@serfab/cadre-core 0.11.0 → 0.13.0

package/src/cadre-node.ts

@@ -11,6 +11,8 @@ import type {
   StrandInstance,
   StrandRow,
   StrandConfig,
+  FoundStrandConfig,
+  FoundStrandResult,
   SAppConfig,
   CadreNodeEvents,
   ControlNetworkSeed,
@@ -34,7 +36,7 @@ import type {
   PeerAddressRecord,
   ResolveDeviceTokenOpts
 } from './types.js';
-import { CONTROL_CLUSTER_POLICY, CONTROL_REPLICATION_BREADTH, DEFAULT_CHECKIN_WINDOW_MS } from './types.js';
+import { controlClusterPolicy, CONTROL_REPLICATION_BREADTH, DEFAULT_CHECKIN_WINDOW_MS } from './types.js';
 import { sign } from '@optimystic/quereus-plugin-crypto';
 import { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, requireEd25519PublicKeyB64, type Ed25519KeyPair } from './ed25519-key.js';
 import { strandTransportKey } from './strand-transport-key.js';
@@ -42,6 +44,7 @@ import { DEFAULT_IDENTITY_KEY_ID } from './key-store.js';
 import { loadOrCreateIdentityKey } from './identity-key.js';
 import { MemoryTrustedOwnerStore, type TrustedOwnerStore, type TrustSource } from './trusted-owner-store.js';
 import { MemoryBootstrapPeerStore, type BootstrapPeerStore } from './bootstrap-peer-store.js';
+import { MemoryEnrolledMachineStore, type EnrolledMachineStore } from './enrolled-machine-store.js';
 import { mergePeerAddrs, groupAddrsByPeerId, type MergeAddrsResult } from './peer-addr-book.js';
 import { verifyCadrePeerVoucher } from './peer-authorization.js';
 import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
@@ -51,7 +54,7 @@ import {
   isPeerRecordFresh,
   orderSignalingFirst,
   isSignalingAddr,
-  trailingPeerId,
+  withTrailingPeerId,
   currentMemberTrustPolicy,
   DEFAULT_PEER_RECORD_MAX_AGE_MS,
   DEFAULT_PEER_RECORD_HEARTBEAT_MS
@@ -63,6 +66,7 @@ import {
 } from './device-token.js';
 import { StrandWatcher, type StrandQueryable, type SAppIdLookup } from './strand-watcher.js';
 import { StrandInstanceManager } from './strand-instance-manager.js';
+import { PeerJoinBackfill } from './peer-join-backfill.js';
 import { deriveCohortMembers } from './strand-cohort.js';
 import type { CohortPeerRow } from './strand-cohort.js';
 import {
@@ -74,14 +78,20 @@ import {
 import { withDeadline } from './control-stream.js';
 import { EnrollmentService } from './enrollment.js';
 import { HibernationManager, type HibernationCallbacks } from './hibernation-manager.js';
-import { ControlDatabase, type RevokedRowRef } from './control-database.js';
+import { ControlDatabase, isStrandIdConflict, type RevokedRowRef } from './control-database.js';
 import { SeedBootstrapService, type SeedEventCallbacks } from './seed-bootstrap.js';
 import type { SeedTrustPolicy } from './seed-trust-policy.js';
 import {
   StrandSolicitationService,
   type StrandSolicitationServiceOptions
 } from './strand-solicitation.js';
-import { createMembershipConnectionGater, DEFAULT_ENROLLMENT_WINDOW_MS } from './membership-connection-gater.js';
+import { MAX_STRAND_ADDRS } from './strand-formation-protocol.js';
+import {
+  createMembershipConnectionGater,
+  DEFAULT_ENROLLMENT_WINDOW_MS,
+  UnauthorizedReservationBudget,
+  type InboundConnectionVerdict
+} from './membership-connection-gater.js';
 import { StrandWakeService, dialWake } from './strand-wake-protocol.js';
 import { StrandAddrService, collectStrandAddrs, type StrandAddrPeer } from './strand-addr-protocol.js';
 import {
@@ -92,7 +102,8 @@ import {
   peerStrandKey,
   type CircuitRelayTarget
 } from './delegate-admission.js';
-import { resolveListenAddrs } from './relay-addrs.js';
+import { relayCircuitAddrs, resolveListenAddrs, resolveTransportOptions, RelayReservationFailedError } from './relay-addrs.js';
+import { replacesAdvertisedAddrs, resolveAnnounceAddrs } from './announce-addrs.js';
 import {
   superviseRelayReservation,
   resolveRelayReservationState,
@@ -143,6 +154,30 @@ function relayStrandAddrPeer(relay: CircuitRelayTarget): StrandAddrPeer {
   return { peerId: relay.relayPeerId, addrs: [multiaddr(relay.relayAddr)] };
 }
 
+/**
+ * `primary` followed by the entries of `extra` it does not already contain, de-duplicated
+ * and order-preserving.
+ *
+ * Used wherever a strand's discovery seed unions two sources of address strings — the
+ * freshly-RPC'd sibling answers and the cross-party addresses learned at formation. The
+ * caller passes the FRESHER source as `primary`, so a stale entry can only ever be
+ * appended, never promoted ahead of a current one, and each source keeps whatever
+ * signaling-first ordering it arrived with.
+ */
+function unionAddrs(primary: readonly string[], extra: readonly string[]): string[] {
+  if (extra.length === 0) {
+    return [...primary];
+  }
+  const out = [...primary];
+  const seen = new Set(primary);
+  for (const addr of extra) {
+    if (seen.has(addr)) continue;
+    seen.add(addr);
+    out.push(addr);
+  }
+  return out;
+}
+
 /**
  * Build the signing callback the `ControlDatabase` writers expect: they hand it the
  * canonical row-bound message BYTES (see `buildAuthorizationMessage`), and it ed25519-signs
@@ -166,6 +201,60 @@ function requireNonBlank(value: string, label: string): string {
   return trimmed;
 }
 
+/**
+ * Is the live `Strand` row the one a publish of `desired` would have produced?
+ *
+ * "Identical content" means `(Type, MemberPrivateKey)` and deliberately NOT
+ * `FounderOwnerKey`: that column is provenance (WHICH machine published the row), not
+ * content. Two machines of one party racing to found the same id must keep resolving as
+ * "the winner's row stands" — the loser adopts the row and, since the winner's key is on
+ * it, correctly comes up as a joiner (see `launchStrand`'s founder derivation). Comparing
+ * it here would turn that benign race into a hard throw. `Id` is the lookup key and
+ * `StampId` is a single-use nonce, so the two compared columns are all the content there
+ * is. A live row matching on both is, by construction, the state a repeat publish would
+ * have reached, whichever branch of `Strand.AuthorizedInsert` seated it (owner-signed, or
+ * the unsigned consent branch an invite redemption uses).
+ *
+ * Returns the mismatching column names, empty when the row matches. The KEY's value is
+ * deliberately never returned or logged — it is the closed strand's read-gating secret.
+ */
+function strandRowMismatches(live: StrandRow, desired: StrandRow): string[] {
+  const mismatches: string[] = [];
+  if (live.Type !== desired.Type) {
+    mismatches.push(`Type is '${live.Type}', not the requested '${desired.Type}'`);
+  }
+  if ((live.MemberPrivateKey ?? null) !== (desired.MemberPrivateKey ?? null)) {
+    mismatches.push('MemberPrivateKey differs from the one supplied');
+  }
+  return mismatches;
+}
+
+/**
+ * The live row when it matches `desired` ({@link strandRowMismatches}); otherwise throw
+ * naming the columns that differ.
+ *
+ * A mismatch must stay a hard error: accepting one would let a retry reopen a strand the
+ * party closed, or swap the key that gates its reads — so the two cases the raw
+ * `UNIQUE constraint failed: Strand.Id` could not distinguish ("already done, carry on"
+ * vs. "genuine conflict, stop") are separated here rather than left to the caller.
+ *
+ * @param situation - How the row came to be there, as a verb phrase completing
+ *   `Strand <id> …`, e.g. `'is already published'`.
+ */
+function requireMatchingStrandRow(live: StrandRow, desired: StrandRow, situation: string): StrandRow {
+  const mismatches = strandRowMismatches(live, desired);
+  if (mismatches.length > 0) {
+    throw new Error(
+      `Strand ${desired.Id} ${situation} with DIFFERENT content, so this publish is a ` +
+      `conflict, not a repeat: ${mismatches.join('; ')}. Reconcile deliberately — attach ` +
+      'the existing strand with addStrand/foundStrand to keep it, or unpublishStrand first ' +
+      'to re-seat it (destructive for a closed strand: its MemberPrivateKey is stored ' +
+      'nowhere else).'
+    );
+  }
+  return live;
+}
+
 /**
  * CadreNode is the main entry point for a cadre member.
  * It manages:
@@ -197,6 +286,14 @@ export class CadreNode implements SAppIdLookup {
   private trustedOwnerStore: TrustedOwnerStore | null = null;
   private controlNode: Libp2p | null = null;
   private controlDatabase: ControlDatabase | null = null;
+  /**
+   * The CONTROL network's peer-join block catch-up — same module as the
+   * per-strand ones, but membership-gated (see {@link startControlBackfill}).
+   * Created in {@link start} after the control node and database are up, stopped
+   * and dropped in {@link cleanup} before either is torn down, so a stop()→
+   * start() cycle rebuilds it with a fresh caught-up-peer memo.
+   */
+  private controlBackfill: PeerJoinBackfill | null = null;
   private strandWatcher: StrandWatcher | null = null;
   private strandManager: StrandInstanceManager;
   private hibernationManager: HibernationManager;
@@ -244,10 +341,11 @@ export class CadreNode implements SAppIdLookup {
   private eventHandlers: Map<keyof CadreNodeEvents, Set<EventHandler<never>>> = new Map();
 
   /**
-   * Relay multiaddrs the caller asked {@link reserveRelays} to reserve through.
-   * Empty (the default) means nobody asked, so {@link getRelayReservationState}
-   * reports `none` — this whole surface is opt-in and dormant for the CLI/host
-   * nodes, which use the configured `network.relayAddrs` route instead.
+   * Relay multiaddrs the caller asked {@link reserveRelays} to reserve through —
+   * or, on a node that names `network.relayAddrs`, the ones
+   * {@link driveControlRelayReservation} asked for at the end of {@link start}.
+   * Empty (the default) means neither happened, so {@link getRelayReservationState}
+   * reports `none`.
    */
   private relayReserveAddrs: string[] = [];
   /**
@@ -263,6 +361,24 @@ export class CadreNode implements SAppIdLookup {
    */
   private relayReserveError: string | null = null;
 
+  /**
+   * True from just before the control libp2p node is created until
+   * {@link ControlDatabase.initialize} has settled — the connection gate's
+   * BRING-UP QUIET PERIOD (`membership-connection-gater.ts`), during which this
+   * node refuses every control connection in both directions.
+   *
+   * The invariant: the control database is built while this node holds zero
+   * control connections. Every same-party sibling connected in that window joins
+   * the Optimystic cohort the bring-up's block probes consult, and a sibling that
+   * has not yet replicated this node's `CadrePeer` row refuses them all — which
+   * fails `start()` outright and cannot be retried into convergence (writing the
+   * row that would clear the refusal needs the database being built).
+   *
+   * Cleared on FAILURE as well as success ({@link cleanup} clears it), so
+   * teardown is never gated.
+   */
+  private controlBringUpInFlight = false;
+
   /** Map of strandId -> sAppConfig for sAppId filtering and management */
   private sAppConfigs: Map<string, SAppConfig> = new Map();
 
@@ -329,13 +445,27 @@ export class CadreNode implements SAppIdLookup {
   /**
    * In-memory delegate admission grants (see `delegate-admission.ts`): the
    * strand-node transport peerIds this party's members have announced over the
-   * strand-addr RPC, admitted at the CONNECTION level so a member's NAT'd
-   * strand node can hold a circuit-relay reservation on this node. Consulted
-   * ONLY by {@link admitInboundControlConnection}; the fail-closed per-stream
-   * gate ({@link authorizeInboundControlStream}) never honors it.
+   * strand-addr RPC, admitted at the CONNECTION and RESERVATION levels so a
+   * member's NAT'd strand node can hold a circuit-relay reservation on this
+   * node (without spending the unauthorized-reservation budget). Consulted
+   * ONLY by {@link admitInboundControlConnection} and
+   * {@link admitControlRelayReservation}; the fail-closed per-stream gate
+   * ({@link authorizeInboundControlStream}) never honors it.
    */
   private readonly delegateAdmission = new DelegateAdmissionStore();
 
+  /**
+   * Bounded budget of concurrent circuit-relay reservations granted to peers
+   * this node cannot (yet) place as members — the boot-ordering window where a
+   * genuine sibling reserves before its `CadrePeer` row has replicated here.
+   * Consulted only by {@link admitControlRelayReservation} (the gater's
+   * `denyInboundRelayReservation` policy); authorized members and announced
+   * delegates are admitted before it and never counted. Cap from
+   * `network.unauthorizedRelayReservationCap` (default
+   * `MAX_UNAUTHORIZED_RELAY_RESERVATIONS`).
+   */
+  private readonly unauthorizedRelayReservations: UnauthorizedReservationBudget;
+
   /**
    * When this node last ANNOUNCED a delegate, keyed `<targetPeerId>\n<strandId>`
    * (the peer announced TO, not the delegate). Throttles
@@ -357,6 +487,37 @@ export class CadreNode implements SAppIdLookup {
    */
   private readonly strandPeerAddrRefreshAt = new Map<string, number>();
 
