@serfab/cadre-core 0.8.1 → 0.10.0

package/src/seed-bootstrap.ts

@@ -2,9 +2,9 @@ import debug from 'debug';
 import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
 import { digest, sign, verify, getPublicKey } from '@optimystic/quereus-plugin-crypto';
 import type { Libp2p, Connection } from '@libp2p/interface';
-import { multiaddr } from '@multiformats/multiaddr';
+import { multiaddr, type Multiaddr } from '@multiformats/multiaddr';
 import { peerIdFromString } from '@libp2p/peer-id';
-import { type ControlStream, writeFrame, readStreamToEnd } from './control-stream.js';
+import { type ControlStream, writeFrame, withDeadline, exchangeFrame, readStreamToEnd } from './control-stream.js';
 import type {
   ControlNetworkSeed,
   SeedPeer,
@@ -18,15 +18,19 @@ import type {
   InviteResult,
   CadreInvite,
   PeerAddressRecord,
-  DeviceTokenRecord
+  DeviceTokenRecord,
+  RevocationRow
 } from './types.js';
 import type { ControlDatabase } from './control-database.js';
+import { generateStampId } from './control-database.js';
 import { canonicalJson } from './canonical-json.js';
-import { peerAuthorizationDigest } from './peer-authorization.js';
+import { deviceTokenAddDigest } from './peer-authorization.js';
 import {
   type SeedTrustPolicy,
-  dbAnchoredTrustPolicy,
+  type SeedTrustDecision,
+  anchoredTrustPolicy,
 } from './seed-trust-policy.js';
+import type { TrustedOwnerStore } from './trusted-owner-store.js';
 
 const log = debug('sereus:cadre:seed-bootstrap');
 
@@ -42,6 +46,9 @@ const DEFAULT_SEED_READ_TIMEOUT_MS = 10_000;
 /** Default cap on concurrent inbound seed streams a single peer can pin open. */
 const DEFAULT_MAX_CONCURRENT_SEEDS = 100;
 
+/** Default time the sender waits for a seed delivery (dial + ack read) before aborting (ms). */
+const DEFAULT_SEED_DELIVER_TIMEOUT_MS = 10_000;
+
 /**
  * Decode a 4-byte big-endian length-prefixed frame; returns the body bytes.
  *
@@ -73,10 +80,10 @@ export function decodeLengthPrefixedFrame(data: Uint8Array, maxLength = MAX_SEED
  *
  * An Ed25519 PeerId is an identity multihash of the public key, so
  * `peerIdFromString(id).publicKey.raw` is the 32-byte ed25519 key whose
- * base64url form matches the `AuthorityKey.Key` representation (and
- * `authorityKeyFromLibp2p().publicKeyB64`). Returns null for a non-Ed25519
+ * base64url form matches the `OwnerKey.Key` representation (and
+ * `ed25519KeyPairFromLibp2p().publicKeyB64`). Returns null for a non-Ed25519
  * id, a missing embedded key, or any parse failure — callers treat null as
- * "not an authority" rather than throwing.
+ * "not an owner" rather than throwing.
  */
 export function ed25519PublicKeyB64FromPeerId(peerId: string): string | null {
   try {
@@ -105,16 +112,24 @@ export function canonicalSeedPayload(
   return canonicalJson({ partyId: seed.partyId, peers: seed.peers });
 }
 
+/**
+ * An {@link ApplySeedResult} for a seed refused before the owner-dial loop ran,
+ * so the dial counters read zero rather than being absent.
+ */
+function seedRejected(error: string): ApplySeedResult {
+  return { success: false, peersAdded: 0, error, ownerDialsAttempted: 0, ownerDialsFailed: 0 };
+}
+
 /**
  * Configuration for the SeedBootstrapService
  */
 export interface SeedBootstrapConfig {
   /** Party ID for this cadre */
   partyId: string;
-  /** Authority private key for signing seeds and peer authorizations (base64url) */
-  authorityPrivateKey?: string;
-  /** Authority public key (base64url) - derived from private key if not provided */
-  authorityPublicKey?: string;
+  /** Owner private key for signing seeds and peer authorizations (base64url) */
+  ownerPrivateKey?: string;
+  /** Owner public key (base64url) - derived from private key if not provided */
+  ownerPublicKey?: string;
   /**
    * Optional async resolver returning the multiaddrs to embed in invites.
    * When unset, `libp2pNode.getMultiaddrs()` is used. Hosts behind NAT supply
@@ -124,9 +139,9 @@ export interface SeedBootstrapConfig {
   inviteAddressResolver?: () => Promise<string[]>;
   /**
    * Trust anchor for incoming seeds. Decides whether a signature-verified
-   * `signerKey` should be trusted, against the receiver's known authority
-   * keys (NOT the seed body). Defaults to `dbAnchoredTrustPolicy()`, which
-   * rejects any signer not already in the `AuthorityKey` table. An enrollment
+   * `signerKey` should be trusted, against the receiver's anchored owner
+   * keys (NOT the seed body). Defaults to `anchoredTrustPolicy()`, which
+   * rejects any signer not already in {@link trustedOwners}. An enrollment
    * caller can pass a per-seed override to `applySeed` instead.
    *
    * A `CadreNode` forwards its node-wide `CadreNodeConfig.seedTrustPolicy` here
@@ -134,6 +149,19 @@ export interface SeedBootstrapConfig {
    * since a network-delivered seed has no per-call override.
    */
   trustPolicy?: SeedTrustPolicy;
+  /**
+   * The node-local, NON-replicated trusted-owner anchor. Supplies
+   * `SeedTrustContext.knownOwnerKeys` for every {@link applySeed}, and receives
+   * a key accepted via a pin/TOFU (see `SeedTrustDecision.anchorAs`).
+   *
+   * Deliberately NOT `ControlDatabase.getOwnerKeys()`: the replicated
+   * `OwnerKey` table is pollutable — any connecting node can genesis-insert its
+   * own key and let it replicate — so a seed signed by a stranger's self-issued
+   * owner key would pass a table-anchored check. A `CadreNode` passes its
+   * `getTrustedOwnerStore()` here. Unset (e.g. a directly-constructed service in
+   * a test) means an EMPTY anchor: only a pinned/TOFU policy can accept a seed.
+   */
+  trustedOwners?: TrustedOwnerStore;
   /**
    * Time the inbound seed handler waits for the seed frame before aborting the
    * read (ms). Defaults to {@link DEFAULT_SEED_READ_TIMEOUT_MS}. Bounds a
@@ -146,6 +174,15 @@ export interface SeedBootstrapConfig {
    * returned without applying any seed.
    */
   maxConcurrentSeeds?: number;
+  /**
+   * Time {@link SeedBootstrapService.deliverSeed} waits for the whole exchange —
+   * dial, write, ack read — before aborting (ms). Defaults to
+   * {@link DEFAULT_SEED_DELIVER_TIMEOUT_MS}. Bounds the SENDER against a seed
+   * target that accepts the stream and then never replies; the target is a
+   * not-yet-trusted node during onboarding, so this is the more exposed
+   * direction than the receiver knobs above.
+   */
+  seedDeliverTimeoutMs?: number;
 }
 
