@serfab/cadre-core 0.9.0 → 0.10.0

package/dist/seed-bootstrap.js

@@ -3,11 +3,11 @@ import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } fr
 import { digest, sign, verify, getPublicKey } from '@optimystic/quereus-plugin-crypto';
 import { multiaddr } from '@multiformats/multiaddr';
 import { peerIdFromString } from '@libp2p/peer-id';
-import { writeFrame, readStreamToEnd } from './control-stream.js';
+import { writeFrame, withDeadline, exchangeFrame, readStreamToEnd } from './control-stream.js';
 import { generateStampId } from './control-database.js';
 import { canonicalJson } from './canonical-json.js';
-import { peerAuthorizationDigest, cadrePeerVoucherDigest, cadrePeerRemoveDigest } from './peer-authorization.js';
-import { dbAnchoredTrustPolicy, } from './seed-trust-policy.js';
+import { deviceTokenAddDigest } from './peer-authorization.js';
+import { anchoredTrustPolicy, } from './seed-trust-policy.js';
 const log = debug('sereus:cadre:seed-bootstrap');
 /** Protocol ID for seed delivery */
 export const SEED_PROTOCOL = '/sereus/seed/1.0.0';
@@ -17,6 +17,8 @@ const MAX_SEED_SIZE = 1024 * 1024;
 const DEFAULT_SEED_READ_TIMEOUT_MS = 10000;
 /** Default cap on concurrent inbound seed streams a single peer can pin open. */
 const DEFAULT_MAX_CONCURRENT_SEEDS = 100;
+/** Default time the sender waits for a seed delivery (dial + ack read) before aborting (ms). */
+const DEFAULT_SEED_DELIVER_TIMEOUT_MS = 10000;
 /**
  * Decode a 4-byte big-endian length-prefixed frame; returns the body bytes.
  *
@@ -76,6 +78,13 @@ export function ed25519PublicKeyB64FromPeerId(peerId) {
 export function canonicalSeedPayload(seed) {
     return canonicalJson({ partyId: seed.partyId, peers: seed.peers });
 }
+/**
+ * An {@link ApplySeedResult} for a seed refused before the owner-dial loop ran,
+ * so the dial counters read zero rather than being absent.
+ */
+function seedRejected(error) {
+    return { success: false, peersAdded: 0, error, ownerDialsAttempted: 0, ownerDialsFailed: 0 };
+}
 /**
  * SeedBootstrapService handles control network seed generation and delivery.
  *
@@ -91,9 +100,10 @@ export class SeedBootstrapService {
         this.activeStreams = 0;
         this.eventCallbacks = {};
         this.config = config;
-        this.trustPolicy = config.trustPolicy ?? dbAnchoredTrustPolicy();
+        this.trustPolicy = config.trustPolicy ?? anchoredTrustPolicy();
         this.seedReadTimeoutMs = config.seedReadTimeoutMs ?? DEFAULT_SEED_READ_TIMEOUT_MS;
         this.maxConcurrentSeeds = config.maxConcurrentSeeds ?? DEFAULT_MAX_CONCURRENT_SEEDS;
+        this.seedDeliverTimeoutMs = config.seedDeliverTimeoutMs ?? DEFAULT_SEED_DELIVER_TIMEOUT_MS;
         // Derive public key from private key if not provided
         if (config.ownerPrivateKey && !config.ownerPublicKey) {
             this.ownerPublicKey = getPublicKey(config.ownerPrivateKey, 'ed25519', 'base64url', 'base64url');
@@ -144,7 +154,7 @@ export class SeedBootstrapService {
     }
     /**
      * Authorize a new peer to join the cadre.
-     * Signs the peer ID with the owner key and inserts into CadrePeer table.
+     * Signs a membership voucher with the owner key and inserts into CadrePeer table.
      *
      * The owner vouches the `PublicKey <-> PeerId` binding: rather than trust a
      * caller-supplied key, the binding is enforced by construction — `PublicKey` is
@@ -176,9 +186,14 @@ export class SeedBootstrapService {
      * is its own owner (it holds the owner key): the row is owner-signed
      * (satisfying `AuthorizedInsert`) AND carries a valid self-`Sig`, so it resolves
      * immediately without a follow-up self-update.
+     *
+     * @returns `true` when this call seated the row, `false` when a concurrent writer
+     *   (e.g. an {@link authorizePeer} of this node's own id) had already seated it —
+     *   in which case the row in the database is NOT this record and carries whatever
+     *   `Sig` that writer had, so the caller must self-update to publish its signature.
      */
     async insertSelfPeerRecord(record) {
-        await this.insertCadrePeerRow({
+        return await this.insertCadrePeerRow({
             peerId: record.peerId,
             publicKey: record.publicKey,
             multiaddr: record.addrs.join(','),
@@ -187,91 +202,87 @@ export class SeedBootstrapService {
         });
     }
     /**
-     * Shared owner-signed `CadrePeer` INSERT. Mints a fresh single-use `StampId`
-     * and signs the voucher digest `digest(peerId, stampId)` ({@link cadrePeerVoucherDigest})
-     * with the owner key (satisfying `AuthorizedInsert`), then writes the full record
-     * row with the vouching (owner, signature) persisted into VouchOwner/VouchSig.
