@serfab/cadre-core 0.12.0 → 0.13.0

package/dist/cadre-node.js

@@ -4,7 +4,7 @@ import { peerIdFromString, peerIdFromPrivateKey } from '@libp2p/peer-id';
 import { createLibp2pNode } from '@optimystic/db-p2p';
 import { wrapStorageWithCache, disposeStorageCache } from '@serfab/quereus-plugin-sereus';
 import { multiaddr } from '@multiformats/multiaddr';
-import { CONTROL_CLUSTER_POLICY, CONTROL_REPLICATION_BREADTH, DEFAULT_CHECKIN_WINDOW_MS } from './types.js';
+import { controlClusterPolicy, CONTROL_REPLICATION_BREADTH, DEFAULT_CHECKIN_WINDOW_MS } from './types.js';
 import { sign } from '@optimystic/quereus-plugin-crypto';
 import { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, requireEd25519PublicKeyB64 } from './ed25519-key.js';
 import { strandTransportKey } from './strand-transport-key.js';
@@ -12,6 +12,7 @@ import { DEFAULT_IDENTITY_KEY_ID } from './key-store.js';
 import { loadOrCreateIdentityKey } from './identity-key.js';
 import { MemoryTrustedOwnerStore } from './trusted-owner-store.js';
 import { MemoryBootstrapPeerStore } from './bootstrap-peer-store.js';
+import { MemoryEnrolledMachineStore } from './enrolled-machine-store.js';
 import { mergePeerAddrs, groupAddrsByPeerId } from './peer-addr-book.js';
 import { verifyCadrePeerVoucher } from './peer-authorization.js';
 import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
@@ -19,19 +20,21 @@ import { signPeerRecord, verifyPeerRecordSignature, isPeerRecordFresh, orderSign
 import { signDeviceTokenRecord, verifyDeviceTokenSignature, isPushPlatform } from './device-token.js';
 import { StrandWatcher } from './strand-watcher.js';
 import { StrandInstanceManager } from './strand-instance-manager.js';
+import { PeerJoinBackfill } from './peer-join-backfill.js';
 import { deriveCohortMembers } from './strand-cohort.js';
 import { selectControlCohortDials, DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE } from './control-cohort.js';
 import { withDeadline } from './control-stream.js';
 import { EnrollmentService } from './enrollment.js';
 import { HibernationManager } from './hibernation-manager.js';
-import { ControlDatabase } from './control-database.js';
+import { ControlDatabase, isStrandIdConflict } from './control-database.js';
 import { SeedBootstrapService } from './seed-bootstrap.js';
 import { StrandSolicitationService } from './strand-solicitation.js';
+import { MAX_STRAND_ADDRS } from './strand-formation-protocol.js';
 import { createMembershipConnectionGater, DEFAULT_ENROLLMENT_WINDOW_MS, UnauthorizedReservationBudget } from './membership-connection-gater.js';
 import { StrandWakeService, dialWake } from './strand-wake-protocol.js';
 import { StrandAddrService, collectStrandAddrs } from './strand-addr-protocol.js';
 import { DelegateAdmissionStore, extractCircuitRelayTargets, dueRelayAnnounces, pruneStoppedStrandAnnounces, peerStrandKey } from './delegate-admission.js';
-import { relayCircuitAddrs, resolveListenAddrs, RelayReservationFailedError } from './relay-addrs.js';
+import { relayCircuitAddrs, resolveListenAddrs, resolveTransportOptions, RelayReservationFailedError } from './relay-addrs.js';
 import { replacesAdvertisedAddrs, resolveAnnounceAddrs } from './announce-addrs.js';
 import { superviseRelayReservation, resolveRelayReservationState } from './relay-reservation.js';
 import { PushFanoutService } from './push-fanout.js';
@@ -64,6 +67,30 @@ export const STRAND_PEER_ADDR_REFRESH_MS = 10 * 60 * 1000;
 function relayStrandAddrPeer(relay) {
     return { peerId: relay.relayPeerId, addrs: [multiaddr(relay.relayAddr)] };
 }
+/**
+ * `primary` followed by the entries of `extra` it does not already contain, de-duplicated
+ * and order-preserving.
+ *
+ * Used wherever a strand's discovery seed unions two sources of address strings — the
+ * freshly-RPC'd sibling answers and the cross-party addresses learned at formation. The
+ * caller passes the FRESHER source as `primary`, so a stale entry can only ever be
+ * appended, never promoted ahead of a current one, and each source keeps whatever
+ * signaling-first ordering it arrived with.
+ */
+function unionAddrs(primary, extra) {
+    if (extra.length === 0) {
+        return [...primary];
+    }
+    const out = [...primary];
+    const seen = new Set(primary);
+    for (const addr of extra) {
+        if (seen.has(addr))
+            continue;
+        seen.add(addr);
+        out.push(addr);
+    }
+    return out;
+}
 /**
  * Build the signing callback the `ControlDatabase` writers expect: they hand it the
  * canonical row-bound message BYTES (see `buildAuthorizationMessage`), and it ed25519-signs
@@ -84,6 +111,56 @@ function requireNonBlank(value, label) {
     }
     return trimmed;
 }
+/**
+ * Is the live `Strand` row the one a publish of `desired` would have produced?
+ *
+ * "Identical content" means `(Type, MemberPrivateKey)` and deliberately NOT
+ * `FounderOwnerKey`: that column is provenance (WHICH machine published the row), not
+ * content. Two machines of one party racing to found the same id must keep resolving as
+ * "the winner's row stands" — the loser adopts the row and, since the winner's key is on
+ * it, correctly comes up as a joiner (see `launchStrand`'s founder derivation). Comparing
+ * it here would turn that benign race into a hard throw. `Id` is the lookup key and
+ * `StampId` is a single-use nonce, so the two compared columns are all the content there
+ * is. A live row matching on both is, by construction, the state a repeat publish would
+ * have reached, whichever branch of `Strand.AuthorizedInsert` seated it (owner-signed, or
+ * the unsigned consent branch an invite redemption uses).
+ *
+ * Returns the mismatching column names, empty when the row matches. The KEY's value is
+ * deliberately never returned or logged — it is the closed strand's read-gating secret.
+ */
+function strandRowMismatches(live, desired) {
+    const mismatches = [];
+    if (live.Type !== desired.Type) {
+        mismatches.push(`Type is '${live.Type}', not the requested '${desired.Type}'`);
+    }
+    if ((live.MemberPrivateKey ?? null) !== (desired.MemberPrivateKey ?? null)) {
+        mismatches.push('MemberPrivateKey differs from the one supplied');
+    }
+    return mismatches;
+}
+/**
+ * The live row when it matches `desired` ({@link strandRowMismatches}); otherwise throw
+ * naming the columns that differ.
+ *
+ * A mismatch must stay a hard error: accepting one would let a retry reopen a strand the
+ * party closed, or swap the key that gates its reads — so the two cases the raw
+ * `UNIQUE constraint failed: Strand.Id` could not distinguish ("already done, carry on"
+ * vs. "genuine conflict, stop") are separated here rather than left to the caller.
+ *
+ * @param situation - How the row came to be there, as a verb phrase completing
+ *   `Strand <id> …`, e.g. `'is already published'`.
+ */
+function requireMatchingStrandRow(live, desired, situation) {
+    const mismatches = strandRowMismatches(live, desired);
+    if (mismatches.length > 0) {
+        throw new Error(`Strand ${desired.Id} ${situation} with DIFFERENT content, so this publish is a ` +
+            `conflict, not a repeat: ${mismatches.join('; ')}. Reconcile deliberately — attach ` +
+            'the existing strand with addStrand/foundStrand to keep it, or unpublishStrand first ' +
+            'to re-seat it (destructive for a closed strand: its MemberPrivateKey is stored ' +
+            'nowhere else).');
+    }
+    return live;
+}
 /**
  * CadreNode is the main entry point for a cadre member.
