+        }
+        return [...out.values()];
+    }
+    /**
+     * One address bound to `peerId`, or `null` when it cannot be — logged either
+     * way, never thrown, so every caller's list-shaping stays total.
+     *
+     * `withTrailingPeerId` encapsulates `/p2p/<peerId>`, which throws on a peer id
+     * that does not parse. Unreachable for a `CadrePeer` row (the binding gate
+     * above parsed it already), reachable for a seed-supplied one
+     * ({@link bootstrapDialAddrs}).
+     */
+    bindAddrToPeer(addr, peerId) {
+        try {
+            const bound = withTrailingPeerId(addr, peerId);
+            if (!bound) {
+                log('normalizeDialAddrs: dropping addr %s — it names a peer other than %s', addr.toString(), peerId);
+            }
+            return bound;
+        }
+        catch (error) {
+            log('normalizeDialAddrs: cannot bind %s to %s: %o', addr.toString(), peerId, error);
+            return null;
+        }
     }
     /** Parse multiaddr strings, dropping (and logging) any that fail to parse. */
     parseMultiaddrs(addrs) {
@@ -1851,6 +2121,16 @@ export class CadreNode {
      * Cold-start fallback: the libp2p peerStore multiaddrs for `peerId` (seeded by
      * {@link SeedBootstrapService.applySeed}). Returns `[]` on a missing entry or any
      * parse/lookup failure — never throws.
+     *
+     * Normalized through {@link normalizeDialAddrs} for the same reason
+     * {@link resolvePeerAddrs} is, and with more cause: the address book hands back
+     * a list that is inherently MIXED. `@libp2p/peer-store`'s
+     * `dedupeFilterAndSortAddresses` strips a trailing `/p2p/<peerId>` only when
+     * that id is the address's FIRST `/p2p/` component, so a direct address
+     * round-trips bare while a relayed one — whose first `/p2p/` names the relay —
+     * keeps its suffix (the same asymmetry `peer-addr-book.ts`'s `addrKey` exists
+     * to absorb). Feeding both to one `dial()` is exactly the
+     * `InvalidParametersError` that skipped the whole peer.
      */
     async peerStoreAddrs(peerId) {
         if (!this.controlNode) {
@@ -1860,7 +2140,7 @@ export class CadreNode {
             const peer = await this.controlNode.peerStore.get(peerIdFromString(peerId));
             // Re-parse through the top-level multiaddr parser so the returned type matches
             // resolvePeerAddrs (the peerStore bundles its own @multiformats/multiaddr copy).
-            return this.parseMultiaddrs(peer.addresses.map((a) => a.multiaddr.toString()));
+            return this.normalizeDialAddrs(this.parseMultiaddrs(peer.addresses.map((a) => a.multiaddr.toString())), peerId);
         }
         catch (error) {
             log('reconcileControlCohort: peerStore lookup for %s failed: %o', peerId, error);
@@ -1949,6 +2229,13 @@ export class CadreNode {
             if (!this._running || !this.controlNode) {
                 return;
             }
+            // NOTE: a connection this node still holds in `status: 'open'` after the remote
+            // has already aborted it counts as connected here, so the cold-start retry stays
+            // suppressed for that peer until the connection monitor's next ping notices the
+            // abort — measured at ~9 s in `control-cohort-cold-start-retry.integration.ts`.
+            // Bounded and self-healing today; it would start to matter if the connection
+            // monitor's ping interval were lengthened, or if recovery ever had to meet a
+            // deadline tighter than one ping interval.
             if (connected.has(peerId)) {
                 continue;
             }
@@ -1962,32 +2249,15 @@ export class CadreNode {
      * Bind a bootstrap peer's seed addresses to its peer id, so the dial
      * authenticates the peer it is aiming at rather than trusting whoever answers.