 /**
@@ -154,8 +191,15 @@ export interface SeedBootstrapConfig {
 export interface SeedEventCallbacks {
   /** Called when a seed is received via the protocol */
   onSeedReceived?: (partyId: string, peerId: string) => void;
-  /** Called when a seed is successfully applied */
-  onSeedApplied?: (partyId: string, peersAdded: number) => void;
+  /**
+   * Called when a seed is successfully applied.
+   *
+   * `seed` is the applied seed itself: the inbound protocol handler applies it
+   * INSIDE the service, so this callback is the only seam through which a
+   * `CadreNode` sees a wire-delivered seed's contents — which it needs to
+   * retain the owner-flagged peers as cold-start bootstrap dial targets.
+   */
+  onSeedApplied?: (partyId: string, peersAdded: number, seed: ControlNetworkSeed) => void;
   /** Called when seed application fails */
   onSeedError?: (partyId: string, error: string) => void;
 }
@@ -171,30 +215,32 @@ export class SeedBootstrapService {
   private readonly config: SeedBootstrapConfig;
   private libp2pNode: Libp2p | null = null;
   private controlDatabase: ControlDatabase | null = null;
-  private readonly authorityPublicKey: string | null;
+  private readonly ownerPublicKey: string | null;
   private readonly trustPolicy: SeedTrustPolicy;
   private readonly seedReadTimeoutMs: number;
   private readonly maxConcurrentSeeds: number;
+  private readonly seedDeliverTimeoutMs: number;
   /** In-flight inbound seed streams, used to enforce {@link maxConcurrentSeeds}. */
   private activeStreams = 0;
   private eventCallbacks: SeedEventCallbacks = {};
 
   constructor(config: SeedBootstrapConfig) {
     this.config = config;
-    this.trustPolicy = config.trustPolicy ?? dbAnchoredTrustPolicy();
+    this.trustPolicy = config.trustPolicy ?? anchoredTrustPolicy();
     this.seedReadTimeoutMs = config.seedReadTimeoutMs ?? DEFAULT_SEED_READ_TIMEOUT_MS;
     this.maxConcurrentSeeds = config.maxConcurrentSeeds ?? DEFAULT_MAX_CONCURRENT_SEEDS;
+    this.seedDeliverTimeoutMs = config.seedDeliverTimeoutMs ?? DEFAULT_SEED_DELIVER_TIMEOUT_MS;
 
     // Derive public key from private key if not provided
-    if (config.authorityPrivateKey && !config.authorityPublicKey) {
-      this.authorityPublicKey = getPublicKey(
-        config.authorityPrivateKey,
+    if (config.ownerPrivateKey && !config.ownerPublicKey) {
+      this.ownerPublicKey = getPublicKey(
+        config.ownerPrivateKey,
         'ed25519',
         'base64url',
         'base64url'
       ) as string;
     } else {
-      this.authorityPublicKey = config.authorityPublicKey ?? null;
+      this.ownerPublicKey = config.ownerPublicKey ?? null;
     }
 
     log('SeedBootstrapService created for party: %s', config.partyId);
@@ -209,15 +255,15 @@ export class SeedBootstrapService {
   }
 
   /**
-   * Whether this service holds an authority private key, i.e. can produce the
-   * authority signatures that gate `CadrePeer` / `DeviceToken` inserts, deletes,
+   * Whether this service holds an owner private key, i.e. can produce the
+   * owner signatures that gate `CadrePeer` / `DeviceToken` inserts, deletes,
    * and re-authorizations. A seed-listener-only service (`enableSeedListener`,
-   * no authority key) returns false: it can receive/apply seeds but cannot author
-   * or re-issue authority writes. Used by the write-while-alone re-replication
-   * drain to skip authority work on a non-authority node.
+   * no owner key) returns false: it can receive/apply seeds but cannot author
+   * or re-issue owner writes. Used by the write-while-alone re-replication
+   * drain to skip owner work on a non-owner node.
    */
   canAuthorize(): boolean {
-    return !!this.config.authorityPrivateKey;
+    return !!this.config.ownerPrivateKey;
   }
 
   /**
@@ -250,14 +296,14 @@ export class SeedBootstrapService {
 
   /**
    * Authorize a new peer to join the cadre.
-   * Signs the peer ID with the authority key and inserts into CadrePeer table.
+   * Signs a membership voucher with the owner key and inserts into CadrePeer table.
    *
-   * The authority vouches the `PublicKey <-> PeerId` binding: rather than trust a
+   * The owner vouches the `PublicKey <-> PeerId` binding: rather than trust a
    * caller-supplied key, the binding is enforced by construction — `PublicKey` is
    * DERIVED from the (Ed25519) `peerId`. A non-Ed25519 peer id yields a null
    * `PublicKey`, and such a row can never be self-updated (it has no key to
    * verify against), which is correct. The row is inserted with a fresh
-   * `UpdatedAt` but no self-signature (`Sig` null) — the authority cannot produce
+   * `UpdatedAt` but no self-signature (`Sig` null) — the owner cannot produce
    * the peer's self-signature, so the peer must self-publish (see
    * {@link CadreNode.registerSelf}) before the row resolves.
    */
@@ -277,15 +323,20 @@ export class SeedBootstrapService {
   }
 
   /**
-   * Authority-signed INSERT of this node's OWN self-signed address record.
+   * Owner-signed INSERT of this node's OWN self-signed address record.
    *
    * Used by {@link CadreNode.registerSelf} when the node is not yet a member and
-   * is its own authority (it holds the authority key): the row is authority-signed
+   * is its own owner (it holds the owner key): the row is owner-signed
    * (satisfying `AuthorizedInsert`) AND carries a valid self-`Sig`, so it resolves
    * immediately without a follow-up self-update.
+   *
+   * @returns `true` when this call seated the row, `false` when a concurrent writer
+   *   (e.g. an {@link authorizePeer} of this node's own id) had already seated it —
+   *   in which case the row in the database is NOT this record and carries whatever
+   *   `Sig` that writer had, so the caller must self-update to publish its signature.
    */
-  async insertSelfPeerRecord(record: PeerAddressRecord): Promise<void> {
-    await this.insertCadrePeerRow({
+  async insertSelfPeerRecord(record: PeerAddressRecord): Promise<boolean> {
+    return await this.insertCadrePeerRow({
       peerId: record.peerId,
       publicKey: record.publicKey,
       multiaddr: record.addrs.join(','),
@@ -295,11 +346,20 @@ export class SeedBootstrapService {
   }
 