  * It manages:
@@ -106,6 +183,14 @@ export class CadreNode {
         this.trustedOwnerStore = null;
         this.controlNode = null;
         this.controlDatabase = null;
+        /**
+         * The CONTROL network's peer-join block catch-up — same module as the
+         * per-strand ones, but membership-gated (see {@link startControlBackfill}).
+         * Created in {@link start} after the control node and database are up, stopped
+         * and dropped in {@link cleanup} before either is torn down, so a stop()→
+         * start() cycle rebuilds it with a fresh caught-up-peer memo.
+         */
+        this.controlBackfill = null;
         this.strandWatcher = null;
         this.seedBootstrapService = null;
         this.strandSolicitationService = null;
@@ -272,6 +357,36 @@ export class CadreNode {
          * stale stamp.
          */
         this.strandPeerAddrRefreshAt = new Map();
+        /**
+         * CROSS-PARTY strand-network addresses learned at formation, keyed by strandId — the
+         * responder's live strand addrs, carried back on the formation result
+         * (`FormationResultMessage.strandAddrs`) and recorded by {@link formStrand}.
+         *
+         * This is the ONLY cross-party discovery input there is. The strand-addr RPC that
+         * resolves a strand's addresses is membership-gated and answers own-party siblings
+         * only, so without this map a joiner's cohort seed for a two-party strand is empty and
+         * the mesh never forms.
+         *
+         * Read by {@link resolveCohortSeed} (launch + hibernation resume) and re-merged by
+         * every {@link refreshStrandPeerAddrs} pass — the re-merge is what keeps the entries
+         * alive past the peerStore's one-hour address expiry, since nothing can re-resolve
+         * them.
+         *
+         * IN-MEMORY and ONE-SHOT, deliberately (see `docs/strands.md`): the addresses die with
+         * the process, and a restarted initiator with no sibling running the strand is back to
+         * an empty seed until the durability work lands
+         * (`backlog/feat-cross-party-strand-addr-durability`). They are also never refreshed,
+         * so a responder whose relay reservation rotates before the initiator dials leaves a
+         * dead entry behind; recovery today is a fresh invitation.
+         *
+         * NOTE: entries are kept for the node's lifetime, including across a
+         * {@link stopStrand} — a stopped strand may be rediscovered by the watcher and must
+         * still get its seed. Each strand's list is capped at `MAX_STRAND_ADDRS`, but the
+         * number of KEYS is bounded only by the strands this node has ever formed as an
+         * initiator (not by time); if a node ever forms strands at scale, evict on
+         * `unpublishStrand` or cap the map.
+         */
+        this.crossPartyStrandAddrs = new Map();
         /**
          * Cold-start bootstrap dial targets: the owner-flagged peers of every seed
          * this node has applied, keyed by peer id, valued by the seed's multiaddr
@@ -306,6 +421,16 @@ export class CadreNode {
          * the party if it is ever stranded again.
          */
         this.bootstrapPeerStore = null;
+        /**
+         * Node-local record of the party's enrolled-machine count (see
+         * `enrolled-machine-store.ts`), kept so the CONTROL node can declare a
+         * block-repair yardstick at bring-up. Constructed (or adopted from
+         * `config.enrolledMachines.store`) by {@link initializeEnrolledMachineStore};
+         * written by {@link refreshAuthorizedControlPeers}. Like
+         * {@link bootstrapPeerStore} it is deliberately NOT cleared by {@link cleanup},
+         * so it survives a stop()→start() cycle of the same node instance.
+         */
+        this.enrolledMachineStore = null;
         /** Initial self-registration timer (see {@link scheduleSelfRegistration}). */
         this.selfRegistrationTimer = null;
         /** TTL heartbeat that re-publishes the self record before it goes stale. */
@@ -547,6 +672,13 @@ export class CadreNode {
             // closed before any network bring-up, and the retained dial targets are
             // loaded before the first reconcile pass could consult them.
             this.initializeBootstrapPeerStore();
+            // Read the party's enrolled-machine count out of its node-local record and
+            // capture it for buildControlNodeOptions below. This MUST precede
+            // createControlNode: Optimystic freezes the cluster policy when the node is
+            // built, and the ControlDatabase that could answer the question live does not
+            // exist until after that. Remembering the number across the restart is the
+            // only way to declare it at all — see `enrolled-machine-store.ts`.
+            this.initializeEnrolledMachineStore();
             // Arm the connection gate's BRING-UP QUIET PERIOD before the libp2p node
             // exists, so no connection can form ahead of it: `@libp2p/bootstrap` emits
             // its discovery events ~1 s after `libp2p.start()` and the connection
@@ -660,6 +792,12 @@ export class CadreNode {
             // delayed refresh path) so no early `connection:open` is missed — the
             // write-while-alone re-replication drain must fire on the first 0→≥1 edge.
             this.wireControlConnectionListeners();
+            // Arm the control network's peer-join block catch-up now that the control
+            // DB (which the push-time membership gate reads) is up. Armed even when
+            // this node is alone — like the strand one, it only does work when the
+            // control libp2p node reports a peer connection, and arming it at start is
+            // what closes the "genesised alone, headers never replicate" hole.
+            this.startControlBackfill();
             // Seed the per-stream gate's materialized authorized set now that the
             // control DB is up (non-blocking; the helper never rejects). Until it
             // lands the snapshot is empty, which the stream gate treats as cold
@@ -846,6 +984,46 @@ export class CadreNode {
         }
         this.bootstrapPeerStore = store;
     }
+    /**
+     * Construct (or adopt) the node-local enrolled-machine store and capture the
+     * count this run will declare into {@link declaredEnrolledMachines}.
+     *
+     * Synchronous for the same reason {@link initializeBootstrapPeerStore} is: an
+     * injected store has already loaded its persisted count by the time it is handed
+     * in (its `open` is the async part), and the in-memory default has nothing to
+     * load. Must run BEFORE {@link createControlNode} — that is the whole point of
+     * the record; see `enrolled-machine-store.ts`.
+     *
+     * The store instance is kept across stop()→start() (so a count recorded during
+     * the previous run is not lost with the ephemeral default), but the DECLARED
+     * count is re-read every time — which is how a restart applies a number the
+     * previous run learned.
+     *
+     * A store scoped to a different party is a configuration error, fail closed. It
+     * is only a repair hint, but a hint sized by a foreign party's membership is a
+     * number nobody chose, and the mismatch always means a miswired embedder.
+     */
+    initializeEnrolledMachineStore() {
+        const partyId = this.config.controlNetwork.partyId;
+        const store = this.enrolledMachineStore
+            ?? this.config.enrolledMachines?.store
+            ?? new MemoryEnrolledMachineStore(partyId);
+        if (store.partyId !== partyId) {
+            throw new Error(`CadreNodeConfig: enrolledMachines.store is scoped to party ${store.partyId}, ` +
+                `but this node serves party ${partyId} — refusing to size a repair yardstick from a foreign party`);
+        }
+        this.enrolledMachineStore = store;
+        this.declaredEnrolledMachines = store.count();
+        log('control repair yardstick will be declared from %o enrolled machine(s)', this.declaredEnrolledMachines);
+    }
+    /**
+     * The node-local enrolled-machine store (null before {@link start}) — what this
+     * node last knew about its party's size. Exposed for diagnostics and for a host
+     * that wants to show which repair yardstick the next launch will declare.
+     */
+    getEnrolledMachineStore() {
+        return this.enrolledMachineStore;
+    }
     /**
      * The node-local cold-start bootstrap-peer store (null before {@link start}) —
      * the retained owner addresses {@link reconcileControlCohort}'s cold-start
@@ -892,6 +1070,90 @@ export class CadreNode {
     async createControlNode() {
         return await createLibp2pNode(this.buildControlNodeOptions());
     }
+    /**
+     * The control libp2p node's Optimystic network name — ONE binding for every
+     * derivation from it (`db-p2p` namespaces all of the node's protocol ids as
+     * `/optimystic/<networkName>/...`), so the node options and the block-transfer
+     * protocol prefix the control backfill dials can never drift apart.