+  /**
+   * CROSS-PARTY strand-network addresses learned at formation, keyed by strandId — the
+   * responder's live strand addrs, carried back on the formation result
+   * (`FormationResultMessage.strandAddrs`) and recorded by {@link formStrand}.
+   *
+   * This is the ONLY cross-party discovery input there is. The strand-addr RPC that
+   * resolves a strand's addresses is membership-gated and answers own-party siblings
+   * only, so without this map a joiner's cohort seed for a two-party strand is empty and
+   * the mesh never forms.
+   *
+   * Read by {@link resolveCohortSeed} (launch + hibernation resume) and re-merged by
+   * every {@link refreshStrandPeerAddrs} pass — the re-merge is what keeps the entries
+   * alive past the peerStore's one-hour address expiry, since nothing can re-resolve
+   * them.
+   *
+   * IN-MEMORY and ONE-SHOT, deliberately (see `docs/strands.md`): the addresses die with
+   * the process, and a restarted initiator with no sibling running the strand is back to
+   * an empty seed until the durability work lands
+   * (`backlog/feat-cross-party-strand-addr-durability`). They are also never refreshed,
+   * so a responder whose relay reservation rotates before the initiator dials leaves a
+   * dead entry behind; recovery today is a fresh invitation.
+   *
+   * NOTE: entries are kept for the node's lifetime, including across a
+   * {@link stopStrand} — a stopped strand may be rediscovered by the watcher and must
+   * still get its seed. Each strand's list is capped at `MAX_STRAND_ADDRS`, but the
+   * number of KEYS is bounded only by the strands this node has ever formed as an
+   * initiator (not by time); if a node ever forms strands at scale, evict on
+   * `unpublishStrand` or cap the map.
+   */
+  private readonly crossPartyStrandAddrs = new Map<string, string[]>();
+
   /**
    * Cold-start bootstrap dial targets: the owner-flagged peers of every seed
    * this node has applied, keyed by peer id, valued by the seed's multiaddr
@@ -392,6 +553,36 @@ export class CadreNode implements SAppIdLookup {
    */
   private bootstrapPeerStore: BootstrapPeerStore | null = null;
 
+  /**
+   * Node-local record of the party's enrolled-machine count (see
+   * `enrolled-machine-store.ts`), kept so the CONTROL node can declare a
+   * block-repair yardstick at bring-up. Constructed (or adopted from
+   * `config.enrolledMachines.store`) by {@link initializeEnrolledMachineStore};
+   * written by {@link refreshAuthorizedControlPeers}. Like
+   * {@link bootstrapPeerStore} it is deliberately NOT cleared by {@link cleanup},
+   * so it survives a stop()→start() cycle of the same node instance.
+   */
+  private enrolledMachineStore: EnrolledMachineStore | null = null;
+
+  /**
+   * The enrolled-machine count this node's CONTROL libp2p node was (or will be)
+   * built with — read out of {@link enrolledMachineStore} during {@link start},
+   * before {@link createControlNode}, and consumed by
+   * {@link buildControlNodeOptions}.
+   *
+   * A captured FIELD rather than a live `store.count()` read, deliberately: the
+   * store moves as membership changes, but Optimystic froze the policy when the
+   * node was built, so this field is the honest answer to "what did this node
+   * actually declare?" and does not drift away from the running node. It is
+   * re-read on each {@link start}, which is what makes a stop()→start() cycle pick
+   * up a count recorded during the previous run.
+   *
+   * `undefined` — a brand-new node, an unreadable slot, or the ephemeral default
+   * store — means "this node does not know", which `controlClusterPolicy` answers
+   * with the frozen base policy itself.
+   */
+  private declaredEnrolledMachines: number | undefined;
+
   /** Initial self-registration timer (see {@link scheduleSelfRegistration}). */
   private selfRegistrationTimer: ReturnType<typeof setTimeout> | null = null;
   /** TTL heartbeat that re-publishes the self record before it goes stale. */
@@ -501,6 +692,9 @@ export class CadreNode implements SAppIdLookup {
     this.config = config;
     this.strandManager = new StrandInstanceManager();
     this.enrollmentService = new EnrollmentService();
+    this.unauthorizedRelayReservations = new UnauthorizedReservationBudget(
+      config.network?.unauthorizedRelayReservationCap
+    );
 
     // Create hibernation manager with callbacks
     const hibernationCallbacks: HibernationCallbacks = {
@@ -630,20 +824,14 @@ export class CadreNode implements SAppIdLookup {
 
     log('Starting CadreNode for party: %s', this.config.controlNetwork.partyId);
 
-    // NOTE: the only direct `console.*` in this library — a boot-time operator warning, not a
-    // diagnostic trace (those use `debug`, which an operator never sees without `DEBUG=`). If a
-    // second such warning ever appears here, route both through a `CadreNodeEvents` entry the
-    // embedder surfaces instead of growing a console surface inside a library.
-    if (this.config.network?.announceAddrs && this.config.network.announceAddrs.length > 0) {
-      console.warn(
-        'network.announceAddrs is set but not yet supported (no upstream db-p2p option to apply it) ' +
-        '— this node will keep advertising its listen/relay addresses instead.'
-      );
-    }
-
     try {
       const tTotal = performance.now();
 
+      // Config pre-flight, inside the guarded region: resolving the listen addrs it reads
+      // throws on a malformed `relayAddrs` entry, and that failure belongs on the same
+      // logged-and-cleaned-up path as every other one in start().
+      this.warnIfAnnounceAddrsDiscardRelay();
+
       // Install the WebRTC TURN-relay tracker BEFORE any libp2p bring-up, so it
       // wraps globalThis.RTCPeerConnection before the control node can create one.
       // Inert on Node.js (no RTCPeerConnection); disposed in cleanup().
@@ -666,6 +854,33 @@ export class CadreNode implements SAppIdLookup {
       // loaded before the first reconcile pass could consult them.
       this.initializeBootstrapPeerStore();
 
+      // Read the party's enrolled-machine count out of its node-local record and
+      // capture it for buildControlNodeOptions below. This MUST precede
+      // createControlNode: Optimystic freezes the cluster policy when the node is
+      // built, and the ControlDatabase that could answer the question live does not
+      // exist until after that. Remembering the number across the restart is the
+      // only way to declare it at all — see `enrolled-machine-store.ts`.
+      this.initializeEnrolledMachineStore();
+
+      // Arm the connection gate's BRING-UP QUIET PERIOD before the libp2p node
+      // exists, so no connection can form ahead of it: `@libp2p/bootstrap` emits
+      // its discovery events ~1 s after `libp2p.start()` and the connection
+      // manager auto-dials from there, which is INSIDE createControlNode below.
+      // The invariant being protected is "zero control connections during
+      // control-database bring-up" — see the field's doc and
+      // `membership-connection-gater.ts` → "The bring-up quiet period".
+      //
+      // NOTE: without this gate the bootstrap arm is a RACE, not a guarantee — its
+      // safety margin is bring-up duration versus @libp2p/bootstrap's 1 s discovery
+      // fuse, and bring-up duration is (raw-storage operations) × per-operation
+      // latency. The cold-start operation count and the 50-90 ms/op figure a loaded
+      // phone actually sees live in `control-database.ts`'s `loadSchema` note (and
+      // are pinned by `control-start-storage-op-budget.spec.ts`): at the top of that
+      // range bring-up is 9-15 s, far past the fuse. So if this gate is ever removed
+      // or bypassed, that arm reopens for exactly the nodes most likely to hit it —
+      // phones joining a party, whose membership row has not replicated yet.
+      this.controlBringUpInFlight = true;
+
       // Create the control network libp2p node
       let t0 = performance.now();
       this.controlNode = await this.createControlNode();
@@ -688,6 +903,21 @@ export class CadreNode implements SAppIdLookup {
       });
       await this.controlDatabase.initialize();
       timing('[start] controlDatabase.initialize: %dms', Math.round(performance.now() - t0));
+      // The database exists locally now, so the quiet period has done its job and
+      // this node can be in the conversation. A failure above never reaches here —
+      // `cleanup()` on the catch path opens the gate instead, so teardown (and a
+      // retry by the embedder) is not gated.
+      //
+      // NOTE: the window ends HERE, not at the end of start(), so the awaited control-DB
+      // work that follows — `strandWatcher.start()`'s first poll — can run against a
+      // cohort a connection just joined. Fine now: every block that poll reads was
+      // created locally by the initialize() above, so a refusing sibling has nothing to
+      // refuse. If a boot ever fails with `BlockUnavailableError` from BELOW this line,
+      // that assumption broke. Do not simply move this clear later without measuring:
+      // `handleStrandAdded` runs inside `strandWatcher.start()` and seeds each strand
+      // node from CONNECTED siblings (`resolveCohortSeed`), so a longer window trades a
+      // bring-up hazard for boot-time strand seeds that are always empty.
+      this.controlBringUpInFlight = false;
       log('Control database initialized');
 
       // Attach the per-stream gate to the control DB's membership hub, so every
@@ -765,18 +995,41 @@ export class CadreNode implements SAppIdLookup {
       // write-while-alone re-replication drain must fire on the first 0→≥1 edge.
       this.wireControlConnectionListeners();
 
+      // Arm the control network's peer-join block catch-up now that the control
+      // DB (which the push-time membership gate reads) is up. Armed even when
+      // this node is alone — like the strand one, it only does work when the
+      // control libp2p node reports a peer connection, and arming it at start is
+      // what closes the "genesised alone, headers never replicate" hole.
+      this.startControlBackfill();
+
       // Seed the per-stream gate's materialized authorized set now that the
       // control DB is up (non-blocking; the helper never rejects). Until it
       // lands the snapshot is empty, which the stream gate treats as cold
       // start and admits.
       void this.refreshMembershipGate('start');
 
+      // Reserve the configured relays LAST, so every step above ran against a
+      // cohort of one (see driveControlRelayReservation). Ahead of
+      // scheduleSelfRegistration, so this node's first published `CadrePeer` row
+      // already carries the `/p2p-circuit` address the reservation earns it.
+      // Throws on a relay that will not have us — start() is fail-fast for a node
+      // whose operator named a relay.
+      await this.driveControlRelayReservation();
+
       // Schedule self-registration in background
       this.scheduleSelfRegistration();
 
     } catch (error) {
       log('Failed to start CadreNode: %o', error);
+      // `driveControlRelayReservation` throws AFTER `control:connected` was emitted,
+      // so a subscriber can have seen this node come up. Balance the edge rather than
+      // leaving it dangling — `cleanup()` has torn the node down either way, and the
+      // events are what an embedder drives its "am I connected" UI from.
+      const wasConnected = this._running;
       await this.cleanup();
+      if (wasConnected) {
+        this.emit('control:disconnected', undefined);
+      }
       throw error;
     }
   }
@@ -817,19 +1070,7 @@ export class CadreNode implements SAppIdLookup {
     }
 
     log('Stopping CadreNode');
-    // Stop the retry loop BEFORE tearing the node down, not after: `cleanup()`
-    // stops the control node partway through, and a tick that fires during it
-    // would dial and then poll a half-torn-down node for the whole reserve
-    // timeout — logging spurious dial failures and holding the process open.
-    this.relayReserveSupervisor?.stop();
-    this.relayReserveSupervisor = null;
     await this.cleanup();
-    // Drop the rest of the relay-reservation posture: a stopped node holds no
-    // reservation, so a restarted instance must not report the previous run's
-    // `reserved`.
-    this.relayReserveAddrs = [];
-    this.relayReserveError = null;
-    this._running = false;
     this.emit('control:disconnected', undefined);
     log('CadreNode stopped');
   }
@@ -974,6 +1215,50 @@ export class CadreNode implements SAppIdLookup {
     this.bootstrapPeerStore = store;
   }
 
+  /**
+   * Construct (or adopt) the node-local enrolled-machine store and capture the
+   * count this run will declare into {@link declaredEnrolledMachines}.
+   *
+   * Synchronous for the same reason {@link initializeBootstrapPeerStore} is: an
+   * injected store has already loaded its persisted count by the time it is handed
+   * in (its `open` is the async part), and the in-memory default has nothing to
+   * load. Must run BEFORE {@link createControlNode} — that is the whole point of
+   * the record; see `enrolled-machine-store.ts`.
+   *
+   * The store instance is kept across stop()→start() (so a count recorded during
+   * the previous run is not lost with the ephemeral default), but the DECLARED
+   * count is re-read every time — which is how a restart applies a number the
+   * previous run learned.
+   *
+   * A store scoped to a different party is a configuration error, fail closed. It
+   * is only a repair hint, but a hint sized by a foreign party's membership is a
+   * number nobody chose, and the mismatch always means a miswired embedder.
+   */
+  private initializeEnrolledMachineStore(): void {
+    const partyId = this.config.controlNetwork.partyId;
+    const store = this.enrolledMachineStore
+      ?? this.config.enrolledMachines?.store
+      ?? new MemoryEnrolledMachineStore(partyId);
+    if (store.partyId !== partyId) {
+      throw new Error(
+        `CadreNodeConfig: enrolledMachines.store is scoped to party ${store.partyId}, ` +
+        `but this node serves party ${partyId} — refusing to size a repair yardstick from a foreign party`
+      );
+    }
+    this.enrolledMachineStore = store;
+    this.declaredEnrolledMachines = store.count();
+    log('control repair yardstick will be declared from %o enrolled machine(s)', this.declaredEnrolledMachines);
+  }
+
+  /**
+   * The node-local enrolled-machine store (null before {@link start}) — what this
+   * node last knew about its party's size. Exposed for diagnostics and for a host
+   * that wants to show which repair yardstick the next launch will declare.
+   */
+  getEnrolledMachineStore(): EnrolledMachineStore | null {
+    return this.enrolledMachineStore;
+  }
+
   /**
    * The node-local cold-start bootstrap-peer store (null before {@link start}) —
    * the retained owner addresses {@link reconcileControlCohort}'s cold-start
@@ -1024,6 +1309,93 @@ export class CadreNode implements SAppIdLookup {
     return await createLibp2pNode(this.buildControlNodeOptions());
   }
 
