@serfab/cadre-core 0.9.0 → 0.10.0

package/dist/cadre-node.d.ts

@@ -2,12 +2,15 @@ import type { Libp2p, PeerId } from '@libp2p/interface';
 import type { Multiaddr } from '@multiformats/multiaddr';
 import type { CadreNodeConfig, StrandInstance, StrandConfig, SAppConfig, CadreNodeEvents, ControlNetworkSeed, ApplySeedResult, AddDroneOptions, AddPhoneOptions, DroneInitResult, InviteResult, CadreInvite, OpenInvitation, FormStrandResult, StrandFormationDisclosure, ResolveOpts, SelfRegistrationOutcome, ServiceWakeResult, PushPlatform, DeviceTokenRecord, ResolveDeviceTokenOpts } from './types.js';
 import { type Ed25519KeyPair } from './ed25519-key.js';
+import { type TrustedOwnerStore, type TrustSource } from './trusted-owner-store.js';
+import { type BootstrapPeerStore } from './bootstrap-peer-store.js';
 import { type SAppIdLookup } from './strand-watcher.js';
 import { EnrollmentService } from './enrollment.js';
 import { ControlDatabase } from './control-database.js';
 import { SeedBootstrapService } from './seed-bootstrap.js';
 import type { SeedTrustPolicy } from './seed-trust-policy.js';
 import { StrandSolicitationService, type StrandSolicitationServiceOptions } from './strand-solicitation.js';
+import { type RelayReservationState, type RelayReservationSupervisorOptions } from './relay-reservation.js';
 import type { WakeAck } from './types.js';
 import { type ConnectionPathSummary } from './diagnostics/connection-path.js';
 type EventHandler<T> = (data: T) => void;
@@ -31,6 +34,15 @@ export declare class CadreNode implements SAppIdLookup {
      * launch) reads this resolved field, never `config.privateKey` directly.
      */
     private identityKey;
+    /**
+     * Node-local, NON-replicated trusted-owner anchor (see
+     * `trusted-owner-store.ts`). Constructed (or adopted from
+     * `config.trustedOwners.store`) by {@link initializeTrustedOwnerStore} during
+     * {@link start}; deliberately NOT cleared by {@link cleanup}, so an in-memory
+     * anchor survives a stop()→start() cycle of the same node instance. Never
+     * sourced from replicated control state.
+     */
+    private trustedOwnerStore;
     private controlNode;
     private controlDatabase;
     private strandWatcher;
@@ -70,6 +82,25 @@ export declare class CadreNode implements SAppIdLookup {
      */
     private windowWaiters;
     private eventHandlers;
+    /**
+     * Relay multiaddrs the caller asked {@link reserveRelays} to reserve through.
+     * Empty (the default) means nobody asked, so {@link getRelayReservationState}
+     * reports `none` — this whole surface is opt-in and dormant for the CLI/host
+     * nodes, which use the configured `network.relayAddrs` route instead.
+     */
+    private relayReserveAddrs;
+    /**
+     * The running retry loop for {@link relayReserveAddrs}, or `null` when nobody
+     * asked for a reservation / there was no control node to supervise. It owns the
+     * in-flight flag, the last failure and the next-attempt time; this class only
+     * starts it, stops it and reads it.
+     */
+    private relayReserveSupervisor;
+    /**
+     * Reason {@link reserveRelays} produced no reservation when there is no
+     * supervisor to hold one — i.e. the pre-start `control node unavailable` case.
+     */
+    private relayReserveError;
     /** Map of strandId -> sAppConfig for sAppId filtering and management */
     private sAppConfigs;
     /**
@@ -79,6 +110,106 @@ export declare class CadreNode implements SAppIdLookup {
      * control-network node never needs to dial back to the manager.
      */
     private latestInviteAddresses;
+    /**
+     * Epoch ms until which the control-network inbound gate admits
+     * not-yet-authorized peers (see {@link admitInboundControlConnection} /
+     * {@link openEnrollmentWindow}). 0 = no window open. Opened automatically by
+     * {@link createInvite}; deliberately NOT reset on stop() — a stop/start cycle
+     * inside an outstanding invite's validity must not strand the invitee.
+     *
+     * NOTE: in-memory only, so a PROCESS restart mid-invite closes the door until
+     * the owner re-mints or the invitee is authorized. Fine while invites are
+     * short-lived and redeemed promptly; if long-lived invites or restart-prone
+     * hosts become normal, persist the window (or derive it from the issued-invite
+     * records `SeedBootstrapService` already keeps).
+     */
+    private enrollmentWindowUntil;
+    /**
+     * Lazily-parsed PeerIds of `controlNetwork.bootstrapNodes` (see
+     * {@link getBootstrapPeerIds}) — infrastructure the inbound gate always admits.
+     */
+    private bootstrapPeerIds;
+    /**
+     * Materialized in-memory snapshot of the AUTHORIZED member peer ids (the
+     * {@link listAuthorizedMembers} result), consulted by the per-stream
+     * control-DB gate ({@link authorizeInboundControlStream}). That predicate
+     * runs on EVERY inbound Optimystic control-DB stream and must never await a
+     * control-DB read: those reads pull blocks over the very protocols the
+     * predicate gates, which closes a circular wait that ends in mutual denial
+     * (the upstream gate is fail-closed on timeout, unlike the fail-open
+     * connection gater). So the set is refreshed OUT OF BAND instead — after
+     * start, on every {@link reconcileControlCohort} pass (15s cadence), and
+     * immediately after every LOCAL membership mutation so a just-vouched peer
+     * is admitted without waiting for the timer. That last refresh is AUTOMATIC:
+     * the control database notifies {@link refreshMembershipGate} after every
+     * committed `CadrePeer` write (see `ControlDatabase.mutateCadrePeer`), so no
+     * writer has to remember. A change that arrives by REPLICATION is picked up
+     * on the next timed refresh — bounded staleness, acceptable because this gate
+     * is defense in depth: rows an unadmitted peer manages to write are still
+     * disbelieved at read time by the voucher-anchored predicate.
+     */
+    private authorizedControlPeers;
+    /**
+     * Coalescing state for {@link refreshMembershipGate}: a pending "the snapshot
+     * is stale" flag, the single in-flight drain that consumes it, and the depth
+     * of open {@link deferMembershipGateRefresh} scopes (a burst of writes inside
+     * one scope collapses to a single refresh at scope exit).
+     */
+    private membershipGateDirty;
+    private membershipGateDrain;
+    private membershipGateDeferDepth;
+    /**
+     * In-memory delegate admission grants (see `delegate-admission.ts`): the
+     * strand-node transport peerIds this party's members have announced over the
+     * strand-addr RPC, admitted at the CONNECTION level so a member's NAT'd
+     * strand node can hold a circuit-relay reservation on this node. Consulted
+     * ONLY by {@link admitInboundControlConnection}; the fail-closed per-stream
+     * gate ({@link authorizeInboundControlStream}) never honors it.
+     */
+    private readonly delegateAdmission;
+    /**
+     * When this node last ANNOUNCED a delegate, keyed `<targetPeerId>\n<strandId>`
+     * (the peer announced TO, not the delegate). Throttles
+     * {@link refreshDelegateGrants} to once per `DELEGATE_GRANT_TTL_MS / 2` per
+     * (relay, strand) so the 15 s reconcile tick never becomes per-tick RPC
+     * chatter; the launch/resume announce passes record here too. Keys whose
+     * strand is no longer running are pruned on each reconcile pass.
+     */
+    private readonly delegateAnnounceAt;
+    /**
+     * Cold-start bootstrap dial targets: the owner-flagged peers of every seed
+     * this node has applied, keyed by peer id, valued by the seed's multiaddr
+     * strings (parsed lazily, at dial time). Written by
+     * {@link recordSeedBootstrapPeers}; read only by
+     * {@link dialColdStartBootstrap} while the control database still has no
+     * siblings to dial.
+     *
+     * A STORE rather than a plain map (see `bootstrap-peer-store.ts`), because the
+     * targets must outlive the process: a node seeded into a party it could not
+     * reach has nothing else on disk naming that party's addresses (`applySeed`
+     * writes no control row, and `CadrePeer` fills in only after a connection
+     * succeeds), so an in-memory-only set left it stranded permanently across a
+     * restart. Constructed (or adopted from `config.bootstrapPeers.store`) by
+     * {@link initializeBootstrapPeerStore} during {@link start}; deliberately NOT
+     * cleared by {@link cleanup}, so it survives a stop()→start() cycle of the same
+     * node instance — same lifecycle as {@link trustedOwnerStore}. Durability
+     * depends on the injected backend: Node gets a file-backed store from the CLI,
+     * RN/browser stay ephemeral for now.