+     */
+    controlNetworkName() {
+        return `control-${this.config.controlNetwork.partyId}`;
+    }
+    /**
+     * Arm the CONTROL network's peer-join block catch-up: push every block in the
+     * control database's own raw store to each newly connected AUTHORIZED member
+     * this runtime has not yet caught up. This is what physically replicates
+     * control blocks committed while the writer was alone — the named
+     * collection-header blocks written once at genesis above all, whose revision
+     * never moves again, so no later commit ever carries them to a member that
+     * joined after them. Without it, such a member that restarts offline reads
+     * the affected control tables as EMPTY, silently (`isMember()` answers false
+     * for peers it knew about before the restart).
+     *
+     * Unlike the per-strand instances (see `strand-instance-manager.ts`), pushes
+     * are gated on {@link isAuthorizedMember}, judged at push time: the control
+     * network's inbound connection gate deliberately admits non-members in
+     * several states (seed delivery to an un-enrolled node, an open enrollment
+     * window, an outstanding invitation, configured bootstrap/relay peers), and
+     * pushing the whole control store to such a peer would hand a stranger the
+     * party's entire membership, addresses and strand list. The receiving side
+     * needs no work of its own: `createLibp2pNode` registers the block-transfer
+     * handler on every node it builds, control node included, and this node's
+     * per-stream gate (`authorizeInboundControlStream`) covers the inbound
+     * direction. A denied peer is retried on its next `connection:open`, and —
+     * because the production join order is connect-then-authorize — on every
+     * committed membership change via {@link refreshAuthorizedControlPeers}'s
+     * `scheduleConnectedPeers()` call.
+     *
+     * No-ops (logged) when the embedder configured no control storage or the
+     * node exposes no key network — the backfill would have nothing to read or
+     * no way to dial.
+     */
+    startControlBackfill() {
+        if (this.config.controlBackfill?.enabled === false || !this.controlNode) {
+            return;
+        }
+        // Through the resolver, not the {@link controlStorage} memo field: the resolver is
+        // idempotent (it returns the same wrapped store `buildControlNodeOptions` already
+        // resolved), so the catch-up cannot be silently disarmed by a future reordering that
+        // moves this call ahead of the one that populated the field.
+        const storage = this.resolveControlStorage();
+        const keyNetwork = this.controlNode.keyNetwork;
+        if (!storage || !keyNetwork) {
+            log('Control peer-join block catch-up is inert: %s', !storage ? 'no control storage configured' : 'control node exposes no keyNetwork');
+            return;
+        }
+        const networkName = this.controlNetworkName();
+        this.controlBackfill = new PeerJoinBackfill({
+            label: networkName,
+            libp2p: this.controlNode,
+            peerNetwork: keyNetwork,
+            storage,
+            // The same prefix the receiver registered its block-transfer handler
+            // under — derived from the same networkName binding the node options
+            // used, never re-spelled here.
+            protocolPrefix: `/optimystic/${networkName}`,
+            authorizePeer: (peerId) => this.isAuthorizedMember(peerId)
+        }, {
+            // A shorter settle window than the strand default (1000 ms): the control
+            // store is small (a party's membership — dozens of blocks), a re-push is
+            // idempotent, and the window a joiner is connected before going offline
+            // can be short (converge one row, then stop) — a slow debounce is the
+            // difference between that joiner holding the collection headers and
+            // reading its own membership as empty after an offline restart.
+            //
+            // NOTE: 250 is reasoned, not swept — the delete-while-alone scenario's
+            // phases 1-3 finish in about a second, so the 1000 ms strand default left
+            // the push racing the joiner's stop, and 250 gives margin. Nobody measured
+            // the shape of the curve either side of it. If the control gates start
+            // flaking on a joiner that stopped before being caught up, lower this
+            // before looking anywhere else; if catch-up pushes start showing up as
+            // connection-churn noise, raise it.
+            debounceMs: 250,
+            ...this.config.controlBackfill
+        });
+        this.controlBackfill.start();
+    }
     /**
      * The control database's cache-wrapped raw storage, resolved from
      * `config.storage.provider` on first use and then held in {@link controlStorage}
@@ -974,6 +1236,11 @@ export class CadreNode {
         // the END of `start()`, so the control database is built while this node holds
         // zero control connections. See `relay-addrs.ts` and `start()`.
         const listenAddrs = resolveListenAddrs(network, 'search');
+        // The transports those listen entries imply. A `/ws` entry switches db-p2p's
+        // WebSocket transport on (without it the entry binds nothing and libp2p reports
+        // nothing); anything outside {tcp, ws/wss, p2p-circuit} throws here rather than
+        // being silently dropped at bring-up. See `relay-addrs.ts`.
+        const transportOptions = resolveTransportOptions(network, listenAddrs);
         const enableRelay = this.relayServerEnabled();
         // The control node's own storage, resolved once per runtime (see
         // {@link resolveControlStorage}) rather than per call.
@@ -981,7 +1248,7 @@ export class CadreNode {
         const nodeOptions = {
             port: 0,
             bootstrapNodes: controlNetwork.bootstrapNodes,
-            networkName: `control-${controlNetwork.partyId}`,
+            networkName: this.controlNetworkName(),
             storage: controlStorageProvider,
             fretProfile: profile === 'storage' ? 'core' : 'edge',
             relay: enableRelay,
@@ -992,10 +1259,22 @@ export class CadreNode {
             // CONTROL_CLUSTER_POLICY: only the admission gate defaults to 2, while the read-repair
             // corroboration floor would otherwise fall back to this clusterSize of 16.
             clusterSize: CONTROL_REPLICATION_BREADTH,
-            clusterPolicy: CONTROL_CLUSTER_POLICY,
+            // The base control policy with the block-repair corroboration yardstick declared
+            // from the machines this party had enrolled at this node's last look
+            // ({@link declaredEnrolledMachines}, read in start() before this runs). Handed
+            // `undefined` — a brand-new node, an unreadable record, or an embedder that
+            // injected no store — this returns the frozen CONTROL_CLUSTER_POLICY object
+            // itself, so the unknown case is provably byte-for-byte the old behaviour.
+            // The yardstick moves ALONE: `assumedClusterSize` stays pinned at 2, because a
+            // party of phones cannot promise three quarters of its machines are awake.
+            clusterPolicy: controlClusterPolicy(this.declaredEnrolledMachines),
             arachnode: { enableRingZulu: profile === 'storage' },
             ...(identityKey && { privateKey: identityKey }),
             ...(network?.transports && { transports: network.transports }),
+            // `{ wsPort }` when a listen entry names WebSocket, otherwise `{}` — and always
+            // `{}` when `network.transports` is set, since the embedder owns transport policy
+            // then. Spread NEXT to `transports` because the two answer the same question.
+            ...transportOptions,
             // Configured `listenAddrs`, plus the bare `/p2p-circuit` search listener when
             // `network.relayAddrs` is set — that listener registers the pending reservation
             // `driveControlRelayReservation` fills after bring-up.
@@ -1325,6 +1604,68 @@ export class CadreNode {
             const members = await this.listAuthorizedMembers(false);
             this.authorizedControlPeers = new Set(members.map((m) => m.peerId));
             log('refreshAuthorizedControlPeers(%s): %d authorized peer(s)', reason, this.authorizedControlPeers.size);
+            // Remember the party's size for the NEXT launch's control-node repair yardstick
+            // (see `enrolled-machine-store.ts`): this is the only place the count is known,
+            // and the control node that needs it was built long before this ran. Recorded
+            // from the snapshot just materialized — no second membership query.
+            //
+            // CONTROL-NETWORK ONLY, and that scope is load-bearing. Every enrolled machine
+            // runs the control node by construction, so here the party's machine count IS
+            // the count of machines serving the network — the quantity
+            // `resolveRepairYardstick` asks for. It is NOT that quantity for a strand, which
+            // launches only on machines whose embedder registered its sApp config (see
+            // {@link addStrand}), so this number must never be routed to a strand node:
+            // over-declaring pins Optimystic's repair corroboration floor at two peers and a
+            // strand that can field only one can then never repair. `launchStrand` therefore
+            // declares nothing; see the NOTE there.