   /**
-   * Shared authority-signed `CadrePeer` INSERT. Signs `digest(peerId)` with the
-   * authority key (satisfying `AuthorizedInsert`) and writes the full record
-   * row. The authority signature does NOT cover the address columns — those are
-   * vouched only as far as the authority asserts them, and a peer's own `Sig`
-   * (when present) is what makes the row resolvable.
+   * Shared owner-signed `CadrePeer` INSERT — the row fields and the owner-key
+   * precondition; the stamp mint, voucher signature, write lock, existence check and
+   * membership notify are all {@link ControlDatabase.insertCadrePeer}'s (see there for
+   * the anti-replay and insert-race rationale). No `CadrePeer` write may bypass that
+   * method: the write is what admits the peer's traffic.
+   *
+   * The DB check precedes the owner-key check here, matching the order this method has
+   * always surfaced them (the owner-key error used to come out of the signer, after the
+   * DB check).
+   *
+   * @returns `true` when this call performed the INSERT, `false` when the row was
+   *   already seated by a concurrent writer. The loser needs to know: an authorize seats
+   *   a row with a null `Sig`, so a self-publish that lost the race must fall through to
+   *   a self-update or its record never lands.
    */
   private async insertCadrePeerRow(row: {
     peerId: string;
@@ -307,78 +367,122 @@ export class SeedBootstrapService {
     multiaddr: string;
     updatedAt: number;
     sig: string | null;
-  }): Promise<void> {
-    const signature = this.signPeerAuthorization(row.peerId);
+  }): Promise<boolean> {
     if (!this.controlDatabase) {
       throw new Error('Control database not initialized');
     }
-    const db = this.controlDatabase.getDatabase();
-    await db.exec(`
-      insert into CadreControl.CadrePeer (PeerId, PublicKey, Multiaddr, UpdatedAt, Sig)
-        with context AuthorityKey = ?, Signature = ?
-        values (?, ?, ?, ?, ?)
-    `, [this.authorityPublicKey, signature, row.peerId, row.publicKey, row.multiaddr, row.updatedAt, row.sig]);
+    const ownerKey = this.requireOwnerPublicKey();
+    return await this.controlDatabase.insertCadrePeer(
+      row, ownerKey, message => this.signMessageBytes(message),
+    );
   }
 
   /**
-   * Authority-signed INSERT of a peer's OWN self-signed `DeviceToken` row.
+   * Owner-signed INSERT of a peer's OWN self-signed `DeviceToken` row.
    *
    * Counterpart to {@link insertSelfPeerRecord} for the device-token registry: the
-   * row is authority-signed (satisfying `DeviceToken.AuthorizedInsert`, which vouches
-   * membership exactly as `CadrePeer.AuthorizedInsert` does) AND carries the peer's
-   * own self-`Sig` over the token payload. The authority signature covers only the
-   * PeerId — it does NOT vouch the token contents; the peer's `Sig` (verified at
+   * row is owner-signed (satisfying `DeviceToken.AuthorizedInsert` via the
+   * 'add'-tagged digest, {@link deviceTokenAddDigest}) AND carries the peer's
+   * own self-`Sig` over the token payload. The owner signature covers the WHOLE row
+   * (every column, ending in a freshly minted single-use `StampId`) — but covering the
+   * token contents is not the same as vouching them: the peer's `Sig` (verified at
    * resolve time against the bound `CadrePeer.PublicKey`) is what makes the row
    * resolvable. Used by {@link CadreNode.registerDeviceToken} for the first publish
-   * when the node is its own authority.
+   * when the node is its own owner.
+   *
+   * The stamp is per-INSERT, so a re-register after a clear mints a fresh one and a
+   * fresh signature — unaffected by the cleared row's retired stamp
+   * (`DeviceToken.NotRevoked`).
    */
   async insertSelfDeviceToken(record: DeviceTokenRecord): Promise<void> {
-    const signature = this.signPeerAuthorization(record.peerId);
+    const stampId = generateStampId(record.peerId);
+    const signature = this.signDigest(deviceTokenAddDigest({ ...record, stampId }));
     if (!this.controlDatabase) {
       throw new Error('Control database not initialized');
     }
-    const db = this.controlDatabase.getDatabase();
-    await db.exec(`
-      insert into CadreControl.DeviceToken (PeerId, Platform, Token, UpdatedAt, Sig)
-        with context AuthorityKey = ?, Signature = ?
-        values (?, ?, ?, ?, ?)
-    `, [this.authorityPublicKey, signature, record.peerId, record.platform, record.token, record.updatedAt, record.sig]);
-    log('Device token inserted (authority-signed): %s', record.peerId);
+    await this.controlDatabase.execWrite(`
+      insert into CadreControl.DeviceToken (PeerId, Platform, Token, UpdatedAt, Sig, StampId)
+        with context OwnerKey = ?, Signature = ?
+        values (?, ?, ?, ?, ?, ?)
+    `, [this.ownerPublicKey, signature, record.peerId, record.platform, record.token, record.updatedAt, record.sig, stampId]);
+    log('Device token inserted (owner-signed): %s', record.peerId);
   }
 
   /**
-   * Authority-signed DELETE of a peer's `DeviceToken` row (logout / token
-   * invalidation). The `DeviceToken.AuthorizedInsert` constraint gates both insert
-   * AND delete on an authority signature over `digest(old.PeerId)`, so — like
-   * {@link removePeer} for `CadrePeer` — clearing a token requires the authority key.
+   * Owner-signed DELETE of a peer's `DeviceToken` row (logout / token
+   * invalidation). The `DeviceToken.AuthorizedDelete` constraint validates an owner
+   * signature over the 'remove'-tagged digest bound to the STORED row's
+   * (PeerId, StampId) — deliberately distinct from the insert digest, so a captured
+   * insert approval can never be replayed to clear a token. Like {@link removePeer}
+   * for `CadrePeer`, clearing a token requires the owner key.
+   *
+   * The delete and the `Revocation` tombstone retiring the row's `StampId` commit in
+   * ONE transaction — `DeviceToken.RevocationRecorded` refuses a bare delete, and
+   * without the tombstone the stamp would free up and the never-expiring insert
+   * approval (which the cleared device holds a copy of) would re-seat the token. The
+   * tombstone carries its OWN owner signature: retiring a stamp permanently forecloses
+   * that row, so it is an owner action in its own right.
+   *
+   * Both digests, the stamp read, and the transaction come from
+   * {@link ControlDatabase.deleteDeviceToken} — one shared implementation across
+   * `CadrePeer` / `DeviceToken` / `Strand` / `ValidationKey`. What stays here is the
+   * owner-key precondition; a no-op on an already-absent row is the shared body's
+   * behavior, and unlike {@link removePeer} nothing here rides on it.
    */
   async deleteDeviceToken(peerId: string): Promise<void> {
-    const signature = this.signPeerAuthorization(peerId);
+    // Fail fast on a keyless service BEFORE the DB read, so a non-owner gets the
+    // owner-key error rather than a silent no-op on an absent row.
+    const ownerKey = this.requireOwnerPublicKey();
     if (!this.controlDatabase) {
       throw new Error('Control database not initialized');
     }
-    const db = this.controlDatabase.getDatabase();
-    await db.exec(`
-      delete from CadreControl.DeviceToken
-        with context AuthorityKey = ?, Signature = ?
-        where PeerId = ?
-    `, [this.authorityPublicKey, signature, peerId]);
-    log('Device token removed (authority-signed): %s', peerId);
+    await this.controlDatabase.deleteDeviceToken(
+      peerId, ownerKey, message => this.signMessageBytes(message),
+    );
   }
 