-     * The owner signature does NOT cover the address columns — those are vouched only
-     * as far as the owner asserts them, and a peer's own `Sig` (when present) is what
-     * makes the row resolvable.
+     * Shared owner-signed `CadrePeer` INSERT — the row fields and the owner-key
+     * precondition; the stamp mint, voucher signature, write lock, existence check and
+     * membership notify are all {@link ControlDatabase.insertCadrePeer}'s (see there for
+     * the anti-replay and insert-race rationale). No `CadrePeer` write may bypass that
+     * method: the write is what admits the peer's traffic.
+     *
+     * The DB check precedes the owner-key check here, matching the order this method has
+     * always surfaced them (the owner-key error used to come out of the signer, after the
+     * DB check).
+     *
+     * @returns `true` when this call performed the INSERT, `false` when the row was
+     *   already seated by a concurrent writer. The loser needs to know: an authorize seats
+     *   a row with a null `Sig`, so a self-publish that lost the race must fall through to
+     *   a self-update or its record never lands.
      */
     async insertCadrePeerRow(row) {
         if (!this.controlDatabase) {
             throw new Error('Control database not initialized');
         }
-        // Fresh single-use nonce; the voucher signs digest(peerId, stampId) so a captured
-        // insert can't be replayed (StampId is unique) and can't be repurposed as a delete
-        // (which signs a distinct 'remove'-scoped digest).
-        // NOTE: StampId uniqueness only blocks insert-replay while the row (or its StampId)
-        // is still present — a delete frees the StampId, so a captured authorized insert could
-        // be replayed to re-add a peer the owner had removed (a revocation bypass). Fully
-        // subsumed by the connection gater (ticket 6): with no outsider write there is no
-        // replay at all. If that gate ever proves insufficient, bind inserts to a persistent
-        // per-peer sequence / tombstone instead of a row-scoped nonce.
-        const stampId = generateStampId(row.peerId);
-        const signature = this.signDigest(cadrePeerVoucherDigest(row.peerId, stampId));
-        const db = this.controlDatabase.getDatabase();
-        // Persist the vouching (owner, signature) onto the row (VouchOwner/VouchSig)
-        // — identical to the context pair, which the AuthorizedInsert constraint binds — so a
-        // reader can later re-check the voucher against its node-local trusted-owner anchor.
-        await db.exec(`
-      insert into CadreControl.CadrePeer (PeerId, PublicKey, Multiaddr, UpdatedAt, Sig, StampId, VouchOwner, VouchSig)
-        with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, ?, ?, ?, ?, ?)
-    `, [this.ownerPublicKey, signature, row.peerId, row.publicKey, row.multiaddr, row.updatedAt, row.sig, stampId, this.ownerPublicKey, signature]);
+        const ownerKey = this.requireOwnerPublicKey();
+        return await this.controlDatabase.insertCadrePeer(row, ownerKey, message => this.signMessageBytes(message));
     }
     /**
      * Owner-signed INSERT of a peer's OWN self-signed `DeviceToken` row.
      *
      * Counterpart to {@link insertSelfPeerRecord} for the device-token registry: the
-     * row is owner-signed (satisfying `DeviceToken.AuthorizedInsert`, which vouches
-     * membership exactly as `CadrePeer.AuthorizedInsert` does) AND carries the peer's
-     * own self-`Sig` over the token payload. The owner signature covers only the
-     * PeerId — it does NOT vouch the token contents; the peer's `Sig` (verified at
+     * row is owner-signed (satisfying `DeviceToken.AuthorizedInsert` via the
+     * 'add'-tagged digest, {@link deviceTokenAddDigest}) AND carries the peer's
+     * own self-`Sig` over the token payload. The owner signature covers the WHOLE row
+     * (every column, ending in a freshly minted single-use `StampId`) — but covering the
+     * token contents is not the same as vouching them: the peer's `Sig` (verified at
      * resolve time against the bound `CadrePeer.PublicKey`) is what makes the row
      * resolvable. Used by {@link CadreNode.registerDeviceToken} for the first publish
      * when the node is its own owner.
+     *
+     * The stamp is per-INSERT, so a re-register after a clear mints a fresh one and a
+     * fresh signature — unaffected by the cleared row's retired stamp
+     * (`DeviceToken.NotRevoked`).
      */
     async insertSelfDeviceToken(record) {
-        const signature = this.signPeerAuthorization(record.peerId);
+        const stampId = generateStampId(record.peerId);
+        const signature = this.signDigest(deviceTokenAddDigest({ ...record, stampId }));
         if (!this.controlDatabase) {
             throw new Error('Control database not initialized');
         }
-        const db = this.controlDatabase.getDatabase();
-        await db.exec(`
-      insert into CadreControl.DeviceToken (PeerId, Platform, Token, UpdatedAt, Sig)
+        await this.controlDatabase.execWrite(`
+      insert into CadreControl.DeviceToken (PeerId, Platform, Token, UpdatedAt, Sig, StampId)
         with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, ?, ?)