+            //
+            // `+ 1` for this node, which is not in its own authorized set. An EMPTY snapshot
+            // is recorded as 1 rather than skipped. That is deliberate, and the reason
+            // is a party that genuinely SHRANK: if empty meant "record nothing", a party
+            // whose other machines were all revoked would keep declaring its old, larger
+            // number forever, and over-declaring is the unsafe direction — at a yardstick of
+            // 3 or more Optimystic pins the repair corroboration floor at two peers, so a
+            // cohort that can only field one peer could never repair at all. Recording 1
+            // lets the number come back down; the floor then turns it into 2, which is
+            // exactly what declaring nothing resolves to.
+            //
+            // NOTE: the cost of that choice is that a TRANSIENT empty read overwrites a good
+            // remembered count with 1 — a membership snapshot is legitimately empty early in
+            // a run on a node whose rows have not replicated yet or whose trusted-owner
+            // anchor is still unseeded (`listAuthorizedMembers` authorizes no one without an
+            // anchor). Bounded and safe: the next refresh once rows land re-records the real
+            // count, and the only node that loses anything is one stopped inside that window,
+            // which then declares 2 — today's behaviour — on its next launch. If a node ever
+            // needs to declare the right number on its FIRST post-restart launch, the fix is
+            // to distinguish "no rows yet" from "no members" at this site, not to skip empty.
+            //
+            // A removed peer stops counting at REVOCATION, not at reap: `queryCadrePeers`
+            // drops rows whose `StampId` is retired, and `listAuthorizedMembers` reads
+            // through it. That is why there is no reap hook writing this record.
+            //
+            // `void`: the store never rejects and logs its own persist failures, and this
+            // method's contract is never-rejects. A failed write leaves the in-memory count
+            // correct for this session and re-lands on the next refresh.
+            void this.enrolledMachineStore?.record(this.authorizedControlPeers.size + 1);
+            // Membership moved: give the control backfill another look at every
+            // connected peer. The production join order is connect-then-authorize, so
+            // a joiner's first catch-up pass was denied at the gate while its
+            // connection stays up — without this re-arm it would wait for a
+            // reconnect. Cheap and idempotent: caught-up peers are skipped before any
+            // timer is set, a peer whose pass is in flight is deferred to the end of
+            // that pass (the pass may already be past its gate check — this very
+            // commit is what would authorize it), and the gate re-judges at push time.
+            //
+            // NOTE: every refresh re-arms every connected peer that is not yet caught
+            // up, and each re-armed pass costs one `CadrePeer` query at the gate. A
+            // connection that is admitted but never authorized — a configured
+            // bootstrap or relay peer, the steady state for a NAT'd node — is
+            // therefore re-judged on every membership write and every timed reconcile
+            // tick, forever. Negligible at a cadre's handful of connections; if a node
+            // ever holds many such connections, or refreshes get frequent, skip
+            // re-arming peers whose last pass was denied under the SAME membership
+            // snapshot instead of re-arming unconditionally.
+            this.controlBackfill?.scheduleConnectedPeers();
         }
         catch (error) {
             log('refreshAuthorizedControlPeers(%s) failed — keeping previous snapshot: %o', reason, error);
@@ -1544,6 +1885,29 @@ export class CadreNode {
         }
         return null;
     }
+    /**
+     * Does the `Strand` row name THIS machine as its founder — i.e. is its
+     * `FounderOwnerKey` this node's own owner key (the key behind its PeerId)?
+     * A null/absent column (a consent-seated strand, or a hand-built row) and a
+     * node with no owner key both derive `false`: without a positive match this
+     * machine must attach, never bootstrap. Pure key derivation, no I/O — cheap
+     * enough for {@link launchStrand}'s tracked-instance early return.
+     *
+     * NOTE: reads "one owner key per machine" — the reference model, where the owner
+     * key IS the key behind the PeerId. Two machines running the SAME identity key
+     * would both derive `true` and each bootstrap on its own replica, which is the
+     * double-`Header` hazard this derivation exists to avoid. Unreachable today: that
+     * configuration also gives both machines one PeerId, which already breaks control
+     * networking well before any strand launches. Revisit if machines ever share an
+     * owner key while holding distinct transport identities — the derivation would
+     * then need a per-machine discriminator (the `CadrePeer` PeerId) on the row.
+     */
+    isSelfFoundedRow(strand) {
+        if (strand.FounderOwnerKey == null) {
+            return false;
+        }
+        return strand.FounderOwnerKey === this.getSelfSigningKey()?.publicKeyB64;
+    }
     /**
      * The owner keypair (base64url Ed25519) derived from this node's resolved
      * identity key. In the single-key reference model the owner signing key is
@@ -1788,21 +2152,26 @@ export class CadreNode {
      * One address bound to `peerId`, or `null` when it cannot be — logged either
      * way, never thrown, so every caller's list-shaping stays total.
      *
+     * Used both to normalize addresses this node DIALS (a `CadrePeer` row, a
+     * seed-supplied bootstrap addr) and to normalize the ones it ANNOUNCES
+     * ({@link getStrandMultiaddrs}); the rule is the same either way — an address
+     * that does not reach `peerId` is not an address for `peerId`.
+     *
      * `withTrailingPeerId` encapsulates `/p2p/<peerId>`, which throws on a peer id
      * that does not parse. Unreachable for a `CadrePeer` row (the binding gate
-     * above parsed it already), reachable for a seed-supplied one
-     * ({@link bootstrapDialAddrs}).
+     * above parsed it already) and for our own node's id, reachable for a
+     * seed-supplied one ({@link bootstrapDialAddrs}).
      */
     bindAddrToPeer(addr, peerId) {
         try {
             const bound = withTrailingPeerId(addr, peerId);
             if (!bound) {
-                log('normalizeDialAddrs: dropping addr %s — it names a peer other than %s', addr.toString(), peerId);
+                log('bindAddrToPeer: dropping addr %s — it names a peer other than %s', addr.toString(), peerId);
             }
             return bound;
         }
         catch (error) {
-            log('normalizeDialAddrs: cannot bind %s to %s: %o', addr.toString(), peerId, error);
+            log('bindAddrToPeer: cannot bind %s to %s: %o', addr.toString(), peerId, error);
             return null;
         }
     }
@@ -3052,6 +3421,14 @@ export class CadreNode {
         // announce timestamps that would suppress the next session's refresh.
         this.delegateAdmission.clear();
         this.delegateAnnounceAt.clear();
+        // Control backfill first — before the database closes and the control node
+        // stops — so no NEW catch-up push is issued against a torn-down transport.
+        // A push already in flight is not awaited; it fails into the module's own
+        // per-chunk catch. (Mirrors releaseRuntime in strand-instance-manager.ts.)
+        if (this.controlBackfill) {
+            this.controlBackfill.stop();
+            this.controlBackfill = null;
+        }
         // Close control database (this also shuts down the collection factory).
         // Detach the membership hub first: nothing this teardown does should drive a
         // gate refresh, and a notification arriving after this point is a no-op.
@@ -3152,8 +3529,8 @@ export class CadreNode {
     /**
      * Rebuild a quiesced strand's runtime, re-resolving the volatile cohort input
      * first: the discovery seed may have grown since the strand last ran. Shared by
-     * the wake (`handleStrandWake`) and check-in (`handleStrandCheckIn`) paths so
-     * both apply the same fresh seed resolution. `resumeStrand` is idempotent
+     * the wake (`handleStrandWake`) and check-in (`handleStrandCheckIn`) paths so both
+     * apply the same fresh resolution. `resumeStrand` is idempotent
      * (returns the live instance unchanged) as a backstop against double-resume.
      */
     async resumeStrandRuntime(strandId) {
@@ -3164,6 +3541,9 @@ export class CadreNode {
             ? peerIdFromPrivateKey(await strandTransportKey(this.identityKey, strandId)).toString()
             : undefined;
         const bootstrapNodes = await this.resolveCohortSeed(strandId, delegatePeerId);
+        // NOTE: no `servingMachines` override — see `launchStrand` for why a strand node
+        // declares no repair yardstick, and `StartStrandConfig.servingMachines` for the
+        // count that would legitimately go here once one exists.
         const instance = await this.strandManager.resumeStrand(strandId, { bootstrapNodes });
         // Same reason as the launch path: `bootstrapNodes` only reaches the address
         // book through @libp2p/bootstrap discovery, so merge it directly as well.