+     *
+     * Deliberately NOT the libp2p peer store, which {@link peerStoreAddrs} already
+     * reads for the steady-state path. The peer store is shared with everything
+     * libp2p discovers, so "dial every entry" would grow into dialing arbitrary
+     * discovered peers as the node lives longer; this store holds exactly the peers
+     * an owner-signed, trust-anchored seed nominated as owners. `applySeed` merges
+     * the same addresses into the peer store as well, so the two never disagree —
+     * this one is just the precisely-scoped subset.
+     *
+     * A later seed OVERWRITES an entry rather than merging, so a re-seed after an
+     * owner's address changes replaces the stale address instead of accumulating
+     * dead ones. Entries are never evicted: they are the node's only way back into
+     * the party if it is ever stranded again.
+     */
+    private bootstrapPeerStore;
     /** Initial self-registration timer (see {@link scheduleSelfRegistration}). */
     private selfRegistrationTimer;
     /** TTL heartbeat that re-publishes the self record before it goes stale. */
@@ -107,15 +238,38 @@ export declare class CadreNode implements SAppIdLookup {
      */
     private registerSelfInFlight;
     /**
-     * Re-replication queue for owner control writes that committed while this
-     * node was alone — `controlNode.getConnections().length === 0` at write time
-     * means the Optimystic commit was local-only (the block's cluster was ≤1) and
-     * never broadcast. Maps the affected subject peerId → the write to re-issue once
-     * the cohort grows. A later op for the same subject overwrites an earlier one
-     * (authorize then remove → remove wins). Drained on the 0→≥1 control-connection
-     * transition by {@link drainPendingControlReplication}.
+     * Re-replication queue for owner `authorizePeer` writes that committed while
+     * this node was alone — `controlNode.getConnections().length === 0` at write
+     * time means the Optimystic commit was local-only (the block's cluster was ≤1)
+     * and never broadcast. Maps the affected subject peerId → 'authorize', to
+     * re-issue once the cohort grows. Removals are NOT tracked here — a delete
+     * leaves a `Revocation` tombstone, tracked by {@link pendingRevocations}; a
+     * removePeer also clears any queued authorize for the same subject (the row is
+     * gone, so re-issuing the insert would be wrong). Drained on the 0→≥1
+     * control-connection transition by {@link drainPendingControlReplication}.
      */
     private pendingPeerWrites;
+    /**
+     * Re-replication queue for `Revocation` tombstones that committed while this
+     * node was alone, keyed on the retired `StampId`. Fed by the control DB's
+     * committed-delete seam ({@link noteGuardedDelete}), so one queue covers all
+     * four guarded tables (`CadrePeer` / `DeviceToken` / `Strand` /
+     * `ValidationKey`). Drained (owner-signed `ReissuedAt` bump, which re-broadcasts
+     * the tombstone) by {@link drainPendingRevocations}. Cleared on stop alongside
+     * {@link pendingPeerWrites} — the tombstone rows are durable, so the next
+     * lifetime's first-growth sweep re-covers anything dropped here.
+     */
+    private pendingRevocations;
+    /**
+     * Guards the once-per-lifetime first-growth revocation sweep (re-issue EVERY
+     * locally-held tombstone, covering removals from before this node started).
+     * Deliberately separate from {@link reconstructedLocalOnlyWrites} and set only
+     * after a sweep pass SUCCEEDS (including the nothing-held case) — a throwing
+     * sweep retries on the next growth edge instead of being lost for the lifetime.
+     * Reset on stop, so a stop()→start() cycle sweeps again (that second start is
+     * exactly a "removals from before this lifetime" case).
+     */
+    private reissuedHeldRevocations;
     /** This node's own `CadrePeer` self-write committed local-only (re-touched on growth). */
     private pendingSelfPeerWrite;
     /** This node's own `DeviceToken` self-write committed local-only (re-touched on growth). */
@@ -249,11 +403,11 @@ export declare class CadreNode implements SAppIdLookup {
      * before any network bring-up. Resolution order:
      *
      * 1. Both `keyStore` and `privateKey` set ⇒ configuration error (throws).
-     * 2. `keyStore` set ⇒ load protobuf bytes from `identityKeyId` (default
-     *    {@link DEFAULT_IDENTITY_KEY_ID}). Found ⇒ deserialize; empty ⇒ generate a
-     *    fresh Ed25519 key, persist it, and use it. A rejected `get` (access denied
-     *    / backend failure) PROPAGATES — we never generate a new key on a read
-     *    error, which would silently orphan the real identity.
+     * 2. `keyStore` set ⇒ {@link loadOrCreateIdentityKey} against `identityKeyId`
+     *    (default {@link DEFAULT_IDENTITY_KEY_ID}): load when the slot is present,
+     *    generate + persist when it is empty. A rejected `get` (access denied /
+     *    backend failure) PROPAGATES — we never generate a new key on a read error,
+     *    which would silently orphan the real identity.
      * 3. `privateKey` set ⇒ use it directly.
      * 4. Neither ⇒ leave undefined; libp2p generates an ephemeral key.
      *
@@ -261,7 +415,227 @@ export declare class CadreNode implements SAppIdLookup {
      * resolved key rather than regenerating or re-persisting.
      */
     private resolveIdentityKey;
+    /**
+     * Construct (or adopt) the node-local trusted-owner anchor and seed the
+     * out-of-band pinned keys from `config.trustedOwners`. The store is NEVER
+     * sourced from the replicated control DB — its entries come only from
+     * genesis self-trust ({@link initializeSeedBootstrap}), config pins (here),
+     * or runtime enrollment pins ({@link trustOwnerKeys}).
+     *
+     * Idempotent across stop()→start(): the store instance is kept, and
+     * re-seeding config pins is a no-op ({@link TrustedOwnerStore.trust} is
+     * idempotent). An injected store scoped to a different party is a
+     * configuration error (fail closed before any network bring-up).
+     */
+    private initializeTrustedOwnerStore;
+    /**
+     * Construct (or adopt) the node-local cold-start bootstrap-peer store (see
+     * {@link bootstrapPeerStore}). Synchronous: an injected store has already
+     * loaded its persisted targets by the time it is handed in (its `open` is the
+     * async part), and the in-memory fallback has nothing to load.
+     *
+     * Idempotent across stop()→start(): the store instance is kept, so retained
+     * targets survive a restart of the same node instance even with the ephemeral
+     * default. An injected store scoped to a different party is a configuration
+     * error (fail closed before any network bring-up) — a foreign party's addresses
+     * must never enter this node's dial loop.
+     */
+    private initializeBootstrapPeerStore;
+    /**
+     * The node-local cold-start bootstrap-peer store (null before {@link start}) —
+     * the retained owner addresses {@link reconcileControlCohort}'s cold-start
+     * branch re-dials. Exposed for diagnostics and for a host that wants to show
+     * "what would this node dial if it is stranded?".
+     */
+    getBootstrapPeerStore(): BootstrapPeerStore | null;
+    /**
+     * The node-local trusted-owner anchor (null before {@link start}). This is
+     * the set the authorized-membership predicate and seed-trust anchor consult —
+     * never the replicated `OwnerKey` table, which any stranger can pollute.
+     */
+    getTrustedOwnerStore(): TrustedOwnerStore | null;
+    /**
+     * Persist out-of-band-established owner keys into the node-local anchor —
+     * the runtime enrollment seam: call with `CadreInvite.ownerKeys` when
+     * redeeming an invite (BEFORE the first `applySeed`, so the anchor already
+     * holds the pins when seed trust consults it), or with an operator-supplied
+     * pin. Idempotent. ('genesis' provenance is reserved for the node's own
+     * founding key, seeded internally by {@link initializeSeedBootstrap}.)
+     *
+     * Validates every key's shape before trusting any of them (all-or-nothing):
+     * a malformed entry anywhere in `keys` rejects the whole call before a
+     * single key is anchored. For the invite route this means a `CadreInvite`
+     * carrying one malformed `ownerKeys` entry fails the redemption outright —
+     * consistent with the anchor's existing whole-record-or-nothing policy for
+     * a corrupt persisted entry (see `trusted-owner-store.ts`'s
+     * `unusableEntry: 'discard-all'`) — rather than silently anchoring a subset
+     * and leaving the caller to notice a key went missing.