   /**
-   * Sign a peer ID with the authority key for a `CadrePeer` / `DeviceToken`
-   * insert-or-delete. The signed bytes come from the shared
-   * {@link peerAuthorizationDigest} helper so the offline `cadre enroll register`
-   * verifier checks the exact same construction. Throws if no authority key is set.
+   * Return the configured owner private key, or throw if none is set. The single
+   * precondition gate for every owner-signed write. {@link removePeer} /
+   * {@link reauthorizePeer} read the row's `StampId` from the DB BEFORE they sign, so
+   * they call this up front — otherwise a keyless service would either surface the
+   * wrong "Control database not initialized" error or, worse, silently no-op when the
+   * target row is absent (the early `stampId === null` return) instead of rejecting.
    */
-  private signPeerAuthorization(peerId: string): string {
-    if (!this.config.authorityPrivateKey) {
-      throw new Error('Authority private key required to authorize peers');
+  private requireOwnerPrivateKey(): string {
+    if (!this.config.ownerPrivateKey) {
+      throw new Error('Owner private key required to authorize peers');
     }
+    return this.config.ownerPrivateKey;
+  }
+
+  /**
+   * The owner PUBLIC key that rides in every owner-signed write's context, non-null.
+   *
+   * The field is nullable because a read-only service carries no owner key at all, but the
+   * constructor derives the public key whenever `ownerPrivateKey` is set — so gating on
+   * {@link requireOwnerPrivateKey} first makes the pair inseparable and the second throw
+   * unreachable. Callers that must reject a keyless service BEFORE any DB read use this as
+   * their first line and get the owner-key precondition for free.
+   */
+  private requireOwnerPublicKey(): string {
+    this.requireOwnerPrivateKey();
+    if (!this.ownerPublicKey) {
+      throw new Error('Owner public key required to authorize peers');
+    }
+    return this.ownerPublicKey;
+  }
+
+  /**
+   * Sign a base64url digest with the owner key (ed25519). The single place the
+   * owner private key is applied; callers pass the canonical domain-tagged digest for
+   * the specific action ({@link deviceTokenAddDigest}), or the raw-bytes form via
+   * {@link signMessageBytes}. Throws if no owner key is set.
+   */
+  private signDigest(digestB64url: string): string {
     return sign(
-      peerAuthorizationDigest(peerId),
-      this.config.authorityPrivateKey,
+      digestB64url,
+      this.requireOwnerPrivateKey(),
       'ed25519',
       'base64url',
       'base64url',
@@ -387,78 +491,140 @@ export class SeedBootstrapService {
   }
 
   /**
-   * Remove a peer from the cadre by authority signature.
+   * Adapt the control database's raw-bytes `signMessage` callback (every guarded delete
+   * takes one) to {@link signDigest}'s base64url-string form. Both encodings hash to the
+   * same signed bytes (`sign` decodes its base64url input), so a signature minted here
+   * satisfies the same schema CHECK as one from the callers that sign the bytes directly — see
+   * `control-revocation-replay.spec.ts`'s "raw-bytes and digest-string signers agree".
+   */
+  private signMessageBytes(message: Uint8Array): string {
+    return this.signDigest(uint8ArrayToString(message, 'base64url'));
+  }
+
+  /**
+   * Remove a peer from the cadre by owner signature.
    *
-   * The constraint over CadrePeer's `check on insert, delete` validates a
-   * signature over `digest(old.PeerId)` by an authority key. We use the same
-   * digest pattern as authorizePeer.
+   * The `CadrePeer.AuthorizedDelete` (`check on delete`) constraint validates a
+   * signature over the DISTINCT 'remove'-tagged digest
+   * `digest('CadreControl.CadrePeer', 'remove', old.PeerId, old.StampId)` by an owner
+   * key — deliberately NOT the insert voucher digest, so the row's stored `VouchSig` can
+   * never be replayed to delete.
+   *
+   * The delete and the `Revocation` tombstone retiring the row's `StampId` commit in ONE
+   * transaction — `CadrePeer.RevocationRecorded` refuses a bare delete, and without the
+   * tombstone the stamp would free up and the original admission approval (which never
+   * expires, and which the removed peer holds a copy of) would re-seat the row.
+   *
+   * The tombstone is separately owner-signed (satisfying `Revocation.Authorized`):
+   * retiring a stamp evicts that peer party-wide and permanently forecloses re-admitting
+   * the row, so it is an owner action in its own right, not a side effect the delete's
+   * signature covers.
+   *
+   * Both digests, the stamp read, the transaction, and the post-commit membership notify
+   * come from {@link ControlDatabase.deleteCadrePeer} — one shared implementation across
+   * `CadrePeer` / `DeviceToken` / `Strand` / `ValidationKey`. What stays here is the
+   * owner-key precondition and the absent-row gate the notify depends on (below).
    */
   async removePeer(peerId: string): Promise<void> {
-    // Same canonical digest as the authorizing INSERT (see peerAuthorizationDigest);
-    // also validates the authority key is present before touching the database.
-    const signature = this.signPeerAuthorization(peerId);
+    // Fail fast on a keyless service BEFORE any DB read: a non-owner cannot sign the
+    // remove digest, and this precedence (owner key, then control DB) is what the
+    // unit contract asserts.
+    const ownerKey = this.requireOwnerPublicKey();
     if (!this.controlDatabase) {
       throw new Error('Control database not initialized');
     }
+    // This absent-row gate must stay OUTSIDE the delete, even though the delete repeats it
+    // internally: deleteCadrePeer's membership notify fires whenever its body resolves,
+    // with no idea whether the body wrote anything, so delegating an absent peer would
+    // fire a spurious membership notification.
+    // NOTE: deleteCadrePeer re-reads the StampId, so a peer removed by another writer
+    // between the two reads no-ops silently yet still notifies. Narrow concurrent-removal
+    // window only — the common "already absent" case is caught here.
+    const stampId = await this.controlDatabase.queryCadrePeerStampId(peerId);
+    if (stampId === null) {
+      log('removePeer: no CadrePeer row for %s (already absent)', peerId);
+      return;
+    }
 
     log('Removing peer: %s', peerId);
 