+  /**
+   * The control libp2p node's Optimystic network name — ONE binding for every
+   * derivation from it (`db-p2p` namespaces all of the node's protocol ids as
+   * `/optimystic/<networkName>/...`), so the node options and the block-transfer
+   * protocol prefix the control backfill dials can never drift apart.
+   */
+  private controlNetworkName(): string {
+    return `control-${this.config.controlNetwork.partyId}`;
+  }
+
+  /**
+   * Arm the CONTROL network's peer-join block catch-up: push every block in the
+   * control database's own raw store to each newly connected AUTHORIZED member
+   * this runtime has not yet caught up. This is what physically replicates
+   * control blocks committed while the writer was alone — the named
+   * collection-header blocks written once at genesis above all, whose revision
+   * never moves again, so no later commit ever carries them to a member that
+   * joined after them. Without it, such a member that restarts offline reads
+   * the affected control tables as EMPTY, silently (`isMember()` answers false
+   * for peers it knew about before the restart).
+   *
+   * Unlike the per-strand instances (see `strand-instance-manager.ts`), pushes
+   * are gated on {@link isAuthorizedMember}, judged at push time: the control
+   * network's inbound connection gate deliberately admits non-members in
+   * several states (seed delivery to an un-enrolled node, an open enrollment
+   * window, an outstanding invitation, configured bootstrap/relay peers), and
+   * pushing the whole control store to such a peer would hand a stranger the
+   * party's entire membership, addresses and strand list. The receiving side
+   * needs no work of its own: `createLibp2pNode` registers the block-transfer
+   * handler on every node it builds, control node included, and this node's
+   * per-stream gate (`authorizeInboundControlStream`) covers the inbound
+   * direction. A denied peer is retried on its next `connection:open`, and —
+   * because the production join order is connect-then-authorize — on every
+   * committed membership change via {@link refreshAuthorizedControlPeers}'s
+   * `scheduleConnectedPeers()` call.
+   *
+   * No-ops (logged) when the embedder configured no control storage or the
+   * node exposes no key network — the backfill would have nothing to read or
+   * no way to dial.
+   */
+  private startControlBackfill(): void {
+    if (this.config.controlBackfill?.enabled === false || !this.controlNode) {
+      return;
+    }
+    // Through the resolver, not the {@link controlStorage} memo field: the resolver is
+    // idempotent (it returns the same wrapped store `buildControlNodeOptions` already
+    // resolved), so the catch-up cannot be silently disarmed by a future reordering that
+    // moves this call ahead of the one that populated the field.
+    const storage = this.resolveControlStorage();
+    const keyNetwork = (this.controlNode as Libp2pNodeWithRepo).keyNetwork;
+    if (!storage || !keyNetwork) {
+      log('Control peer-join block catch-up is inert: %s',
+        !storage ? 'no control storage configured' : 'control node exposes no keyNetwork');
+      return;
+    }
+    const networkName = this.controlNetworkName();
+    this.controlBackfill = new PeerJoinBackfill({
+      label: networkName,
+      libp2p: this.controlNode,
+      peerNetwork: keyNetwork,
+      storage,
+      // The same prefix the receiver registered its block-transfer handler
+      // under — derived from the same networkName binding the node options
+      // used, never re-spelled here.
+      protocolPrefix: `/optimystic/${networkName}`,
+      authorizePeer: (peerId) => this.isAuthorizedMember(peerId)
+    }, {
+      // A shorter settle window than the strand default (1000 ms): the control
+      // store is small (a party's membership — dozens of blocks), a re-push is
+      // idempotent, and the window a joiner is connected before going offline
+      // can be short (converge one row, then stop) — a slow debounce is the
+      // difference between that joiner holding the collection headers and
+      // reading its own membership as empty after an offline restart.
+      //
+      // NOTE: 250 is reasoned, not swept — the delete-while-alone scenario's
+      // phases 1-3 finish in about a second, so the 1000 ms strand default left
+      // the push racing the joiner's stop, and 250 gives margin. Nobody measured
+      // the shape of the curve either side of it. If the control gates start
+      // flaking on a joiner that stopped before being caught up, lower this
+      // before looking anywhere else; if catch-up pushes start showing up as
+      // connection-churn noise, raise it.
+      debounceMs: 250,
+      ...this.config.controlBackfill
+    });
+    this.controlBackfill.start();
+  }
+
   /**
    * The control database's cache-wrapped raw storage, resolved from
    * `config.storage.provider` on first use and then held in {@link controlStorage}
@@ -1055,6 +1427,45 @@ export class CadreNode implements SAppIdLookup {
     return this.controlStorage;
   }
 
+  /**
+   * Warn the operator when `network.announceAddrs` will silently cost this node the
+   * relay reachability it also configured.
+   *
+   * A non-empty announce set REPLACES everything libp2p advertises, so the
+   * `/p2p-circuit` address earned by a relay reservation is dropped from the node's
+   * advertised addresses even though the reservation itself is still held — peers
+   * behind NAT stop being able to reach it through that relay. Not an error: an
+   * operator whose relay slot is decorative may genuinely want only the announced
+   * address, so this reports and proceeds.
+   *
+   * Keyed off the RESOLVED listen addrs rather than `relayAddrs` alone, so a
+   * hand-written `/p2p-circuit` entry in `listenAddrs` — the same reservation by the
+   * longer route — is caught too.
+   *
+   * NOTE: the only direct `console.*` in this library — a boot-time operator warning, not a
+   * diagnostic trace (those use `debug`, which an operator never sees without `DEBUG=`). If a
+   * second such warning ever appears here, route both through a `CadreNodeEvents` entry the
+   * embedder surfaces instead of growing a console surface inside a library.
+   */
+  private warnIfAnnounceAddrsDiscardRelay(): void {
+    const network = this.config.network;
+    if (!replacesAdvertisedAddrs(network)) {
+      return;
+    }
+    const listensOnCircuit = (resolveListenAddrs(network) ?? [])
+      .some((addr) => addr.includes('/p2p-circuit'));
+    if (!listensOnCircuit) {
+      return;
+    }
+    console.warn(
+      'network.announceAddrs is set alongside a circuit-relay listener (from network.relayAddrs, ' +
+      'or a /p2p-circuit entry in network.listenAddrs). A non-empty announce set REPLACES every ' +
+      'address this node advertises, so the /p2p-circuit address earned from the relay reservation ' +
+      'will not be advertised and peers will stop reaching this node through that relay. ' +
+      'Use network.appendAnnounceAddrs instead to advertise an extra address without discarding the rest.'
+    );
+  }
+
   /**
    * Map this node's config onto the control network's libp2p node options.
    *
@@ -1066,11 +1477,18 @@ export class CadreNode implements SAppIdLookup {
   private buildControlNodeOptions(): Parameters<typeof createLibp2pNode>[0] {
     const { controlNetwork, network, profile } = this.config;
     const identityKey = this.identityKey;
-    const listenAddrs = resolveListenAddrs(network);
-
-    // Determine relay mode: if explicitly set in config, use that;
-    // otherwise default to true for storage profile nodes (better connectivity/uptime)
-    const enableRelay = network?.enableRelay ?? (profile === 'storage');
+    // `'search'`: `network.relayAddrs` contributes the bare `/p2p-circuit` SEARCH
+    // entry, which opens no connection — the reservation is driven explicitly at
+    // the END of `start()`, so the control database is built while this node holds
+    // zero control connections. See `relay-addrs.ts` and `start()`.
+    const listenAddrs = resolveListenAddrs(network, 'search');
+    // The transports those listen entries imply. A `/ws` entry switches db-p2p's
+    // WebSocket transport on (without it the entry binds nothing and libp2p reports
+    // nothing); anything outside {tcp, ws/wss, p2p-circuit} throws here rather than
+    // being silently dropped at bring-up. See `relay-addrs.ts`.
+    const transportOptions = resolveTransportOptions(network, listenAddrs);
+
+    const enableRelay = this.relayServerEnabled();
 
     // The control node's own storage, resolved once per runtime (see
     // {@link resolveControlStorage}) rather than per call.
@@ -1079,7 +1497,7 @@ export class CadreNode implements SAppIdLookup {
     const nodeOptions: Parameters<typeof createLibp2pNode>[0] = {
       port: 0,
       bootstrapNodes: controlNetwork.bootstrapNodes,
-      networkName: `control-${controlNetwork.partyId}`,
+      networkName: this.controlNetworkName(),
       storage: controlStorageProvider,
       fretProfile: profile === 'storage' ? 'core' : 'edge',
       relay: enableRelay,
@@ -1090,20 +1508,42 @@ export class CadreNode implements SAppIdLookup {
       // CONTROL_CLUSTER_POLICY: only the admission gate defaults to 2, while the read-repair
       // corroboration floor would otherwise fall back to this clusterSize of 16.
       clusterSize: CONTROL_REPLICATION_BREADTH,
-      clusterPolicy: CONTROL_CLUSTER_POLICY,
+      // The base control policy with the block-repair corroboration yardstick declared
+      // from the machines this party had enrolled at this node's last look
+      // ({@link declaredEnrolledMachines}, read in start() before this runs). Handed
+      // `undefined` — a brand-new node, an unreadable record, or an embedder that
+      // injected no store — this returns the frozen CONTROL_CLUSTER_POLICY object
+      // itself, so the unknown case is provably byte-for-byte the old behaviour.
+      // The yardstick moves ALONE: `assumedClusterSize` stays pinned at 2, because a
+      // party of phones cannot promise three quarters of its machines are awake.
+      clusterPolicy: controlClusterPolicy(this.declaredEnrolledMachines),
       arachnode: { enableRingZulu: profile === 'storage' },
       ...(identityKey && { privateKey: identityKey }),
       ...(network?.transports && { transports: network.transports }),
-      // Configured `listenAddrs`, plus a `/p2p-circuit` listener for every
-      // `network.relayAddrs` entry — that listener is what reserves the relay slot.
+      // `{ wsPort }` when a listen entry names WebSocket, otherwise `{}` — and always
+      // `{}` when `network.transports` is set, since the embedder owns transport policy
+      // then. Spread NEXT to `transports` because the two answer the same question.
+      ...transportOptions,
+      // Configured `listenAddrs`, plus the bare `/p2p-circuit` search listener when
+      // `network.relayAddrs` is set — that listener registers the pending reservation
+      // `driveControlRelayReservation` fills after bring-up.
       ...(listenAddrs && { listenAddrs }),
+      // What this node ADVERTISES, which is not the same question as what it binds.
+      // Either field is present only when configured non-empty; a non-empty
+      // `announceAddrs` replaces the advertised set (see warnIfAnnounceAddrsDiscardRelay).
+      ...resolveAnnounceAddrs(network),
       // The CONTROL node composes the membership admission gate onto any
-      // caller-supplied gater (deny from either wins on inbound; all other
-      // hooks pass through). Strand cohort nodes keep the raw configured gater
-      // (see strand-instance-manager.ts) — their peers are legitimately
+      // caller-supplied gater (deny from either wins on the inbound-encrypted
+      // and relay-reservation hooks; all other hooks pass through). Strand
+      // cohort nodes keep the raw configured gater (see
+      // strand-instance-manager.ts) — their peers are legitimately
       // cross-party, so cadre membership must not gate them.
       connectionGater: createMembershipConnectionGater(
-        { admitInbound: (remotePeerId) => this.admitInboundControlConnection(remotePeerId) },
+        {
+          admitInbound: (remotePeerId) => this.admitInboundControlConnection(remotePeerId),
+          admitRelayReservation: (remotePeerId) => this.admitControlRelayReservation(remotePeerId),
+          bringUpInFlight: () => this.controlBringUpInFlight
+        },
         network?.connectionGater
       ),
       // Fail-closed per-stream authorization for the four Optimystic control-DB
@@ -1117,6 +1557,18 @@ export class CadreNode implements SAppIdLookup {
     return nodeOptions;
   }
 