-    `, [this.ownerPublicKey, signature, record.peerId, record.platform, record.token, record.updatedAt, record.sig]);
+        values (?, ?, ?, ?, ?, ?)
+    `, [this.ownerPublicKey, signature, record.peerId, record.platform, record.token, record.updatedAt, record.sig, stampId]);
         log('Device token inserted (owner-signed): %s', record.peerId);
     }
     /**
      * Owner-signed DELETE of a peer's `DeviceToken` row (logout / token
-     * invalidation). The `DeviceToken.AuthorizedInsert` constraint gates both insert
-     * AND delete on an owner signature over `digest(old.PeerId)`, so — like
-     * {@link removePeer} for `CadrePeer` — clearing a token requires the owner key.
+     * invalidation). The `DeviceToken.AuthorizedDelete` constraint validates an owner
+     * signature over the 'remove'-tagged digest bound to the STORED row's
+     * (PeerId, StampId) — deliberately distinct from the insert digest, so a captured
+     * insert approval can never be replayed to clear a token. Like {@link removePeer}
+     * for `CadrePeer`, clearing a token requires the owner key.
+     *
+     * The delete and the `Revocation` tombstone retiring the row's `StampId` commit in
+     * ONE transaction — `DeviceToken.RevocationRecorded` refuses a bare delete, and
+     * without the tombstone the stamp would free up and the never-expiring insert
+     * approval (which the cleared device holds a copy of) would re-seat the token. The
+     * tombstone carries its OWN owner signature: retiring a stamp permanently forecloses
+     * that row, so it is an owner action in its own right.
+     *
+     * Both digests, the stamp read, and the transaction come from
+     * {@link ControlDatabase.deleteDeviceToken} — one shared implementation across
+     * `CadrePeer` / `DeviceToken` / `Strand` / `ValidationKey`. What stays here is the
+     * owner-key precondition; a no-op on an already-absent row is the shared body's
+     * behavior, and unlike {@link removePeer} nothing here rides on it.
      */
     async deleteDeviceToken(peerId) {
-        const signature = this.signPeerAuthorization(peerId);
+        // Fail fast on a keyless service BEFORE the DB read, so a non-owner gets the
+        // owner-key error rather than a silent no-op on an absent row.
+        const ownerKey = this.requireOwnerPublicKey();
         if (!this.controlDatabase) {
             throw new Error('Control database not initialized');
         }
-        const db = this.controlDatabase.getDatabase();
-        await db.exec(`
-      delete from CadreControl.DeviceToken
-        with context OwnerKey = ?, Signature = ?
-        where PeerId = ?
-    `, [this.ownerPublicKey, signature, peerId]);
-        log('Device token removed (owner-signed): %s', peerId);
-    }
-    /**
-     * Sign a peer ID with the owner key for a `CadrePeer` / `DeviceToken`
-     * insert-or-delete. The signed bytes come from the shared
-     * {@link peerAuthorizationDigest} helper so the offline `cadre enroll register`
-     * verifier checks the exact same construction. Throws if no owner key is set.
-     */
-    signPeerAuthorization(peerId) {
-        return this.signDigest(peerAuthorizationDigest(peerId));
+        await this.controlDatabase.deleteDeviceToken(peerId, ownerKey, message => this.signMessageBytes(message));
     }
     /**
      * Return the configured owner private key, or throw if none is set. The single
@@ -287,65 +298,101 @@ export class SeedBootstrapService {
         }
         return this.config.ownerPrivateKey;
     }
+    /**
+     * The owner PUBLIC key that rides in every owner-signed write's context, non-null.
+     *
+     * The field is nullable because a read-only service carries no owner key at all, but the
+     * constructor derives the public key whenever `ownerPrivateKey` is set — so gating on
+     * {@link requireOwnerPrivateKey} first makes the pair inseparable and the second throw
+     * unreachable. Callers that must reject a keyless service BEFORE any DB read use this as
+     * their first line and get the owner-key precondition for free.
+     */
+    requireOwnerPublicKey() {
+        this.requireOwnerPrivateKey();
+        if (!this.ownerPublicKey) {
+            throw new Error('Owner public key required to authorize peers');
+        }
+        return this.ownerPublicKey;
+    }
     /**
      * Sign a base64url digest with the owner key (ed25519). The single place the
-     * owner private key is applied; callers pass the canonical digest for the specific
-     * action ({@link cadrePeerVoucherDigest} / {@link cadrePeerRemoveDigest} /
-     * {@link peerAuthorizationDigest}). Throws if no owner key is set.
+     * owner private key is applied; callers pass the canonical domain-tagged digest for
+     * the specific action ({@link deviceTokenAddDigest}), or the raw-bytes form via
+     * {@link signMessageBytes}. Throws if no owner key is set.