+     */
+    trustOwnerKeys(keys: Iterable<string>, source: Exclude<TrustSource, 'genesis'>): Promise<void>;
     private createControlNode;
+    /**
+     * Map this node's config onto the control network's libp2p node options.
+     *
+     * Split out of {@link createControlNode} purely so the mapping is assertable without
+     * standing up a real libp2p node — `packages/cadre-core/test/cadre-node-control-node-options.spec.ts`
+     * calls it on a bare `new CadreNode(config)`. Read nothing else into the split; the
+     * only caller in production is `createControlNode`.
+     */
+    private buildControlNodeOptions;
+    /**
+     * Decide whether an inbound CONTROL-network connection from `remotePeerId`
+     * should be admitted — the policy behind the connection gater wired in
+     * {@link createControlNode}. Deny only on a positive "unauthorized outsider
+     * while no stranger path is open" determination; everything ambiguous admits
+     * and defers to the fail-closed per-stream gates (see
+     * `membership-connection-gater.ts` for the layer's rationale and the
+     * stranger-open protocol allowlist).
+     *
+     * Admits when ANY of:
+     *  1. a shared-baseline check admits ({@link admitControlPeerUnconditionally}
+     *     — not running / DB torn down, absent-or-empty trusted-owner anchor, or
+     *     configured bootstrap/relay infrastructure);
+     *  2. an enrollment window is open ({@link openEnrollmentWindow}, opened by
+     *     {@link createInvite}) — the invitee dials in before it is authorized;
+     *  3. the peer holds a live DELEGATE ADMISSION GRANT — an authorized member
+     *     announced it (over the strand-addr RPC) as the transport peerId of its
+     *     own strand node, so a NAT'd member's strand node can hold a
+     *     circuit-relay reservation here (see `delegate-admission.ts`).
+     *     Connection only: the per-stream gate below never honors a grant;
+     *  4. the authorized-member set is empty — cold start: the rows that would
+     *     authorize anyone arrive by replication over these very connections;
+     *  5. the peer IS an authorized member; or
+     *  6. an open invitation is OUTSTANDING — at least one unexpired,
+     *     not-fully-consumed invitation this node minted or persisted (see
+     *     `StrandSolicitationService.hasOutstandingInvitation`). A formation
+     *     initiator is another party's peer by design and its token is only
+     *     checkable inside the protocol, so the gate asks the coarser question
+     *     "does this node expect a stranger at all?". Merely REGISTERING the
+     *     responder ({@link initializeStrandSolicitation}) no longer suspends
+     *     stranger denial — eager registration (as `reference-app-rn` does at
+     *     bring-up) and `formStrand`'s lazy initialization both leave the gate
+     *     armed, because neither mints an invitation.
+     *
+     * Ordering is semantically free (the checks are OR'd) but decides who pays:
+     * checks 1-3 are in-memory, 4/5 share one control-DB read, and only a peer
+     * already on the deny path reaches check 6's invitation lookup.
+     *
+     * Caveats of check 6, both self-healing:
+     *  - the in-memory mint registry dies with the process, so after a restart
+     *    only invitations persisted as `FormationInvite` rows still hold the
+     *    exemption open (re-mint otherwise — same story as the enrollment window);
+     *  - a peer holding a token whose `FormationInvite` row has not replicated to
+     *    this node yet is denied even though the formation handler would have
+     *    accepted it, exactly like the unreplicated-membership-row case below.
+     *
+     * NOTE: check 4/5 runs a control-DB read per inbound connection
+     * (`listAuthorizedMembers`); connections are rare and cadres small, and this
+     * layer is fail-open behind `ADMISSION_DECISION_TIMEOUT_MS`, so the live
+     * read is safe here — unlike the per-stream gate, which must consult the
+     * materialized {@link authorizedControlPeers} snapshot instead.
+     * NOTE: a sibling whose membership row has not yet replicated to
+     * this node is denied until the row converges (typically via the owner);
+     * either side's next outbound reconcile dial (outbound is never gated)
+     * re-establishes the link — self-healing, but visible as a transient deny.
+     */
+    private admitInboundControlConnection;
+    /**
+     * Hold the control-network inbound gate open for not-yet-authorized peers
+     * until `untilEpochMs` (extends, never shrinks, an already-open window).
+     * {@link createInvite} calls this automatically; a host running an
+     * out-of-band enrollment flow (e.g. accepting a phone whose invite this node
+     * never minted) can open it explicitly before the stranger dials in.
+     */
+    openEnrollmentWindow(untilEpochMs: number): void;
+    /**
+     * Record (or refresh) a delegate admission grant: `delegatePeerId` is the
+     * transport peerId of `announcerPeerId`'s strand-`strandId` node, admitted
+     * at the CONNECTION level (all a circuit-relay reservation needs) for
+     * `DELEGATE_GRANT_TTL_MS`. Called by the strand-addr responder after its
+     * authorized-membership gate has passed; public so tests can drive the
+     * admission policy without a full strand launch. A re-announce for the same
+     * (announcer, strand) REPLACES the previous delegate rather than
+     * accumulating. Never honored by {@link authorizeInboundControlStream}.
+     */
+    grantDelegateAdmission(announcerPeerId: string, strandId: string, delegatePeerId: string): void;
+    /** Is `remotePeerId` covered by a live delegate admission grant? */
+    hasDelegateAdmission(remotePeerId: string): boolean;
+    /**
+     * The admission checks SHARED by the connection gate
+     * ({@link admitInboundControlConnection}) and the per-stream control-DB gate
+     * ({@link authorizeInboundControlStream}) — factored so the two layers cannot
+     * drift. All in-memory and cheap (the stream gate runs this per inbound
+     * stream). Returns true when the peer must be admitted BEFORE any membership
+     * source is consulted:
+     *  - the node is not fully up (`start()` in progress / DB torn down) — both
+     *    gates exist from libp2p bring-up, before the control DB does;
+     *  - the trusted-owner anchor is absent or empty — an un-enrolled node has
+     *    no basis to judge anyone and MUST accept its enrollment seed;
+     *  - the peer is one of the configured control bootstrap/relay nodes —
+     *    operator-configured infrastructure, not cadre members.
+     * False only means "no unconditional admit": the caller then judges the peer
+     * against its own membership source (a live DB read for the fail-open
+     * connection gate; the materialized snapshot for the fail-closed stream gate).
+     */
+    private admitControlPeerUnconditionally;
+    /**
+     * Per-stream authorization for the four Optimystic control-DB protocols
+     * (`/optimystic/control-<party>/{repo,cluster,sync,block-transfer}/…`),
+     * wired as `authorizeInboundStream` in {@link createControlNode} — the
+     * fail-closed layer behind the fail-open connection gater. Control node
+     * ONLY: strand cohort nodes legitimately serve cross-party peers.
+     *
+     * The STRICT SUBSET of {@link admitInboundControlConnection}: the same
+     * "no basis to judge" admissions (shared via
+     * {@link admitControlPeerUnconditionally}), minus the stranger carve-outs
+     * (enrollment window, outstanding open invitation, delegate admission
+     * grant). The first two exist so a stranger can reach `/sereus/seed/1.0.0`
+     * and `/sereus/formation/1.0.0` — neither is gated here, and admitting a
+     * stranger to `repo` during an enrollment window is exactly the hole this
+     * gate closes. A DELEGATE-admitted connection (a member's strand node
+     * holding a circuit-relay reservation, see `delegate-admission.ts`) is
+     * likewise exactly a case this gate must still refuse: the delegate gets
+     * the connection and never the control DB.
+     *
+     * Admits when ANY of:
+     *  1. a shared-baseline check admits (not running / no DB, empty anchor,
+     *     configured bootstrap infra);
+     *  2. the materialized authorized set is empty — cold start, before the
+     *     rows that would authorize anyone have replicated in;
+     *  3. the peer IS in the materialized authorized set.
+     *
+     * Deliberately SYNCHRONOUS and pure in-memory — see
+     * {@link authorizedControlPeers} for why a control-DB read here would
+     * deadlock into mutual denial. With a sync predicate the upstream deadline
+     * (`authorizeInboundStreamTimeoutMs`) never trips, so it stays at its
+     * default.
+     *
+     * NOTE: the snapshot keys on PEER ID, so a node with no persistent identity
+     * key never lands a `CadrePeer` row ({@link registerSelf} skips) and its
+     * siblings deny its control-DB streams once their own snapshot is non-empty —
+     * owner status is a KEY, not a peer id, so being the owner does not exempt it.