+  /**
+   * Does this node's CONTROL libp2p run the circuit-relay server? An explicit
+   * `network.enableRelay` wins; otherwise storage-profile nodes default to on
+   * (better connectivity/uptime). Shared by {@link buildControlNodeOptions}
+   * (which configures the server from it) and
+   * {@link admitInboundControlConnection} (whose deny/admit-for-relay branch
+   * must agree with whether a reservation is even servable here).
+   */
+  private relayServerEnabled(): boolean {
+    return this.config.network?.enableRelay ?? (this.config.profile === 'storage');
+  }
+
   /**
    * Decide whether an inbound CONTROL-network connection from `remotePeerId`
    * should be admitted — the policy behind the connection gater wired in
@@ -1126,7 +1578,7 @@ export class CadreNode implements SAppIdLookup {
    * `membership-connection-gater.ts` for the layer's rationale and the
    * stranger-open protocol allowlist).
    *
-   * Admits when ANY of:
+   * Returns `'admit'` when ANY of:
    *  1. a shared-baseline check admits ({@link admitControlPeerUnconditionally}
    *     — not running / DB torn down, absent-or-empty trusted-owner anchor, or
    *     configured bootstrap/relay infrastructure);
@@ -1163,43 +1615,119 @@ export class CadreNode implements SAppIdLookup {
    *    this node yet is denied even though the formation handler would have
    *    accepted it, exactly like the unreplicated-membership-row case below.
    *
+   * When every check falls through, the verdict depends on whether this node
+   * runs the circuit-relay server ({@link relayServerEnabled}): without one,
+   * `'deny'`; with one, `'admit-for-relay'` — a circuit-relay reservation is
+   * established by the reserving peer DIALING the relay, so a connection deny
+   * here kills the reservation, and that deny is NOT self-healing: an outbound
+   * reconcile re-dial re-establishes a data link, but no outbound dial can
+   * grant the remote peer a reservation, and a relay-only peer has no address
+   * of its own to dial back — the reservation IS its address. The gater admits
+   * such a connection, decides the reservation via
+   * {@link admitControlRelayReservation}, and drops the connection if no
+   * reservation is admitted in time (see `membership-connection-gater.ts` →
+   * "The relay-reservation seam").
+   *
    * NOTE: check 4/5 runs a control-DB read per inbound connection
    * (`listAuthorizedMembers`); connections are rare and cadres small, and this
    * layer is fail-open behind `ADMISSION_DECISION_TIMEOUT_MS`, so the live
    * read is safe here — unlike the per-stream gate, which must consult the
    * materialized {@link authorizedControlPeers} snapshot instead.
-   * NOTE: a sibling whose membership row has not yet replicated to
-   * this node is denied until the row converges (typically via the owner);
-   * either side's next outbound reconcile dial (outbound is never gated)
-   * re-establishes the link — self-healing, but visible as a transient deny.
-   */
-  private async admitInboundControlConnection(remotePeerId: string): Promise<boolean> {
+   * NOTE: on a relay-DISABLED node, a sibling whose membership row has not yet
+   * replicated here is denied until the row converges (typically via the
+   * owner); either side's next outbound reconcile dial (outbound is never
+   * gated) re-establishes the DATA link — self-healing for data, visible as a
+   * transient deny. That self-healing story never covered a reservation, which
+   * is exactly why the relay-enabled path above exists.
+   */
+  private async admitInboundControlConnection(remotePeerId: string): Promise<InboundConnectionVerdict> {
     if (this.admitControlPeerUnconditionally(remotePeerId)) {
-      return true;
+      return 'admit';
     }
     if (Date.now() < this.enrollmentWindowUntil) {
-      return true;
+      return 'admit';
     }
     if (this.delegateAdmission.has(remotePeerId)) {
-      return true;
+      return 'admit';
     }
     const authorized = await this.listAuthorizedMembers();
     if (authorized.length === 0) {
-      return true;
+      return 'admit';
     }
     if (authorized.some((m) => m.peerId === remotePeerId)) {
-      return true;
+      return 'admit';
     }
     try {
       if (await this.strandSolicitationService?.hasOutstandingInvitation()) {
-        return true;
+        return 'admit';
       }
     } catch (error) {
       log('admitInboundControlConnection: outstanding-invitation check threw for %s — admitting (fail-open): %o', remotePeerId, error);
-      return true;
+      return 'admit';
+    }
+    if (this.relayServerEnabled()) {
+      log('admitInboundControlConnection: admitting %s FOR RELAY ONLY — not an authorized member and no enrollment path open; the gater drops the connection unless a reservation is admitted', remotePeerId);
+      return 'admit-for-relay';
     }
     log('admitInboundControlConnection: DENYING inbound from %s — not an authorized member and no enrollment path open', remotePeerId);
-    return false;
+    return 'deny';
+  }
+
+  /**
+   * Should `remotePeerId` be granted a circuit-relay reservation slot on this
+   * node's relay server? The policy behind the gater's
+   * `denyInboundRelayReservation` hook (see `membership-connection-gater.ts` →
+   * "The relay-reservation seam"); the circuit-relay server consults it per
+   * RESERVE request, so it is never called on a node whose relay server is off.
+   *
+   * Admits when ANY of:
+   *  1. a shared-baseline check admits ({@link admitControlPeerUnconditionally}
+   *     — not running / DB torn down, absent-or-empty trusted-owner anchor, or
+   *     configured bootstrap/relay infrastructure);
+   *  2. the peer holds a live delegate admission grant — a member's strand
+   *     node reserving here (see `delegate-admission.ts`); never counted
+   *     against the unauthorized budget;
+   *  3. the authorized-member set is empty (cold start) or the peer IS an
+   *     authorized member — members are never counted against the budget; or
+   *  4. the peer takes (or already holds) a slot in the bounded
+   *     unauthorized-reservation budget — the boot-ordering window where a
+   *     genuine member reserves before its `CadrePeer` row replicates here.
+   *     Cap via `network.unauthorizedRelayReservationCap` (0 = refuse every
+   *     unauthorized reservation).
+   *
+   * Every uncounted admission also RELEASES the budget slot the peer may hold
+   * from an earlier reservation taken while it was still unplaceable — a member
+   * that boots, reserves, and only then has its row replicate here would
+   * otherwise keep that slot spent for the rest of the entry's TTL.
+   *
+   * The connection gate's stranger carve-outs (an open enrollment window, an
+   * outstanding formation invitation) deliberately do NOT extend here: they
+   * exist so a stranger's SEED or FORMATION stream can ride a connection, and
+   * neither needs relay capacity. A genuine invitee that does need a relay slot
+   * takes one from the budget like any other unplaced peer, so an open window
+   * never becomes an unbounded grant of this node's forwarding capacity.
+   */
+  private async admitControlRelayReservation(remotePeerId: string): Promise<boolean> {
+    if (this.admitControlPeerUnconditionally(remotePeerId)) {
+      return this.admitReservationUncounted(remotePeerId);
+    }
+    if (this.delegateAdmission.has(remotePeerId)) {
+      return this.admitReservationUncounted(remotePeerId);
+    }
+    const authorized = await this.listAuthorizedMembers();
+    if (authorized.length === 0 || authorized.some((m) => m.peerId === remotePeerId)) {
+      return this.admitReservationUncounted(remotePeerId);
+    }
+    const admitted = this.unauthorizedRelayReservations.tryAdmit(remotePeerId);
+    log('admitControlRelayReservation: %s %s under the unauthorized-reservation budget',
+      admitted ? 'admitting' : 'REFUSING', remotePeerId);
+    return admitted;
+  }
+
+  /** Admit a reservation on the peer's own merits, giving back any budget slot it still holds. */
+  private admitReservationUncounted(remotePeerId: string): true {
+    this.unauthorizedRelayReservations.release(remotePeerId);
+    return true;
   }
 
   /**
@@ -1217,7 +1745,8 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Record (or refresh) a delegate admission grant: `delegatePeerId` is the
    * transport peerId of `announcerPeerId`'s strand-`strandId` node, admitted
-   * at the CONNECTION level (all a circuit-relay reservation needs) for
+   * at the CONNECTION and RESERVATION levels (all a circuit-relay reservation
+   * needs, without spending the unauthorized-reservation budget) for
    * `DELEGATE_GRANT_TTL_MS`. Called by the strand-addr responder after its
    * authorized-membership gate has passed; public so tests can drive the
    * admission policy without a full strand launch. A re-announce for the same
@@ -1325,15 +1854,83 @@ export class CadreNode implements SAppIdLookup {
    *
    * The SOLE caller is {@link drainMembershipGate}, which serializes refreshes —
    * so two reads can no longer settle out of order.
+   *
+   * Reads WITHOUT the transient-failure retry, deliberately: `ControlDatabase` drives
+   * this listener with its write lock HELD (`notifyMembershipChanged`), so a retrying
+   * read here would sleep its backoff holding the lock and stall every other local
+   * writer. Nothing is lost — this refresh already keeps the previous snapshot on
+   * failure and is re-driven by the next membership write and by the timed reconcile.
    */
   private async refreshAuthorizedControlPeers(reason: string): Promise<void> {
     if (!this._running || !this.controlDatabase) {
       return;
     }
     try {
-      const members = await this.listAuthorizedMembers();
+      const members = await this.listAuthorizedMembers(false);
       this.authorizedControlPeers = new Set(members.map((m) => m.peerId));
       log('refreshAuthorizedControlPeers(%s): %d authorized peer(s)', reason, this.authorizedControlPeers.size);
+      // Remember the party's size for the NEXT launch's control-node repair yardstick
+      // (see `enrolled-machine-store.ts`): this is the only place the count is known,
+      // and the control node that needs it was built long before this ran. Recorded
+      // from the snapshot just materialized — no second membership query.
+      //
+      // CONTROL-NETWORK ONLY, and that scope is load-bearing. Every enrolled machine
+      // runs the control node by construction, so here the party's machine count IS
+      // the count of machines serving the network — the quantity
+      // `resolveRepairYardstick` asks for. It is NOT that quantity for a strand, which
+      // launches only on machines whose embedder registered its sApp config (see
+      // {@link addStrand}), so this number must never be routed to a strand node:
+      // over-declaring pins Optimystic's repair corroboration floor at two peers and a
+      // strand that can field only one can then never repair. `launchStrand` therefore
+      // declares nothing; see the NOTE there.
+      //
+      // `+ 1` for this node, which is not in its own authorized set. An EMPTY snapshot
+      // is recorded as 1 rather than skipped. That is deliberate, and the reason
+      // is a party that genuinely SHRANK: if empty meant "record nothing", a party
+      // whose other machines were all revoked would keep declaring its old, larger
+      // number forever, and over-declaring is the unsafe direction — at a yardstick of
+      // 3 or more Optimystic pins the repair corroboration floor at two peers, so a
+      // cohort that can only field one peer could never repair at all. Recording 1
+      // lets the number come back down; the floor then turns it into 2, which is
+      // exactly what declaring nothing resolves to.
+      //
+      // NOTE: the cost of that choice is that a TRANSIENT empty read overwrites a good
+      // remembered count with 1 — a membership snapshot is legitimately empty early in
+      // a run on a node whose rows have not replicated yet or whose trusted-owner
+      // anchor is still unseeded (`listAuthorizedMembers` authorizes no one without an
+      // anchor). Bounded and safe: the next refresh once rows land re-records the real
+      // count, and the only node that loses anything is one stopped inside that window,
+      // which then declares 2 — today's behaviour — on its next launch. If a node ever
+      // needs to declare the right number on its FIRST post-restart launch, the fix is
+      // to distinguish "no rows yet" from "no members" at this site, not to skip empty.
+      //
+      // A removed peer stops counting at REVOCATION, not at reap: `queryCadrePeers`
+      // drops rows whose `StampId` is retired, and `listAuthorizedMembers` reads
+      // through it. That is why there is no reap hook writing this record.
+      //
+      // `void`: the store never rejects and logs its own persist failures, and this
+      // method's contract is never-rejects. A failed write leaves the in-memory count
+      // correct for this session and re-lands on the next refresh.
+      void this.enrolledMachineStore?.record(this.authorizedControlPeers.size + 1);
+      // Membership moved: give the control backfill another look at every
+      // connected peer. The production join order is connect-then-authorize, so
+      // a joiner's first catch-up pass was denied at the gate while its
+      // connection stays up — without this re-arm it would wait for a
+      // reconnect. Cheap and idempotent: caught-up peers are skipped before any
+      // timer is set, a peer whose pass is in flight is deferred to the end of
+      // that pass (the pass may already be past its gate check — this very
+      // commit is what would authorize it), and the gate re-judges at push time.
+      //
+      // NOTE: every refresh re-arms every connected peer that is not yet caught
+      // up, and each re-armed pass costs one `CadrePeer` query at the gate. A
+      // connection that is admitted but never authorized — a configured
+      // bootstrap or relay peer, the steady state for a NAT'd node — is
+      // therefore re-judged on every membership write and every timed reconcile
+      // tick, forever. Negligible at a cadre's handful of connections; if a node
+      // ever holds many such connections, or refreshes get frequent, skip
+      // re-arming peers whose last pass was denied under the SAME membership
+      // snapshot instead of re-arming unconditionally.
+      this.controlBackfill?.scheduleConnectedPeers();
     } catch (error) {
       log('refreshAuthorizedControlPeers(%s) failed — keeping previous snapshot: %o', reason, error);
     }
@@ -1567,6 +2164,30 @@ export class CadreNode implements SAppIdLookup {
     return null;
   }
 
+  /**
+   * Does the `Strand` row name THIS machine as its founder — i.e. is its
+   * `FounderOwnerKey` this node's own owner key (the key behind its PeerId)?
+   * A null/absent column (a consent-seated strand, or a hand-built row) and a
+   * node with no owner key both derive `false`: without a positive match this
+   * machine must attach, never bootstrap. Pure key derivation, no I/O — cheap
+   * enough for {@link launchStrand}'s tracked-instance early return.
+   *
+   * NOTE: reads "one owner key per machine" — the reference model, where the owner
+   * key IS the key behind the PeerId. Two machines running the SAME identity key
+   * would both derive `true` and each bootstrap on its own replica, which is the
+   * double-`Header` hazard this derivation exists to avoid. Unreachable today: that
+   * configuration also gives both machines one PeerId, which already breaks control
+   * networking well before any strand launches. Revisit if machines ever share an
+   * owner key while holding distinct transport identities — the derivation would
+   * then need a per-machine discriminator (the `CadrePeer` PeerId) on the row.
+   */
+  private isSelfFoundedRow(strand: StrandRow): boolean {
+    if (strand.FounderOwnerKey == null) {
+      return false;
+    }
+    return strand.FounderOwnerKey === this.getSelfSigningKey()?.publicKeyB64;
+  }
+
   /**
    * The owner keypair (base64url Ed25519) derived from this node's resolved
    * identity key. In the single-key reference model the owner signing key is
@@ -1635,6 +2256,20 @@ export class CadreNode implements SAppIdLookup {
     };
     this.controlNode.addEventListener('self:peer:update', this.selfPeerUpdateHandler);
 
+    // NOTE: a node AUTHORIZED AFTER IT BOOTED can wait a whole heartbeat (7.5 min)
+    // to publish its address. `registerSelf` no-ops while a node has no readable
+    // `CadrePeer` row, so its boot-time publish does nothing, and the two triggers
+    // wired here are the only ones after that: `self:peer:update` needs an ADDRESS
+    // CHANGE, and a relay-only node's addresses stop changing the moment its
+    // reservation lands — inside `start()`, before this listener exists. Harmless
+    // where a late-authorized node's addresses keep churning (NAT/relay rotation
+    // fire the event anyway), and invisible while parties authorize members before
+    // they boot. If late enrollment becomes the normal path — an invited phone is
+    // exactly that — republish on the membership-change seam that already exists
+    // (`ControlDatabase.setMembershipChangeListener`) rather than lengthening this
+    // list of triggers. Measured while writing
+    // `relay-only-control-addr.integration.ts` case 4, which drives `registerSelf()`
+    // explicitly because neither trigger is dependable there.
     this.recordRefreshTimer = setInterval(() => republish('heartbeat'), DEFAULT_PEER_RECORD_HEARTBEAT_MS);
     (this.recordRefreshTimer as { unref?: () => void } | null)?.unref?.();
 
@@ -1715,6 +2350,10 @@ export class CadreNode implements SAppIdLookup {
    * Survivors are returned signaling (`/p2p-circuit`) first, filtered to
    * signaling-only when requested, as parsed `Multiaddr`s (unparsable addrs
    * dropped). Any gate failure yields an empty array rather than throwing.
+   *
+   * Every returned address is normalized to terminate in `/p2p/<peerId>` — see
+   * {@link normalizeDialAddrs} for why that invariant, not each dial site's own
+   * handling, is what keeps a mixed list from taking a whole peer offline.
    */
   async resolvePeerAddrs(peerId: string, opts: ResolveOpts = {}): Promise<Multiaddr[]> {
     if (!this.controlDatabase) {
@@ -1767,12 +2406,77 @@ export class CadreNode implements SAppIdLookup {
 
