@serfab/cadre-core 0.9.0 → 0.10.0

package/dist/cadre-node.js

@@ -1,15 +1,19 @@
 import debug from 'debug';
 import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
-import { generateKeyPair, privateKeyToProtobuf, privateKeyFromProtobuf } from '@libp2p/crypto/keys';
-import { peerIdFromString } from '@libp2p/peer-id';
+import { peerIdFromString, peerIdFromPrivateKey } from '@libp2p/peer-id';
 import { createLibp2pNode } from '@optimystic/db-p2p';
 import { multiaddr } from '@multiformats/multiaddr';
-import { DEFAULT_CHECKIN_WINDOW_MS } from './types.js';
+import { CONTROL_CLUSTER_POLICY, CONTROL_REPLICATION_BREADTH, DEFAULT_CHECKIN_WINDOW_MS } from './types.js';
 import { sign } from '@optimystic/quereus-plugin-crypto';
-import { ed25519KeyPairFromLibp2p } from './ed25519-key.js';
+import { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, requireEd25519PublicKeyB64 } from './ed25519-key.js';
+import { strandTransportKey } from './strand-transport-key.js';
 import { DEFAULT_IDENTITY_KEY_ID } from './key-store.js';
+import { loadOrCreateIdentityKey } from './identity-key.js';
+import { MemoryTrustedOwnerStore } from './trusted-owner-store.js';
+import { MemoryBootstrapPeerStore } from './bootstrap-peer-store.js';
+import { verifyCadrePeerVoucher } from './peer-authorization.js';
 import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
-import { signPeerRecord, verifyPeerRecordSignature, isPeerRecordFresh, orderSignalingFirst, isSignalingAddr, currentMemberTrustPolicy, DEFAULT_PEER_RECORD_MAX_AGE_MS, DEFAULT_PEER_RECORD_HEARTBEAT_MS } from './peer-record.js';
+import { signPeerRecord, verifyPeerRecordSignature, isPeerRecordFresh, orderSignalingFirst, isSignalingAddr, trailingPeerId, currentMemberTrustPolicy, DEFAULT_PEER_RECORD_MAX_AGE_MS, DEFAULT_PEER_RECORD_HEARTBEAT_MS } from './peer-record.js';
 import { signDeviceTokenRecord, verifyDeviceTokenSignature, isPushPlatform } from './device-token.js';
 import { StrandWatcher } from './strand-watcher.js';
 import { StrandInstanceManager } from './strand-instance-manager.js';
@@ -20,8 +24,12 @@ import { HibernationManager } from './hibernation-manager.js';
 import { ControlDatabase } from './control-database.js';
 import { SeedBootstrapService } from './seed-bootstrap.js';
 import { StrandSolicitationService } from './strand-solicitation.js';
+import { createMembershipConnectionGater, DEFAULT_ENROLLMENT_WINDOW_MS } from './membership-connection-gater.js';
 import { StrandWakeService, dialWake } from './strand-wake-protocol.js';
 import { StrandAddrService, collectStrandAddrs } from './strand-addr-protocol.js';
+import { DelegateAdmissionStore, extractCircuitRelayTargets, dueRelayAnnounces, pruneStoppedStrandAnnounces, peerStrandKey } from './delegate-admission.js';
+import { resolveListenAddrs } from './relay-addrs.js';
+import { superviseRelayReservation, resolveRelayReservationState } from './relay-reservation.js';
 import { PushFanoutService } from './push-fanout.js';
 import { summarizeConnectionPaths, classifyTransport } from './diagnostics/connection-path.js';
 import { TurnRelayTracker } from './diagnostics/webrtc-turn-tracker.js';
@@ -33,6 +41,33 @@ const timing = debug('sereus:cadre:timing');
  * `RTCPeerConnection` reaching `connected` and libp2p surfacing the connection.
  */
 const TURN_CONSUME_WINDOW_MS = 1000;
+/**
+ * A circuit relay as a strand-addr RPC target: dialed by peerId, with its
+ * direct addr riding along as the fallback for a relay we hold no connection to.
+ */
+function relayStrandAddrPeer(relay) {
+    return { peerId: relay.relayPeerId, addrs: [multiaddr(relay.relayAddr)] };
+}
+/**
+ * Build the signing callback the `ControlDatabase` writers expect: they hand it the
+ * canonical row-bound message BYTES (see `buildAuthorizationMessage`), and it ed25519-signs
+ * them directly (no pre-hash) with the owner private key, returning a base64url signature.
+ */
+function signMessageWith(privateKeyB64) {
+    return (message) => sign(message, privateKeyB64, 'ed25519', 'bytes', 'base64url', 'base64url');
+}
+/**
+ * Reject a blank identifier before it reaches the control database, where it would fail an
+ * authorization CHECK as an opaque constraint error rather than an actionable message.
+ * Returns the trimmed value so callers write the same bytes they validated.
+ */
+function requireNonBlank(value, label) {
+    const trimmed = value.trim();
+    if (trimmed.length === 0) {
+        throw new Error(`A ${label} is required (received an empty or whitespace-only value)`);
+    }
+    return trimmed;
+}
 /**
  * CadreNode is the main entry point for a cadre member.
  * It manages:
@@ -44,6 +79,15 @@ const TURN_CONSUME_WINDOW_MS = 1000;
  */
 export class CadreNode {
     constructor(config) {
+        /**
+         * Node-local, NON-replicated trusted-owner anchor (see
+         * `trusted-owner-store.ts`). Constructed (or adopted from
+         * `config.trustedOwners.store`) by {@link initializeTrustedOwnerStore} during
+         * {@link start}; deliberately NOT cleared by {@link cleanup}, so an in-memory
+         * anchor survives a stop()→start() cycle of the same node instance. Never
+         * sourced from replicated control state.