-    const db = this.controlDatabase.getDatabase();
-    await db.exec(`
-      delete from CadreControl.CadrePeer
-        with context AuthorityKey = ?, Signature = ?
-        where PeerId = ?
-    `, [this.authorityPublicKey, signature, peerId]);
+    await this.controlDatabase.deleteCadrePeer(
+      peerId, ownerKey, message => this.signMessageBytes(message),
+    );
 
-    log('Peer %s removed successfully', peerId);
+    log('Peer %s removed successfully (stamp retired)', peerId);
   }
 
   /**
-   * Authority "re-touch" of an existing `CadrePeer` membership row: bump
-   * `UpdatedAt` under the authority branch of `CadrePeer.AuthorizedUpdate` (a
-   * signature over `digest(peerId)` — the same construction {@link authorizePeer}
-   * uses) so the row is re-emitted as a fresh, broadcasting transaction.
+   * Owner "re-touch" of an existing `CadrePeer` membership row: bump `UpdatedAt` and
+   * re-vouch the row so it is re-emitted as a fresh, broadcasting transaction. This is
+   * the write-while-alone re-replication primitive (`control-write-ensure-replicated`):
+   * a membership row that committed local-only (its block's cluster ≤1 at insert) is
+   * pushed to the cohort once it grows.
    *
-   * This is the write-while-alone re-replication primitive
-   * (`control-write-ensure-replicated`): a membership row that committed
-   * local-only (its block's cluster ≤1 at insert) is pushed to the cohort once it
-   * grows, by re-issuing this monotonic bump. It is an UPDATE (not the original
-   * INSERT) because the row already exists locally; a re-INSERT would hit the
-   * `PeerId` PK. Only the freshness stamp changes — `PublicKey` / `Multiaddr` /
-   * `Sig` are left intact — so it is safe over a row whose peer has not
-   * self-published (`Sig` null); the caller must skip a row that already carries a
-   * self-`Sig` (that row is the owning peer's to refresh, and bumping `UpdatedAt`
-   * without re-signing would invalidate its self-signature).
+   * The stamp read, the voucher signature, the write lock and the membership notify are
+   * {@link ControlDatabase.reauthorizeCadrePeer}'s — including the caveat that it rebinds
+   * `VouchOwner` to this node's owner key. What stays here is the owner-key precondition.
+   *
+   * A no-op (no throw, no notify) when the row does not exist.
    *
    * @param peerId - the membership row to re-touch.
    * @param updatedAt - the strictly-increasing freshness stamp to write.
-   * @throws if no authority private key is configured (a non-authority cannot
+   * @throws if no owner private key is configured (a non-owner cannot
    *   re-sign another peer's row) or the control database is not initialized.
    */
   async reauthorizePeer(peerId: string, updatedAt: number): Promise<void> {
-    // Reuses the exact digest authorizePeer signs (peerAuthorizationDigest), which
-    // the authority branch of AuthorizedUpdate verifies; throws if no authority key.
-    const signature = this.signPeerAuthorization(peerId);
+    // Fail fast on a keyless service before any DB read (see removePeer): a non-owner
+    // cannot re-sign the voucher, and must not silently no-op on an absent row.
+    const ownerKey = this.requireOwnerPublicKey();
     if (!this.controlDatabase) {
       throw new Error('Control database not initialized');
     }
-    const db = this.controlDatabase.getDatabase();
-    await db.exec(`
-      update CadreControl.CadrePeer
-        with context AuthorityKey = ?, Signature = ?
-        set UpdatedAt = ?
-        where PeerId = ?
-    `, [this.authorityPublicKey, signature, updatedAt, peerId]);
+    const retouched = await this.controlDatabase.reauthorizeCadrePeer(
+      peerId, updatedAt, ownerKey, message => this.signMessageBytes(message),
+    );
+    if (!retouched) {
+      log('reauthorizePeer: no CadrePeer row for %s (nothing to re-touch)', peerId);
+      return;
+    }
     log('Peer %s re-authorized (UpdatedAt=%d) for write-while-alone re-replication', peerId, updatedAt);
   }
 
+  /**
+   * Owner re-issue of a batch of `Revocation` tombstones: bump each row's
+   * `ReissuedAt` so the storage layer re-broadcasts a tombstone that committed
+   * while the node was alone. The delete-while-alone counterpart of
+   * {@link reauthorizePeer} — a removed row cannot be re-touched (it is gone),
+   * but its tombstone can, and every membership read treats a retired stamp as
+   * absent.
+   *
+   * The signatures, the single transaction, and the strictly-monotonic
+   * `reissuedAt` contract are {@link ControlDatabase.reissueRevocations}'s. What
+   * stays here is the owner-key precondition.
+   *
+   * @returns how many tombstones were re-issued (`rows.length` on success).
+   * @throws if no owner private key is configured or the control database is not
+   *   initialized.
+   */
+  async reissueRevocations(rows: readonly RevocationRow[], reissuedAt: number): Promise<number> {
+    // Fail fast on a keyless service before any DB work (see removePeer): a
+    // non-owner cannot sign the reissue digests.
+    const ownerKey = this.requireOwnerPublicKey();
+    if (!this.controlDatabase) {
+      throw new Error('Control database not initialized');
+    }
+    return this.controlDatabase.reissueRevocations(
+      rows, reissuedAt, ownerKey, message => this.signMessageBytes(message),
+    );
+  }
+
   /**
    * Create a seed from the current control network state.
-   * The seed contains peer information and is signed by an authority.
+   * The seed contains peer information and is signed by an owner.
    */
   async createSeed(): Promise<ControlNetworkSeed> {
-    if (!this.config.authorityPrivateKey || !this.authorityPublicKey) {
-      throw new Error('Authority key required to create seeds');
+    if (!this.config.ownerPrivateKey || !this.ownerPublicKey) {
+      throw new Error('Owner key required to create seeds');
     }
     
     if (!this.controlDatabase || !this.libp2pNode) {
@@ -481,7 +647,7 @@ export class SeedBootstrapService {
     const seedDigest = digest([seedJson], 'sha256', 'base64url') as string;
     const signature = sign(
       seedDigest,
-      this.config.authorityPrivateKey,
+      this.config.ownerPrivateKey,
       'ed25519',
       'base64url',
       'base64url',
@@ -491,7 +657,7 @@ export class SeedBootstrapService {
     const seed: ControlNetworkSeed = {
       ...seedData,
       signature,
-      signerKey: this.authorityPublicKey,
+      signerKey: this.ownerPublicKey,
     };
     