      */
     signDigest(digestB64url) {
         return sign(digestB64url, this.requireOwnerPrivateKey(), 'ed25519', 'base64url', 'base64url', 'base64url');
     }
+    /**
+     * Adapt the control database's raw-bytes `signMessage` callback (every guarded delete
+     * takes one) to {@link signDigest}'s base64url-string form. Both encodings hash to the
+     * same signed bytes (`sign` decodes its base64url input), so a signature minted here
+     * satisfies the same schema CHECK as one from the callers that sign the bytes directly — see
+     * `control-revocation-replay.spec.ts`'s "raw-bytes and digest-string signers agree".
+     */
+    signMessageBytes(message) {
+        return this.signDigest(uint8ArrayToString(message, 'base64url'));
+    }
     /**
      * Remove a peer from the cadre by owner signature.
      *
      * The `CadrePeer.AuthorizedDelete` (`check on delete`) constraint validates a
-     * signature over the DISTINCT 'remove'-scoped digest `digest(old.PeerId, old.StampId,
-     * 'remove')` ({@link cadrePeerRemoveDigest}) by an owner key — deliberately NOT the
-     * insert voucher digest, so the row's stored `VouchSig` can never be replayed to delete.
+     * signature over the DISTINCT 'remove'-tagged digest
+     * `digest('CadreControl.CadrePeer', 'remove', old.PeerId, old.StampId)` by an owner
+     * key — deliberately NOT the insert voucher digest, so the row's stored `VouchSig` can
+     * never be replayed to delete.
+     *
+     * The delete and the `Revocation` tombstone retiring the row's `StampId` commit in ONE
+     * transaction — `CadrePeer.RevocationRecorded` refuses a bare delete, and without the
+     * tombstone the stamp would free up and the original admission approval (which never
+     * expires, and which the removed peer holds a copy of) would re-seat the row.
+     *
+     * The tombstone is separately owner-signed (satisfying `Revocation.Authorized`):
+     * retiring a stamp evicts that peer party-wide and permanently forecloses re-admitting
+     * the row, so it is an owner action in its own right, not a side effect the delete's
+     * signature covers.
+     *
+     * Both digests, the stamp read, the transaction, and the post-commit membership notify
+     * come from {@link ControlDatabase.deleteCadrePeer} — one shared implementation across
+     * `CadrePeer` / `DeviceToken` / `Strand` / `ValidationKey`. What stays here is the
+     * owner-key precondition and the absent-row gate the notify depends on (below).
      */
     async removePeer(peerId) {
         // Fail fast on a keyless service BEFORE any DB read: a non-owner cannot sign the
         // remove digest, and this precedence (owner key, then control DB) is what the
         // unit contract asserts.
-        this.requireOwnerPrivateKey();
+        const ownerKey = this.requireOwnerPublicKey();
         if (!this.controlDatabase) {
             throw new Error('Control database not initialized');
         }
-        // Delete is authorized by a signature over a DISTINCT 'remove'-scoped digest bound to
-        // the row's CURRENT StampId — so the row's stored voucher (a signature over the
-        // voucher digest) can never be replayed to authorize a delete.
+        // This absent-row gate must stay OUTSIDE the delete, even though the delete repeats it
+        // internally: deleteCadrePeer's membership notify fires whenever its body resolves,
+        // with no idea whether the body wrote anything, so delegating an absent peer would
+        // fire a spurious membership notification.
+        // NOTE: deleteCadrePeer re-reads the StampId, so a peer removed by another writer
+        // between the two reads no-ops silently yet still notifies. Narrow concurrent-removal
+        // window only — the common "already absent" case is caught here.
         const stampId = await this.controlDatabase.queryCadrePeerStampId(peerId);
         if (stampId === null) {
             log('removePeer: no CadrePeer row for %s (already absent)', peerId);
             return;
         }
-        const signature = this.signDigest(cadrePeerRemoveDigest(peerId, stampId));
         log('Removing peer: %s', peerId);
-        const db = this.controlDatabase.getDatabase();
-        await db.exec(`
-      delete from CadreControl.CadrePeer
-        with context OwnerKey = ?, Signature = ?
-        where PeerId = ?
-    `, [this.ownerPublicKey, signature, peerId]);
-        log('Peer %s removed successfully', peerId);
-    }
-    /**
-     * Owner "re-touch" of an existing `CadrePeer` membership row: bump
-     * `UpdatedAt` under the owner branch of `CadrePeer.AuthorizedUpdate` (a
-     * signature over `digest(peerId)` — the same construction {@link authorizePeer}
-     * uses) so the row is re-emitted as a fresh, broadcasting transaction.
-     *
-     * This is the write-while-alone re-replication primitive
-     * (`control-write-ensure-replicated`): a membership row that committed
-     * local-only (its block's cluster ≤1 at insert) is pushed to the cohort once it
-     * grows, by re-issuing this monotonic bump. It is an UPDATE (not the original
-     * INSERT) because the row already exists locally; a re-INSERT would hit the
-     * `PeerId` PK. Only the freshness stamp changes — `PublicKey` / `Multiaddr` /
-     * `Sig` are left intact — so it is safe over a row whose peer has not
-     * self-published (`Sig` null); the caller must skip a row that already carries a
-     * self-`Sig` (that row is the owning peer's to refresh, and bumping `UpdatedAt`
-     * without re-signing would invalidate its self-signature).