+         */
+        this.trustedOwnerStore = null;
         this.controlNode = null;
         this.controlDatabase = null;
         this.strandWatcher = null;
@@ -80,6 +124,25 @@ export class CadreNode {
          */
         this.windowWaiters = new Set();
         this.eventHandlers = new Map();
+        /**
+         * Relay multiaddrs the caller asked {@link reserveRelays} to reserve through.
+         * Empty (the default) means nobody asked, so {@link getRelayReservationState}
+         * reports `none` — this whole surface is opt-in and dormant for the CLI/host
+         * nodes, which use the configured `network.relayAddrs` route instead.
+         */
+        this.relayReserveAddrs = [];
+        /**
+         * The running retry loop for {@link relayReserveAddrs}, or `null` when nobody
+         * asked for a reservation / there was no control node to supervise. It owns the
+         * in-flight flag, the last failure and the next-attempt time; this class only
+         * starts it, stops it and reads it.
+         */
+        this.relayReserveSupervisor = null;
+        /**
+         * Reason {@link reserveRelays} produced no reservation when there is no
+         * supervisor to hold one — i.e. the pre-start `control node unavailable` case.
+         */
+        this.relayReserveError = null;
         /** Map of strandId -> sAppConfig for sAppId filtering and management */
         this.sAppConfigs = new Map();
         /**
@@ -89,6 +152,106 @@ export class CadreNode {
          * control-network node never needs to dial back to the manager.
          */
         this.latestInviteAddresses = null;
+        /**
+         * Epoch ms until which the control-network inbound gate admits
+         * not-yet-authorized peers (see {@link admitInboundControlConnection} /
+         * {@link openEnrollmentWindow}). 0 = no window open. Opened automatically by
+         * {@link createInvite}; deliberately NOT reset on stop() — a stop/start cycle
+         * inside an outstanding invite's validity must not strand the invitee.
+         *
+         * NOTE: in-memory only, so a PROCESS restart mid-invite closes the door until
+         * the owner re-mints or the invitee is authorized. Fine while invites are
+         * short-lived and redeemed promptly; if long-lived invites or restart-prone
+         * hosts become normal, persist the window (or derive it from the issued-invite
+         * records `SeedBootstrapService` already keeps).
+         */
+        this.enrollmentWindowUntil = 0;
+        /**
+         * Lazily-parsed PeerIds of `controlNetwork.bootstrapNodes` (see
+         * {@link getBootstrapPeerIds}) — infrastructure the inbound gate always admits.
+         */
+        this.bootstrapPeerIds = null;
+        /**
+         * Materialized in-memory snapshot of the AUTHORIZED member peer ids (the
+         * {@link listAuthorizedMembers} result), consulted by the per-stream
+         * control-DB gate ({@link authorizeInboundControlStream}). That predicate
+         * runs on EVERY inbound Optimystic control-DB stream and must never await a
+         * control-DB read: those reads pull blocks over the very protocols the
+         * predicate gates, which closes a circular wait that ends in mutual denial
+         * (the upstream gate is fail-closed on timeout, unlike the fail-open
+         * connection gater). So the set is refreshed OUT OF BAND instead — after
+         * start, on every {@link reconcileControlCohort} pass (15s cadence), and
+         * immediately after every LOCAL membership mutation so a just-vouched peer
+         * is admitted without waiting for the timer. That last refresh is AUTOMATIC:
+         * the control database notifies {@link refreshMembershipGate} after every
+         * committed `CadrePeer` write (see `ControlDatabase.mutateCadrePeer`), so no
+         * writer has to remember. A change that arrives by REPLICATION is picked up
+         * on the next timed refresh — bounded staleness, acceptable because this gate
+         * is defense in depth: rows an unadmitted peer manages to write are still
+         * disbelieved at read time by the voucher-anchored predicate.
+         */
+        this.authorizedControlPeers = new Set();
+        /**
+         * Coalescing state for {@link refreshMembershipGate}: a pending "the snapshot
+         * is stale" flag, the single in-flight drain that consumes it, and the depth
+         * of open {@link deferMembershipGateRefresh} scopes (a burst of writes inside
+         * one scope collapses to a single refresh at scope exit).
+         */
+        this.membershipGateDirty = false;
+        this.membershipGateDrain = null;
+        this.membershipGateDeferDepth = 0;
+        /**
+         * In-memory delegate admission grants (see `delegate-admission.ts`): the
+         * strand-node transport peerIds this party's members have announced over the
+         * strand-addr RPC, admitted at the CONNECTION level so a member's NAT'd
+         * strand node can hold a circuit-relay reservation on this node. Consulted
+         * ONLY by {@link admitInboundControlConnection}; the fail-closed per-stream
+         * gate ({@link authorizeInboundControlStream}) never honors it.
+         */
+        this.delegateAdmission = new DelegateAdmissionStore();
+        /**
+         * When this node last ANNOUNCED a delegate, keyed `<targetPeerId>\n<strandId>`
+         * (the peer announced TO, not the delegate). Throttles
+         * {@link refreshDelegateGrants} to once per `DELEGATE_GRANT_TTL_MS / 2` per
+         * (relay, strand) so the 15 s reconcile tick never becomes per-tick RPC
+         * chatter; the launch/resume announce passes record here too. Keys whose
+         * strand is no longer running are pruned on each reconcile pass.
+         */
+        this.delegateAnnounceAt = new Map();
+        /**
+         * Cold-start bootstrap dial targets: the owner-flagged peers of every seed
+         * this node has applied, keyed by peer id, valued by the seed's multiaddr
+         * strings (parsed lazily, at dial time). Written by
+         * {@link recordSeedBootstrapPeers}; read only by
+         * {@link dialColdStartBootstrap} while the control database still has no
+         * siblings to dial.