@@ -3297,6 +3677,14 @@ export class CadreNode {
      * Add a strand with its sApp configuration.
      * The hosting application must provide the sApp schema when creating a strand.
      *
+     * This is the ATTACH half only — it starts the local instance and never publishes the
+     * `Strand` row. A joiner (the row arrived over the control network) wants exactly this; a
+     * FOUNDER wants {@link foundStrand}, which publishes and attaches in one resumable call.
+     * With no explicit `founder` flag, founder-ness is derived from the row's
+     * `FounderOwnerKey` (see {@link StrandConfig.founder}) — so attaching a row THIS machine
+     * published (e.g. re-attaching its own orphan after a restart) founds it, and attaching
+     * anyone else's row joins, without the caller needing to know which it is.
+     *
      * A rejected call leaves nothing running but DOES leave the sApp config
      * registered, deliberately: both an explicit retry and the {@link StrandWatcher}'s
      * automatic relaunch need it. So once the strand's row is visible on the control
@@ -3312,9 +3700,11 @@ export class CadreNode {
         const { strandRow, sAppConfig, founder } = config;
         // Store sApp config for this strand
         this.sAppConfigs.set(strandRow.Id, sAppConfig);
-        log('Registered sAppConfig for strand %s (sApp: %s, founder: %s)', strandRow.Id, sAppConfig.id, founder ?? false);
-        // `founder` only flows from the explicit addStrand path — the control-discovered
-        // join path never founds, so its rows arrive via sync (see handleStrandAdded).
+        log('Registered sAppConfig for strand %s (sApp: %s, founder: %s)', strandRow.Id, sAppConfig.id, founder ?? 'derived');
+        // An unset `founder` is DERIVED from the row inside launchStrand (this node founds
+        // iff the row's FounderOwnerKey is its own owner key); an explicit flag wins — the
+        // formation/responder flows pass one deliberately, since their consent-seated rows
+        // carry a null column. See StrandConfig.founder.
         return await this.launchStrand(strandRow, sAppConfig, founder);
     }
     /**
@@ -3322,16 +3712,41 @@ export class CadreNode {
      * owner identity, so other cadre members discover it via control-network
      * sync (their {@link StrandWatcher} fires `strand:discovered`).
      *
-     * This is the owner-signed `Strand` INSERT that {@link addStrand}
-     * deliberately omits: `addStrand` only starts the LOCAL strand instance,
-     * whereas publishing makes the strand visible cadre-wide. A typical creator
-     * does both (start locally + publish); a discovering peer only does
-     * `addStrand` (the row already exists).
+     * **Founding a strand is TWO steps** — this one (publish the row cadre-wide) and
+     * {@link addStrand} (start the local instance, `founder: true` to write the strand's
+     * `Header`/founding membership). `addStrand` deliberately omits the insert: it only
+     * starts the LOCAL instance, whereas publishing makes the strand visible cadre-wide. A
+     * discovering peer only does `addStrand` (the row already exists). Callers founding a
+     * strand should use {@link foundStrand}, which performs both steps and is safe to
+     * re-run — hand-rolling the pair is what left strands half-founded when an app was
+     * killed between them.
+     *
+     * **Idempotent for identical content.** A live row whose `(Type, MemberPrivateKey)` match
+     * the arguments is the state this call would have produced, so the call logs and returns
+     * that row instead of writing — a publish interrupted after it committed can be repeated.
+     * DIFFERENT content on the same id throws, naming the columns that differ, rather than
+     * surfacing the raw `UNIQUE constraint failed: Strand.Id`: silently accepting it would
+     * let a retry reopen a closed strand or swap the key gating its reads. The read and the
+     * insert are not atomic, so a concurrent founder (two machines of one party, same id) is
+     * caught on the insert's uniqueness rejection and resolved the same way — re-read, no-op
+     * on a match, rethrow otherwise. Never an overwrite either way.
+     *
+     * A tombstoned strand is NOT resurrected here: {@link unpublishStrand} deletes the row, so
+     * the idempotent branch is unreachable and the ordinary publish path re-seats it, exactly
+     * as that method documents.
+     *
+     * **Already stuck on `UNIQUE constraint failed: Strand.Id`?** The row is already published
+     * — attach, do NOT republish: `addStrand` (or {@link foundStrand}) with the id and, for a
+     * closed strand, the `MemberPrivateKey` read back from the row. `unpublishStrand` + a
+     * fresh publish also clears it for an OPEN strand, but is destructive for a closed one
+     * (the key exists nowhere else). No app-data wipe is needed for either.
      *
      * The insert is signed with the ed25519 key behind this node's PeerId — which
      * {@link ed25519KeyPairFromLibp2p} also exposes as the node's owner keypair,
-     * so peer identity and owner key are one and the same. That key must be
-     * enrolled in `OwnerKey` (e.g. via {@link ControlDatabase.ensureOwnerKey}
+     * so peer identity and owner key are one and the same. That key is also persisted on the
+     * row as `FounderOwnerKey` (the schema pins the column to the verified signer), which is
+     * what later lets any launch derive "this machine is the founder" from the row alone.
+     * The key must be enrolled in `OwnerKey` (e.g. via {@link ControlDatabase.ensureOwnerKey}
      * at genesis) or the schema's `Strand.AuthorizedInsert` constraint rejects the write.
      * Failing loudly here is intentional: a silently-unpublished strand would run
      * as a local-only island that no peer could ever discover or join.
@@ -3340,16 +3755,148 @@ export class CadreNode {
      *   {@link addStrand}).
      * @param type - `'o'` for open (default) or `'c'` for closed.
      * @param memberPrivateKey - Optional membership key for a closed strand.
-     * @throws if the node is not started, exposes no owner signing key, the id is blank, or
-     *   the control DB rejects the (unauthorized) insert.
+     * @returns The live `Strand` row — the one just inserted, or the matching one already
+     *   there. A closed strand's caller should carry THIS row's `MemberPrivateKey` forward:
+     *   on a repeat it is the stored key, not the argument.
+     * @throws if the node is not started, exposes no owner signing key, the id is blank, a
+     *   row with the same id holds different content, or the control DB rejects the
+     *   (unauthorized) insert.
      */
     async publishStrand(strandId, type = 'o', memberPrivateKey) {
         const signingKey = this.requireOwnerSigningKey(`publish strand ${strandId}`);
         // Trim/reject here so the id that lands matches the one unpublishStrand looks up: it
         // trims too, and an untrimmed row would be unreachable by the same string.
         const trimmed = requireNonBlank(strandId, 'strand id');
-        await this.controlDatabase.insertStrand(trimmed, type, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64), memberPrivateKey);
+        // FounderOwnerKey records THIS machine as the row's publisher (the schema pins it to
+        // the signing owner), which is what later lets a relaunch derive founder-ness.
+        const desired = {
+            Id: trimmed,
+            Type: type,
+            MemberPrivateKey: memberPrivateKey ?? null,
+            FounderOwnerKey: signingKey.publicKeyB64,
+        };
+        // Read first rather than leaning on the insert's collision for BOTH readings. The
+        // ordinary resume (an app killed after its own publish committed) then needs no error
+        // matching at all: the collision path can only recognise itself by the engine's message
+        // TEXT (see isStrandIdConflict), and an upstream reword there must degrade the RARE race,
+        // not the common resume. It also spends no stamp or signature on a known no-op.
+        const existing = await this.controlDatabase.queryStrand(trimmed);
+        if (existing) {
+            // NOTE: reads local converged state, and `queryStrand` does not filter rows whose
+            // StampId a Revocation has retired. So on a sibling that still physically holds a row
+            // deleted elsewhere while ALONE (the delete-while-alone gap in docs/architecture.md),
+            // an owner-signed republish now no-ops onto that doomed row instead of re-seating the
+            // id under a fresh stamp. Harmless while that gap is itself unresolved — both
+            // behaviours end at the same unconverged state — but if delete-while-alone ever gains
+            // real replay, filter retired stamps here (queryStrandStampId + the Revocation read)
+            // so a re-seat is not mistaken for a repeat.