     log('Created seed with %d peers', peers.length);
@@ -503,10 +669,15 @@ export class SeedBootstrapService {
    *
    * Validates the seed signature, then evaluates a trust anchor for the
    * `signerKey` that does NOT come from the seed body: the receiver's
-   * `AuthorityKey` table (DB-anchored), optionally augmented by pinned keys or
-   * TOFU via the configured/overriding `SeedTrustPolicy`. A forged
-   * self-asserting seed — one that merely lists its own signer as an authority
-   * peer — no longer passes.
+   * node-local {@link SeedBootstrapConfig.trustedOwners} anchor, optionally
+   * augmented by pinned keys or TOFU via the configured/overriding
+   * `SeedTrustPolicy`. A forged self-asserting seed — one that merely lists its
+   * own signer as an owner peer — no longer passes, and neither does one signed
+   * by a key a stranger genesis-inserted into the replicated `OwnerKey` table.
+   *
+   * A key accepted via a pin/TOFU is persisted into the anchor (the policy says
+   * so via `SeedTrustDecision.anchorAs`), so the next seed from that owner is
+   * anchored without re-supplying the invite.
    *
    * @param seed - The seed to apply (already transport-decoded).
    * @param options.trustPolicy - Per-call policy override (e.g. a
@@ -518,35 +689,39 @@ export class SeedBootstrapService {
     options?: { trustPolicy?: SeedTrustPolicy }
   ): Promise<ApplySeedResult> {
     if (!this.libp2pNode) {
-      return { success: false, peersAdded: 0, error: 'Service not initialized' };
+      return seedRejected('Service not initialized');
     }
 
+    // NOTE: `seed.partyId` is never checked against `config.partyId`. Nothing
+    // downstream reads it — trust is keyed on `signerKey` vs the anchor, and the
+    // anchor a stray-party seed could write into belongs to THIS party, which
+    // only a caller-supplied pin for that signer can reach. If applying a seed
+    // ever branches on its partyId (or the anchor becomes multi-party), reject a
+    // mismatch here instead.
     log('Applying seed for party: %s', seed.partyId);
 
     // Validate the seed signature
     if (!this.validateSeedSignature(seed)) {
-      return { success: false, peersAdded: 0, error: 'Invalid seed signature' };
+      return seedRejected('Invalid seed signature');
     }
 
-    // Evaluate the trust anchor for the signer key. The known-authority set is
-    // sourced from the receiver's control DB, never from the seed itself; a
-    // cold-start node with no DB and no override therefore sees an empty set.
-    const knownAuthorityKeys = this.controlDatabase
-      ? await this.controlDatabase.getAuthorityKeys()
-      : new Set<string>();
+    // Evaluate the trust anchor for the signer key. The known-owner set comes
+    // from the receiver's NODE-LOCAL anchor — never from the seed itself, and
+    // never from the replicated OwnerKey table (a stranger can genesis-insert
+    // its own key there and let it replicate into every peer's copy). A node
+    // whose anchor was never seeded, with no policy override, sees an empty set
+    // and rejects.
+    const knownOwnerKeys = this.config.trustedOwners?.all() ?? new Set<string>();
     const policy = options?.trustPolicy ?? this.trustPolicy;
     const decision = await policy.evaluate({
       partyId: seed.partyId,
       signerKey: seed.signerKey,
-      knownAuthorityKeys,
+      knownOwnerKeys,
     });
     if (!decision.trusted) {
-      return {
-        success: false,
-        peersAdded: 0,
-        error: decision.reason ?? 'Signer key not trusted by trust policy',
-      };
+      return seedRejected(decision.reason ?? 'Signer key not trusted by trust policy');
     }
+    await this.anchorAcceptedSigner(seed.signerKey, decision);
 
     let peersAdded = 0;
 
@@ -570,23 +745,71 @@ export class SeedBootstrapService {
       }
     }
 
-    // Dial authority peers to establish connections
-    for (const peer of seed.peers.filter(p => p.isAuthority)) {
+    // Dial owner peers to establish connections. Best-effort and COUNTED: an
+    // owner that is momentarily down leaves this node seeded but unconnected,
+    // which the caller can only see if the outcome is reported (see
+    // `ApplySeedResult.ownerDialsFailed`). Recovery is not this loop's job —
+    // `CadreNode.dialColdStartBootstrap` retries these same addresses on every
+    // control-cohort reconcile pass until the control database has siblings.
+    // `createSeed` projects EVERY CadrePeer row, so an owner applying a seed
+    // minted after it joined finds ITSELF in the owner list. Dialing self always
+    // throws, which would report a healthy owner as "seeded but stranded".
+    // Optional-chained: partial libp2p handles (unit-test doubles) omit `peerId`,
+    // and an undefined self simply matches nothing.
+    const selfPeerId = this.libp2pNode.peerId?.toString();
+    let ownerDialsAttempted = 0;
+    let ownerDialsFailed = 0;
+    for (const peer of seed.peers.filter(p => p.isOwner)) {
+      if (peer.multiaddrs.length === 0 || peer.peerId === selfPeerId) {
+        continue;
+      }
+      ownerDialsAttempted++;
       try {
-        if (peer.multiaddrs.length > 0) {
-          const addr = multiaddr(peer.multiaddrs[0]);
+        const addr = multiaddr(peer.multiaddrs[0]);
 
-          log('Dialing authority peer: %s', peer.peerId);
-          await this.libp2pNode.dial(addr);
-        }
+        log('Dialing owner peer: %s', peer.peerId);
+        await this.libp2pNode.dial(addr);
       } catch (error) {
+        ownerDialsFailed++;
         log('Failed to dial peer %s: %o', peer.peerId, error);
         // Continue - not all peers need to be reachable
       }
     }
 
-    log('Applied seed: %d peers added', peersAdded);
-    return { success: true, peersAdded };
+    log('Applied seed: %d peers added, %d/%d owner dial(s) failed',
+      peersAdded, ownerDialsFailed, ownerDialsAttempted);
+    return { success: true, peersAdded, ownerDialsAttempted, ownerDialsFailed };
+  }
+
+  /**
+   * Persist a signer that a pin/TOFU accepted into the node-local anchor, so a
+   * later seed from the same owner is anchored without re-supplying the invite
+   * or re-prompting. Only the policy decides this happens (`anchorAs` is unset
+   * when the key was already anchored, so a plain re-apply writes nothing) and
+   * `trust()` is idempotent, keeping the original provenance for a known key.
+   *
+   * Failure to PERSIST does not fail the seed: `trust()` reflects the key in the
+   * in-memory anchor synchronously, so this seed and the rest of the session are
+   * unaffected — only durability across a restart is lost, and that is logged.
+   *
+   * NOTE: anchoring a key can flip `CadrePeer` rows ALREADY present from
+   * unauthorized to authorized, which the write-driven membership-gate refresh
+   * (`ControlDatabase.mutateCadrePeer`) cannot see — no row was written. Every
+   * anchor mutation today rides seed application, and both seed paths refresh the
+   * gate explicitly afterwards (`CadreNode.applySeed`, `onSeedApplied`). If some
+   * future path anchors an owner OUTSIDE seed application, it owes the same
+   * `CadreNode.refreshMembershipGate()` — or the anchor needs its own hub.
+   */
+  private async anchorAcceptedSigner(signerKey: string, decision: SeedTrustDecision): Promise<void> {
+    if (!decision.anchorAs || !this.config.trustedOwners) {
+      return;
+    }
+    try {
+      await this.config.trustedOwners.trust(signerKey, decision.anchorAs);
+      log('Anchored seed signer %s as %s', signerKey, decision.anchorAs);
+    } catch (error) {
+      log('Failed to persist accepted seed signer into the trusted-owner anchor: %o', error);
+    }
   }
 