+         *
+         * A STORE rather than a plain map (see `bootstrap-peer-store.ts`), because the
+         * targets must outlive the process: a node seeded into a party it could not
+         * reach has nothing else on disk naming that party's addresses (`applySeed`
+         * writes no control row, and `CadrePeer` fills in only after a connection
+         * succeeds), so an in-memory-only set left it stranded permanently across a
+         * restart. Constructed (or adopted from `config.bootstrapPeers.store`) by
+         * {@link initializeBootstrapPeerStore} during {@link start}; deliberately NOT
+         * cleared by {@link cleanup}, so it survives a stop()→start() cycle of the same
+         * node instance — same lifecycle as {@link trustedOwnerStore}. Durability
+         * depends on the injected backend: Node gets a file-backed store from the CLI,
+         * RN/browser stay ephemeral for now.
+         *
+         * Deliberately NOT the libp2p peer store, which {@link peerStoreAddrs} already
+         * reads for the steady-state path. The peer store is shared with everything
+         * libp2p discovers, so "dial every entry" would grow into dialing arbitrary
+         * discovered peers as the node lives longer; this store holds exactly the peers
+         * an owner-signed, trust-anchored seed nominated as owners. `applySeed` merges
+         * the same addresses into the peer store as well, so the two never disagree —
+         * this one is just the precisely-scoped subset.
+         *
+         * A later seed OVERWRITES an entry rather than merging, so a re-seed after an
+         * owner's address changes replaces the stale address instead of accumulating
+         * dead ones. Entries are never evicted: they are the node's only way back into
+         * the party if it is ever stranded again.
+         */
+        this.bootstrapPeerStore = null;
         /** Initial self-registration timer (see {@link scheduleSelfRegistration}). */
         this.selfRegistrationTimer = null;
         /** TTL heartbeat that re-publishes the self record before it goes stale. */
@@ -118,15 +281,38 @@ export class CadreNode {
         this.registerSelfInFlight = null;
         // ── Write-while-alone re-replication (control-write-ensure-replicated) ──────
         /**
-         * Re-replication queue for owner control writes that committed while this
-         * node was alone — `controlNode.getConnections().length === 0` at write time
-         * means the Optimystic commit was local-only (the block's cluster was ≤1) and
-         * never broadcast. Maps the affected subject peerId → the write to re-issue once
-         * the cohort grows. A later op for the same subject overwrites an earlier one
-         * (authorize then remove → remove wins). Drained on the 0→≥1 control-connection
-         * transition by {@link drainPendingControlReplication}.
+         * Re-replication queue for owner `authorizePeer` writes that committed while
+         * this node was alone — `controlNode.getConnections().length === 0` at write
+         * time means the Optimystic commit was local-only (the block's cluster was ≤1)
+         * and never broadcast. Maps the affected subject peerId → 'authorize', to
+         * re-issue once the cohort grows. Removals are NOT tracked here — a delete
+         * leaves a `Revocation` tombstone, tracked by {@link pendingRevocations}; a
+         * removePeer also clears any queued authorize for the same subject (the row is
+         * gone, so re-issuing the insert would be wrong). Drained on the 0→≥1
+         * control-connection transition by {@link drainPendingControlReplication}.
          */
         this.pendingPeerWrites = new Map();
+        /**
+         * Re-replication queue for `Revocation` tombstones that committed while this
+         * node was alone, keyed on the retired `StampId`. Fed by the control DB's
+         * committed-delete seam ({@link noteGuardedDelete}), so one queue covers all
+         * four guarded tables (`CadrePeer` / `DeviceToken` / `Strand` /
+         * `ValidationKey`). Drained (owner-signed `ReissuedAt` bump, which re-broadcasts
+         * the tombstone) by {@link drainPendingRevocations}. Cleared on stop alongside
+         * {@link pendingPeerWrites} — the tombstone rows are durable, so the next
+         * lifetime's first-growth sweep re-covers anything dropped here.
+         */
+        this.pendingRevocations = new Map();
+        /**
+         * Guards the once-per-lifetime first-growth revocation sweep (re-issue EVERY
+         * locally-held tombstone, covering removals from before this node started).
+         * Deliberately separate from {@link reconstructedLocalOnlyWrites} and set only
+         * after a sweep pass SUCCEEDS (including the nothing-held case) — a throwing
+         * sweep retries on the next growth edge instead of being lost for the lifetime.
+         * Reset on stop, so a stop()→start() cycle sweeps again (that second start is
+         * exactly a "removals from before this lifetime" case).
+         */
+        this.reissuedHeldRevocations = false;
         /** This node's own `CadrePeer` self-write committed local-only (re-touched on growth). */
         this.pendingSelfPeerWrite = false;
         /** This node's own `DeviceToken` self-write committed local-only (re-touched on growth). */
@@ -282,6 +468,14 @@ export class CadreNode {
             return;
         }
         log('Starting CadreNode for party: %s', this.config.controlNetwork.partyId);
+        // NOTE: the only direct `console.*` in this library — a boot-time operator warning, not a
+        // diagnostic trace (those use `debug`, which an operator never sees without `DEBUG=`). If a
+        // second such warning ever appears here, route both through a `CadreNodeEvents` entry the
+        // embedder surfaces instead of growing a console surface inside a library.
+        if (this.config.network?.announceAddrs && this.config.network.announceAddrs.length > 0) {
+            console.warn('network.announceAddrs is set but not yet supported (no upstream db-p2p option to apply it) ' +
+                '— this node will keep advertising its listen/relay addresses instead.');
+        }
         try {
             const tTotal = performance.now();
             // Install the WebRTC TURN-relay tracker BEFORE any libp2p bring-up, so it
@@ -292,6 +486,16 @@ export class CadreNode {
             // libp2p/network bring-up, so a misconfiguration or an access-denied secure
             // store fails closed before a node is created.
             await this.resolveIdentityKey();
+            // Bring up the node-local trusted-owner anchor (and seed config pins)
+            // before any network bring-up: a mis-scoped injected store fails closed
+            // here, and out-of-band pins are anchored before the first seed/peer
+            // interaction could consult them.