     // Order signaling-first (the on-record order was what we verified above),
     // optionally restrict to signaling addrs, then parse — dropping any addr
-    // that does not parse as a multiaddr.
+    // that does not parse as a multiaddr — and finally normalize every survivor
+    // onto `/p2p/<peerId>` so no caller ever sees a mixed list.
     let addrs = orderSignalingFirst(record.addrs);
     if (opts.signalingOnly) {
       addrs = addrs.filter(isSignalingAddr);
     }
-    return this.parseMultiaddrs(addrs);
+    return this.normalizeDialAddrs(this.parseMultiaddrs(addrs), peerId);
+  }
+
+  /**
+   * Guarantee every address handed to a control-network dial terminates in
+   * `/p2p/<peerId>`, with no duplicates — the invariant every dial path
+   * downstream relies on.
+   *
+   * `libp2p.dial(addrs)` requires that the addresses in ONE dial either all name
+   * a peer id or none do; a list mixing a circuit address (which ends in
+   * `/p2p/<target>`) with a bare direct one (which ends in `/tcp/…`) makes that
+   * call throw, and the whole peer is then silently skipped rather than one bad
+   * address.
+   *
+   * Applied by ALL THREE sources of control-dial candidates, so no call site
+   * invents its own rule and none can produce a mixed list: the signed record
+   * ({@link resolvePeerAddrs}), the libp2p address book
+   * ({@link peerStoreAddrs}), and a seed's retained owner addresses
+   * ({@link bootstrapDialAddrs}).
+   *
+   * An address naming a DIFFERENT trailing peer id is dropped: it does not reach
+   * `peerId`, so it does not belong in this peer's candidate list (libp2p's own
+   * dial queue filters the same shape out one layer lower).
+   */
+  private normalizeDialAddrs(addrs: Multiaddr[], peerId: string): Multiaddr[] {
+    // Keyed by the NORMALIZED string, so two entries differing only by the suffix
+    // (`/ip4/…/tcp/4001` and `/ip4/…/tcp/4001/p2p/<peerId>`) collapse into one.
+    // Normalization is what makes them equal; a surviving duplicate would cost a
+    // real dial attempt — a whole slice of `dialWake`'s budget — on an address
+    // already being tried.
+    const out = new Map<string, Multiaddr>();
+    for (const addr of addrs) {
+      const bound = this.bindAddrToPeer(addr, peerId);
+      if (bound) {
+        out.set(bound.toString(), bound);
+      }
+    }
+    return [...out.values()];
+  }
+
+  /**
+   * One address bound to `peerId`, or `null` when it cannot be — logged either
+   * way, never thrown, so every caller's list-shaping stays total.
+   *
+   * Used both to normalize addresses this node DIALS (a `CadrePeer` row, a
+   * seed-supplied bootstrap addr) and to normalize the ones it ANNOUNCES
+   * ({@link getStrandMultiaddrs}); the rule is the same either way — an address
+   * that does not reach `peerId` is not an address for `peerId`.
+   *
+   * `withTrailingPeerId` encapsulates `/p2p/<peerId>`, which throws on a peer id
+   * that does not parse. Unreachable for a `CadrePeer` row (the binding gate
+   * above parsed it already) and for our own node's id, reachable for a
+   * seed-supplied one ({@link bootstrapDialAddrs}).
+   */
+  private bindAddrToPeer(addr: Multiaddr, peerId: string): Multiaddr | null {
+    try {
+      const bound = withTrailingPeerId(addr, peerId);
+      if (!bound) {
+        log('bindAddrToPeer: dropping addr %s — it names a peer other than %s', addr.toString(), peerId);
+      }
+      return bound;
+    } catch (error) {
+      log('bindAddrToPeer: cannot bind %s to %s: %o', addr.toString(), peerId, error);
+      return null;
+    }
   }
 
   /** Parse multiaddr strings, dropping (and logging) any that fail to parse. */
@@ -2107,6 +2811,16 @@ export class CadreNode implements SAppIdLookup {
    * Cold-start fallback: the libp2p peerStore multiaddrs for `peerId` (seeded by
    * {@link SeedBootstrapService.applySeed}). Returns `[]` on a missing entry or any
    * parse/lookup failure — never throws.
+   *
+   * Normalized through {@link normalizeDialAddrs} for the same reason
+   * {@link resolvePeerAddrs} is, and with more cause: the address book hands back
+   * a list that is inherently MIXED. `@libp2p/peer-store`'s
+   * `dedupeFilterAndSortAddresses` strips a trailing `/p2p/<peerId>` only when
+   * that id is the address's FIRST `/p2p/` component, so a direct address
+   * round-trips bare while a relayed one — whose first `/p2p/` names the relay —
+   * keeps its suffix (the same asymmetry `peer-addr-book.ts`'s `addrKey` exists
+   * to absorb). Feeding both to one `dial()` is exactly the
+   * `InvalidParametersError` that skipped the whole peer.
    */
   private async peerStoreAddrs(peerId: string): Promise<Multiaddr[]> {
     if (!this.controlNode) {
@@ -2116,7 +2830,10 @@ export class CadreNode implements SAppIdLookup {
       const peer = await this.controlNode.peerStore.get(peerIdFromString(peerId));
       // Re-parse through the top-level multiaddr parser so the returned type matches
       // resolvePeerAddrs (the peerStore bundles its own @multiformats/multiaddr copy).
-      return this.parseMultiaddrs(peer.addresses.map((a) => a.multiaddr.toString()));
+      return this.normalizeDialAddrs(
+        this.parseMultiaddrs(peer.addresses.map((a) => a.multiaddr.toString())),
+        peerId
+      );
     } catch (error) {
       log('reconcileControlCohort: peerStore lookup for %s failed: %o', peerId, error);
       return [];
@@ -2207,6 +2924,13 @@ export class CadreNode implements SAppIdLookup {
       if (!this._running || !this.controlNode) {
         return;
       }
+      // NOTE: a connection this node still holds in `status: 'open'` after the remote
+      // has already aborted it counts as connected here, so the cold-start retry stays
+      // suppressed for that peer until the connection monitor's next ping notices the
+      // abort — measured at ~9 s in `control-cohort-cold-start-retry.integration.ts`.
+      // Bounded and self-healing today; it would start to matter if the connection
+      // monitor's ping interval were lengthened, or if recovery ever had to meet a
+      // deadline tighter than one ping interval.
       if (connected.has(peerId)) {
         continue;
       }
@@ -2222,32 +2946,15 @@ export class CadreNode implements SAppIdLookup {
    * Bind a bootstrap peer's seed addresses to its peer id, so the dial
    * authenticates the peer it is aiming at rather than trusting whoever answers.
    *
-   * An address that already carries `/p2p/<id>` must carry THIS peer's id or it
-   * is dropped (a seed that disagrees with itself is not a dial target); one
-   * that carries none — an `addressOverrides`-published record, say — gets the
-   * id encapsulated. Unencapsulatable addresses are dropped rather than dialed
-   * bare.
+   * The same {@link normalizeDialAddrs} rule the resolved and address-book paths
+   * use, on the third and last source of control-dial candidates: an address that
+   * already terminates in `/p2p/<id>` must carry THIS peer's id or it is dropped
+   * (a seed that disagrees with itself is not a dial target); one that does not —
+   * a bare listen addr, or a relay hop with the destination missing — gets the id
+   * encapsulated; an unencapsulatable one is dropped rather than dialed bare.
    */
   private bootstrapDialAddrs(peerId: string, addrs: string[]): Multiaddr[] {
-    const out: Multiaddr[] = [];
-    for (const addr of this.parseMultiaddrs(addrs)) {
-      const embedded = trailingPeerId(addr);
-      if (embedded === peerId) {
-        out.push(addr);
-        continue;
-      }
-      if (embedded !== null) {
-        log('reconcileControlCohort(cold-start): addr %s names peer %s, not %s; dropping',
-          addr.toString(), embedded, peerId);
-        continue;
-      }
-      try {
-        out.push(addr.encapsulate(`/p2p/${peerId}`));
-      } catch (error) {
-        log('reconcileControlCohort(cold-start): cannot bind %s to %s: %o', addr.toString(), peerId, error);
-      }
-    }
-    return out;
+    return this.normalizeDialAddrs(this.parseMultiaddrs(addrs), peerId);
   }
 
   /** Dial one cold-start bootstrap peer, best-effort. Returns whether it connected. */
@@ -3013,7 +3720,32 @@ export class CadreNode implements SAppIdLookup {
     }
   }
 
+  /**
+   * Return this node to its pre-{@link start} state. The ONE teardown — `stop()` and
+   * a failed `start()` both come here, so anything a stopped node must not still be
+   * doing belongs in this method and not in `stop()`. `stop()` adds only the
+   * `control:disconnected` emit, which a never-connected start has no edge for.
+   */
   private async cleanup(): Promise<void> {
+    // Open the connection gate's bring-up quiet period unconditionally: teardown
+    // must never be gated, and this is the path a FAILED start() takes.
+    this.controlBringUpInFlight = false;
+
+    // Stop the relay retry loop BEFORE tearing the node down, not after: the control
+    // node is stopped partway through below, and a tick that fires during it would
+    // dial and then poll a half-torn-down node for the whole reserve timeout —
+    // logging spurious dial failures on a `.unref()`'d timer that nothing ever
+    // clears. `driveControlRelayReservation` starts this supervisor from inside
+    // `start()`, so a start that fails ON the reservation leaves one running unless
+    // it is stopped here.
+    this.relayReserveSupervisor?.stop();
+    this.relayReserveSupervisor = null;
+    // Drop the rest of the relay-reservation posture: a torn-down node holds no
+    // reservation, so neither a restarted instance nor a caller inspecting a failed
+    // start reports the previous attempt's `reserved`.
+    this.relayReserveAddrs = [];
+    this.relayReserveError = null;
+
     // Resolve + clear any in-flight wake windows first, so an in-flight check-in
     // or serviceWake unblocks and tears down cleanly rather than firing a stale
     // window timer (or hanging) after the strand manager is stopped below.
@@ -3080,6 +3812,15 @@ export class CadreNode implements SAppIdLookup {
     this.delegateAdmission.clear();
     this.delegateAnnounceAt.clear();
 
+    // Control backfill first — before the database closes and the control node
+    // stops — so no NEW catch-up push is issued against a torn-down transport.
+    // A push already in flight is not awaited; it fails into the module's own
+    // per-chunk catch. (Mirrors releaseRuntime in strand-instance-manager.ts.)
+    if (this.controlBackfill) {
+      this.controlBackfill.stop();
+      this.controlBackfill = null;
+    }
+
     // Close control database (this also shuts down the collection factory).
     // Detach the membership hub first: nothing this teardown does should drive a
     // gate refresh, and a notification arriving after this point is a no-op.
@@ -3096,11 +3837,12 @@ export class CadreNode implements SAppIdLookup {
       this.controlNode = null;
     }
 
-    // Release the control store's cache registration LAST — after the database and
-    // node that write through it are down. Dropping the field is what lets a
-    // stop()/start() cycle re-resolve the provider against a live cache instead of
-    // handing the restarted node a retired wrapper. Logged, never thrown: a
-    // cache-bookkeeping failure must not abort a teardown.
+    // Release the control store's claim on its cache LAST — after the database and
+    // node that write through it are down. The wrapper counts holders, so this empties
+    // and unregisters the cache only if no other scope still holds it. Dropping the
+    // field is what lets a stop()/start() cycle re-resolve the provider against a live
+    // cache instead of handing the restarted node a retired wrapper. Logged, never
+    // thrown: a cache-bookkeeping failure must not abort a teardown.
     if (this.controlStorage) {
       const controlStorage = this.controlStorage;
       this.controlStorage = null;
@@ -3108,6 +3850,13 @@ export class CadreNode implements SAppIdLookup {
         (err) => log('Failed to dispose control storage cache: %o', err)
       );
     }
+
+    // LAST, so every step above still ran against a node that considered itself up
+    // (several of them early-return while `_running` is false). A failed `start()`
+    // that had already flipped it — the reservation drive throws after that point —
+    // must not leave `isRunning` true over a torn-down node, which would report
+    // healthy and make the embedder's retry a no-op ("already running").
+    this._running = false;
   }
 
   // Hibernation callbacks
@@ -3185,8 +3934,8 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Rebuild a quiesced strand's runtime, re-resolving the volatile cohort input
    * first: the discovery seed may have grown since the strand last ran. Shared by
-   * the wake (`handleStrandWake`) and check-in (`handleStrandCheckIn`) paths so
-   * both apply the same fresh seed resolution. `resumeStrand` is idempotent
+   * the wake (`handleStrandWake`) and check-in (`handleStrandCheckIn`) paths so both
+   * apply the same fresh resolution. `resumeStrand` is idempotent
    * (returns the live instance unchanged) as a backstop against double-resume.
    */
   private async resumeStrandRuntime(strandId: string): Promise<void> {
@@ -3197,6 +3946,9 @@ export class CadreNode implements SAppIdLookup {
       ? peerIdFromPrivateKey(await strandTransportKey(this.identityKey, strandId)).toString()
       : undefined;
     const bootstrapNodes = await this.resolveCohortSeed(strandId, delegatePeerId);
+    // NOTE: no `servingMachines` override — see `launchStrand` for why a strand node
+    // declares no repair yardstick, and `StartStrandConfig.servingMachines` for the
+    // count that would legitimately go here once one exists.
     const instance = await this.strandManager.resumeStrand(strandId, { bootstrapNodes });
     // Same reason as the launch path: `bootstrapNodes` only reaches the address
     // book through @libp2p/bootstrap discovery, so merge it directly as well.
@@ -3338,6 +4090,14 @@ export class CadreNode implements SAppIdLookup {
    * Add a strand with its sApp configuration.
    * The hosting application must provide the sApp schema when creating a strand.
    *
+   * This is the ATTACH half only — it starts the local instance and never publishes the
+   * `Strand` row. A joiner (the row arrived over the control network) wants exactly this; a
+   * FOUNDER wants {@link foundStrand}, which publishes and attaches in one resumable call.
+   * With no explicit `founder` flag, founder-ness is derived from the row's
+   * `FounderOwnerKey` (see {@link StrandConfig.founder}) — so attaching a row THIS machine
+   * published (e.g. re-attaching its own orphan after a restart) founds it, and attaching
+   * anyone else's row joins, without the caller needing to know which it is.
+   *
    * A rejected call leaves nothing running but DOES leave the sApp config
    * registered, deliberately: both an explicit retry and the {@link StrandWatcher}'s
    * automatic relaunch need it. So once the strand's row is visible on the control
@@ -3356,10 +4116,12 @@ export class CadreNode implements SAppIdLookup {
     // Store sApp config for this strand
     this.sAppConfigs.set(strandRow.Id, sAppConfig);
     log('Registered sAppConfig for strand %s (sApp: %s, founder: %s)',
-      strandRow.Id, sAppConfig.id, founder ?? false);
+      strandRow.Id, sAppConfig.id, founder ?? 'derived');
 