+        await this.controlDatabase.deleteCadrePeer(peerId, ownerKey, message => this.signMessageBytes(message));
+        log('Peer %s removed successfully (stamp retired)', peerId);
+    }
+    /**
+     * Owner "re-touch" of an existing `CadrePeer` membership row: bump `UpdatedAt` and
+     * re-vouch the row so it is re-emitted as a fresh, broadcasting transaction. This is
+     * the write-while-alone re-replication primitive (`control-write-ensure-replicated`):
+     * a membership row that committed local-only (its block's cluster ≤1 at insert) is
+     * pushed to the cohort once it grows.
+     *
+     * The stamp read, the voucher signature, the write lock and the membership notify are
+     * {@link ControlDatabase.reauthorizeCadrePeer}'s — including the caveat that it rebinds
+     * `VouchOwner` to this node's owner key. What stays here is the owner-key precondition.
+     *
+     * A no-op (no throw, no notify) when the row does not exist.
      *
      * @param peerId - the membership row to re-touch.
      * @param updatedAt - the strictly-increasing freshness stamp to write.
@@ -355,34 +402,42 @@ export class SeedBootstrapService {
     async reauthorizePeer(peerId, updatedAt) {
         // Fail fast on a keyless service before any DB read (see removePeer): a non-owner
         // cannot re-sign the voucher, and must not silently no-op on an absent row.
-        this.requireOwnerPrivateKey();
+        const ownerKey = this.requireOwnerPublicKey();
         if (!this.controlDatabase) {
             throw new Error('Control database not initialized');
         }
-        // The owner branch of AuthorizedUpdate verifies a voucher over digest(PeerId,
-        // StampId) and re-binds VouchOwner/VouchSig. Sign over the row's CURRENT StampId
-        // (unchanged by this re-touch) and re-set the voucher columns so the branch passes.
-        // NOTE: this rebinds VouchOwner to THIS node's owner key. Benign today — the
-        // write-while-alone drain only re-touches rows this node itself authored. If a future
-        // path lets one owner re-touch a row a DIFFERENT owner vouched, the voucher
-        // silently flips to this owner; that only matters once ticket-4's predicate checks
-        // VouchOwner against a node-local anchor, and only if the two owners differ in
-        // anchor membership.
-        const stampId = await this.controlDatabase.queryCadrePeerStampId(peerId);
-        if (stampId === null) {
+        const retouched = await this.controlDatabase.reauthorizeCadrePeer(peerId, updatedAt, ownerKey, message => this.signMessageBytes(message));
+        if (!retouched) {
             log('reauthorizePeer: no CadrePeer row for %s (nothing to re-touch)', peerId);
             return;
         }
-        const signature = this.signDigest(cadrePeerVoucherDigest(peerId, stampId));
-        const db = this.controlDatabase.getDatabase();
-        await db.exec(`
-      update CadreControl.CadrePeer
-        with context OwnerKey = ?, Signature = ?
-        set UpdatedAt = ?, VouchOwner = ?, VouchSig = ?
-        where PeerId = ?
-    `, [this.ownerPublicKey, signature, updatedAt, this.ownerPublicKey, signature, peerId]);
         log('Peer %s re-authorized (UpdatedAt=%d) for write-while-alone re-replication', peerId, updatedAt);
     }
+    /**
+     * Owner re-issue of a batch of `Revocation` tombstones: bump each row's
+     * `ReissuedAt` so the storage layer re-broadcasts a tombstone that committed
+     * while the node was alone. The delete-while-alone counterpart of
+     * {@link reauthorizePeer} — a removed row cannot be re-touched (it is gone),
+     * but its tombstone can, and every membership read treats a retired stamp as
+     * absent.
+     *
+     * The signatures, the single transaction, and the strictly-monotonic
+     * `reissuedAt` contract are {@link ControlDatabase.reissueRevocations}'s. What
+     * stays here is the owner-key precondition.
+     *
+     * @returns how many tombstones were re-issued (`rows.length` on success).
+     * @throws if no owner private key is configured or the control database is not
+     *   initialized.
+     */
+    async reissueRevocations(rows, reissuedAt) {
+        // Fail fast on a keyless service before any DB work (see removePeer): a
+        // non-owner cannot sign the reissue digests.
+        const ownerKey = this.requireOwnerPublicKey();
+        if (!this.controlDatabase) {
+            throw new Error('Control database not initialized');
+        }
+        return this.controlDatabase.reissueRevocations(rows, reissuedAt, ownerKey, message => this.signMessageBytes(message));
+    }
     /**
      * Create a seed from the current control network state.
      * The seed contains peer information and is signed by an owner.
@@ -419,10 +474,15 @@ export class SeedBootstrapService {
      *
      * Validates the seed signature, then evaluates a trust anchor for the
      * `signerKey` that does NOT come from the seed body: the receiver's
-     * `OwnerKey` table (DB-anchored), optionally augmented by pinned keys or
-     * TOFU via the configured/overriding `SeedTrustPolicy`. A forged
-     * self-asserting seed — one that merely lists its own signer as an owner
-     * peer — no longer passes.