+     * Harmless today (a real deployment persists its identity; the ephemeral-owner
+     * case appears only in tests, which configure the owner as bootstrap infra —
+     * `push-wake-e2e.integration.ts` design note 3). If an ephemeral-identity node
+     * ever becomes a supported deployment, this gate needs a key-based admission.
+     */
+    private authorizeInboundControlStream;
+    /**
+     * Refresh {@link authorizedControlPeers} from the control DB, best-effort: a
+     * failed read keeps the previous snapshot (never clears it), so a transient
+     * DB error can neither flip the stream gate's cold-start carve-out back open
+     * nor drop a legitimate member mid-flight. Never rejects.
+     *
+     * The SOLE caller is {@link drainMembershipGate}, which serializes refreshes —
+     * so two reads can no longer settle out of order.
+     */
+    private refreshAuthorizedControlPeers;
+    /**
+     * PeerIds of the configured control bootstrap nodes (relay/bootstrap
+     * infrastructure — always admitted inbound). Parsed once, lazily; an
+     * address without a `/p2p/<id>` component contributes nothing.
+     */
+    private getBootstrapPeerIds;
     private createStrandQueryable;
     /**
      * Schedule the node's initial self-record publish + ongoing refresh shortly
@@ -280,7 +654,11 @@ export declare class CadreNode implements SAppIdLookup {
      *   PeerId (the resolved node identity from `keyStore`/`config.privateKey`).
      * - If the row already exists: a self-signed UPDATE bumping `UpdatedAt`.
      * - If not, and the node is its own owner: an owner-signed INSERT that
-     *   also carries the self-signature.
+     *   also carries the self-signature. That INSERT is idempotent, so if an owner
+     *   {@link authorizePeer} of this node's own id seated the row inside the
+     *   read-then-insert window it no-ops — the publish then falls through to the
+     *   UPDATE path (re-reading and re-signing against the row that landed) rather
+     *   than leaving the authorize's null `Sig` in place, and reports `refreshed`.
      * - Otherwise: logs and returns (a non-owner node with no row yet must
      *   wait for an owner to insert it; it can then self-refresh).
      *
@@ -294,6 +672,13 @@ export declare class CadreNode implements SAppIdLookup {
     registerSelf(): Promise<SelfRegistrationOutcome>;
     /** The body of {@link registerSelf}; serialised by its single-flight guard. */
     private publishSelfRecord;
+    /**
+     * Sign this node's address record for publication, stamped strictly later than
+     * `existing` (the row it is about to replace, or null for a first insert) so a
+     * same-millisecond re-publish still satisfies the monotonic `UpdatedAt` rule the
+     * `CadrePeer.AuthorizedUpdate` self-branch enforces.
+     */
+    private signSelfRecord;
     /**
      * The ed25519 keypair (base64url) the node signs its own record with — the key
      * behind its libp2p PeerId. Sourced from the resolved {@link identityKey}
@@ -399,6 +784,65 @@ export declare class CadreNode implements SAppIdLookup {
      * parse/lookup failure — never throws.
      */
     private peerStoreAddrs;
+    /**
+     * Retain a just-applied seed's owner-flagged peers as cold-start bootstrap
+     * dial targets (see {@link bootstrapPeerStore}).
+     *
+     * Called for every seed this node accepts, on BOTH intake paths — the
+     * {@link applySeed} wrapper (which may run on a throwaway service, so the
+     * service itself is the wrong place to keep this) and the inbound
+     * `/sereus/seed/1.0.0` handler via `onSeedApplied`. Peers with no address are
+     * skipped: there is nothing to dial.
+     *
+     * `isOwner` is the seed's own claim about its peers, exactly as
+     * `SeedBootstrapService.applySeed` uses it to choose its dial targets. That is
+     * sound here for the same reason it is sound there — the whole seed is
+     * signature-checked against a trust-anchored signer before this runs, and the
+     * flag only *selects a dial target*; a dial grants no authority.
+     *
+     * Self is excluded. `createSeed` projects EVERY `CadrePeer` row, so an owner
+     * that applies a seed minted after it joined finds itself in the owner list;
+     * retaining that would make the cold-start pass dial this node forever (the
+     * steady-state pass filters self out of its sibling list for the same reason).
+     */
+    private recordSeedBootstrapPeers;
+    /**
+     * Cold-start branch of the reconcile pass: re-dial the seed's owner peers
+     * while the control database still has no siblings to dial.
+     *
+     * `SeedBootstrapService.applySeed` dials those owners exactly ONCE, best-effort.
+     * When that single dial fails — owner momentarily down, relay reservation not
+     * up yet, NAT traversal lost the race — the joining node has an empty
+     * `CadrePeer` table and no connection, and the steady-state pass above cannot
+     * help: it dials only siblings enumerated from that very table. Retrying here
+     * is the only way back in.
+     *
+     * Unbounded, at the reconcile cadence, with no backoff: the branch is already
+     * gated by "the control database has no siblings", so it stops the moment the
+     * node is actually in the party, and a node that is stranded MUST keep trying —
+     * a give-up rule would turn a transient outage into a permanent one. The steady
+     * cost is one dial per bootstrap peer per pass (seeds nominate one or a few
+     * owners), each failing fast against an unreachable address.
+     * NOTE: if seeds ever carry many owner peers, or the reconcile cadence tightens
+     * well below its 15 s default, add per-peer backoff here.
+     *
+     * Best-effort per peer, exactly like {@link dialControlSibling}: one dead
+     * address never aborts the pass.
+     */
+    private dialColdStartBootstrap;
+    /**
+     * Bind a bootstrap peer's seed addresses to its peer id, so the dial
+     * authenticates the peer it is aiming at rather than trusting whoever answers.
+     *
+     * An address that already carries `/p2p/<id>` must carry THIS peer's id or it
+     * is dropped (a seed that disagrees with itself is not a dial target); one
+     * that carries none — an `addressOverrides`-published record, say — gets the
+     * id encapsulated. Unencapsulatable addresses are dropped rather than dialed
+     * bare.
+     */
+    private bootstrapDialAddrs;
+    /** Dial one cold-start bootstrap peer, best-effort. Returns whether it connected. */
+    private dialBootstrapPeer;
     /**
      * Whether a control write happening now would commit local-only. A sound lower
      * bound is "no connected control peers": 0 connections ⇒ the block's cluster is
@@ -408,6 +852,9 @@ export declare class CadreNode implements SAppIdLookup {
      * is caught by the cohort's periodic pull-on-read instead. Re-issuing an already-
      * replicated row is harmless (an idempotent monotonic bump), so the coarse proxy
      * is acceptable as the agreed first cut.
+     *
+     * Reads {@link getControlConnectionCount} — the public, embedder-facing form of
+     * the same sample — so the two cannot drift.
      */
     private committedAlone;
     /**
@@ -417,12 +864,23 @@ export declare class CadreNode implements SAppIdLookup {
      * cohort grows; otherwise the write replicated and any stale queue entry for this
      * subject is dropped.
      *
-     * A `remove` that commits alone is a security-relevant durability gap (a revoked
-     * peer may persist as a member elsewhere), so it is logged loudly — and, because
-     * a physical delete leaves no local trace to re-issue from, its on-growth
-     * re-issue is best-effort only (see {@link drainPendingPeerWrites}).
+     * A `remove` never queues here — a delete's re-replicable half is its
+     * `Revocation` tombstone, which the committed-delete seam routes into
+     * {@link pendingRevocations} ({@link noteGuardedDelete}). The `remove` arm only
+     * drops any queued authorize for the subject (the row is gone; re-issuing the
+     * insert would resurrect it) and, when the commit was alone, logs the
+     * security-relevant window loudly.
      */
     private noteControlWrite;
+    /**
+     * Committed-delete seam handler ({@link GuardedDeleteListener}, wired in
+     * {@link start}): a guarded-table delete and its `Revocation` tombstone
+     * committed. If the node was alone the tombstone is local-only — queue it for
+     * an owner-signed re-issue on cohort growth; otherwise it broadcast, so drop
+     * any stale queue entry for the stamp. Synchronous by contract — bookkeeping
+     * only, never throws into the delete path.
+     */
+    private noteGuardedDelete;
     /**
      * Drain the write-while-alone re-replication queue: re-issue the writes that
      * committed local-only now that the cohort can broadcast them. Public so the
@@ -443,6 +901,38 @@ export declare class CadreNode implements SAppIdLookup {
      * the drain.