+            await this.initializeTrustedOwnerStore();
+            // Bring up the node-local cold-start bootstrap-peer store alongside the
+            // anchor, and for the same two reasons: a mis-scoped injected store fails
+            // closed before any network bring-up, and the retained dial targets are
+            // loaded before the first reconcile pass could consult them.
+            this.initializeBootstrapPeerStore();
             // Create the control network libp2p node
             let t0 = performance.now();
             this.controlNode = await this.createControlNode();
@@ -313,6 +517,15 @@ export class CadreNode {
             await this.controlDatabase.initialize();
             timing('[start] controlDatabase.initialize: %dms', Math.round(performance.now() - t0));
             log('Control database initialized');
+            // Attach the per-stream gate to the control DB's membership hub, so every
+            // committed `CadrePeer` write re-materializes the authorized snapshot on its
+            // own. Wired before anything can write. `_running` is still false for the
+            // rest of start() and the refresh early-returns while it is — a write in that
+            // window is covered by start's own pass below.
+            this.controlDatabase.setMembershipChangeListener((reason) => this.refreshMembershipGate(reason));
+            // Committed-delete seam → write-while-alone revocation queue. Same wiring
+            // window argument as the membership listener above.
+            this.controlDatabase.setGuardedDeleteListener((revocation) => this.noteGuardedDelete(revocation));
             // Create strand queryable using the control database
             const queryable = this.createStrandQueryable();
             // Create and start the strand watcher with sAppId lookup
@@ -340,9 +553,14 @@ export class CadreNode {
             // resolving a strand's bootstrap seed asks us for our live strand-network
             // multiaddrs (its CadrePeer row only knows our *control* address). Gated on
             // AUTHORIZED membership; answers only for strands we are actively meshing.
+            // The same RPC doubles as the delegate-announce channel: a member's request
+            // may carry the derived peerId its strand node runs as, and we record an
+            // admission grant so our connection gate (and thus our relay server, when
+            // enabled) admits it — see delegate-admission.ts.
             this.strandAddrService = new StrandAddrService({
                 isMember: (peerId) => this.isAuthorizedMember(peerId),
                 getStrandMultiaddrs: (strandId) => this.getStrandMultiaddrs(strandId),
+                onDelegateAnnounce: (announcer, strandId, delegate) => this.grantDelegateAdmission(announcer, strandId, delegate),
             });
             this.strandAddrService.initialize(this.controlNode);
             // Server-side push-wake fan-out: only when push is configured.
@@ -358,6 +576,11 @@ export class CadreNode {
             // delayed refresh path) so no early `connection:open` is missed — the
             // write-while-alone re-replication drain must fire on the first 0→≥1 edge.
             this.wireControlConnectionListeners();
+            // Seed the per-stream gate's materialized authorized set now that the
+            // control DB is up (non-blocking; the helper never rejects). Until it
+            // lands the snapshot is empty, which the stream gate treats as cold
+            // start and admits.
+            void this.refreshMembershipGate('start');
             // Schedule self-registration in background
             this.scheduleSelfRegistration();
         }
@@ -401,7 +624,18 @@ export class CadreNode {
             return;
         }
         log('Stopping CadreNode');
+        // Stop the retry loop BEFORE tearing the node down, not after: `cleanup()`
+        // stops the control node partway through, and a tick that fires during it
+        // would dial and then poll a half-torn-down node for the whole reserve
+        // timeout — logging spurious dial failures and holding the process open.
+        this.relayReserveSupervisor?.stop();
+        this.relayReserveSupervisor = null;
         await this.cleanup();
+        // Drop the rest of the relay-reservation posture: a stopped node holds no
+        // reservation, so a restarted instance must not report the previous run's
+        // `reserved`.
+        this.relayReserveAddrs = [];
+        this.relayReserveError = null;
         this._running = false;
         this.emit('control:disconnected', undefined);
         log('CadreNode stopped');
@@ -436,11 +670,11 @@ export class CadreNode {
      * before any network bring-up. Resolution order:
      *
      * 1. Both `keyStore` and `privateKey` set ⇒ configuration error (throws).
-     * 2. `keyStore` set ⇒ load protobuf bytes from `identityKeyId` (default
-     *    {@link DEFAULT_IDENTITY_KEY_ID}). Found ⇒ deserialize; empty ⇒ generate a
-     *    fresh Ed25519 key, persist it, and use it. A rejected `get` (access denied
-     *    / backend failure) PROPAGATES — we never generate a new key on a read
-     *    error, which would silently orphan the real identity.
+     * 2. `keyStore` set ⇒ {@link loadOrCreateIdentityKey} against `identityKeyId`
+     *    (default {@link DEFAULT_IDENTITY_KEY_ID}): load when the slot is present,
+     *    generate + persist when it is empty. A rejected `get` (access denied /
+     *    backend failure) PROPAGATES — we never generate a new key on a read error,
+     *    which would silently orphan the real identity.
      * 3. `privateKey` set ⇒ use it directly.
      * 4. Neither ⇒ leave undefined; libp2p generates an ephemeral key.
      *
@@ -457,21 +691,11 @@ export class CadreNode {
                 'configure at most one source for the node identity');
         }
         if (keyStore) {
-            const keyId = identityKeyId ?? DEFAULT_IDENTITY_KEY_ID;
-            // A rejection here (e.g. KeyStoreAccessError) must propagate — do NOT fall
-            // through to generation, which would orphan an existing but unreadable key.