+     * node-local {@link SeedBootstrapConfig.trustedOwners} anchor, optionally
+     * augmented by pinned keys or TOFU via the configured/overriding
+     * `SeedTrustPolicy`. A forged self-asserting seed — one that merely lists its
+     * own signer as an owner peer — no longer passes, and neither does one signed
+     * by a key a stranger genesis-inserted into the replicated `OwnerKey` table.
+     *
+     * A key accepted via a pin/TOFU is persisted into the anchor (the policy says
+     * so via `SeedTrustDecision.anchorAs`), so the next seed from that owner is
+     * anchored without re-supplying the invite.
      *
      * @param seed - The seed to apply (already transport-decoded).
      * @param options.trustPolicy - Per-call policy override (e.g. a
@@ -431,19 +491,26 @@ export class SeedBootstrapService {
      */
     async applySeed(seed, options) {
         if (!this.libp2pNode) {
-            return { success: false, peersAdded: 0, error: 'Service not initialized' };
+            return seedRejected('Service not initialized');
         }
+        // NOTE: `seed.partyId` is never checked against `config.partyId`. Nothing
+        // downstream reads it — trust is keyed on `signerKey` vs the anchor, and the
+        // anchor a stray-party seed could write into belongs to THIS party, which
+        // only a caller-supplied pin for that signer can reach. If applying a seed
+        // ever branches on its partyId (or the anchor becomes multi-party), reject a
+        // mismatch here instead.
         log('Applying seed for party: %s', seed.partyId);
         // Validate the seed signature
         if (!this.validateSeedSignature(seed)) {
-            return { success: false, peersAdded: 0, error: 'Invalid seed signature' };
-        }
-        // Evaluate the trust anchor for the signer key. The known-owner set is
-        // sourced from the receiver's control DB, never from the seed itself; a
-        // cold-start node with no DB and no override therefore sees an empty set.
-        const knownOwnerKeys = this.controlDatabase
-            ? await this.controlDatabase.getOwnerKeys()
-            : new Set();
+            return seedRejected('Invalid seed signature');
+        }
+        // Evaluate the trust anchor for the signer key. The known-owner set comes
+        // from the receiver's NODE-LOCAL anchor — never from the seed itself, and
+        // never from the replicated OwnerKey table (a stranger can genesis-insert
+        // its own key there and let it replicate into every peer's copy). A node
+        // whose anchor was never seeded, with no policy override, sees an empty set
+        // and rejects.
+        const knownOwnerKeys = this.config.trustedOwners?.all() ?? new Set();
         const policy = options?.trustPolicy ?? this.trustPolicy;
         const decision = await policy.evaluate({
             partyId: seed.partyId,
@@ -451,12 +518,9 @@ export class SeedBootstrapService {
             knownOwnerKeys,
         });
         if (!decision.trusted) {
-            return {
-                success: false,
-                peersAdded: 0,
-                error: decision.reason ?? 'Signer key not trusted by trust policy',
-            };
+            return seedRejected(decision.reason ?? 'Signer key not trusted by trust policy');
         }
+        await this.anchorAcceptedSigner(seed.signerKey, decision);
         let peersAdded = 0;
         // Add peers to the peer store
         for (const peer of seed.peers) {
@@ -476,22 +540,69 @@ export class SeedBootstrapService {
                 log('Failed to add peer %s: %o', peer.peerId, error);
             }
         }
-        // Dial owner peers to establish connections
+        // Dial owner peers to establish connections. Best-effort and COUNTED: an
+        // owner that is momentarily down leaves this node seeded but unconnected,
+        // which the caller can only see if the outcome is reported (see
+        // `ApplySeedResult.ownerDialsFailed`). Recovery is not this loop's job —
+        // `CadreNode.dialColdStartBootstrap` retries these same addresses on every
+        // control-cohort reconcile pass until the control database has siblings.
+        // `createSeed` projects EVERY CadrePeer row, so an owner applying a seed
+        // minted after it joined finds ITSELF in the owner list. Dialing self always
+        // throws, which would report a healthy owner as "seeded but stranded".
+        // Optional-chained: partial libp2p handles (unit-test doubles) omit `peerId`,
+        // and an undefined self simply matches nothing.