      *
-     * An address that already carries `/p2p/<id>` must carry THIS peer's id or it
-     * is dropped (a seed that disagrees with itself is not a dial target); one
-     * that carries none — an `addressOverrides`-published record, say — gets the
-     * id encapsulated. Unencapsulatable addresses are dropped rather than dialed
-     * bare.
+     * The same {@link normalizeDialAddrs} rule the resolved and address-book paths
+     * use, on the third and last source of control-dial candidates: an address that
+     * already terminates in `/p2p/<id>` must carry THIS peer's id or it is dropped
+     * (a seed that disagrees with itself is not a dial target); one that does not —
+     * a bare listen addr, or a relay hop with the destination missing — gets the id
+     * encapsulated; an unencapsulatable one is dropped rather than dialed bare.
      */
     bootstrapDialAddrs(peerId, addrs) {
-        const out = [];
-        for (const addr of this.parseMultiaddrs(addrs)) {
-            const embedded = trailingPeerId(addr);
-            if (embedded === peerId) {
-                out.push(addr);
-                continue;
-            }
-            if (embedded !== null) {
-                log('reconcileControlCohort(cold-start): addr %s names peer %s, not %s; dropping', addr.toString(), embedded, peerId);
-                continue;
-            }
-            try {
-                out.push(addr.encapsulate(`/p2p/${peerId}`));
-            }
-            catch (error) {
-                log('reconcileControlCohort(cold-start): cannot bind %s to %s: %o', addr.toString(), peerId, error);
-            }
-        }
-        return out;
+        return this.normalizeDialAddrs(this.parseMultiaddrs(addrs), peerId);
     }
     /** Dial one cold-start bootstrap peer, best-effort. Returns whether it connected. */
     async dialBootstrapPeer(peerId, addrs) {
@@ -2705,7 +2975,30 @@ export class CadreNode {
             });
         }
     }
+    /**
+     * Return this node to its pre-{@link start} state. The ONE teardown — `stop()` and
+     * a failed `start()` both come here, so anything a stopped node must not still be
+     * doing belongs in this method and not in `stop()`. `stop()` adds only the
+     * `control:disconnected` emit, which a never-connected start has no edge for.
+     */
     async cleanup() {
+        // Open the connection gate's bring-up quiet period unconditionally: teardown
+        // must never be gated, and this is the path a FAILED start() takes.
+        this.controlBringUpInFlight = false;
+        // Stop the relay retry loop BEFORE tearing the node down, not after: the control
+        // node is stopped partway through below, and a tick that fires during it would
+        // dial and then poll a half-torn-down node for the whole reserve timeout —
+        // logging spurious dial failures on a `.unref()`'d timer that nothing ever
+        // clears. `driveControlRelayReservation` starts this supervisor from inside
+        // `start()`, so a start that fails ON the reservation leaves one running unless
+        // it is stopped here.
+        this.relayReserveSupervisor?.stop();
+        this.relayReserveSupervisor = null;
+        // Drop the rest of the relay-reservation posture: a torn-down node holds no
+        // reservation, so neither a restarted instance nor a caller inspecting a failed
+        // start reports the previous attempt's `reserved`.
+        this.relayReserveAddrs = [];
+        this.relayReserveError = null;
         // Resolve + clear any in-flight wake windows first, so an in-flight check-in
         // or serviceWake unblocks and tears down cleanly rather than firing a stale
         // window timer (or hanging) after the strand manager is stopped below.
@@ -2773,16 +3066,23 @@ export class CadreNode {
             await this.controlNode.stop();
             this.controlNode = null;
         }
-        // Release the control store's cache registration LAST — after the database and
-        // node that write through it are down. Dropping the field is what lets a
-        // stop()/start() cycle re-resolve the provider against a live cache instead of
-        // handing the restarted node a retired wrapper. Logged, never thrown: a
-        // cache-bookkeeping failure must not abort a teardown.