   /**
@@ -608,61 +831,86 @@ export class SeedBootstrapService {
 
   /**
    * Deliver a seed directly to a peer via the /sereus/seed/1.0.0 protocol.
+   *
+   * Sender hardening: the whole exchange — dial, write, ack read — is bounded by
+   * {@link seedDeliverTimeoutMs}, and the ack is capped at {@link MAX_SEED_SIZE}.
+   * The target is a NOT-YET-TRUSTED node the instigator chose to dial during
+   * onboarding, so an unbounded read here is strictly more exposed than the
+   * membership-gated receiver paths: without the bound a target that accepts the
+   * stream and never replies parks this call forever, and one that streams
+   * arbitrary bytes as a fake ack exhausts memory.
    */
   async deliverSeed(targetMultiaddr: string, seed: ControlNetworkSeed): Promise<SeedAckMessage> {
     if (!this.libp2pNode) {
       throw new Error('Service not initialized');
     }
-
+    // Capture the node so the closure below needs no non-null assertion.
+    const node = this.libp2pNode;
     const addr = multiaddr(targetMultiaddr);
 
     log('Delivering seed to: %s', targetMultiaddr);
 
-    // Dial the target and open a stream
-    const rawStream = await this.libp2pNode.dialProtocol(addr, SEED_PROTOCOL);
-    const stream = rawStream as unknown as ControlStream;
-
-    try {
-      // Send the seed message as one length-prefixed frame (shared writer).
-      const message: SeedMessage = {
-        partyId: seed.partyId,
-        peers: seed.peers,
-        signature: seed.signature,
-        signerKey: seed.signerKey,
-      };
-
-      writeFrame(stream, message);
-
-      // In libp2p v3.x, close() closes the write end only (signals EOF),
-      // while the read end remains open for receiving the ack.
-      await stream.close();
+    return await withDeadline(
+      this.seedDeliverTimeoutMs,
+      `Seed delivery to ${targetMultiaddr}`,
+      (signal) => this.sendSeed(node, addr, seed, signal),
+    );
+  }
 
-      // Read the acknowledgment (stream is AsyncIterable in libp2p 3.x)
-      const chunks: Uint8Array[] = [];
-      for await (const chunk of stream) {
-        const bytes = chunk instanceof Uint8Array ? chunk : (chunk as { subarray(): Uint8Array }).subarray();
-        chunks.push(bytes);
-      }
+  /**
+   * Open one stream to the target, send the seed frame, half-close, and read the ack.
+   *
+   * `signal` is the deadline from {@link deliverSeed}: it goes to `dialProtocol` so
+   * a timeout during connect aborts the dial, and into {@link exchangeFrame} so a
+   * timeout after the stream is open resets it — releasing the otherwise unbounded
+   * ack-read.
+   *
+   * Deliberately NOT `runOnLimitedConnection`: a wake sets it because a wake is a
+   * tiny frame over a relay, whereas a seed is up to 1MB and this delivery path
+   * does not dial relay addresses today. Changing that is a separate decision.
+   */
+  private async sendSeed(
+    node: Libp2p,
+    addr: Multiaddr,
+    seed: ControlNetworkSeed,
+    signal: AbortSignal,
+  ): Promise<SeedAckMessage> {
+    const rawStream = await node.dialProtocol(addr, SEED_PROTOCOL, { signal });
 
-      const responseData = new Uint8Array(chunks.reduce((sum, c) => sum + c.length, 0));
-      let offset = 0;
-      for (const chunk of chunks) {
-        responseData.set(chunk, offset);
-        offset += chunk.length;
-      }
+    const message: SeedMessage = {
+      partyId: seed.partyId,
+      peers: seed.peers,
+      signature: seed.signature,
+      signerKey: seed.signerKey,
+    };
 
-      // Parse length-prefixed response
-      const responseBody = decodeLengthPrefixedFrame(responseData);
-      const responseJson = new TextDecoder().decode(responseBody);
-      const ack = JSON.parse(responseJson) as SeedAckMessage;
+    const ack = await exchangeFrame(
+      rawStream as unknown as ControlStream,
+      signal,
+      message,
+      (stream) => this.readSeedAck(stream),
+      'Seed delivery aborted by timeout',
+    );
 
-      log('Seed delivery response: accepted=%s', ack.accepted);
-      return ack;
+    log('Seed delivery response: accepted=%s', ack.accepted);
+    return ack;
+  }
 
-    } catch (err) {
-      stream.abort(err instanceof Error ? err : new Error(String(err)));
-      throw err;
-    }
+  /**
+   * Read the ack frame a delivery target writes back, bounded by
+   * {@link seedDeliverTimeoutMs} and capped at {@link MAX_SEED_SIZE} — an
+   * untrusted target must not be able to stream unlimited bytes as a fake ack.
+   * Decoding runs inside {@link exchangeFrame}'s `try`, so a malformed or
+   * non-JSON ack resets the stream rather than leaking it.
+   */
+  private async readSeedAck(stream: ControlStream): Promise<SeedAckMessage> {
+    const data = await readStreamToEnd(stream, {
+      maxBytes: MAX_SEED_SIZE,
+      timeoutMs: this.seedDeliverTimeoutMs,
+      label: 'Seed ack',
+    });
+    const body = decodeLengthPrefixedFrame(data, MAX_SEED_SIZE);
+    return JSON.parse(new TextDecoder().decode(body)) as SeedAckMessage;
   }
 
   /**
@@ -711,19 +959,27 @@ export class SeedBootstrapService {
   /**
    * Query peers from the control database.
    *
-   * Authority identity is sourced from the `AuthorityKey` table, not from the
+   * Owner identity is sourced from the `OwnerKey` table, not from the
    * transport peer ID. An Ed25519 libp2p PeerId embeds its public key (identity
    * multihash), so each peer's ed25519 key is derivable from its `PeerId`; a
-   * peer is an authority iff that derived key is in the `AuthorityKey` set.
-   * This makes any authority node markable — not just the local one — and ties
-   * `isAuthority` to the control table rather than to `peerId === self`.
+   * peer is an owner iff that derived key is in the `OwnerKey` set.
+   * This makes any owner node markable — not just the local one — and ties
+   * `isOwner` to the control table rather than to `peerId === self`.
+   *
+   * NOTE: this is the one owner lookup deliberately left on the REPLICATED
+   * table rather than the node-local anchor. `SeedPeer.isOwner` is a dial hint
+   * — the receiver dials owner-flagged peers first — not a trust decision, and
+   * the receiver re-derives real trust from its own anchor. So a polluted table
+   * costs at most a wasted dial, while anchoring here would silently drop
+   * legitimate co-owners this node never pinned. If `isOwner` ever gates
+   * anything the receiver TRUSTS, move it to the anchor.
    */
   private async queryPeers(): Promise<SeedPeer[]> {
     if (!this.controlDatabase) {
       return [];
     }
 