-    // `founder` only flows from the explicit addStrand path — the control-discovered
-    // join path never founds, so its rows arrive via sync (see handleStrandAdded).
+    // An unset `founder` is DERIVED from the row inside launchStrand (this node founds
+    // iff the row's FounderOwnerKey is its own owner key); an explicit flag wins — the
+    // formation/responder flows pass one deliberately, since their consent-seated rows
+    // carry a null column. See StrandConfig.founder.
     return await this.launchStrand(strandRow, sAppConfig, founder);
   }
 
@@ -3368,16 +4130,41 @@ export class CadreNode implements SAppIdLookup {
    * owner identity, so other cadre members discover it via control-network
    * sync (their {@link StrandWatcher} fires `strand:discovered`).
    *
-   * This is the owner-signed `Strand` INSERT that {@link addStrand}
-   * deliberately omits: `addStrand` only starts the LOCAL strand instance,
-   * whereas publishing makes the strand visible cadre-wide. A typical creator
-   * does both (start locally + publish); a discovering peer only does
-   * `addStrand` (the row already exists).
+   * **Founding a strand is TWO steps** — this one (publish the row cadre-wide) and
+   * {@link addStrand} (start the local instance, `founder: true` to write the strand's
+   * `Header`/founding membership). `addStrand` deliberately omits the insert: it only
+   * starts the LOCAL instance, whereas publishing makes the strand visible cadre-wide. A
+   * discovering peer only does `addStrand` (the row already exists). Callers founding a
+   * strand should use {@link foundStrand}, which performs both steps and is safe to
+   * re-run — hand-rolling the pair is what left strands half-founded when an app was
+   * killed between them.
+   *
+   * **Idempotent for identical content.** A live row whose `(Type, MemberPrivateKey)` match
+   * the arguments is the state this call would have produced, so the call logs and returns
+   * that row instead of writing — a publish interrupted after it committed can be repeated.
+   * DIFFERENT content on the same id throws, naming the columns that differ, rather than
+   * surfacing the raw `UNIQUE constraint failed: Strand.Id`: silently accepting it would
+   * let a retry reopen a closed strand or swap the key gating its reads. The read and the
+   * insert are not atomic, so a concurrent founder (two machines of one party, same id) is
+   * caught on the insert's uniqueness rejection and resolved the same way — re-read, no-op
+   * on a match, rethrow otherwise. Never an overwrite either way.
+   *
+   * A tombstoned strand is NOT resurrected here: {@link unpublishStrand} deletes the row, so
+   * the idempotent branch is unreachable and the ordinary publish path re-seats it, exactly
+   * as that method documents.
+   *
+   * **Already stuck on `UNIQUE constraint failed: Strand.Id`?** The row is already published
+   * — attach, do NOT republish: `addStrand` (or {@link foundStrand}) with the id and, for a
+   * closed strand, the `MemberPrivateKey` read back from the row. `unpublishStrand` + a
+   * fresh publish also clears it for an OPEN strand, but is destructive for a closed one
+   * (the key exists nowhere else). No app-data wipe is needed for either.
    *
    * The insert is signed with the ed25519 key behind this node's PeerId — which
    * {@link ed25519KeyPairFromLibp2p} also exposes as the node's owner keypair,
-   * so peer identity and owner key are one and the same. That key must be
-   * enrolled in `OwnerKey` (e.g. via {@link ControlDatabase.ensureOwnerKey}
+   * so peer identity and owner key are one and the same. That key is also persisted on the
+   * row as `FounderOwnerKey` (the schema pins the column to the verified signer), which is
+   * what later lets any launch derive "this machine is the founder" from the row alone.
+   * The key must be enrolled in `OwnerKey` (e.g. via {@link ControlDatabase.ensureOwnerKey}
    * at genesis) or the schema's `Strand.AuthorizedInsert` constraint rejects the write.
    * Failing loudly here is intentional: a silently-unpublished strand would run
    * as a local-only island that no peer could ever discover or join.
@@ -3386,22 +4173,162 @@ export class CadreNode implements SAppIdLookup {
    *   {@link addStrand}).
    * @param type - `'o'` for open (default) or `'c'` for closed.
    * @param memberPrivateKey - Optional membership key for a closed strand.
-   * @throws if the node is not started, exposes no owner signing key, the id is blank, or
-   *   the control DB rejects the (unauthorized) insert.
-   */
-  async publishStrand(strandId: string, type: 'o' | 'c' = 'o', memberPrivateKey?: string): Promise<void> {
+   * @returns The live `Strand` row — the one just inserted, or the matching one already
+   *   there. A closed strand's caller should carry THIS row's `MemberPrivateKey` forward:
+   *   on a repeat it is the stored key, not the argument.
+   * @throws if the node is not started, exposes no owner signing key, the id is blank, a
+   *   row with the same id holds different content, or the control DB rejects the
+   *   (unauthorized) insert.
+   */
+  async publishStrand(strandId: string, type: 'o' | 'c' = 'o', memberPrivateKey?: string): Promise<StrandRow> {
     const signingKey = this.requireOwnerSigningKey(`publish strand ${strandId}`);
     // Trim/reject here so the id that lands matches the one unpublishStrand looks up: it
     // trims too, and an untrimmed row would be unreachable by the same string.
     const trimmed = requireNonBlank(strandId, 'strand id');
-    await this.controlDatabase!.insertStrand(
-      trimmed,
-      type,
-      signingKey.publicKeyB64,
-      signMessageWith(signingKey.privateKeyB64),
-      memberPrivateKey
-    );
+    // FounderOwnerKey records THIS machine as the row's publisher (the schema pins it to
+    // the signing owner), which is what later lets a relaunch derive founder-ness.
+    const desired: StrandRow = {
+      Id: trimmed,
+      Type: type,
+      MemberPrivateKey: memberPrivateKey ?? null,
+      FounderOwnerKey: signingKey.publicKeyB64,
+    };
+
+    // Read first rather than leaning on the insert's collision for BOTH readings. The
+    // ordinary resume (an app killed after its own publish committed) then needs no error
+    // matching at all: the collision path can only recognise itself by the engine's message
+    // TEXT (see isStrandIdConflict), and an upstream reword there must degrade the RARE race,
+    // not the common resume. It also spends no stamp or signature on a known no-op.
+    const existing = await this.controlDatabase!.queryStrand(trimmed);
+    if (existing) {
+      // NOTE: reads local converged state, and `queryStrand` does not filter rows whose
+      // StampId a Revocation has retired. So on a sibling that still physically holds a row
+      // deleted elsewhere while ALONE (the delete-while-alone gap in docs/architecture.md),
+      // an owner-signed republish now no-ops onto that doomed row instead of re-seating the
+      // id under a fresh stamp. Harmless while that gap is itself unresolved — both
+      // behaviours end at the same unconverged state — but if delete-while-alone ever gains
+      // real replay, filter retired stamps here (queryStrandStampId + the Revocation read)
+      // so a re-seat is not mistaken for a repeat.
+      const matched = requireMatchingStrandRow(existing, desired, 'is already published');
+      log('publishStrand(%s): already published (type %s) with identical content — no-op', trimmed, type);
+      return matched;
+    }
+
+    try {
+      await this.controlDatabase!.insertStrand(
+        trimmed,
+        type,
+        signingKey.publicKeyB64,
+        signMessageWith(signingKey.privateKeyB64),
+        memberPrivateKey
+      );
+    } catch (error) {
+      // Only the uniqueness collision is a candidate for the idempotent reading; every
+      // other rejection (unauthorized signer, retired stamp) must keep surfacing.
+      if (!isStrandIdConflict(error)) {
+        throw error;
+      }
+      const landed = await this.controlDatabase!.queryStrand(trimmed);
+      if (!landed) {
+        // Collided, yet no row is readable: not the race this branch handles (a row
+        // deleted between the rejection and the re-read, or a stale local view). Surface
+        // the original rather than guessing.
+        throw error;
+      }
+      log('publishStrand(%s): lost a concurrent founding race; re-read the landed row', trimmed);
+      return requireMatchingStrandRow(landed, desired, 'landed concurrently from another founder');
+    }
     log('Published strand %s (type %s) to control DB under owner %s', trimmed, type, signingKey.publicKeyB64);
+    return desired;
+  }
+
+  /**
+   * Found a strand — publish its row cadre-wide AND start the local instance as its
+   * founder — in one resumable call. The single entry point for creating a strand; a
+   * caller joining one someone else founded uses {@link addStrand} alone.
+   *
+   * Safe to re-run from any point of interruption, which hand-rolling
+   * {@link publishStrand} + {@link addStrand} is not. Either half can already have
+   * happened:
+   *
+   * - **row already published** → the stored row is adopted rather than re-published, so a
+   *   run killed after the insert committed no longer dies on
+   *   `UNIQUE constraint failed: Strand.Id`. For a closed strand the row's STORED
+   *   `MemberPrivateKey` wins over `config.memberPrivateKey`: a caller that mints a key per
+   *   attempt (as the reference apps do) would otherwise present a key that does not match
+   *   the membership already seated in the strand.
+   * - **instance already running** → the tracked instance is returned, and — because the
+   *   `Strand` row records its publishing machine (`FounderOwnerKey`) — a founder request
+   *   against an instance that was first launched as a joiner now runs the (idempotent,
+   *   insert-if-absent) founder bootstrap on it rather than silently skipping it
+   *   ({@link StrandInstanceManager.foundExistingStrand}). So a strand that something else
+   *   attached first — the reference RN app's `strand:discovered` handler after a restart,
+   *   or this node's own {@link StrandWatcher} poll winning `launchStrand`'s
+   *   `resolveCohortSeed` window — still ends up with its `Strand.Header` written.
+   *
+   * Founder-ness is resolved FROM THE ROW, not assumed: this machine founds iff the
+   * resolved row's `FounderOwnerKey` is its own owner key. A fresh publish records this
+   * machine, so the common path founds; a machine that lost a concurrent founding race to
+   * a sibling adopts the sibling's row and ATTACHES instead — deliberately, since two
+   * machines bootstrapping the same strand on separate replicas is the double-`Header`
+   * hazard. The returned {@link FoundStrandResult.founded} says which happened.
+   *
+   * `Type` is compared, not adopted: a stored row of the other type means the caller and
+   * the control plane disagree about what this strand IS, so it throws.
+   *
+   * @returns The instance AND the row the strand actually runs under — read the membership
+   *   key from the returned row, not from a freshly minted one ({@link FoundStrandResult}).
+   * @throws if the node is not started, the id is blank, a published row of the same id has
+   *   a different `Type`, or either half rejects.
+   */
+  async foundStrand(config: FoundStrandConfig): Promise<FoundStrandResult> {
+    const { strandId, type = 'o', memberPrivateKey, sAppConfig } = config;
+    if (!this._running || !this.controlDatabase) {
+      throw new Error(`CadreNode must be started before attempting to found strand ${strandId}`);
+    }
+    const trimmed = requireNonBlank(strandId, 'strand id');
+    const published = await this.controlDatabase.queryStrand(trimmed);
+    const strandRow = published
+      ? this.adoptPublishedStrand(published, type, memberPrivateKey)
+      : await this.publishStrand(trimmed, type, memberPrivateKey);
+    // Derived, not hardcoded `true`: adopting a row another machine published means that
+    // machine runs the bootstrap — this one must attach or it would write a second Header.
+    const founded = this.isSelfFoundedRow(strandRow);
+    if (!founded) {
+      log('foundStrand(%s): the stored row was published by a different machine ' +
+        '(FounderOwnerKey is not this node\'s owner key) — attaching as a joiner; ' +
+        'the founder bootstrap runs on the publishing machine', trimmed);
+    }
+    const instance = await this.addStrand({ strandRow, sAppConfig, founder: founded });
+    return { instance, strandRow, founded };
+  }
+
+  /**
+   * Resume onto an already-published `Strand` row: keep its stored content, reject a type
+   * disagreement. The stored `MemberPrivateKey` is authoritative — see {@link foundStrand}
+   * for why a caller-minted key must lose here (and why that is NOT the same rule as
+   * {@link publishStrand}'s, which throws on a key mismatch because it is being asked to
+   * WRITE that key, not to resume onto what already exists).
+   */
+  private adoptPublishedStrand(
+    published: StrandRow,
+    type: 'o' | 'c',
+    memberPrivateKey?: string
+  ): StrandRow {
+    if (published.Type !== type) {
+      throw new Error(
+        `Cannot found strand ${published.Id} as type '${type}': it is already published as ` +
+        `type '${published.Type}'. Reconcile deliberately rather than re-founding — a ` +
+        'published open strand cannot be closed, nor a closed one opened, by re-publishing.'
+      );
+    }
+    if (memberPrivateKey !== undefined && memberPrivateKey !== published.MemberPrivateKey) {
+      log('foundStrand(%s): already published — resuming on the STORED MemberPrivateKey; ' +
+        'the supplied key is discarded (read it back from the returned instance)', published.Id);
+    } else {
+      log('foundStrand(%s): already published (type %s) — adopting the stored row', published.Id, type);
+    }
+    return published;
   }
 