+        // Release the control store's claim on its cache LAST — after the database and
+        // node that write through it are down. The wrapper counts holders, so this empties
+        // and unregisters the cache only if no other scope still holds it. Dropping the
+        // field is what lets a stop()/start() cycle re-resolve the provider against a live
+        // cache instead of handing the restarted node a retired wrapper. Logged, never
+        // thrown: a cache-bookkeeping failure must not abort a teardown.
         if (this.controlStorage) {
             const controlStorage = this.controlStorage;
             this.controlStorage = null;
             await disposeStorageCache(controlStorage).catch((err) => log('Failed to dispose control storage cache: %o', err));
         }
+        // LAST, so every step above still ran against a node that considered itself up
+        // (several of them early-return while `_running` is false). A failed `start()`
+        // that had already flipped it — the reservation drive throws after that point —
+        // must not leave `isRunning` true over a torn-down node, which would report
+        // healthy and make the embedder's retry a no-op ("already running").
+        this._running = false;
     }
     // Hibernation callbacks
     async handleStrandIdle(strandId) {
@@ -3406,11 +3706,25 @@ export class CadreNode {
     }
     /**
      * The circuit relays this node's strand nodes would reserve through: the
-     * union of the RESOLVED listen addrs' circuits — a hand-written
-     * `network.listenAddrs` circuit entry or a `network.relayAddrs` entry, which
-     * the strand node inherits verbatim either way — and the control node's own
-     * live `/p2p-circuit` multiaddrs (a reservation this node discovered rather
-     * than configured).
+     * union of CONFIGURED relays — `network.relayAddrs`, plus any hand-written
+     * `network.listenAddrs` circuit entry, both of which a strand node inherits
+     * verbatim — and the control node's own live `/p2p-circuit` multiaddrs (a
+     * reservation this node discovered rather than configured).
+     *
+     * The CONFIGURED half reads `network.relayAddrs` and `network.listenAddrs`
+     * directly rather than going through {@link resolveListenAddrs}: the control
+     * node's resolution takes the `'search'` route, whose bare `/p2p-circuit` entry
+     * names no relay, so a configured relay would be unannounceable here until this
+     * node's own reservation landed — and the announce must be in place BEFORE a
+     * strand node dials its reservation, since the relay's membership gate does not
+     * know the strand's derived peerId (see delegate-admission.ts). Configuration is
+     * authoritative; the live multiaddrs only ADD relays nobody configured.
+     *
+     * The `listenAddrs` half is now unreachable on a control node — `relay-addrs.ts`
+     * rejects a hand-written `<relay>/p2p-circuit` listen entry outright, because the
+     * bring-up quiet period denies the dial that listener makes from inside
+     * `libp2p.start()`. Kept because it costs one spread and this is the one place
+     * that would silently stop announcing if that rejection is ever relaxed.
      *
      * NOTE: a relay the STRAND node discovers on its own (autorelay — in neither
      * source) gets no announcement, and a membership-gated one will deny it; fine
@@ -3418,7 +3732,8 @@ export class CadreNode {
      */
     circuitRelayTargets() {
         return extractCircuitRelayTargets([
-            ...(resolveListenAddrs(this.config.network) ?? []),
+            ...relayCircuitAddrs(this.config.network?.relayAddrs ?? []),
+            ...(this.config.network?.listenAddrs ?? []),
             ...(this.controlNode?.getMultiaddrs().map(String) ?? [])
         ]);
     }
@@ -3869,16 +4184,60 @@ export class CadreNode {
     getControlNode() {
         return this.controlNode;
     }
+    /**
+     * The boot-path half of {@link reserveRelays}: reserve through every
+     * `network.relayAddrs` entry, or fail `start()`.