      */
     private retouchSelfDeviceToken;
+    /**
+     * Re-issue `Revocation` tombstones so a removal that committed while alone
+     * still reaches the cohort. Two regimes, one method:
+     *
+     * - **First successful pass per process** ({@link reissuedHeldRevocations}
+     *   false): sweep EVERY locally-held tombstone from `queryRevocations()` — the
+     *   only cover for a removal made before this process started, since the
+     *   in-memory queue does not survive a restart. Queued stamps are part of that
+     *   same batch (exactly once — one transaction, no double bump).
+     * - **Later passes**: only the tombstones queued in-session by
+     *   {@link noteGuardedDelete}.
+     *
+     * Owner-gated: a node with no owner key cannot sign a re-issue, so stray queue
+     * entries are dropped (mirrors {@link drainPendingPeerWrites}). Best-effort — a
+     * failure is logged and leaves the queue (and the sweep flag) untouched for the
+     * next growth edge. A successful `reissueRevocations` exec is NOT proof of
+     * broadcast (the connection that fired the growth edge may not be in the
+     * affected block's cluster — see
+     * tickets/backlog/control-rereplication-broadcast-confirmation); the drain
+     * inherits that known gap, and a full disconnect→reconnect (or the next
+     * process's sweep) re-covers it.
+     *
+     * NOTE: the sweep is O(all tombstones ever) row-updates — plus one owner
+     * signature each — in one transaction, once per lifetime. `Revocation` is
+     * append-only and unbounded growth is declared acceptable for a cadre-sized
+     * party. If the tombstone table ever gets large, bound the sweep (e.g. persist
+     * a node-local high-water mark of what has been re-issued while connected)
+     * instead of re-touching everything; note the `Math.max(...)` spread below also
+     * caps out around 10^5 rows (V8 argument limit) before the size becomes merely
+     * a latency problem.
+     */
+    private drainPendingRevocations;
     /**
      * One-shot, first-cohort-growth reconstruction of the write-while-alone queue for
      * an OWNER node: re-touch every membership row that may be an unreplicated
@@ -455,29 +945,36 @@ export declare class CadreNode implements SAppIdLookup {
      * row is a no-op-equivalent).
      *
      * A node with no owner private key skips this entirely — it cannot re-sign
-     * rows for other peers, and rows it merely holds are not its to re-issue. DELETEs
-     * cannot be reconstructed here (a removed row leaves no local trace and the schema
-     * carries no tombstone) — see the delete-path note in {@link drainPendingPeerWrites}.
+     * rows for other peers, and rows it merely holds are not its to re-issue.
+     * DELETEs are not reconstructed here — the `Revocation` tombstone sweep in
+     * {@link drainPendingRevocations} covers them (a removed row leaves no
+     * `CadrePeer` trace, but its tombstone is re-issuable).
      */
     private reconstructAuthoredMembership;
+    /**
+     * Body of {@link reconstructAuthoredMembership}'s sweep: re-issue each candidate
+     * owner-authored row, returning how many were re-touched. A per-row failure is
+     * logged and skipped; a teardown mid-sweep stops it.
+     */
+    private reissueAuthoredMembershipRows;
     /**
      * Drain the in-session write-while-alone queue: re-issue each pending owner
-     * membership write now that the cohort can broadcast it. Sequential (no fan-out)
-     * to avoid a thundering re-touch; an entry is cleared only on success, so a
-     * failure (or a still-alone re-commit) leaves it queued for the next growth.
-     *
-     * - `authorize`: re-issue as an idempotent monotonic owner UPDATE
-     *   ({@link reissuePeerAuthorize}). Skipped (and cleared) if the row vanished
-     *   (raced a delete) or now carries a self-`Sig` (the peer self-published and owns
-     *   its republish).
-     * - `remove` (security-relevant): a removePeer-while-alone physically removed the
-     *   row locally, so a re-issued DELETE matches nothing and does NOT propagate —
-     *   full delete durability requires a schema tombstone (deferred:
-     *   `control-delete-while-alone-tombstone`). We still attempt the re-issue
-     *   (harmless, and it propagates in the row-still-present case); the commit-alone
-     *   was already logged loudly in {@link noteControlWrite}.
+     * authorize as an idempotent monotonic owner UPDATE
+     * ({@link reissuePeerAuthorize}) now that the cohort can broadcast it.
+     * Sequential (no fan-out) to avoid a thundering re-touch; an entry is cleared
+     * only on success, so a failure (or a still-alone re-commit) leaves it queued
+     * for the next growth. An entry is skipped (and cleared) if the row vanished
+     * (raced a delete) or now carries a self-`Sig` (the peer self-published and owns
+     * its republish). Removals are drained by {@link drainPendingRevocations}, not
+     * here.
      */
     private drainPendingPeerWrites;
+    /**
+     * Body of {@link drainPendingPeerWrites}' loop. An entry is cleared only on
+     * success (or when there is nothing left to re-issue); a failure is logged and
+     * the entry stays queued for the next cohort growth.
+     */
+    private reissuePendingPeerWrites;
     /**
      * Re-issue an owner membership row as a monotonic owner UPDATE: bump
      * `UpdatedAt` strictly above the stored value (and the wall clock) and re-sign via
@@ -549,8 +1046,10 @@ export declare class CadreNode implements SAppIdLookup {
      *   2. `publicKey <-> peerId` binding — the stored key's libp2p identity is the
      *      requested peerId,
      *   3. a `DeviceToken` row exists with a known {@link PushPlatform},
-     *   4. self-signature verifies against the bound `CadrePeer.PublicKey`,
-     *   5. freshness — `updatedAt` is positive and within `opts.maxAgeMs` (default:
+     *   4. the row's `StampId` is NOT retired in `CadreControl.Revocation` — the
+     *      read-side half of the clear (see below),
+     *   5. self-signature verifies against the bound `CadrePeer.PublicKey`,
+     *   6. freshness — `updatedAt` is positive and within `opts.maxAgeMs` (default:
      *      no ceiling, since a push token is valid until it rotates).
      *
      * A peer that is not a current member, or whose token has no backing `CadrePeer`
@@ -672,6 +1171,14 @@ export declare class CadreNode implements SAppIdLookup {
     /**
      * Add a strand with its sApp configuration.
      * The hosting application must provide the sApp schema when creating a strand.
+     *
+     * A rejected call leaves nothing running but DOES leave the sApp config
+     * registered, deliberately: both an explicit retry and the {@link StrandWatcher}'s
+     * automatic relaunch need it. So once the strand's row is visible on the control
+     * network (via {@link publishStrand} or another member), a failed launch keeps
+     * being re-attempted in the background — each failure re-emitting `strand:error`
+     * — until it succeeds. {@link detachStrand} (reached via {@link stopStrand}) is
+     * what abandons a strand for good.
      */
     addStrand(config: StrandConfig): Promise<StrandInstance>;
     /**
@@ -689,7 +1196,7 @@ export declare class CadreNode implements SAppIdLookup {
      * {@link ed25519KeyPairFromLibp2p} also exposes as the node's owner keypair,
      * so peer identity and owner key are one and the same. That key must be
      * enrolled in `OwnerKey` (e.g. via {@link ControlDatabase.ensureOwnerKey}
-     * at genesis) or the schema's `Strand.Authorized` constraint rejects the write.
+     * at genesis) or the schema's `Strand.AuthorizedInsert` constraint rejects the write.
      * Failing loudly here is intentional: a silently-unpublished strand would run
      * as a local-only island that no peer could ever discover or join.
      *
@@ -697,14 +1204,70 @@ export declare class CadreNode implements SAppIdLookup {
      *   {@link addStrand}).
      * @param type - `'o'` for open (default) or `'c'` for closed.
      * @param memberPrivateKey - Optional membership key for a closed strand.
-     * @throws if the node is not started, exposes no owner signing key, or the
-     *   control DB rejects the (unauthorized) insert.
+     * @throws if the node is not started, exposes no owner signing key, the id is blank, or
+     *   the control DB rejects the (unauthorized) insert.
      */
     publishStrand(strandId: string, type?: 'o' | 'c', memberPrivateKey?: string): Promise<void>;
+    /**
+     * Remove this party's `Strand` row from the shared control database — the owner-signed
+     * inverse of {@link publishStrand}.
+     *
+     * Party-wide, unlike {@link stopStrand}, which only stops the strand on THIS node: every
+     * cadre node watching the table sees the row vanish on its next poll (default 5 s) and
+     * stops its own instance. This node converges immediately — the method forces a watcher
+     * poll and stops any still-running local instance before resolving. Removing the row
+     * removes OUR party's participation only: other parties in the strand keep their own
+     * rows and the strand network carries on, so no cross-party sign-off is involved — this
+     * is an owner-signed control-plane write like every other, not "destroy the network".