-            const bytes = await keyStore.get(keyId);
-            if (bytes) {
-                // Corrupt/garbage bytes throw here; surface loudly rather than
-                // regenerating (which would orphan the real identity).
-                this.identityKey = privateKeyFromProtobuf(bytes);
-                log('Identity key loaded from key store (slot present)');
-                return;
-            }
-            const generated = await generateKeyPair('Ed25519');
-            await keyStore.set(keyId, privateKeyToProtobuf(generated));
-            this.identityKey = generated;
-            log('Identity key generated and persisted to key store (first run)');
+            // Shared with the embedding app: `reference-app-rn` resolves the very same
+            // key before constructing this node so it can sign its ICE-manifest request
+            // with it (identity-key.ts). One copy of the rule, so neither side can
+            // drift into generating a second identity.
+            this.identityKey = await loadOrCreateIdentityKey(keyStore, identityKeyId ?? DEFAULT_IDENTITY_KEY_ID);
             return;
         }
         if (privateKey) {
@@ -480,9 +704,119 @@ export class CadreNode {
         }
         // Neither configured: libp2p generates an ephemeral key internally.
     }
+    /**
+     * Construct (or adopt) the node-local trusted-owner anchor and seed the
+     * out-of-band pinned keys from `config.trustedOwners`. The store is NEVER
+     * sourced from the replicated control DB — its entries come only from
+     * genesis self-trust ({@link initializeSeedBootstrap}), config pins (here),
+     * or runtime enrollment pins ({@link trustOwnerKeys}).
+     *
+     * Idempotent across stop()→start(): the store instance is kept, and
+     * re-seeding config pins is a no-op ({@link TrustedOwnerStore.trust} is
+     * idempotent). An injected store scoped to a different party is a
+     * configuration error (fail closed before any network bring-up).
+     */
+    async initializeTrustedOwnerStore() {
+        const { trustedOwners } = this.config;
+        const partyId = this.config.controlNetwork.partyId;
+        if (!this.trustedOwnerStore) {
+            const store = trustedOwners?.store ?? new MemoryTrustedOwnerStore(partyId);
+            if (store.partyId !== partyId) {
+                throw new Error(`CadreNodeConfig: trustedOwners.store is scoped to party ${store.partyId}, ` +
+                    `but this node serves party ${partyId} — refusing to mix trust anchors`);
+            }
+            this.trustedOwnerStore = store;
+        }
+        // Validate every pin before trusting any: a malformed entry must not leave
+        // earlier, valid pins anchored while start() then fails on a later one —
+        // config pins land all-or-nothing, same as the runtime seam below.
+        const pinnedKeys = (trustedOwners?.pinnedKeys ?? []).map(key => requireEd25519PublicKeyB64(key, 'pinned owner key'));
+        for (const key of pinnedKeys) {
+            await this.trustedOwnerStore.trust(key, trustedOwners?.pinnedSource ?? 'operator');
+        }
+    }
+    /**
+     * Construct (or adopt) the node-local cold-start bootstrap-peer store (see
+     * {@link bootstrapPeerStore}). Synchronous: an injected store has already
+     * loaded its persisted targets by the time it is handed in (its `open` is the
+     * async part), and the in-memory fallback has nothing to load.
+     *
+     * Idempotent across stop()→start(): the store instance is kept, so retained
+     * targets survive a restart of the same node instance even with the ephemeral
+     * default. An injected store scoped to a different party is a configuration
+     * error (fail closed before any network bring-up) — a foreign party's addresses
+     * must never enter this node's dial loop.
+     */
+    initializeBootstrapPeerStore() {
+        const partyId = this.config.controlNetwork.partyId;
+        if (this.bootstrapPeerStore) {
+            return;
+        }
+        const store = this.config.bootstrapPeers?.store ?? new MemoryBootstrapPeerStore(partyId);
+        if (store.partyId !== partyId) {
+            throw new Error(`CadreNodeConfig: bootstrapPeers.store is scoped to party ${store.partyId}, ` +
+                `but this node serves party ${partyId} — refusing to mix cold-start dial targets`);
+        }
+        this.bootstrapPeerStore = store;
+    }
+    /**
+     * The node-local cold-start bootstrap-peer store (null before {@link start}) —
+     * the retained owner addresses {@link reconcileControlCohort}'s cold-start
+     * branch re-dials. Exposed for diagnostics and for a host that wants to show
+     * "what would this node dial if it is stranded?".
+     */
+    getBootstrapPeerStore() {
+        return this.bootstrapPeerStore;
+    }
+    /**
+     * The node-local trusted-owner anchor (null before {@link start}). This is
+     * the set the authorized-membership predicate and seed-trust anchor consult —
+     * never the replicated `OwnerKey` table, which any stranger can pollute.
+     */
+    getTrustedOwnerStore() {
+        return this.trustedOwnerStore;
+    }
+    /**
+     * Persist out-of-band-established owner keys into the node-local anchor —
+     * the runtime enrollment seam: call with `CadreInvite.ownerKeys` when
+     * redeeming an invite (BEFORE the first `applySeed`, so the anchor already
+     * holds the pins when seed trust consults it), or with an operator-supplied
+     * pin. Idempotent. ('genesis' provenance is reserved for the node's own
+     * founding key, seeded internally by {@link initializeSeedBootstrap}.)
+     *
+     * Validates every key's shape before trusting any of them (all-or-nothing):
+     * a malformed entry anywhere in `keys` rejects the whole call before a
+     * single key is anchored. For the invite route this means a `CadreInvite`
+     * carrying one malformed `ownerKeys` entry fails the redemption outright —
+     * consistent with the anchor's existing whole-record-or-nothing policy for
+     * a corrupt persisted entry (see `trusted-owner-store.ts`'s
+     * `unusableEntry: 'discard-all'`) — rather than silently anchoring a subset
+     * and leaving the caller to notice a key went missing.