+        const selfPeerId = this.libp2pNode.peerId?.toString();
+        let ownerDialsAttempted = 0;
+        let ownerDialsFailed = 0;
         for (const peer of seed.peers.filter(p => p.isOwner)) {
+            if (peer.multiaddrs.length === 0 || peer.peerId === selfPeerId) {
+                continue;
+            }
+            ownerDialsAttempted++;
             try {
-                if (peer.multiaddrs.length > 0) {
-                    const addr = multiaddr(peer.multiaddrs[0]);
-                    log('Dialing owner peer: %s', peer.peerId);
-                    await this.libp2pNode.dial(addr);
-                }
+                const addr = multiaddr(peer.multiaddrs[0]);
+                log('Dialing owner peer: %s', peer.peerId);
+                await this.libp2pNode.dial(addr);
             }
             catch (error) {
+                ownerDialsFailed++;
                 log('Failed to dial peer %s: %o', peer.peerId, error);
                 // Continue - not all peers need to be reachable
             }
         }
-        log('Applied seed: %d peers added', peersAdded);
-        return { success: true, peersAdded };
+        log('Applied seed: %d peers added, %d/%d owner dial(s) failed', peersAdded, ownerDialsFailed, ownerDialsAttempted);
+        return { success: true, peersAdded, ownerDialsAttempted, ownerDialsFailed };
+    }
+    /**
+     * Persist a signer that a pin/TOFU accepted into the node-local anchor, so a
+     * later seed from the same owner is anchored without re-supplying the invite
+     * or re-prompting. Only the policy decides this happens (`anchorAs` is unset
+     * when the key was already anchored, so a plain re-apply writes nothing) and
+     * `trust()` is idempotent, keeping the original provenance for a known key.
+     *
+     * Failure to PERSIST does not fail the seed: `trust()` reflects the key in the
+     * in-memory anchor synchronously, so this seed and the rest of the session are
+     * unaffected — only durability across a restart is lost, and that is logged.
+     *
+     * NOTE: anchoring a key can flip `CadrePeer` rows ALREADY present from
+     * unauthorized to authorized, which the write-driven membership-gate refresh
+     * (`ControlDatabase.mutateCadrePeer`) cannot see — no row was written. Every
+     * anchor mutation today rides seed application, and both seed paths refresh the
+     * gate explicitly afterwards (`CadreNode.applySeed`, `onSeedApplied`). If some
+     * future path anchors an owner OUTSIDE seed application, it owes the same
+     * `CadreNode.refreshMembershipGate()` — or the anchor needs its own hub.
+     */
+    async anchorAcceptedSigner(signerKey, decision) {
+        if (!decision.anchorAs || !this.config.trustedOwners) {
+            return;
+        }
+        try {
+            await this.config.trustedOwners.trust(signerKey, decision.anchorAs);
+            log('Anchored seed signer %s as %s', signerKey, decision.anchorAs);
+        }
+        catch (error) {
+            log('Failed to persist accepted seed signer into the trusted-owner anchor: %o', error);
+        }
     }
     /**
      * Encode a seed for out-of-band delivery (e.g., QR code, copy/paste).
@@ -510,51 +621,64 @@ export class SeedBootstrapService {
     }
     /**
      * Deliver a seed directly to a peer via the /sereus/seed/1.0.0 protocol.
+     *
+     * Sender hardening: the whole exchange — dial, write, ack read — is bounded by
+     * {@link seedDeliverTimeoutMs}, and the ack is capped at {@link MAX_SEED_SIZE}.
+     * The target is a NOT-YET-TRUSTED node the instigator chose to dial during
+     * onboarding, so an unbounded read here is strictly more exposed than the
+     * membership-gated receiver paths: without the bound a target that accepts the
+     * stream and never replies parks this call forever, and one that streams
+     * arbitrary bytes as a fake ack exhausts memory.
      */
     async deliverSeed(targetMultiaddr, seed) {
         if (!this.libp2pNode) {
             throw new Error('Service not initialized');
         }
+        // Capture the node so the closure below needs no non-null assertion.
+        const node = this.libp2pNode;
         const addr = multiaddr(targetMultiaddr);
         log('Delivering seed to: %s', targetMultiaddr);
-        // Dial the target and open a stream
-        const rawStream = await this.libp2pNode.dialProtocol(addr, SEED_PROTOCOL);
-        const stream = rawStream;
-        try {
-            // Send the seed message as one length-prefixed frame (shared writer).
-            const message = {
-                partyId: seed.partyId,
-                peers: seed.peers,
-                signature: seed.signature,
-                signerKey: seed.signerKey,
-            };
-            writeFrame(stream, message);
-            // In libp2p v3.x, close() closes the write end only (signals EOF),
-            // while the read end remains open for receiving the ack.
-            await stream.close();
-            // Read the acknowledgment (stream is AsyncIterable in libp2p 3.x)
-            const chunks = [];
-            for await (const chunk of stream) {
-                const bytes = chunk instanceof Uint8Array ? chunk : chunk.subarray();
-                chunks.push(bytes);
-            }
-            const responseData = new Uint8Array(chunks.reduce((sum, c) => sum + c.length, 0));
-            let offset = 0;
-            for (const chunk of chunks) {
-                responseData.set(chunk, offset);
-                offset += chunk.length;
-            }
-            // Parse length-prefixed response
-            const responseBody = decodeLengthPrefixedFrame(responseData);
-            const responseJson = new TextDecoder().decode(responseBody);
-            const ack = JSON.parse(responseJson);
-            log('Seed delivery response: accepted=%s', ack.accepted);
-            return ack;
-        }
-        catch (err) {
-            stream.abort(err instanceof Error ? err : new Error(String(err)));
-            throw err;
-        }
+        return await withDeadline(this.seedDeliverTimeoutMs, `Seed delivery to ${targetMultiaddr}`, (signal) => this.sendSeed(node, addr, seed, signal));
+    }
+    /**
+     * Open one stream to the target, send the seed frame, half-close, and read the ack.