+     *
+     * Irreversible for a closed strand (`Type='c'`): the row carries `MemberPrivateKey`,
+     * this party's membership secret for that network, and it is stored nowhere else.
+     * With it gone the party can never again admit a member to that closed strand, and a
+     * re-published row would carry a DIFFERENT key that does not match the membership
+     * already written into the strand's RBAC layer. The strand id itself is NOT
+     * blacklisted: a fresh owner-signed {@link publishStrand} re-seats it under a new
+     * stamp — only the unsigned consent re-seat is permanently foreclosed (the removal's
+     * `Revocation` tombstone names the id, which the consent branch of
+     * `Strand.AuthorizedInsert` refuses ever after). Outstanding `FormationInvite` rows
+     * bound to the removed strand are unredeemable while the row is absent (the formation
+     * recorder resolves the strand as missing and rejects cleanly).
+     *
+     * Convergence caveats, same class as {@link enrollValidationKey}'s: a sibling that has
+     * not yet synced keeps running the strand until its own watcher observes the missing
+     * row; a sibling whose `strandFilter` never admitted this strand never observes the
+     * removal AT ALL and keeps running its instance indefinitely — opting out of watching a
+     * strand is also opting out of its party-wide removal, so such a node's only stop is its
+     * own local {@link stopStrand}/`unpublishStrand` call; and a removal committed while
+     * ALONE (0 control connections) deletes the row local-only. The accompanying
+     * `Revocation` tombstone IS queued and re-issued on the next cohort-growth edge
+     * ({@link noteGuardedDelete}/{@link drainPendingRevocations}), so the stamp retirement
+     * — and with it the consent re-seat foreclosure — does propagate; but the physical row
+     * deletion cannot be replayed, and `queryStrands` reads raw (no retired-stamp filter),
+     * so siblings that already hold the row keep running the strand until the collection
+     * itself converges (logged loudly; see the delete-while-alone durability note in
+     * docs/architecture.md).
+     *
+     * A no-op (no throw, no tombstone) when the row is already absent — but a
+     * locally-running instance of that id is still stopped.
+     *
+     * NOTE: control-plane only — the strand's local durable storage is retained. Stopping the
+     * instance closes the `StrandDatabase` and its libp2p node but purges no blocks, so a
+     * closed strand's content stays readable on disk to anyone with the data directory. If a
+     * caller ever needs removal to mean "and erase the local copy", that is a separate purge
+     * step, not a widening of this method.
+     *
+     * @param strandId - The `Strand` row id to remove (as passed to {@link publishStrand}).
+     * @throws if the node is not started, exposes no owner signing key, the id is blank, or
+     *   the signer is not an enrolled owner (the schema's `Strand.AuthorizedDelete` rejects
+     *   the write and the row survives). A rejection does NOT imply the row survived: the
+     *   local stop runs after the control-plane delete has already committed, so a failure
+     *   there throws over a completed removal.
+     */
+    unpublishStrand(strandId: string): Promise<void>;
     /**
      * Publish an owner-signed `FormationInvite` (open-invitation token) to the
      * shared control database, so a later {@link formStrand} redemption can be
-     * validated against it (the consent branch of `Strand.Authorized`).
+     * validated against it (the consent branch of `Strand.AuthorizedInsert`).
      *
      * Counterpart to {@link createOpenInvitation}, which only mints the
      * out-of-band {@link OpenInvitation} envelope: persisting the matching
@@ -729,11 +1292,81 @@ export declare class CadreNode implements SAppIdLookup {
         validationUrl?: string;
         strandId?: string;
     }): Promise<void>;
+    /**
+     * Enroll an approver public key allowed to sign off on `ValidationUrl` redemptions.
+     *
+     * A `FormationInvite` carrying a `ValidationUrl` is only redeemable when the approval
+     * that comes back from that URL is signed by a key present in `CadreControl.ValidationKey`
+     * — this is how a party says which outside approver it trusts. Without an enrollment,
+     * every such invitation is unredeemable.
+     *
+     * Signs with the same self-owner key as {@link publishStrand} (the ed25519 key behind
+     * this node's PeerId, which must be an enrolled `OwnerKey`). Throws loudly if the node
+     * isn't started, exposes no signing key, or the key is blank — a blank key would reach
+     * the database and fail the signature CHECK as an opaque constraint error.
+     *
+     * Enrolling this node's OWN owner key is permitted and harmless: the domain/action tags
+     * baked into each authorization digest mean an owner-key signature can never satisfy the
+     * approval rule and an approval can never satisfy an owner rule. No guard is needed.
+     *
+     * NOTE: enrollment is replicated control state, so a key enrolled here is visible to a
+     * sibling cadre node only once control replication converges. A redemption that arrives
+     * at a node which has not caught up is refused as not-enrolled — the same convergence
+     * gap the schema records on `Strand.StampId`. Enroll before circulating the invitations
+     * that depend on the key.
+     *
+     * @param key - Approver public key to enroll (base64url ed25519 public key).
+     */
+    enrollValidationKey(key: string): Promise<void>;
+    /**
+     * Remove an approver public key.
+     *
+     * Narrows who may approve FUTURE redemptions ONLY. The schema's approval CHECKs run at
+     * write time, so a join that was already approved by this key stays valid — removal is
+     * not retroactive and does not re-examine committed rows.
+     *
+     * Rotation is therefore add-then-remove, in that order: removing the only enrolled key
+     * while `ValidationUrl` invitations are outstanding makes every one of them unredeemable
+     * until a new key is enrolled.
+     *
+     * Removing a key that is not enrolled is a silent no-op (no throw, no `Revocation`
+     * tombstone) — see {@link ControlDatabase.deleteValidationKey}.
+     *
+     * @param key - Approver public key to remove (base64url ed25519 public key).
+     */
+    removeValidationKey(key: string): Promise<void>;
+    /**
+     * The approver keys currently enrolled, sorted. Read-only, so unlike
+     * {@link enrollValidationKey} / {@link removeValidationKey} it needs no owner signing
+     * key — only a started node.
+     */
+    listValidationKeys(): Promise<string[]>;
+    /**
+     * Resolve the owner keypair every owner-signed control write needs — {@link publishStrand},
+     * {@link unpublishStrand}, {@link publishFormationInvite}, {@link enrollValidationKey},
+     * {@link removeValidationKey}
+     * — failing loudly in one two-part shape (not started / no signing key, naming owner
+     * genesis as the fix). Narrows `controlDatabase` for the caller: a non-null return means
+     * `this.controlDatabase` is non-null too.
+     *
+     * @param action - Infinitive phrase naming the attempted write, e.g. `'enroll a
+     *   validation key'`; interpolated into both messages.
+     */
+    private requireOwnerSigningKey;
     /**
      * Shared strand launch path for both the explicit (`addStrand`) and the
      * control-discovered (`handleStrandAdded`) entry points. Resolves the cohort
      * seed, selects the mode, starts the strand, and registers it with the
      * hibernation manager before emitting `strand:started`.
+     *
+     * Idempotent no-op when the strand manager already tracks `strand.Id` — the
+     * ordinary founding sequence is `addStrand` (starts it locally) followed by
+     * `publishStrand` (makes it visible), so this node's own `StrandWatcher`
+     * rediscovers a row it already started and calls this again via
+     * `handleStrandAdded`. Without the guard that re-entry would resolve a fresh
+     * (already-connected) cohort seed and re-emit `strand:started` for an
+     * instance that never stopped. The guard runs before the cohort-seed RPC
+     * fan-out, so a rediscovery costs nothing beyond the map lookup.
      */
     private launchStrand;
     /**
@@ -749,8 +1382,61 @@ export declare class CadreNode implements SAppIdLookup {
      * empty (`[]`) — mode still follows membership, and the empty seed self-heals
      * on the next resume / check-in pass. Returns an empty seed when the control DB
      * or node is absent (not yet started / torn down).
+     *
+     * When `delegatePeerId` is given (a strand launch/resume is imminent), the
+     * pass doubles as the delegate ANNOUNCEMENT: our circuit relays are merged
+     * into the RPC targets and every request carries the delegate peerId, so each
+     * receiver records an admission grant BEFORE `libp2p.start()` (re-)dials the
+     * relay reservation — the gate denial there is fatal, not degraded. A
+     * party-member relay answers the RPC (its control node admits us as a
+     * member); a dedicated ops/ relay does not speak the protocol and the
+     * per-peer failure folds to `[]` — harmless, it has no membership gate and
+     * needs no grant. The relay's direct addr rides along as the dial fallback
+     * for a relay we are not yet connected to.