   /**
@@ -3640,23 +4567,53 @@ export class CadreNode implements SAppIdLookup {
    * seed, starts the strand, and registers it with the hibernation manager
    * before emitting `strand:started`.
    *
-   * Idempotent no-op when the strand manager already tracks `strand.Id` — the
-   * ordinary founding sequence is `addStrand` (starts it locally) followed by
-   * `publishStrand` (makes it visible), so this node's own `StrandWatcher`
-   * rediscovers a row it already started and calls this again via
-   * `handleStrandAdded`. Without the guard that re-entry would resolve a fresh
+   * Founder-ness: an explicit `founder` argument wins (the formation/responder flows pass
+   * one deliberately — their consent-seated rows carry a null `FounderOwnerKey`); when
+   * unset it is DERIVED from the row, so the control-discovered path
+   * (`handleStrandAdded`) and a restart's re-attach found this machine's own strands
+   * without the caller having to know. The derivation is pure key comparison — no I/O.
+   *
+   * Idempotent when the strand manager already tracks `strand.Id` — the watcher
+   * rediscovers a row this node already started and calls this again via
+   * `handleStrandAdded`; without the guard that re-entry would resolve a fresh
    * (already-connected) cohort seed and re-emit `strand:started` for an
    * instance that never stopped. The guard runs before the cohort-seed RPC
-   * fan-out, so a rediscovery costs nothing beyond the map lookup.
+   * fan-out, so a rediscovery costs nothing beyond the map lookup plus the (pure)
+   * founder derivation. NOT a silent no-op any more when the launch resolves as a
+   * FOUNDER: the tracked instance may have been launched first as a joiner (an app
+   * attach, or this node's own watcher poll winning the `resolveCohortSeed` window
+   * below), which used to drop the founder request and leave the strand headerless —
+   * now the tracked instance is founded in place
+   * ({@link StrandInstanceManager.foundExistingStrand}), waking it first if quiesced
+   * so the bootstrap actually runs before this resolves.
    */
   private async launchStrand(
     strand: StrandRow,
     sAppConfig: SAppConfig,
     founder?: boolean
   ): Promise<StrandInstance> {
+    const resolvedFounder = founder ?? this.isSelfFoundedRow(strand);
     const existing = this.strandManager.getInstance(strand.Id);
     if (existing) {
-      log('launchStrand: strand %s already tracked locally — skipping re-launch', strand.Id);
+      if (resolvedFounder) {
+        const outcome = await this.strandManager.foundExistingStrand(strand.Id);
+        if (outcome === 'needs-resume') {
+          // Quiesced instance: the retained config now founds, but founding promises
+          // the bootstrap has RUN by the time the caller resolves — wake through the
+          // hibernation manager (coalesced with any in-flight wake, timer-aware) so
+          // the rebuild executes it now rather than at some eventual wake.
+          await this.wakeStrand(strand.Id);
+          // The wake's rebuild founds — UNLESS a wake was already in flight when the
+          // config flipped, in which case it had already read the pre-flip config and
+          // rebuilt as a joiner, and `wakeStrand` merely coalesced onto it. Re-run the
+          // (insert-if-absent) bootstrap so founding never resolves headerless.
+          await this.strandManager.ensureFounderBootstrap(strand.Id);
+        }
+        log('launchStrand: strand %s already tracked — founder request honored (%s)',
+          strand.Id, outcome);
+      } else {
+        log('launchStrand: strand %s already tracked locally — skipping re-launch', strand.Id);
+      }
       return existing;
     }
 
@@ -3697,8 +4654,18 @@ export class CadreNode implements SAppIdLookup {
       bootstrapNodes,
       requireSignedSchemas: this.config.requireSignedSchemas,
       clusterSize: this.config.strandClusterSize,
+      // NOTE: deliberately NO `servingMachines`, so the strand node declares no repair
+      // yardstick and runs the frozen STRAND_CLUSTER_POLICY. The only count this node holds
+      // is the party's enrolled machines (`authorizedControlPeers`), and passing that here
+      // is the regression `bug-strand-yardstick-counts-party-machines` removed — a strand
+      // runs on a subset of the party, and over-declaring makes repair impossible rather
+      // than merely weak. The full argument, and the count that will legitimately go here,
+      // are on `StartStrandConfig.servingMachines`.
       backfill: this.config.strandBackfill,
-      founder
+      revocationEnforcement: this.config.strandRevocationEnforcement,
+      onSelfRevoked: (revokedStrandId) => this.emit('strand:revoked', { strandId: revokedStrandId }),
+      // The RESOLVED flag, never the raw argument — see the doc comment above.
+      founder: resolvedFounder
     });
 
     // The seed reached the node as `bootstrapNodes`, which only enters the
@@ -3741,6 +4708,21 @@ export class CadreNode implements SAppIdLookup {
    * for a relay we are not yet connected to.
    */
   private async resolveCohortSeed(strandId: string, delegatePeerId?: string): Promise<string[]> {
+    const siblings = await this.resolveSiblingSeed(strandId, delegatePeerId);
+    // Sibling answers FIRST: they were resolved just now, while a contact-map entry is as
+    // old as the formation that produced it. `unionAddrs` appends only what the siblings
+    // did not already name, so a fresher answer is never displaced and each source keeps
+    // its own signaling-first ordering.
+    return unionAddrs(siblings, this.crossPartyStrandAddrs.get(strandId) ?? []);
+  }
+
+  /**
+   * The own-party half of {@link resolveCohortSeed}: strand-network addresses resolved
+   * from CONNECTED cohort siblings over the control-mesh strand-addr RPC, doubling as
+   * the delegate announcement when `delegatePeerId` is given. Empty when the control DB
+   * or node is absent (not yet started / torn down).
+   */
+  private async resolveSiblingSeed(strandId: string, delegatePeerId?: string): Promise<string[]> {
     if (!this.controlDatabase || !this.controlNode) {
       return [];
     }
@@ -3804,11 +4786,25 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * The circuit relays this node's strand nodes would reserve through: the
-   * union of the RESOLVED listen addrs' circuits — a hand-written
-   * `network.listenAddrs` circuit entry or a `network.relayAddrs` entry, which
-   * the strand node inherits verbatim either way — and the control node's own
-   * live `/p2p-circuit` multiaddrs (a reservation this node discovered rather
-   * than configured).
+   * union of CONFIGURED relays — `network.relayAddrs`, plus any hand-written
+   * `network.listenAddrs` circuit entry, both of which a strand node inherits
+   * verbatim — and the control node's own live `/p2p-circuit` multiaddrs (a
+   * reservation this node discovered rather than configured).
+   *
+   * The CONFIGURED half reads `network.relayAddrs` and `network.listenAddrs`
+   * directly rather than going through {@link resolveListenAddrs}: the control
+   * node's resolution takes the `'search'` route, whose bare `/p2p-circuit` entry
+   * names no relay, so a configured relay would be unannounceable here until this
+   * node's own reservation landed — and the announce must be in place BEFORE a
+   * strand node dials its reservation, since the relay's membership gate does not
+   * know the strand's derived peerId (see delegate-admission.ts). Configuration is
+   * authoritative; the live multiaddrs only ADD relays nobody configured.
+   *
+   * The `listenAddrs` half is now unreachable on a control node — `relay-addrs.ts`
+   * rejects a hand-written `<relay>/p2p-circuit` listen entry outright, because the
+   * bring-up quiet period denies the dial that listener makes from inside
+   * `libp2p.start()`. Kept because it costs one spread and this is the one place
+   * that would silently stop announcing if that rejection is ever relaxed.
    *
    * NOTE: a relay the STRAND node discovers on its own (autorelay — in neither
    * source) gets no announcement, and a membership-gated one will deny it; fine
@@ -3816,7 +4812,8 @@ export class CadreNode implements SAppIdLookup {
    */
   private circuitRelayTargets(): CircuitRelayTarget[] {
     return extractCircuitRelayTargets([
-      ...(resolveListenAddrs(this.config.network) ?? []),
+      ...relayCircuitAddrs(this.config.network?.relayAddrs ?? []),
+      ...(this.config.network?.listenAddrs ?? []),
       ...(this.controlNode?.getMultiaddrs().map(String) ?? [])
     ]);
   }
@@ -3947,36 +4944,42 @@ export class CadreNode implements SAppIdLookup {
     if (due.length === 0) {
       return;
     }
-    // A due strand with nobody to ask leaves its throttle unstamped (see below),
-    // so this pass re-enters on EVERY 15 s reconcile tick for as long as the node
-    // is alone — which is the steady state of a solo node running a strand.
     // `connectedSiblingTargets`' membership read is unbounded, and with zero
-    // connections its answer is empty whatever the table holds, so decide it here
-    // from the connection list instead of paying for the read once a tick.
-    if (this.controlNode.getConnections().length === 0) {
-      return;
-    }
+    // connections its answer is empty whatever the table holds, so decide it from the
+    // connection list instead of paying for the read once a tick. Note this only skips
+    // the RPC: a strand carrying cross-party contact addresses still refreshes below,
+    // because those never came from a sibling in the first place.
+    //
     // NOTE: one strand-addr RPC per (due strand × connected sibling) per refresh
     // interval — each a tiny request/response on an already-open control
     // connection. If a node ever runs MANY strands at once, batch the RPC to
     // carry several strand ids per request rather than one fan-out per strand.
-    const targets = await this.connectedSiblingTargets().catch((error): StrandAddrPeer[] => {
-      log('refreshStrandPeerAddrs: sibling enumeration failed (skipping pass): %o', error);
-      return [];
-    });
-    // No sibling to ask (or a shutdown landed mid-enumeration): leave every stamp
-    // untouched so the next reconcile tick retries, rather than sitting out the
-    // whole refresh interval having asked nobody.
-    if (targets.length === 0 || !this._running || !this.controlNode) {
+    const targets = this.controlNode.getConnections().length === 0
+      ? []
+      : await this.connectedSiblingTargets().catch((error): StrandAddrPeer[] => {
+        log('refreshStrandPeerAddrs: sibling enumeration failed (skipping pass): %o', error);
+        return [];
+      });
+    // A shutdown landed mid-enumeration.
+    if (!this._running || !this.controlNode) {
       return;
     }
     await Promise.all(due.map((strandId) => this.refreshOneStrandPeerAddrs(strandId, targets, now)));
   }
 
   /**
-   * One strand's share of {@link refreshStrandPeerAddrs}: RPC the siblings, then
-   * merge their answers into this strand's address book. Errors are logged and
-   * swallowed so one strand's failure never costs the others their refresh.
+   * One strand's share of {@link refreshStrandPeerAddrs}: RPC the siblings, union their
+   * answers with this strand's cross-party contact addresses, and merge the lot into the
+   * strand's address book. Errors are logged and swallowed so one strand's failure never
+   * costs the others their refresh.
+   *
+   * `targets` may be EMPTY — a solo node, or one whose only control peers are strangers.
+   * The cross-party addresses still have to be re-merged in that case: they were learned
+   * at formation and can never be re-resolved, so this periodic re-merge is the ONLY
+   * thing standing between them and the peerStore's one-hour expiry. A strand with
+   * neither a sibling to ask nor a contact entry does nothing and leaves its throttle
+   * unstamped, so the next reconcile tick retries rather than sitting out the whole
+   * refresh interval having done nothing.
    */
   private async refreshOneStrandPeerAddrs(
     strandId: string,
@@ -3988,13 +4991,19 @@ export class CadreNode implements SAppIdLookup {
     if (!controlNode || !strandNode) {
       return;
     }
+    const contactAddrs = this.crossPartyStrandAddrs.get(strandId) ?? [];
+    if (targets.length === 0 && contactAddrs.length === 0) {
+      return;
+    }
     try {
       // The running strand node's own peerId is the delegate to announce — see
       // the relationship note on refreshStrandPeerAddrs.
-      const addrs = await collectStrandAddrs(controlNode, [...targets], strandId, {
-        delegatePeerId: strandNode.peerId.toString()
-      });
-      // Stamped on the RPC having happened, not on its answer: the fan-out is
+      const siblingAddrs = targets.length === 0
+        ? []
+        : await collectStrandAddrs(controlNode, [...targets], strandId, {
+          delegatePeerId: strandNode.peerId.toString()
+        });
+      // Stamped on the pass having happened, not on its answer: the fan-out is
       // what the throttle exists to bound, and an all-empty round is a normal
       // steady state for a strand no connected sibling currently runs.
       this.strandPeerAddrRefreshAt.set(strandId, now);
@@ -4003,7 +5012,7 @@ export class CadreNode implements SAppIdLookup {
       if (!this._running || this.strandManager.getInstance(strandId)?.libp2pNode !== strandNode) {
         return;
       }
-      await this.mergeStrandPeerAddrs(strandNode, addrs, strandId);
+      await this.mergeStrandPeerAddrs(strandNode, unionAddrs(siblingAddrs, contactAddrs), strandId);
     } catch (error) {
       log('refreshStrandPeerAddrs: strand %s refresh failed (continuing): %o', strandId, error);
     }
@@ -4027,6 +5036,15 @@ export class CadreNode implements SAppIdLookup {
    * handshake, and a bad entry costs one failed dial that ages out at the
    * peerStore's one-hour expiry. No new gating here — cross-party strand trust is
    * `backlog/strand-network-nat-relay-reachability`.
+   *
+   * NOTE: one input does NOT age out — the cross-party addresses a formation
+   * carried back ({@link crossPartyStrandAddrs}). Nothing can re-resolve them, so
+   * {@link refreshStrandPeerAddrs} re-merges the same stored list every pass, which
+   * also means a junk entry from a responder survives for the node's lifetime rather
+   * than an hour. Bounded to {@link MAX_STRAND_ADDRS} per strand, from a party this
+   * node deliberately formed a strand with, and still authority-free — so the
+   * exposure is a handful of failed dials, not a trust hole. Evict on
+   * `unpublishStrand` if that ever stops being an acceptable price.
    */
   private async mergeStrandPeerAddrs(strandNode: Libp2p, addrs: string[], strandId: string): Promise<void> {
     const counts: Record<MergeAddrsResult, number> = { merged: 0, restamped: 0, skipped: 0, failed: 0 };
@@ -4070,7 +5088,29 @@ export class CadreNode implements SAppIdLookup {
     if (!node) {
       return [];
     }
-    return orderSignalingFirst(node.getMultiaddrs().map((ma) => ma.toString()));
+    // Every entry is bound to THIS strand node's id, because both consumers — the
+    // strand-addr RPC answer and the formation result's `strandAddrs` — are attributed
+    // per peer on arrival (`groupAddrsByPeerId`) and an entry naming no destination is
+    // dropped there. libp2p already appends the id to its announced addresses, so this
+    // is normally a no-op; it is the guard for a bare listen addr and for a relay hop
+    // whose trailing `/p2p/` names the RELAY. An addr terminating in a DIFFERENT id is
+    // dropped rather than announced — it does not reach this node, and announcing it
+    // would file our address under someone else's id in the receiver's book.
+    //
+    // Re-parsed through this package's own `multiaddr` rather than passed straight in:
+    // libp2p hands back its nested `@multiformats/multiaddr` copy, a structurally
+    // different type from the one `withTrailingPeerId` takes (see
+    // `backlog/reference-app-web-libp2p-interface-dedup`). Re-parsing a string libp2p
+    // itself produced cannot fail.
+    const selfId = node.peerId.toString();
+    const addrs: string[] = [];
+    for (const ma of node.getMultiaddrs()) {
+      const bound = this.bindAddrToPeer(multiaddr(ma.toString()), selfId);
+      if (bound !== null) {
+        addrs.push(bound.toString());
+      }
+    }
+    return orderSignalingFirst(addrs);
   }
 