+     *
+     * WHY IT RUNS HERE, AT THE END. `network.relayAddrs` used to resolve to a
+     * CONFIGURED circuit listener, which libp2p dials from inside `libp2p.start()`
+     * — so the relay was already a connected peer, and therefore already in this
+     * node's Optimystic cohort, before `ControlDatabase.initialize()` ran. Building
+     * that database is a long chain of cohort-consulting block probes (catalog
+     * hydration, then one per table, then the indexes), and a sibling that has not
+     * yet replicated this node's `CadrePeer` row correctly refuses every one of
+     * them, so bring-up died on `BlockUnavailableError` — deterministically, on
+     * every boot of a relay-only node. Retrying could not converge either: the
+     * condition that clears the refusal is this node's own row reaching the
+     * sibling, and writing that row needs the database the retry is building.
+     *
+     * So the invariant is ordering, not retrying: the control database is built
+     * while this node holds ZERO control connections (a cohort of one, entirely
+     * local), and only then does it reach out. Everything above in {@link start}
+     * has completed by the time this runs.
+     *
+     * BUDGET: the supervisor's first attempt — `relay-reservation.ts`'s
+     * `DEFAULT_RELAY_RESERVE_TIMEOUT_MS`, 10 s — is what `start()` waits on — deliberately the module default rather
+     * than a boot-specific one. A healthy dial-plus-reserve is sub-second even over
+     * a WAN, so 10 s is slack for a slow link; going much longer would make a dead
+     * relay indistinguishable from a hung start, and much shorter would fail nodes
+     * on links that were merely slow. The retries carry on in the background after
+     * this resolves, exactly as they do for a {@link reserveRelays} caller.
+     */
+    async driveControlRelayReservation() {
+        const relayAddrs = this.config.network?.relayAddrs ?? [];
+        if (relayAddrs.length === 0) {
+            return;
+        }
+        const t0 = performance.now();
+        const state = await this.reserveRelays([...relayAddrs]);
+        timing('[start] reserveRelays: %dms', Math.round(performance.now() - t0));
+        if (state.status !== 'reserved') {
+            throw new RelayReservationFailedError(relayAddrs, state);
+        }
+        log('Reserved a relay slot: %o', state.circuitAddrs);
+    }
     /**
      * Start keeping a relay reservation: dial the given relay(s) from the control
      * node, ask the first one that answers for a reservation slot, wait until the
      * resulting `/p2p-circuit` address makes this node dialable — and keep a
      * supervisor running that re-drives whenever the reservation is later lost.
      *
-     * For nodes that listen on the bare `/p2p-circuit` SEARCH addr (a browser tab)
-     * rather than a configured `network.relayAddrs` circuit listener — see
-     * `relay-reservation.ts` for why the two are alternatives and why configuring
-     * both is a regression. Opt-in: nothing calls this for the CLI/host nodes.
+     * The FAIL-SOFT entry point, for a caller that discovers its relay at runtime
+     * (a browser tab, a host UI). A node that names `network.relayAddrs` gets the
+     * same drive from {@link driveControlRelayReservation} at the end of
+     * {@link start}, which is fail-fast instead. Both fill the pending reservation
+     * the bare `/p2p-circuit` search listener registered; calling this afterwards
+     * simply replaces the supervisor with one over the new list.
      *
      * Resolves once the FIRST attempt has settled, exactly as it did when it drove
      * once; the retries continue in the background until {@link stop} or the next
@@ -4011,6 +4370,10 @@ export class CadreNode {
      * Push the multiaddrs that future invites should advertise. Pass `null` to
      * revert to the libp2p-reported addresses (the default). The host calls this
      * at spawn and on every NAT change.
+     *
+     * Entries need NOT carry a `/p2p/<peerId>` suffix — {@link resolveInviteAddresses}
+     * appends this node's own before anything publishes or dials them (see
+     * {@link normalizeSelfAddrs}). Passing them suffixed is equally fine.
      */
     setInviteAddresses(addresses) {
         this.latestInviteAddresses = addresses;
@@ -4018,17 +4381,59 @@ export class CadreNode {
     }
     /**
      * Resolve the addresses to embed in invites. Prefers pushed addresses, then
-     * any config-supplied resolver, then the libp2p-observed multiaddrs.