      */
     private resolveCohortSeed;
+    /**
+     * The circuit relays this node's strand nodes would reserve through: the
+     * union of the RESOLVED listen addrs' circuits — a hand-written
+     * `network.listenAddrs` circuit entry or a `network.relayAddrs` entry, which
+     * the strand node inherits verbatim either way — and the control node's own
+     * live `/p2p-circuit` multiaddrs (a reservation this node discovered rather
+     * than configured).
+     *
+     * NOTE: a relay the STRAND node discovers on its own (autorelay — in neither
+     * source) gets no announcement, and a membership-gated one will deny it; fine
+     * now, every realistic topology feeds one of the two sources.
+     */
+    private circuitRelayTargets;
+    /**
+     * Record the announce timestamps {@link refreshDelegateGrants} throttles on,
+     * for every relay a delegate-carrying announce pass dialed.
+     *
+     * Recorded OPTIMISTICALLY at announce time: `collectStrandAddrs` folds
+     * per-peer failure to `[]` and reports no per-peer success, and threading
+     * success out would change its API for little gain. A failed INITIAL announce
+     * is fatal-at-start anyway (the relay denies the reservation,
+     * `libp2p.start()` throws, and wake/check-in re-resume retries with a fresh
+     * announce); a failed REFRESH retries within `DELEGATE_GRANT_TTL_MS / 2`
+     * (15 min), still inside the 30 min TTL.
+     */
+    private recordDelegateAnnounces;
+    /**
+     * Re-announce every running strand's delegate peerId to this node's circuit
+     * relays, throttled to once per `DELEGATE_GRANT_TTL_MS / 2` per
+     * (relay, strand). A grant must outlive the reservation: a dropped relay
+     * connection makes the strand's circuit-relay transport re-dial and face the
+     * connection gate again, so the relay must still hold a live grant then.
+     * RELAY targets only — siblings get their announce on every launch/resume
+     * seed pass, and a grant only matters where a reservation can be re-dialed.
+     *
+     * Strands announce CONCURRENTLY: this runs ahead of the reconcile pass's
+     * sibling enumeration, and one unreachable relay costs a dial timeout per
+     * target, which must not stack up per strand.
+     */
+    private refreshDelegateGrants;
+    /** One strand's share of {@link refreshDelegateGrants}: announce to the relays whose grant is due. */
+    private announceDelegateToDueRelays;
     /**
      * The local strand instance's dialable strand-network multiaddrs for the
      * strand-addr RPC, ordered signaling-first (reusing the control node's
@@ -762,9 +1448,26 @@ export declare class CadreNode implements SAppIdLookup {
      */
     private getStrandMultiaddrs;
     /**
-     * Remove a strand
+     * Stop a strand on THIS node only: untrack it from hibernation, drop its sApp config,
+     * stop the local instance, and emit `strand:stopped`. The shared `Strand` row is left
+     * intact, so on the next node restart (or watcher poll) the strand is rediscovered and
+     * surfaces as `strand:discovered` again. Party-wide removal is {@link unpublishStrand}.
+     */
+    stopStrand(strandId: string): Promise<void>;
+    /**
+     * Local teardown for one strand, shared by the caller-driven {@link stopStrand} and the
+     * watcher-driven `handleStrandRemoved`: untrack hibernation, drop the sApp config, stop
+     * the instance, emit `strand:stopped`. Touches no control-plane row — which side of the
+     * removal the node is on is the caller's concern, not this method's.
+     *
+     * The stop + emit are skipped when the strand manager holds no instance for `strandId` —
+     * e.g. a party owner that published a strand's row but never ran it locally, or an
+     * explicit {@link stopStrand} for an id this node never started. `hibernationManager`
+     * untrack and the `sAppConfigs` delete stay unconditional (both are no-ops when there is
+     * nothing to remove), so a launch that failed before an instance was ever tracked still
+     * gets its stray sApp config cleared.
      */
-    removeStrand(strandId: string): Promise<void>;
+    private detachStrand;
     /**
      * Record activity on a strand (resets hibernation timer).
      *
@@ -841,10 +1544,58 @@ export declare class CadreNode implements SAppIdLookup {
      * Get the control network node (for advanced use)
      */
     getControlNode(): Libp2p | null;
+    /**
+     * Start keeping a relay reservation: dial the given relay(s) from the control
+     * node, ask the first one that answers for a reservation slot, wait until the
+     * resulting `/p2p-circuit` address makes this node dialable — and keep a
+     * supervisor running that re-drives whenever the reservation is later lost.
+     *
+     * For nodes that listen on the bare `/p2p-circuit` SEARCH addr (a browser tab)
+     * rather than a configured `network.relayAddrs` circuit listener — see
+     * `relay-reservation.ts` for why the two are alternatives and why configuring
+     * both is a regression. Opt-in: nothing calls this for the CLI/host nodes.
+     *
+     * Resolves once the FIRST attempt has settled, exactly as it did when it drove
+     * once; the retries continue in the background until {@link stop} or the next
+     * `reserveRelays` call. Fail-soft — never throws. An unreachable relay, a
+     * missing control node, or a timeout all resolve to a non-`reserved` status, so
+     * a caller can await this during startup without a dead relay aborting the node.
+     *
+     * Passing an empty list stops the supervisor and resets the posture to `none`
+     * without dialing or waiting.
+     */
+    reserveRelays(addrs: string[], opts?: RelayReservationSupervisorOptions): Promise<RelayReservationState>;
+    /**
+     * The node's CURRENT relay-reservation posture, recomputed from the control
+     * node's live multiaddrs on every call.
+     *
+     * Deliberately not memoised: a reservation can be lost after
+     * {@link reserveRelays} succeeds (the relay restarts, the connection drops) and
+     * a cached `reserved` would let a caller mint invitations carrying circuit
+     * addresses that no longer route.
+     *
+     * A lost reservation now recovers on its own — the supervisor {@link reserveRelays}
+     * starts re-drives on a backoff, reporting `retrying` meanwhile. `error` here
+     * means nothing is going to try again: no supervisor, or no control node.
+     */
+    getRelayReservationState(): RelayReservationState;
     /**
      * Get the control database (for advanced queries)
      */
     getControlDatabase(): ControlDatabase | null;
+    /**
+     * Open control-network connections right now. A lower-bound proxy for replication
+     * reach: 0 connections ⇒ a control write commits local-only. The private
+     * `committedAlone` write-while-alone seam is defined in terms of this.
+     *
+     * It approximates the precise signal (the block's cluster size), and a caller that
+     * samples it AFTER a write samples a slightly wider window than `committedAlone`
+     * does inside the write itself. It exists so an embedder can warn an owner before a
+     * control write that this machine currently sees none of its siblings, and report
+     * after one that the write may not have travelled — a warning shown unconditionally
+     * is a warning people learn to ignore.
+     */
+    getControlConnectionCount(): number;
     /**
      * Force a poll of the strand watcher (for testing)
      */
@@ -872,7 +1623,10 @@ export declare class CadreNode implements SAppIdLookup {
      */
     private resolveInviteAddresses;
     /**
-     * Enumerate the cadre's `CadrePeer` membership.
+     * Enumerate the cadre's `CadrePeer` membership — the ADDRESSABLE surface (see
+     * {@link isMember}). Rows whose stamp is retired in `CadreControl.Revocation`
+     * never reach here: {@link ControlDatabase.queryCadrePeers} excludes them, so a
+     * revoked peer is not addressable either.
      */
     listMembers(): Promise<Array<{
         peerId: string;
@@ -883,30 +1637,72 @@ export declare class CadreNode implements SAppIdLookup {
      *
      * This is the ADDRESSABLE surface ("do I have a dialable address record for this
      * peer") — it includes this node's own self-published row. Address resolution and
-     * push fan-out use this. The trust-facing gate is {@link isAuthorizedMember}.
+     * push fan-out use this. A peer whose stamp is retired in `CadreControl.Revocation`
+     * is excluded here too (the filter lives in
+     * {@link ControlDatabase.queryCadrePeers}): revocation removes a peer from the
+     * addressable surface, not only the trust-facing one, so a revoked peer is no
+     * longer dialed, RPC'd, or handed out as an address. The trust-facing gate is
+     * {@link isAuthorizedMember}.