+            const matched = requireMatchingStrandRow(existing, desired, 'is already published');
+            log('publishStrand(%s): already published (type %s) with identical content — no-op', trimmed, type);
+            return matched;
+        }
+        try {
+            await this.controlDatabase.insertStrand(trimmed, type, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64), memberPrivateKey);
+        }
+        catch (error) {
+            // Only the uniqueness collision is a candidate for the idempotent reading; every
+            // other rejection (unauthorized signer, retired stamp) must keep surfacing.
+            if (!isStrandIdConflict(error)) {
+                throw error;
+            }
+            const landed = await this.controlDatabase.queryStrand(trimmed);
+            if (!landed) {
+                // Collided, yet no row is readable: not the race this branch handles (a row
+                // deleted between the rejection and the re-read, or a stale local view). Surface
+                // the original rather than guessing.
+                throw error;
+            }
+            log('publishStrand(%s): lost a concurrent founding race; re-read the landed row', trimmed);
+            return requireMatchingStrandRow(landed, desired, 'landed concurrently from another founder');
+        }
         log('Published strand %s (type %s) to control DB under owner %s', trimmed, type, signingKey.publicKeyB64);
+        return desired;
+    }
+    /**
+     * Found a strand — publish its row cadre-wide AND start the local instance as its
+     * founder — in one resumable call. The single entry point for creating a strand; a
+     * caller joining one someone else founded uses {@link addStrand} alone.
+     *
+     * Safe to re-run from any point of interruption, which hand-rolling
+     * {@link publishStrand} + {@link addStrand} is not. Either half can already have
+     * happened:
+     *
+     * - **row already published** → the stored row is adopted rather than re-published, so a
+     *   run killed after the insert committed no longer dies on
+     *   `UNIQUE constraint failed: Strand.Id`. For a closed strand the row's STORED
+     *   `MemberPrivateKey` wins over `config.memberPrivateKey`: a caller that mints a key per
+     *   attempt (as the reference apps do) would otherwise present a key that does not match
+     *   the membership already seated in the strand.
+     * - **instance already running** → the tracked instance is returned, and — because the
+     *   `Strand` row records its publishing machine (`FounderOwnerKey`) — a founder request
+     *   against an instance that was first launched as a joiner now runs the (idempotent,
+     *   insert-if-absent) founder bootstrap on it rather than silently skipping it
+     *   ({@link StrandInstanceManager.foundExistingStrand}). So a strand that something else
+     *   attached first — the reference RN app's `strand:discovered` handler after a restart,
+     *   or this node's own {@link StrandWatcher} poll winning `launchStrand`'s
+     *   `resolveCohortSeed` window — still ends up with its `Strand.Header` written.
+     *
+     * Founder-ness is resolved FROM THE ROW, not assumed: this machine founds iff the
+     * resolved row's `FounderOwnerKey` is its own owner key. A fresh publish records this
+     * machine, so the common path founds; a machine that lost a concurrent founding race to
+     * a sibling adopts the sibling's row and ATTACHES instead — deliberately, since two
+     * machines bootstrapping the same strand on separate replicas is the double-`Header`
+     * hazard. The returned {@link FoundStrandResult.founded} says which happened.
+     *
+     * `Type` is compared, not adopted: a stored row of the other type means the caller and
+     * the control plane disagree about what this strand IS, so it throws.
+     *
+     * @returns The instance AND the row the strand actually runs under — read the membership
+     *   key from the returned row, not from a freshly minted one ({@link FoundStrandResult}).
+     * @throws if the node is not started, the id is blank, a published row of the same id has
+     *   a different `Type`, or either half rejects.
+     */
+    async foundStrand(config) {
+        const { strandId, type = 'o', memberPrivateKey, sAppConfig } = config;
+        if (!this._running || !this.controlDatabase) {
+            throw new Error(`CadreNode must be started before attempting to found strand ${strandId}`);
+        }
+        const trimmed = requireNonBlank(strandId, 'strand id');
+        const published = await this.controlDatabase.queryStrand(trimmed);
+        const strandRow = published
+            ? this.adoptPublishedStrand(published, type, memberPrivateKey)
+            : await this.publishStrand(trimmed, type, memberPrivateKey);
+        // Derived, not hardcoded `true`: adopting a row another machine published means that
+        // machine runs the bootstrap — this one must attach or it would write a second Header.
+        const founded = this.isSelfFoundedRow(strandRow);
+        if (!founded) {
+            log('foundStrand(%s): the stored row was published by a different machine ' +
+                '(FounderOwnerKey is not this node\'s owner key) — attaching as a joiner; ' +
+                'the founder bootstrap runs on the publishing machine', trimmed);
+        }
+        const instance = await this.addStrand({ strandRow, sAppConfig, founder: founded });
+        return { instance, strandRow, founded };
+    }
+    /**
+     * Resume onto an already-published `Strand` row: keep its stored content, reject a type
+     * disagreement. The stored `MemberPrivateKey` is authoritative — see {@link foundStrand}
+     * for why a caller-minted key must lose here (and why that is NOT the same rule as
+     * {@link publishStrand}'s, which throws on a key mismatch because it is being asked to
+     * WRITE that key, not to resume onto what already exists).
+     */
+    adoptPublishedStrand(published, type, memberPrivateKey) {
+        if (published.Type !== type) {
+            throw new Error(`Cannot found strand ${published.Id} as type '${type}': it is already published as ` +
+                `type '${published.Type}'. Reconcile deliberately rather than re-founding — a ` +
+                'published open strand cannot be closed, nor a closed one opened, by re-publishing.');
+        }
+        if (memberPrivateKey !== undefined && memberPrivateKey !== published.MemberPrivateKey) {
+            log('foundStrand(%s): already published — resuming on the STORED MemberPrivateKey; ' +
+                'the supplied key is discarded (read it back from the returned instance)', published.Id);
+        }
+        else {
+            log('foundStrand(%s): already published (type %s) — adopting the stored row', published.Id, type);
+        }
+        return published;
     }
     /**
      * Remove this party's `Strand` row from the shared control database — the owner-signed
@@ -3554,19 +4101,49 @@ export class CadreNode {
      * seed, starts the strand, and registers it with the hibernation manager
      * before emitting `strand:started`.
      *
-     * Idempotent no-op when the strand manager already tracks `strand.Id` — the
-     * ordinary founding sequence is `addStrand` (starts it locally) followed by
-     * `publishStrand` (makes it visible), so this node's own `StrandWatcher`
-     * rediscovers a row it already started and calls this again via
-     * `handleStrandAdded`. Without the guard that re-entry would resolve a fresh
+     * Founder-ness: an explicit `founder` argument wins (the formation/responder flows pass
+     * one deliberately — their consent-seated rows carry a null `FounderOwnerKey`); when
+     * unset it is DERIVED from the row, so the control-discovered path
+     * (`handleStrandAdded`) and a restart's re-attach found this machine's own strands
+     * without the caller having to know. The derivation is pure key comparison — no I/O.
+     *
+     * Idempotent when the strand manager already tracks `strand.Id` — the watcher
+     * rediscovers a row this node already started and calls this again via
+     * `handleStrandAdded`; without the guard that re-entry would resolve a fresh
      * (already-connected) cohort seed and re-emit `strand:started` for an
      * instance that never stopped. The guard runs before the cohort-seed RPC
-     * fan-out, so a rediscovery costs nothing beyond the map lookup.
+     * fan-out, so a rediscovery costs nothing beyond the map lookup plus the (pure)
+     * founder derivation. NOT a silent no-op any more when the launch resolves as a
+     * FOUNDER: the tracked instance may have been launched first as a joiner (an app
+     * attach, or this node's own watcher poll winning the `resolveCohortSeed` window
+     * below), which used to drop the founder request and leave the strand headerless —
+     * now the tracked instance is founded in place
+     * ({@link StrandInstanceManager.foundExistingStrand}), waking it first if quiesced
+     * so the bootstrap actually runs before this resolves.