-    const authorityKeys = await this.controlDatabase.getAuthorityKeys();
+    const ownerKeys = await this.controlDatabase.getOwnerKeys();
     const db = this.controlDatabase.getDatabase();
     const peers: SeedPeer[] = [];
 
@@ -733,16 +989,16 @@ export class SeedBootstrapService {
       const multiaddr = row.Multiaddr as string | null;
 
       // Derive the peer's ed25519 key from its PeerId; a non-Ed25519 peer or an
-      // unparsable id yields null and is treated as a non-authority rather than
+      // unparsable id yields null and is treated as a non-owner rather than
       // failing the whole seed creation.
       const pubKeyB64 = ed25519PublicKeyB64FromPeerId(peerId);
-      const isAuthority = pubKeyB64 !== null && authorityKeys.has(pubKeyB64);
+      const isOwner = pubKeyB64 !== null && ownerKeys.has(pubKeyB64);
 
       peers.push({
         peerId,
         multiaddrs: multiaddr ? multiaddr.split(',') : [],
-        isAuthority,
-        ...(isAuthority ? { publicKey: pubKeyB64 } : {}),
+        isOwner,
+        ...(isOwner ? { publicKey: pubKeyB64 } : {}),
       });
     }
 
@@ -821,7 +1077,7 @@ export class SeedBootstrapService {
 
       // Emit appropriate event based on result
       if (result.success) {
-        this.eventCallbacks.onSeedApplied?.(seed.partyId, result.peersAdded);
+        this.eventCallbacks.onSeedApplied?.(seed.partyId, result.peersAdded, seed);
       } else {
         this.eventCallbacks.onSeedError?.(seed.partyId, result.error ?? 'Unknown error');
       }
@@ -921,29 +1177,37 @@ export class SeedBootstrapService {
     // configured (typically by `@serfab/cadre-host`'s NatService), it takes
     // priority — it may substitute a DDNS hostname and externally-mapped
     // port for the raw LAN multiaddrs libp2p reports.
-    let authorityAddrs: string[];
+    let ownerAddrs: string[];
     if (this.config.inviteAddressResolver) {
       try {
-        authorityAddrs = await this.config.inviteAddressResolver();
+        ownerAddrs = await this.config.inviteAddressResolver();
       } catch (err) {
         log('inviteAddressResolver threw, falling back to libp2pNode.getMultiaddrs(): %o', err);
-        authorityAddrs = this.libp2pNode.getMultiaddrs().map(a => a.toString());
+        ownerAddrs = this.libp2pNode.getMultiaddrs().map(a => a.toString());
       }
     } else {
-      authorityAddrs = this.libp2pNode.getMultiaddrs().map(a => a.toString());
+      ownerAddrs = this.libp2pNode.getMultiaddrs().map(a => a.toString());
     }
 
-    // Carry the cadre's authority keys out-of-band so a cold-start invitee can
-    // pin the trusted authority set before applying any seed.
-    const authorityKeys = this.controlDatabase
-      ? Array.from(await this.controlDatabase.getAuthorityKeys())
-      : [];
+    // Carry the cadre's owner keys out-of-band so a cold-start invitee can pin
+    // the trusted owner set before applying any seed.
+    //
+    // Sourced ONLY from this node's own anchor, never from the replicated
+    // OwnerKey table: the invitee anchors whatever arrives here
+    // (CadreNode.trustOwnerKeys with source 'invite'), so handing over the
+    // pollutable table would let a stranger's genesis-inserted key ride an
+    // otherwise-legitimate invite straight into the new node's anchor —
+    // poisoning the very store this whole trust chain rests on. No anchor wired
+    // (a directly-constructed service) means no pins to hand out: an invite
+    // without `ownerKeys` costs the invitee an extra out-of-band step, whereas a
+    // table-sourced one silently hands it an unanchored key.
+    const ownerKeys = Array.from(this.config.trustedOwners?.all() ?? []);
 
     const now = Date.now();
     const invite: CadreInvite = {
       partyId: this.config.partyId,
-      authorityAddrs,
-      authorityKeys: authorityKeys.length ? authorityKeys : undefined,
+      ownerAddrs,
+      ownerKeys: ownerKeys.length ? ownerKeys : undefined,
       token,
       createdAt: now,
       expiresAt: expiresIn ? now + expiresIn : undefined,
@@ -951,7 +1215,7 @@ export class SeedBootstrapService {
 
     const encodedInvite = this.encodeInvite(invite);
 
-    log('Invite created with %d authority addresses, %d authority keys', authorityAddrs.length, authorityKeys.length);
+    log('Invite created with %d owner addresses, %d owner keys', ownerAddrs.length, ownerKeys.length);
 
     return { invite, encodedInvite };
   }
@@ -1045,11 +1309,11 @@ export class SeedBootstrapService {
   }
 
   /**
-   * Dial an authority from an invite.
-   * Use this on a phone after receiving an invite to connect to the authority.
+   * Dial an owner from an invite.
+   * Use this on a phone after receiving an invite to connect to the owner.
    *
    * @param invite - The invite received out-of-band
-   * @returns Connection to the authority
+   * @returns Connection to the owner
    */
   async dialInvite(invite: CadreInvite): Promise<void> {
     if (!this.libp2pNode) {
@@ -1061,15 +1325,15 @@ export class SeedBootstrapService {
       throw new Error('Invite has expired');
     }
 
-    log('Dialing invite authority with %d addresses', invite.authorityAddrs.length);
+    log('Dialing invite owner with %d addresses', invite.ownerAddrs.length);
 
-    // Try each authority address until one succeeds
+    // Try each owner address until one succeeds
     let lastError: Error | null = null;
-    for (const addrStr of invite.authorityAddrs) {
+    for (const addrStr of invite.ownerAddrs) {
       try {
         const addr = multiaddr(addrStr);
         await this.libp2pNode.dial(addr);
-        log('Connected to authority at: %s', addrStr);
+        log('Connected to owner at: %s', addrStr);
         return;
       } catch (error) {
         lastError = error instanceof Error ? error : new Error(String(error));
@@ -1077,7 +1341,7 @@ export class SeedBootstrapService {
       }
     }
 
-    throw lastError ?? new Error('No authority addresses available');
+    throw lastError ?? new Error('No owner addresses available');
   }
 }