+     *
+     * `signal` is the deadline from {@link deliverSeed}: it goes to `dialProtocol` so
+     * a timeout during connect aborts the dial, and into {@link exchangeFrame} so a
+     * timeout after the stream is open resets it — releasing the otherwise unbounded
+     * ack-read.
+     *
+     * Deliberately NOT `runOnLimitedConnection`: a wake sets it because a wake is a
+     * tiny frame over a relay, whereas a seed is up to 1MB and this delivery path
+     * does not dial relay addresses today. Changing that is a separate decision.
+     */
+    async sendSeed(node, addr, seed, signal) {
+        const rawStream = await node.dialProtocol(addr, SEED_PROTOCOL, { signal });
+        const message = {
+            partyId: seed.partyId,
+            peers: seed.peers,
+            signature: seed.signature,
+            signerKey: seed.signerKey,
+        };
+        const ack = await exchangeFrame(rawStream, signal, message, (stream) => this.readSeedAck(stream), 'Seed delivery aborted by timeout');
+        log('Seed delivery response: accepted=%s', ack.accepted);
+        return ack;
+    }
+    /**
+     * Read the ack frame a delivery target writes back, bounded by
+     * {@link seedDeliverTimeoutMs} and capped at {@link MAX_SEED_SIZE} — an
+     * untrusted target must not be able to stream unlimited bytes as a fake ack.
+     * Decoding runs inside {@link exchangeFrame}'s `try`, so a malformed or
+     * non-JSON ack resets the stream rather than leaking it.
+     */
+    async readSeedAck(stream) {
+        const data = await readStreamToEnd(stream, {
+            maxBytes: MAX_SEED_SIZE,
+            timeoutMs: this.seedDeliverTimeoutMs,
+            label: 'Seed ack',
+        });
+        const body = decodeLengthPrefixedFrame(data, MAX_SEED_SIZE);
+        return JSON.parse(new TextDecoder().decode(body));
     }
     /**
      * Get this node's circuit relay address for inclusion in seeds.
@@ -595,6 +719,14 @@ export class SeedBootstrapService {
      * peer is an owner iff that derived key is in the `OwnerKey` set.
      * This makes any owner node markable — not just the local one — and ties
      * `isOwner` to the control table rather than to `peerId === self`.
+     *
+     * NOTE: this is the one owner lookup deliberately left on the REPLICATED
+     * table rather than the node-local anchor. `SeedPeer.isOwner` is a dial hint
+     * — the receiver dials owner-flagged peers first — not a trust decision, and
+     * the receiver re-derives real trust from its own anchor. So a polluted table
+     * costs at most a wasted dial, while anchoring here would silently drop
+     * legitimate co-owners this node never pinned. If `isOwner` ever gates
+     * anything the receiver TRUSTS, move it to the anchor.
      */
     async queryPeers() {
         if (!this.controlDatabase) {
@@ -686,7 +818,7 @@ export class SeedBootstrapService {
             const result = await this.applySeed(seed);
             // Emit appropriate event based on result
             if (result.success) {
-                this.eventCallbacks.onSeedApplied?.(seed.partyId, result.peersAdded);
+                this.eventCallbacks.onSeedApplied?.(seed.partyId, result.peersAdded, seed);
             }
             else {
                 this.eventCallbacks.onSeedError?.(seed.partyId, result.error ?? 'Unknown error');
@@ -789,11 +921,19 @@ export class SeedBootstrapService {
         else {
             ownerAddrs = this.libp2pNode.getMultiaddrs().map(a => a.toString());
         }
-        // Carry the cadre's owner keys out-of-band so a cold-start invitee can
-        // pin the trusted owner set before applying any seed.
-        const ownerKeys = this.controlDatabase
-            ? Array.from(await this.controlDatabase.getOwnerKeys())
-            : [];
+        // Carry the cadre's owner keys out-of-band so a cold-start invitee can pin
+        // the trusted owner set before applying any seed.
+        //
+        // Sourced ONLY from this node's own anchor, never from the replicated
+        // OwnerKey table: the invitee anchors whatever arrives here
+        // (CadreNode.trustOwnerKeys with source 'invite'), so handing over the
+        // pollutable table would let a stranger's genesis-inserted key ride an
+        // otherwise-legitimate invite straight into the new node's anchor —
+        // poisoning the very store this whole trust chain rests on. No anchor wired
+        // (a directly-constructed service) means no pins to hand out: an invite
+        // without `ownerKeys` costs the invitee an extra out-of-band step, whereas a
+        // table-sourced one silently hands it an unanchored key.
+        const ownerKeys = Array.from(this.config.trustedOwners?.all() ?? []);
         const now = Date.now();
         const invite = {
             partyId: this.config.partyId,