+     */
+    async trustOwnerKeys(keys, source) {
+        if (!this.trustedOwnerStore) {
+            throw new Error('CadreNode must be started before trusting owner keys');
+        }
+        const validated = Array.from(keys, key => requireEd25519PublicKeyB64(key, 'pinned owner key'));
+        for (const key of validated) {
+            await this.trustedOwnerStore.trust(key, source);
+        }
+    }
     async createControlNode() {
+        return await createLibp2pNode(this.buildControlNodeOptions());
+    }
+    /**
+     * Map this node's config onto the control network's libp2p node options.
+     *
+     * Split out of {@link createControlNode} purely so the mapping is assertable without
+     * standing up a real libp2p node — `packages/cadre-core/test/cadre-node-control-node-options.spec.ts`
+     * calls it on a bare `new CadreNode(config)`. Read nothing else into the split; the
+     * only caller in production is `createControlNode`.
+     */
+    buildControlNodeOptions() {
         const { controlNetwork, network, storage, profile } = this.config;
         const identityKey = this.identityKey;
+        const listenAddrs = resolveListenAddrs(network);
         // Determine relay mode: if explicitly set in config, use that;
         // otherwise default to true for storage profile nodes (better connectivity/uptime)
         const enableRelay = network?.enableRelay ?? (profile === 'storage');
@@ -500,15 +834,279 @@ export class CadreNode {
             storage: controlStorageProvider,
             fretProfile: profile === 'storage' ? 'core' : 'edge',
             relay: enableRelay,
-            clusterSize: 3,
-            clusterPolicy: { allowDownsize: true, sizeTolerance: 0.5 },
-            arachnode: { enableRingZulu: this.config.profile === 'storage' },
+            // Fixed, and deliberately above any party's node count: every member reads the
+            // whole control database, so a cohort that excludes a member leaves it dependent
+            // on read repair — which cannot converge at a two-member cohort. Not a knob;
+            // see CONTROL_REPLICATION_BREADTH. `assumedClusterSize: 2` is declared explicitly in
+            // CONTROL_CLUSTER_POLICY: only the admission gate defaults to 2, while the read-repair
+            // corroboration floor would otherwise fall back to this clusterSize of 16.
+            clusterSize: CONTROL_REPLICATION_BREADTH,
+            clusterPolicy: CONTROL_CLUSTER_POLICY,
+            arachnode: { enableRingZulu: profile === 'storage' },
             ...(identityKey && { privateKey: identityKey }),
             ...(network?.transports && { transports: network.transports }),
-            ...(network?.listenAddrs && { listenAddrs: network.listenAddrs }),
-            ...(network?.connectionGater && { connectionGater: network.connectionGater })
+            // Configured `listenAddrs`, plus a `/p2p-circuit` listener for every
+            // `network.relayAddrs` entry — that listener is what reserves the relay slot.
+            ...(listenAddrs && { listenAddrs }),
+            // The CONTROL node composes the membership admission gate onto any
+            // caller-supplied gater (deny from either wins on inbound; all other
+            // hooks pass through). Strand cohort nodes keep the raw configured gater
+            // (see strand-instance-manager.ts) — their peers are legitimately
+            // cross-party, so cadre membership must not gate them.
+            connectionGater: createMembershipConnectionGater({ admitInbound: (remotePeerId) => this.admitInboundControlConnection(remotePeerId) }, network?.connectionGater),
+            // Fail-closed per-stream authorization for the four Optimystic control-DB
+            // protocols — the members-only layer the connection gater's stranger
+            // carve-outs cannot express (see authorizeInboundControlStream). Control
+            // node only: strand cohort nodes serve cross-party peers.
+            authorizeInboundStream: (remotePeerId, protocol) => this.authorizeInboundControlStream(remotePeerId, protocol)
         };
-        return await createLibp2pNode(nodeOptions);
+        return nodeOptions;
+    }
+    /**
+     * Decide whether an inbound CONTROL-network connection from `remotePeerId`
+     * should be admitted — the policy behind the connection gater wired in
+     * {@link createControlNode}. Deny only on a positive "unauthorized outsider
+     * while no stranger path is open" determination; everything ambiguous admits
+     * and defers to the fail-closed per-stream gates (see
+     * `membership-connection-gater.ts` for the layer's rationale and the
+     * stranger-open protocol allowlist).
+     *
+     * Admits when ANY of:
+     *  1. a shared-baseline check admits ({@link admitControlPeerUnconditionally}
+     *     — not running / DB torn down, absent-or-empty trusted-owner anchor, or
+     *     configured bootstrap/relay infrastructure);
+     *  2. an enrollment window is open ({@link openEnrollmentWindow}, opened by
+     *     {@link createInvite}) — the invitee dials in before it is authorized;
+     *  3. the peer holds a live DELEGATE ADMISSION GRANT — an authorized member
+     *     announced it (over the strand-addr RPC) as the transport peerId of its
+     *     own strand node, so a NAT'd member's strand node can hold a
+     *     circuit-relay reservation here (see `delegate-admission.ts`).
+     *     Connection only: the per-stream gate below never honors a grant;
+     *  4. the authorized-member set is empty — cold start: the rows that would
+     *     authorize anyone arrive by replication over these very connections;
+     *  5. the peer IS an authorized member; or
+     *  6. an open invitation is OUTSTANDING — at least one unexpired,
+     *     not-fully-consumed invitation this node minted or persisted (see
+     *     `StrandSolicitationService.hasOutstandingInvitation`). A formation
+     *     initiator is another party's peer by design and its token is only
+     *     checkable inside the protocol, so the gate asks the coarser question
+     *     "does this node expect a stranger at all?". Merely REGISTERING the
+     *     responder ({@link initializeStrandSolicitation}) no longer suspends
+     *     stranger denial — eager registration (as `reference-app-rn` does at
+     *     bring-up) and `formStrand`'s lazy initialization both leave the gate
+     *     armed, because neither mints an invitation.