      */
     async launchStrand(strand, sAppConfig, founder) {
+        const resolvedFounder = founder ?? this.isSelfFoundedRow(strand);
         const existing = this.strandManager.getInstance(strand.Id);
         if (existing) {
-            log('launchStrand: strand %s already tracked locally — skipping re-launch', strand.Id);
+            if (resolvedFounder) {
+                const outcome = await this.strandManager.foundExistingStrand(strand.Id);
+                if (outcome === 'needs-resume') {
+                    // Quiesced instance: the retained config now founds, but founding promises
+                    // the bootstrap has RUN by the time the caller resolves — wake through the
+                    // hibernation manager (coalesced with any in-flight wake, timer-aware) so
+                    // the rebuild executes it now rather than at some eventual wake.
+                    await this.wakeStrand(strand.Id);
+                    // The wake's rebuild founds — UNLESS a wake was already in flight when the
+                    // config flipped, in which case it had already read the pre-flip config and
+                    // rebuilt as a joiner, and `wakeStrand` merely coalesced onto it. Re-run the
+                    // (insert-if-absent) bootstrap so founding never resolves headerless.
+                    await this.strandManager.ensureFounderBootstrap(strand.Id);
+                }
+                log('launchStrand: strand %s already tracked — founder request honored (%s)', strand.Id, outcome);
+            }
+            else {
+                log('launchStrand: strand %s already tracked locally — skipping re-launch', strand.Id);
+            }
             return existing;
         }
         // Each strand node gets its own transport identity, derived from the cadre
@@ -3604,8 +4181,18 @@ export class CadreNode {
             bootstrapNodes,
             requireSignedSchemas: this.config.requireSignedSchemas,
             clusterSize: this.config.strandClusterSize,
+            // NOTE: deliberately NO `servingMachines`, so the strand node declares no repair
+            // yardstick and runs the frozen STRAND_CLUSTER_POLICY. The only count this node holds
+            // is the party's enrolled machines (`authorizedControlPeers`), and passing that here
+            // is the regression `bug-strand-yardstick-counts-party-machines` removed — a strand
+            // runs on a subset of the party, and over-declaring makes repair impossible rather
+            // than merely weak. The full argument, and the count that will legitimately go here,
+            // are on `StartStrandConfig.servingMachines`.
             backfill: this.config.strandBackfill,
-            founder
+            revocationEnforcement: this.config.strandRevocationEnforcement,
+            onSelfRevoked: (revokedStrandId) => this.emit('strand:revoked', { strandId: revokedStrandId }),
+            // The RESOLVED flag, never the raw argument — see the doc comment above.
+            founder: resolvedFounder
         });
         // The seed reached the node as `bootstrapNodes`, which only enters the
         // address book via @libp2p/bootstrap discovery. Merge it directly too, so a
@@ -3645,6 +4232,20 @@ export class CadreNode {
      * for a relay we are not yet connected to.
      */
     async resolveCohortSeed(strandId, delegatePeerId) {
+        const siblings = await this.resolveSiblingSeed(strandId, delegatePeerId);
+        // Sibling answers FIRST: they were resolved just now, while a contact-map entry is as
+        // old as the formation that produced it. `unionAddrs` appends only what the siblings
+        // did not already name, so a fresher answer is never displaced and each source keeps
+        // its own signaling-first ordering.
+        return unionAddrs(siblings, this.crossPartyStrandAddrs.get(strandId) ?? []);
+    }
+    /**
+     * The own-party half of {@link resolveCohortSeed}: strand-network addresses resolved
+     * from CONNECTED cohort siblings over the control-mesh strand-addr RPC, doubling as
+     * the delegate announcement when `delegatePeerId` is given. Empty when the control DB
+     * or node is absent (not yet started / torn down).
+     */
+    async resolveSiblingSeed(strandId, delegatePeerId) {
         if (!this.controlDatabase || !this.controlNode) {
             return [];
         }
@@ -3851,35 +4452,41 @@ export class CadreNode {
         if (due.length === 0) {
             return;
         }
-        // A due strand with nobody to ask leaves its throttle unstamped (see below),
-        // so this pass re-enters on EVERY 15 s reconcile tick for as long as the node
-        // is alone — which is the steady state of a solo node running a strand.
         // `connectedSiblingTargets`' membership read is unbounded, and with zero
-        // connections its answer is empty whatever the table holds, so decide it here
-        // from the connection list instead of paying for the read once a tick.
-        if (this.controlNode.getConnections().length === 0) {
-            return;
-        }
+        // connections its answer is empty whatever the table holds, so decide it from the
+        // connection list instead of paying for the read once a tick. Note this only skips
+        // the RPC: a strand carrying cross-party contact addresses still refreshes below,
+        // because those never came from a sibling in the first place.
+        //
         // NOTE: one strand-addr RPC per (due strand × connected sibling) per refresh
         // interval — each a tiny request/response on an already-open control
         // connection. If a node ever runs MANY strands at once, batch the RPC to
         // carry several strand ids per request rather than one fan-out per strand.
-        const targets = await this.connectedSiblingTargets().catch((error) => {
-            log('refreshStrandPeerAddrs: sibling enumeration failed (skipping pass): %o', error);
-            return [];
-        });
-        // No sibling to ask (or a shutdown landed mid-enumeration): leave every stamp
-        // untouched so the next reconcile tick retries, rather than sitting out the
-        // whole refresh interval having asked nobody.
-        if (targets.length === 0 || !this._running || !this.controlNode) {
+        const targets = this.controlNode.getConnections().length === 0
+            ? []
+            : await this.connectedSiblingTargets().catch((error) => {
+                log('refreshStrandPeerAddrs: sibling enumeration failed (skipping pass): %o', error);
+                return [];
+            });
+        // A shutdown landed mid-enumeration.
+        if (!this._running || !this.controlNode) {
             return;
         }
         await Promise.all(due.map((strandId) => this.refreshOneStrandPeerAddrs(strandId, targets, now)));
     }
     /**
-     * One strand's share of {@link refreshStrandPeerAddrs}: RPC the siblings, then
-     * merge their answers into this strand's address book. Errors are logged and
-     * swallowed so one strand's failure never costs the others their refresh.
+     * One strand's share of {@link refreshStrandPeerAddrs}: RPC the siblings, union their
+     * answers with this strand's cross-party contact addresses, and merge the lot into the
+     * strand's address book. Errors are logged and swallowed so one strand's failure never
+     * costs the others their refresh.
+     *
+     * `targets` may be EMPTY — a solo node, or one whose only control peers are strangers.
+     * The cross-party addresses still have to be re-merged in that case: they were learned
+     * at formation and can never be re-resolved, so this periodic re-merge is the ONLY
+     * thing standing between them and the peerStore's one-hour expiry. A strand with
+     * neither a sibling to ask nor a contact entry does nothing and leaves its throttle
+     * unstamped, so the next reconcile tick retries rather than sitting out the whole
+     * refresh interval having done nothing.
      */
     async refreshOneStrandPeerAddrs(strandId, targets, now) {
         const controlNode = this.controlNode;
@@ -3887,13 +4494,19 @@ export class CadreNode {
         if (!controlNode || !strandNode) {
             return;
         }
+        const contactAddrs = this.crossPartyStrandAddrs.get(strandId) ?? [];
+        if (targets.length === 0 && contactAddrs.length === 0) {
+            return;
+        }
         try {
             // The running strand node's own peerId is the delegate to announce — see
             // the relationship note on refreshStrandPeerAddrs.