+     * any config-supplied resolver, then the libp2p-observed multiaddrs. The two
+     * app-supplied sources are normalized onto `/p2p/<self>` (see
+     * {@link normalizeSelfAddrs}) so neither hook has to remember the suffix;
+     * libp2p's own addresses already carry it.
      */
     async resolveInviteAddresses() {
         if (this.latestInviteAddresses !== null) {
-            return this.latestInviteAddresses;
+            return this.normalizeSelfAddrs(this.latestInviteAddresses);
         }
         if (this.config.network?.inviteAddressResolver) {
-            return this.config.network.inviteAddressResolver();
+            return this.normalizeSelfAddrs(await this.config.network.inviteAddressResolver());
         }
+        // Not normalized: this branch is libp2p's own output, which already
+        // encapsulates the peer id into every address it reports. Only the two app
+        // hooks above take arbitrary strings and therefore need the guarantee.
         return this.getMultiaddrs();
     }
+    /**
+     * Normalize addresses an app handed us for THIS node onto `/p2p/<self>`, the
+     * same invariant {@link normalizeDialAddrs} enforces on the way out.
+     *
+     * `setInviteAddresses` (the admin API `PUT /admin/invite-addresses`) and
+     * `network.inviteAddressResolver` both take arbitrary strings, and whatever
+     * they return ends up in this node's published `CadrePeer` record — so ONE
+     * unsuffixed entry from either hook is enough to give every sibling in the
+     * party a mixed candidate list for this peer. Establishing the suffix here,
+     * where those strings enter the system, means neither hook has to know the
+     * rule; `cadre-host`'s `buildInviteAddresses` already appends it, and
+     * re-normalizing an already-suffixed address is a no-op.
+     *
+     * Unparsable and other-peer-addressed entries are passed through untouched
+     * rather than dropped: publication is not the place to police an address's
+     * validity, and {@link resolvePeerAddrs} already drops both on the read side.
+     * Before `start()` resolves an identity there is no peer id to append, so the
+     * list is returned as given.
+     */
+    normalizeSelfAddrs(addrs) {
+        const selfPeerId = this.peerId?.toString();
+        if (!selfPeerId) {
+            return addrs;
+        }
+        return addrs.map((addr) => {
+            let parsed;
+            try {
+                parsed = multiaddr(addr);
+            }
+            catch (error) {
+                log('normalizeSelfAddrs: leaving unparsable multiaddr %s as-is: %o', addr, error);
+                return addr;
+            }
+            return withTrailingPeerId(parsed, selfPeerId)?.toString() ?? addr;
+        });
+    }
     /**
      * Enumerate the cadre's `CadrePeer` membership — the ADDRESSABLE surface (see
      * {@link isMember}). Rows whose stamp is retired in `CadreControl.Revocation`
@@ -4090,13 +4495,18 @@ export class CadreNode {
      * legit member goes un-authorized on readers that only pin the new key. Full
      * rotation handling (re-vouch on rotate) is the
      * `flip-strand-membership-rotation-known-gap` work, not this predicate's.
+     *
+     * @param retry - Whether the underlying membership read may retry a transient cluster
+     *   failure. Only {@link refreshAuthorizedControlPeers} passes `false`, because it runs
+     *   as the control database's membership listener with that database's write lock held;
+     *   see its comment.
      */
-    async listAuthorizedMembers() {
+    async listAuthorizedMembers(retry = true) {
         if (!this.controlDatabase) {
             throw new Error('CadreNode must be started before listing members');
         }
         const selfPeerId = this.peerId?.toString();
-        const rows = await this.controlDatabase.queryCadrePeers();
+        const rows = await this.controlDatabase.queryCadrePeers(retry);
         const authorized = rows
             .filter(row => row.peerId !== selfPeerId && this.hasAnchoredVoucher(row))
             .map(({ peerId, multiaddr }) => ({ peerId, multiaddr }));