+     *
+     * Ordering is semantically free (the checks are OR'd) but decides who pays:
+     * checks 1-3 are in-memory, 4/5 share one control-DB read, and only a peer
+     * already on the deny path reaches check 6's invitation lookup.
+     *
+     * Caveats of check 6, both self-healing:
+     *  - the in-memory mint registry dies with the process, so after a restart
+     *    only invitations persisted as `FormationInvite` rows still hold the
+     *    exemption open (re-mint otherwise — same story as the enrollment window);
+     *  - a peer holding a token whose `FormationInvite` row has not replicated to
+     *    this node yet is denied even though the formation handler would have
+     *    accepted it, exactly like the unreplicated-membership-row case below.
+     *
+     * NOTE: check 4/5 runs a control-DB read per inbound connection
+     * (`listAuthorizedMembers`); connections are rare and cadres small, and this
+     * layer is fail-open behind `ADMISSION_DECISION_TIMEOUT_MS`, so the live
+     * read is safe here — unlike the per-stream gate, which must consult the
+     * materialized {@link authorizedControlPeers} snapshot instead.
+     * NOTE: a sibling whose membership row has not yet replicated to
+     * this node is denied until the row converges (typically via the owner);
+     * either side's next outbound reconcile dial (outbound is never gated)
+     * re-establishes the link — self-healing, but visible as a transient deny.
+     */
+    async admitInboundControlConnection(remotePeerId) {
+        if (this.admitControlPeerUnconditionally(remotePeerId)) {
+            return true;
+        }
+        if (Date.now() < this.enrollmentWindowUntil) {
+            return true;
+        }
+        if (this.delegateAdmission.has(remotePeerId)) {
+            return true;
+        }
+        const authorized = await this.listAuthorizedMembers();
+        if (authorized.length === 0) {
+            return true;
+        }
+        if (authorized.some((m) => m.peerId === remotePeerId)) {
+            return true;
+        }
+        try {
+            if (await this.strandSolicitationService?.hasOutstandingInvitation()) {
+                return true;
+            }
+        }
+        catch (error) {
+            log('admitInboundControlConnection: outstanding-invitation check threw for %s — admitting (fail-open): %o', remotePeerId, error);
+            return true;
+        }
+        log('admitInboundControlConnection: DENYING inbound from %s — not an authorized member and no enrollment path open', remotePeerId);
+        return false;
+    }
+    /**
+     * Hold the control-network inbound gate open for not-yet-authorized peers
+     * until `untilEpochMs` (extends, never shrinks, an already-open window).
+     * {@link createInvite} calls this automatically; a host running an
+     * out-of-band enrollment flow (e.g. accepting a phone whose invite this node
+     * never minted) can open it explicitly before the stranger dials in.
+     */
+    openEnrollmentWindow(untilEpochMs) {
+        this.enrollmentWindowUntil = Math.max(this.enrollmentWindowUntil, untilEpochMs);
+        log('Enrollment window open until %d', this.enrollmentWindowUntil);
+    }
+    /**
+     * Record (or refresh) a delegate admission grant: `delegatePeerId` is the
+     * transport peerId of `announcerPeerId`'s strand-`strandId` node, admitted
+     * at the CONNECTION level (all a circuit-relay reservation needs) for
+     * `DELEGATE_GRANT_TTL_MS`. Called by the strand-addr responder after its
+     * authorized-membership gate has passed; public so tests can drive the
+     * admission policy without a full strand launch. A re-announce for the same
+     * (announcer, strand) REPLACES the previous delegate rather than
+     * accumulating. Never honored by {@link authorizeInboundControlStream}.
+     */
+    grantDelegateAdmission(announcerPeerId, strandId, delegatePeerId) {
+        this.delegateAdmission.grant(announcerPeerId, strandId, delegatePeerId);
+    }
+    /** Is `remotePeerId` covered by a live delegate admission grant? */
+    hasDelegateAdmission(remotePeerId) {
+        return this.delegateAdmission.has(remotePeerId);
+    }
+    /**
+     * The admission checks SHARED by the connection gate
+     * ({@link admitInboundControlConnection}) and the per-stream control-DB gate
+     * ({@link authorizeInboundControlStream}) — factored so the two layers cannot
+     * drift. All in-memory and cheap (the stream gate runs this per inbound
+     * stream). Returns true when the peer must be admitted BEFORE any membership
+     * source is consulted:
+     *  - the node is not fully up (`start()` in progress / DB torn down) — both
+     *    gates exist from libp2p bring-up, before the control DB does;
+     *  - the trusted-owner anchor is absent or empty — an un-enrolled node has
+     *    no basis to judge anyone and MUST accept its enrollment seed;
+     *  - the peer is one of the configured control bootstrap/relay nodes —
+     *    operator-configured infrastructure, not cadre members.
+     * False only means "no unconditional admit": the caller then judges the peer
+     * against its own membership source (a live DB read for the fail-open
+     * connection gate; the materialized snapshot for the fail-closed stream gate).