-            const addrs = await collectStrandAddrs(controlNode, [...targets], strandId, {
-                delegatePeerId: strandNode.peerId.toString()
-            });
-            // Stamped on the RPC having happened, not on its answer: the fan-out is
+            const siblingAddrs = targets.length === 0
+                ? []
+                : await collectStrandAddrs(controlNode, [...targets], strandId, {
+                    delegatePeerId: strandNode.peerId.toString()
+                });
+            // Stamped on the pass having happened, not on its answer: the fan-out is
             // what the throttle exists to bound, and an all-empty round is a normal
             // steady state for a strand no connected sibling currently runs.
             this.strandPeerAddrRefreshAt.set(strandId, now);
@@ -3902,7 +4515,7 @@ export class CadreNode {
             if (!this._running || this.strandManager.getInstance(strandId)?.libp2pNode !== strandNode) {
                 return;
             }
-            await this.mergeStrandPeerAddrs(strandNode, addrs, strandId);
+            await this.mergeStrandPeerAddrs(strandNode, unionAddrs(siblingAddrs, contactAddrs), strandId);
         }
         catch (error) {
             log('refreshStrandPeerAddrs: strand %s refresh failed (continuing): %o', strandId, error);
@@ -3926,6 +4539,15 @@ export class CadreNode {
      * handshake, and a bad entry costs one failed dial that ages out at the
      * peerStore's one-hour expiry. No new gating here — cross-party strand trust is
      * `backlog/strand-network-nat-relay-reachability`.
+     *
+     * NOTE: one input does NOT age out — the cross-party addresses a formation
+     * carried back ({@link crossPartyStrandAddrs}). Nothing can re-resolve them, so
+     * {@link refreshStrandPeerAddrs} re-merges the same stored list every pass, which
+     * also means a junk entry from a responder survives for the node's lifetime rather
+     * than an hour. Bounded to {@link MAX_STRAND_ADDRS} per strand, from a party this
+     * node deliberately formed a strand with, and still authority-free — so the
+     * exposure is a handful of failed dials, not a trust hole. Evict on
+     * `unpublishStrand` if that ever stops being an acceptable price.
      */
     async mergeStrandPeerAddrs(strandNode, addrs, strandId) {
         const counts = { merged: 0, restamped: 0, skipped: 0, failed: 0 };
@@ -3967,7 +4589,29 @@ export class CadreNode {
         if (!node) {
             return [];
         }
-        return orderSignalingFirst(node.getMultiaddrs().map((ma) => ma.toString()));
+        // Every entry is bound to THIS strand node's id, because both consumers — the
+        // strand-addr RPC answer and the formation result's `strandAddrs` — are attributed
+        // per peer on arrival (`groupAddrsByPeerId`) and an entry naming no destination is
+        // dropped there. libp2p already appends the id to its announced addresses, so this
+        // is normally a no-op; it is the guard for a bare listen addr and for a relay hop
+        // whose trailing `/p2p/` names the RELAY. An addr terminating in a DIFFERENT id is
+        // dropped rather than announced — it does not reach this node, and announcing it
+        // would file our address under someone else's id in the receiver's book.
+        //
+        // Re-parsed through this package's own `multiaddr` rather than passed straight in:
+        // libp2p hands back its nested `@multiformats/multiaddr` copy, a structurally
+        // different type from the one `withTrailingPeerId` takes (see
+        // `backlog/reference-app-web-libp2p-interface-dedup`). Re-parsing a string libp2p
+        // itself produced cannot fail.
+        const selfId = node.peerId.toString();
+        const addrs = [];
+        for (const ma of node.getMultiaddrs()) {
+            const bound = this.bindAddrToPeer(multiaddr(ma.toString()), selfId);
+            if (bound !== null) {
+                addrs.push(bound.toString());
+            }
+        }
+        return orderSignalingFirst(addrs);
     }
     /**
      * Stop a strand on THIS node only: untrack it from hibernation, drop its sApp config,
@@ -4670,6 +5314,25 @@ export class CadreNode {
             await this.membershipGateDrain;
         }
     }
+    /**
+     * Re-materialize a CLOSED strand's revoked-peer deny set now, and hang up any
+     * connected peer it newly covers — the strand-side counterpart to
+     * {@link refreshMembershipGate}.
+     *
+     * Unlike that one, NOTHING calls this automatically: strand membership is
+     * written through the strand's own `Database` handle
+     * (`strand-membership-writer.ts`), which raises no notification this runtime
+     * can hook, and a revocation that arrives by REPLICATION raises none either.
+     * The gate therefore polls (default 30 s). An app that has just called
+     * `revokeMember` or `leaveStrand` should follow the write with this call so
+     * the cut is immediate rather than up to one poll interval late.
+     *
+     * Quiet no-op for a strand that is not running, is quiesced, is open, or has
+     * the gate disabled. Never rejects; resolves once the sweep has finished.
+     */
+    async refreshRevocationEnforcement(strandId) {
+        await this.strandManager.refreshRevocationEnforcement(strandId);
+    }
     /**
      * The single in-flight refresh loop behind {@link refreshMembershipGate}: read
      * until the stale flag stays clear, then release the slot.
@@ -4981,7 +5644,11 @@ export class CadreNode {
         this.strandSolicitationService = new StrandSolicitationService({
             ...options,
             partyId: this.config.controlNetwork.partyId,
-            cadrePeerAddrs: this.getMultiaddrs()
+            cadrePeerAddrs: this.getMultiaddrs(),
+            // Overrides any caller-supplied hook, exactly like partyId/cadrePeerAddrs: only
+            // this node can say which strand-network addresses it is actually listening on,
+            // and a wrong answer here seeds a joiner's mesh with addresses that reach nobody.
+            resolveStrandAddrs: (strandId) => this.getStrandMultiaddrs(strandId)
         });
         // Register as responder on the control node
         this.strandSolicitationService.registerResponder(this.controlNode);
@@ -5026,7 +5693,41 @@ export class CadreNode {
         if (!this.strandSolicitationService) {
             this.initializeStrandSolicitation();
         }
-        return await this.strandSolicitationService.formStrand(invitation, disclosure, this.controlNode);
+        const result = await this.strandSolicitationService.formStrand(invitation, disclosure, this.controlNode);
+        this.recordCrossPartyStrandAddrs(result.strandId, result.strandAddrs);
+        return result;
+    }
+    /**
+     * Remember the responder's strand-network addresses for a strand this node just
+     * formed, so the strand's discovery seed has something to work with when the app
+     * launches it (see {@link crossPartyStrandAddrs}).
+     *
+     * Scoped strictly to `strandId`: these addresses reach ONE strand node of ONE other
+     * party and must never seed another strand's mesh or the control peerStore. An empty
+     * list is recorded as no entry at all rather than an empty one, so a later formation
+     * against the same strand that DOES disclose addresses is not shadowed.
+     */
+    recordCrossPartyStrandAddrs(strandId, strandAddrs) {
+        if (strandAddrs.length === 0) {
+            log('formStrand: responder disclosed no strand addrs for %s — cross-party seed stays empty', strandId);
+            return;
+        }
+        // Capped at the same `MAX_STRAND_ADDRS` one arriving list is, because this
+        // ACCUMULATES: re-forming against the same strand (the documented recovery for a
+        // responder whose relay reservation rotated) unions a fresh list onto the old one,
+        // and nothing here can tell a dead entry from a live one. Without the cap, the seed
+        // — and the peerStore rows every refresh pass re-merges from it — would grow by up
+        // to 16 entries per redemption for the node's lifetime. Oldest entries fall off the
+        // end, which is the right end to lose: `unionAddrs` keeps the freshest list first.
+        const merged = unionAddrs(strandAddrs, this.crossPartyStrandAddrs.get(strandId) ?? [])
+            .slice(0, MAX_STRAND_ADDRS);
+        this.crossPartyStrandAddrs.set(strandId, merged);
+        // A strand already running when this lands (a re-formation) would otherwise wait out
+        // the rest of its ~10-minute refresh throttle before the new addresses reached its
+        // address book. Clearing the stamp makes the next 15 s reconcile tick merge them,
+        // which matters precisely because re-forming is the recovery path for a dead entry.
+        this.strandPeerAddrRefreshAt.delete(strandId);
+        log('formStrand: recorded %d cross-party strand addr(s) for %s', merged.length, strandId);
     }
     /**
      * Encode an open invitation for out-of-band delivery (QR, link, etc.).