   /**
@@ -4300,16 +5340,61 @@ export class CadreNode implements SAppIdLookup {
     return this.controlNode;
   }
 
+  /**
+   * The boot-path half of {@link reserveRelays}: reserve through every
+   * `network.relayAddrs` entry, or fail `start()`.
+   *
+   * WHY IT RUNS HERE, AT THE END. `network.relayAddrs` used to resolve to a
+   * CONFIGURED circuit listener, which libp2p dials from inside `libp2p.start()`
+   * — so the relay was already a connected peer, and therefore already in this
+   * node's Optimystic cohort, before `ControlDatabase.initialize()` ran. Building
+   * that database is a long chain of cohort-consulting block probes (catalog
+   * hydration, then one per table, then the indexes), and a sibling that has not
+   * yet replicated this node's `CadrePeer` row correctly refuses every one of
+   * them, so bring-up died on `BlockUnavailableError` — deterministically, on
+   * every boot of a relay-only node. Retrying could not converge either: the
+   * condition that clears the refusal is this node's own row reaching the
+   * sibling, and writing that row needs the database the retry is building.
+   *
+   * So the invariant is ordering, not retrying: the control database is built
+   * while this node holds ZERO control connections (a cohort of one, entirely
+   * local), and only then does it reach out. Everything above in {@link start}
+   * has completed by the time this runs.
+   *
+   * BUDGET: the supervisor's first attempt — `relay-reservation.ts`'s
+   * `DEFAULT_RELAY_RESERVE_TIMEOUT_MS`, 10 s — is what `start()` waits on — deliberately the module default rather
+   * than a boot-specific one. A healthy dial-plus-reserve is sub-second even over
+   * a WAN, so 10 s is slack for a slow link; going much longer would make a dead
+   * relay indistinguishable from a hung start, and much shorter would fail nodes
+   * on links that were merely slow. The retries carry on in the background after
+   * this resolves, exactly as they do for a {@link reserveRelays} caller.
+   */
+  private async driveControlRelayReservation(): Promise<void> {
+    const relayAddrs = this.config.network?.relayAddrs ?? [];
+    if (relayAddrs.length === 0) {
+      return;
+    }
+    const t0 = performance.now();
+    const state = await this.reserveRelays([...relayAddrs]);
+    timing('[start] reserveRelays: %dms', Math.round(performance.now() - t0));
+    if (state.status !== 'reserved') {
+      throw new RelayReservationFailedError(relayAddrs, state);
+    }
+    log('Reserved a relay slot: %o', state.circuitAddrs);
+  }
+
   /**
    * Start keeping a relay reservation: dial the given relay(s) from the control
    * node, ask the first one that answers for a reservation slot, wait until the
    * resulting `/p2p-circuit` address makes this node dialable — and keep a
    * supervisor running that re-drives whenever the reservation is later lost.
    *
-   * For nodes that listen on the bare `/p2p-circuit` SEARCH addr (a browser tab)
-   * rather than a configured `network.relayAddrs` circuit listener — see
-   * `relay-reservation.ts` for why the two are alternatives and why configuring
-   * both is a regression. Opt-in: nothing calls this for the CLI/host nodes.
+   * The FAIL-SOFT entry point, for a caller that discovers its relay at runtime
+   * (a browser tab, a host UI). A node that names `network.relayAddrs` gets the
+   * same drive from {@link driveControlRelayReservation} at the end of
+   * {@link start}, which is fail-fast instead. Both fill the pending reservation
+   * the bare `/p2p-circuit` search listener registered; calling this afterwards
+   * simply replaces the supervisor with one over the new list.
    *
    * Resolves once the FIRST attempt has settled, exactly as it did when it drove
    * once; the retries continue in the background until {@link stop} or the next
@@ -4463,6 +5548,10 @@ export class CadreNode implements SAppIdLookup {
    * Push the multiaddrs that future invites should advertise. Pass `null` to
    * revert to the libp2p-reported addresses (the default). The host calls this
    * at spawn and on every NAT change.
+   *
+   * Entries need NOT carry a `/p2p/<peerId>` suffix — {@link resolveInviteAddresses}
+   * appends this node's own before anything publishes or dials them (see
+   * {@link normalizeSelfAddrs}). Passing them suffixed is equally fine.
    */
   setInviteAddresses(addresses: string[] | null): void {
     this.latestInviteAddresses = addresses;
@@ -4471,18 +5560,60 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Resolve the addresses to embed in invites. Prefers pushed addresses, then
-   * any config-supplied resolver, then the libp2p-observed multiaddrs.
+   * any config-supplied resolver, then the libp2p-observed multiaddrs. The two
+   * app-supplied sources are normalized onto `/p2p/<self>` (see
+   * {@link normalizeSelfAddrs}) so neither hook has to remember the suffix;
+   * libp2p's own addresses already carry it.
    */
   private async resolveInviteAddresses(): Promise<string[]> {
     if (this.latestInviteAddresses !== null) {
-      return this.latestInviteAddresses;
+      return this.normalizeSelfAddrs(this.latestInviteAddresses);
     }
     if (this.config.network?.inviteAddressResolver) {
-      return this.config.network.inviteAddressResolver();
+      return this.normalizeSelfAddrs(await this.config.network.inviteAddressResolver());
     }
+    // Not normalized: this branch is libp2p's own output, which already
+    // encapsulates the peer id into every address it reports. Only the two app
+    // hooks above take arbitrary strings and therefore need the guarantee.
     return this.getMultiaddrs();
   }
 
+  /**
+   * Normalize addresses an app handed us for THIS node onto `/p2p/<self>`, the
+   * same invariant {@link normalizeDialAddrs} enforces on the way out.
+   *
+   * `setInviteAddresses` (the admin API `PUT /admin/invite-addresses`) and
+   * `network.inviteAddressResolver` both take arbitrary strings, and whatever
+   * they return ends up in this node's published `CadrePeer` record — so ONE
+   * unsuffixed entry from either hook is enough to give every sibling in the
+   * party a mixed candidate list for this peer. Establishing the suffix here,
+   * where those strings enter the system, means neither hook has to know the
+   * rule; `cadre-host`'s `buildInviteAddresses` already appends it, and
+   * re-normalizing an already-suffixed address is a no-op.
+   *
+   * Unparsable and other-peer-addressed entries are passed through untouched
+   * rather than dropped: publication is not the place to police an address's
+   * validity, and {@link resolvePeerAddrs} already drops both on the read side.
+   * Before `start()` resolves an identity there is no peer id to append, so the
+   * list is returned as given.
+   */
+  private normalizeSelfAddrs(addrs: string[]): string[] {
+    const selfPeerId = this.peerId?.toString();
+    if (!selfPeerId) {
+      return addrs;
+    }
+    return addrs.map((addr) => {
+      let parsed: Multiaddr;
+      try {
+        parsed = multiaddr(addr);
+      } catch (error) {
+        log('normalizeSelfAddrs: leaving unparsable multiaddr %s as-is: %o', addr, error);
+        return addr;
+      }
+      return withTrailingPeerId(parsed, selfPeerId)?.toString() ?? addr;
+    });
+  }
+
   /**
    * Enumerate the cadre's `CadrePeer` membership — the ADDRESSABLE surface (see
    * {@link isMember}). Rows whose stamp is retired in `CadreControl.Revocation`
@@ -4546,13 +5677,18 @@ export class CadreNode implements SAppIdLookup {
    * legit member goes un-authorized on readers that only pin the new key. Full
    * rotation handling (re-vouch on rotate) is the
    * `flip-strand-membership-rotation-known-gap` work, not this predicate's.
+   *
+   * @param retry - Whether the underlying membership read may retry a transient cluster
+   *   failure. Only {@link refreshAuthorizedControlPeers} passes `false`, because it runs
+   *   as the control database's membership listener with that database's write lock held;
+   *   see its comment.
    */
-  async listAuthorizedMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
+  async listAuthorizedMembers(retry = true): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
     if (!this.controlDatabase) {
       throw new Error('CadreNode must be started before listing members');
     }
     const selfPeerId = this.peerId?.toString();
-    const rows = await this.controlDatabase.queryCadrePeers();
+    const rows = await this.controlDatabase.queryCadrePeers(retry);
     const authorized = rows
       .filter(row => row.peerId !== selfPeerId && this.hasAnchoredVoucher(row))
       .map(({ peerId, multiaddr }) => ({ peerId, multiaddr }));
@@ -4728,6 +5864,26 @@ export class CadreNode implements SAppIdLookup {
     }
   }
 
+  /**
+   * Re-materialize a CLOSED strand's revoked-peer deny set now, and hang up any
+   * connected peer it newly covers — the strand-side counterpart to
+   * {@link refreshMembershipGate}.
+   *
+   * Unlike that one, NOTHING calls this automatically: strand membership is
+   * written through the strand's own `Database` handle
+   * (`strand-membership-writer.ts`), which raises no notification this runtime
+   * can hook, and a revocation that arrives by REPLICATION raises none either.
+   * The gate therefore polls (default 30 s). An app that has just called
+   * `revokeMember` or `leaveStrand` should follow the write with this call so
+   * the cut is immediate rather than up to one poll interval late.
+   *
+   * Quiet no-op for a strand that is not running, is quiesced, is open, or has
+   * the gate disabled. Never rejects; resolves once the sweep has finished.
+   */
+  async refreshRevocationEnforcement(strandId: string): Promise<void> {
+    await this.strandManager.refreshRevocationEnforcement(strandId);
+  }
+
   /**
    * The single in-flight refresh loop behind {@link refreshMembershipGate}: read
    * until the stale flag stays clear, then release the slot.
@@ -5062,7 +6218,11 @@ export class CadreNode implements SAppIdLookup {
     this.strandSolicitationService = new StrandSolicitationService({
       ...options,
       partyId: this.config.controlNetwork.partyId,
-      cadrePeerAddrs: this.getMultiaddrs()
+      cadrePeerAddrs: this.getMultiaddrs(),
+      // Overrides any caller-supplied hook, exactly like partyId/cadrePeerAddrs: only
+      // this node can say which strand-network addresses it is actually listening on,
+      // and a wrong answer here seeds a joiner's mesh with addresses that reach nobody.
+      resolveStrandAddrs: (strandId: string) => this.getStrandMultiaddrs(strandId)
     });
 
     // Register as responder on the control node
@@ -5124,11 +6284,46 @@ export class CadreNode implements SAppIdLookup {
       this.initializeStrandSolicitation();
     }
 
-    return await this.strandSolicitationService!.formStrand(
+    const result = await this.strandSolicitationService!.formStrand(
       invitation,
       disclosure,
       this.controlNode
     );
+    this.recordCrossPartyStrandAddrs(result.strandId, result.strandAddrs);
+    return result;
+  }
+
+  /**
+   * Remember the responder's strand-network addresses for a strand this node just
+   * formed, so the strand's discovery seed has something to work with when the app
+   * launches it (see {@link crossPartyStrandAddrs}).
+   *
+   * Scoped strictly to `strandId`: these addresses reach ONE strand node of ONE other
+   * party and must never seed another strand's mesh or the control peerStore. An empty
+   * list is recorded as no entry at all rather than an empty one, so a later formation
+   * against the same strand that DOES disclose addresses is not shadowed.
+   */
+  private recordCrossPartyStrandAddrs(strandId: string, strandAddrs: readonly string[]): void {
+    if (strandAddrs.length === 0) {
+      log('formStrand: responder disclosed no strand addrs for %s — cross-party seed stays empty', strandId);
+      return;
+    }
+    // Capped at the same `MAX_STRAND_ADDRS` one arriving list is, because this
+    // ACCUMULATES: re-forming against the same strand (the documented recovery for a
+    // responder whose relay reservation rotated) unions a fresh list onto the old one,
+    // and nothing here can tell a dead entry from a live one. Without the cap, the seed
+    // — and the peerStore rows every refresh pass re-merges from it — would grow by up
+    // to 16 entries per redemption for the node's lifetime. Oldest entries fall off the
+    // end, which is the right end to lose: `unionAddrs` keeps the freshest list first.
+    const merged = unionAddrs(strandAddrs, this.crossPartyStrandAddrs.get(strandId) ?? [])
+      .slice(0, MAX_STRAND_ADDRS);
+    this.crossPartyStrandAddrs.set(strandId, merged);
+    // A strand already running when this lands (a re-formation) would otherwise wait out
+    // the rest of its ~10-minute refresh throttle before the new addresses reached its
+    // address book. Clearing the stamp makes the next 15 s reconcile tick merge them,
+    // which matters precisely because re-forming is the recovery path for a dead entry.
+    this.strandPeerAddrRefreshAt.delete(strandId);
+    log('formStrand: recorded %d cross-party strand addr(s) for %s', merged.length, strandId);
   }
 
   /**