      */
     isMember(peerId: string): Promise<boolean>;
     /**
      * Enumerate the party's AUTHORIZED members — the trust-facing set, distinct from
-     * the addressable set ({@link listMembers}). Excludes this node itself: a node
-     * publishes its own `CadrePeer` address row so its dialable address rides in seeds,
-     * but "self" is not a peer this node authorized. The control-network wake and
+     * the addressable set ({@link listMembers}). A peer is authorized iff ALL hold:
+     *
+     *  1. it is not this node itself — a node publishes its own `CadrePeer` address
+     *     row so its dialable address rides in seeds, but "self" is not a peer this
+     *     node authorized;
+     *  2. its `CadrePeer` row carries a complete voucher (`StampId`, `VouchOwner`,
+     *     `VouchSig` all non-null);
+     *  3. `VouchOwner` is in the NODE-LOCAL trusted-owner anchor
+     *     ({@link getTrustedOwnerStore}) — never the replicated `OwnerKey` table,
+     *     which any stranger can genesis-pollute; and
+     *  4. `VouchSig` verifies as that owner's signature over the row's voucher
+     *     digest ({@link verifyCadrePeerVoucher}), so the anchored owner really
+     *     vouched THIS peer id under THIS row's nonce; and
+     *  5. the row's `StampId` is NOT retired in `CadreControl.Revocation` — enforced
+     *     upstream in {@link ControlDatabase.queryCadrePeers}, which drops retired rows
+     *     before ANY reader (this predicate included) sees them, so a row resurrected
+     *     by replaying the captured admission approval on a node that had not yet
+     *     converged on the tombstone (the write-time `NotRevoked` CHECK only sees
+     *     local rows) is still inert to every reader that has the tombstone.
+     *
+     * Fail-closed at every step: a missing anchor (pre-start), an empty anchor (a
+     * not-yet-enrolled node authorizes no one), a null/partial voucher, an
+     * unanchored `VouchOwner`, or a bad signature all yield "not authorized" —
+     * having an address row is NOT membership. The control-network wake and
      * strand-address gates consult this set, NOT the addressable one.
      *
-     * NOTE: this is the addressable set minus self for now. The real trust predicate
-     * (voucher recorded on the row ∈ node-local trusted-owner anchor, signature
-     * verified) lands with the `membership-node-local-owner-anchor` /
-     * `membership-authorized-predicate-and-gates` tickets; keeping the filter in this one
-     * method means that change touches a single place.
+     * NOTE (rotation): if a party owner rotates keys and only the NEW key is pinned
+     * in the anchor, rows the OLD key vouched fail check 3 until re-vouched — a
+     * legit member goes un-authorized on readers that only pin the new key. Full
+     * rotation handling (re-vouch on rotate) is the
+     * `flip-strand-membership-rotation-known-gap` work, not this predicate's.
      */
     listAuthorizedMembers(): Promise<Array<{
         peerId: string;
         multiaddr: string | null;
     }>>;
+    /**
+     * Checks 2–4 of the authorized-membership predicate (see
+     * {@link listAuthorizedMembers}) for one `CadrePeer` row: complete voucher,
+     * `VouchOwner` in the node-local anchor, signature valid over the row's
+     * (PeerId, StampId) voucher digest.
+     *
+     * NOTE: verifies the ed25519 signature on every call (no memo of already-
+     * verified (peerId, stampId, vouchSig) triples). Cadres are a handful of
+     * devices and the gates run per inbound request, so this is cheap today; if
+     * membership or gate traffic ever grows, cache verified triples keyed on the
+     * row's `StampId` (which rotates with every re-vouch).
+     */
+    private hasAnchoredVoucher;
     /**
      * Probe whether a given peer is an AUTHORIZED party member (see
      * {@link listAuthorizedMembers}) — the gate the control-network wake and
-     * strand-address responders consult, NOT {@link isMember} (the addressable surface).
+     * strand-address responders consult, NOT {@link isMember} (the addressable
+     * surface). Deliberately scans the full membership (one `CadrePeer` query)
+     * rather than adding a single-row read path: cadres are small, and one code
+     * path keeps the predicate impossible to drift from the list.
      */
     isAuthorizedMember(peerId: string): Promise<boolean>;
     /**
@@ -935,6 +1731,68 @@ export declare class CadreNode implements SAppIdLookup {
      * Get the seed bootstrap service (for advanced use)
      */
     getSeedBootstrapService(): SeedBootstrapService | null;
+    /**
+     * The event callbacks every {@link SeedBootstrapService} this node owns is
+     * wired with — shared by the owner-capable service ({@link initializeSeedBootstrap})
+     * and the listener-only one ({@link enableSeedListener}) so the two cannot drift.
+     *
+     * A seed applied by the INBOUND protocol handler writes no `CadrePeer` row of
+     * its own (it merges the libp2p peer store and dials owners), so the automatic
+     * write-driven refresh never fires for it — yet applying it can ANCHOR a new
+     * owner key, which flips rows already present from unauthorized to authorized.
+     * Hence the explicit refresh here; without it a peer the freshly anchored owner
+     * vouched for stays denied until the next timed cohort reconcile.
+     */
+    private seedEventCallbacks;
+    /**
+     * Re-materialize the authorized-peer snapshot that the fail-closed per-stream
+     * control-DB gate ({@link authorizeInboundControlStream}) judges against.
+     *
+     * NO `CadrePeer` writer needs to call this: the control database notifies it
+     * after every committed member-row write (`ControlDatabase.mutateCadrePeer`,
+     * wired in {@link start}), which is exactly what makes the refresh automatic
+     * rather than a caller obligation. It stays public for the changes that write
+     * NO row locally and so raise no notification:
+     *
+     * - a membership row that arrived by REPLICATION (otherwise picked up on the
+     *   next timed cohort reconcile — bounded staleness by design), and
+     * - a newly anchored trusted owner key ({@link applySeed}), which flips rows
+     *   ALREADY present from unauthorized to authorized without touching them.
+     *
+     * Coalescing: marks the snapshot stale and resolves once a refresh that began
+     * after this call has completed, so a caller that awaits it always observes
+     * its own change. Concurrent callers share one read. Idempotent and
+     * best-effort (a failed read keeps the previous snapshot); never rejects.
+     */
+    refreshMembershipGate(reason?: string): Promise<void>;
+    /**
+     * The single in-flight refresh loop behind {@link refreshMembershipGate}: read
+     * until the stale flag stays clear, then release the slot.
+     *
+     * NOTE: correct only because {@link membershipGateDirty} is guaranteed TRUE at
+     * entry — its sole caller sets it synchronously, with no await in between. Were
+     * this ever invoked with the flag already clear, the body would never suspend,
+     * so the `finally` would null the slot BEFORE the caller's `??=` filled it, and
+     * the slot would be left holding an already-settled drain that every later
+     * refresh reuses — an unbreakable await/re-check spin. If a second caller is
+     * ever added, have it mark the flag first (or assert it here).
+     */
+    private drainMembershipGate;
+    /**
+     * Collapse a burst of `CadrePeer` writes into ONE gate refresh at scope exit.
+     *
+     * For loops that re-touch many rows (the write-while-alone drains), where a
+     * per-row refresh would mean one full membership read per row for a snapshot
+     * that only has to be correct once the loop settles.
+     *
+     * The depth counter is instance-level, so it also suppresses a genuinely
+     * CONCURRENT external write's refresh for the life of the scope: that writer's
+     * promise resolves before its peer is admitted, and admission lands at scope
+     * exit instead. Acceptable — scope exit is milliseconds away (bounded by the
+     * drain), versus the ~15 s reconcile interval that was the alternative before
+     * any of this existed — but it is the reason these scopes stay short and rare.
+     */
+    private deferMembershipGateRefresh;
     /**
      * Authorize a new peer to join the cadre.
      * Signs the peer ID with the owner key and inserts into CadrePeer table.
@@ -967,6 +1825,13 @@ export declare class CadreNode implements SAppIdLookup {
     applySeed(seed: ControlNetworkSeed, options?: {
         trustPolicy?: SeedTrustPolicy;
     }): Promise<ApplySeedResult>;
+    /**
+     * Post-process an {@link applySeed} outcome: retain the seed's owner peers as
+     * cold-start bootstrap targets, and surface a seed that was accepted but whose
+     * every owner dial failed — the node is now seeded yet unconnected, and the
+     * cold-start reconcile branch is what gets it out of that state.
+     */
+    private noteAppliedSeed;
     /**
      * Deliver a seed directly to a peer via the /sereus/seed/1.0.0 protocol.
      */