+     */
+    admitControlPeerUnconditionally(remotePeerId) {
+        if (!this._running || !this.controlDatabase) {
+            return true;
+        }
+        if (!this.trustedOwnerStore || this.trustedOwnerStore.all().size === 0) {
+            return true;
+        }
+        return this.getBootstrapPeerIds().has(remotePeerId);
+    }
+    /**
+     * Per-stream authorization for the four Optimystic control-DB protocols
+     * (`/optimystic/control-<party>/{repo,cluster,sync,block-transfer}/…`),
+     * wired as `authorizeInboundStream` in {@link createControlNode} — the
+     * fail-closed layer behind the fail-open connection gater. Control node
+     * ONLY: strand cohort nodes legitimately serve cross-party peers.
+     *
+     * The STRICT SUBSET of {@link admitInboundControlConnection}: the same
+     * "no basis to judge" admissions (shared via
+     * {@link admitControlPeerUnconditionally}), minus the stranger carve-outs
+     * (enrollment window, outstanding open invitation, delegate admission
+     * grant). The first two exist so a stranger can reach `/sereus/seed/1.0.0`
+     * and `/sereus/formation/1.0.0` — neither is gated here, and admitting a
+     * stranger to `repo` during an enrollment window is exactly the hole this
+     * gate closes. A DELEGATE-admitted connection (a member's strand node
+     * holding a circuit-relay reservation, see `delegate-admission.ts`) is
+     * likewise exactly a case this gate must still refuse: the delegate gets
+     * the connection and never the control DB.
+     *
+     * Admits when ANY of:
+     *  1. a shared-baseline check admits (not running / no DB, empty anchor,
+     *     configured bootstrap infra);
+     *  2. the materialized authorized set is empty — cold start, before the
+     *     rows that would authorize anyone have replicated in;
+     *  3. the peer IS in the materialized authorized set.
+     *
+     * Deliberately SYNCHRONOUS and pure in-memory — see
+     * {@link authorizedControlPeers} for why a control-DB read here would
+     * deadlock into mutual denial. With a sync predicate the upstream deadline
+     * (`authorizeInboundStreamTimeoutMs`) never trips, so it stays at its
+     * default.
+     *
+     * NOTE: the snapshot keys on PEER ID, so a node with no persistent identity
+     * key never lands a `CadrePeer` row ({@link registerSelf} skips) and its
+     * siblings deny its control-DB streams once their own snapshot is non-empty —
+     * owner status is a KEY, not a peer id, so being the owner does not exempt it.
+     * Harmless today (a real deployment persists its identity; the ephemeral-owner
+     * case appears only in tests, which configure the owner as bootstrap infra —
+     * `push-wake-e2e.integration.ts` design note 3). If an ephemeral-identity node
+     * ever becomes a supported deployment, this gate needs a key-based admission.
+     */
+    authorizeInboundControlStream(remotePeerId, protocol) {
+        if (this.admitControlPeerUnconditionally(remotePeerId)) {
+            return true;
+        }
+        if (this.authorizedControlPeers.size === 0) {
+            return true;
+        }
+        if (this.authorizedControlPeers.has(remotePeerId)) {
+            return true;
+        }
+        // Upstream logs its own denial line; this one carries the WHY.
+        log('authorizeInboundControlStream: DENYING %s on %s — not in the materialized authorized set (%d member(s))', remotePeerId, protocol, this.authorizedControlPeers.size);
+        return false;
+    }
+    /**
+     * Refresh {@link authorizedControlPeers} from the control DB, best-effort: a
+     * failed read keeps the previous snapshot (never clears it), so a transient
+     * DB error can neither flip the stream gate's cold-start carve-out back open
+     * nor drop a legitimate member mid-flight. Never rejects.
+     *
+     * The SOLE caller is {@link drainMembershipGate}, which serializes refreshes —
+     * so two reads can no longer settle out of order.
+     */
+    async refreshAuthorizedControlPeers(reason) {
+        if (!this._running || !this.controlDatabase) {
+            return;
+        }
+        try {
+            const members = await this.listAuthorizedMembers();
+            this.authorizedControlPeers = new Set(members.map((m) => m.peerId));
+            log('refreshAuthorizedControlPeers(%s): %d authorized peer(s)', reason, this.authorizedControlPeers.size);
+        }
+        catch (error) {
+            log('refreshAuthorizedControlPeers(%s) failed — keeping previous snapshot: %o', reason, error);
+        }
+    }
+    /**
+     * PeerIds of the configured control bootstrap nodes (relay/bootstrap
+     * infrastructure — always admitted inbound). Parsed once, lazily; an
+     * address without a `/p2p/<id>` component contributes nothing.
+     */
+    getBootstrapPeerIds() {
+        if (!this.bootstrapPeerIds) {
+            const ids = new Set();
+            for (const addr of this.config.controlNetwork.bootstrapNodes) {
+                try {
+                    // Last `/p2p/<id>` component: on a plain bootstrap addr the node's own
+                    // id; on a circuit addr the dial target (which is what gets admitted).
+                    let id;
+                    for (const component of multiaddr(addr).getComponents()) {
+                        if (component.name === 'p2p' && component.value) {
+                            id = component.value;
+                        }
+                    }
+                    if (id) {
+                        ids.add(id);
+                    }
+                }
+                catch (error) {
+                    log('getBootstrapPeerIds: skipping unparsable bootstrap addr %s: %o', addr, error);
+                }
+            }
+            this.bootstrapPeerIds = ids;
+        }
+        return this.bootstrapPeerIds;
     }
     createStrandQueryable() {
         return {
@@ -558,7 +1156,11 @@ export class CadreNode {
      *   PeerId (the resolved node identity from `keyStore`/`config.privateKey`).
      * - If the row already exists: a self-signed UPDATE bumping `UpdatedAt`.
      * - If not, and the node is its own owner: an owner-signed INSERT that
-     *   also carries the self-signature.
+     *   also carries the self-signature. That INSERT is idempotent, so if an owner
+     *   {@link authorizePeer} of this node's own id seated the row inside the
+     *   read-then-insert window it no-ops — the publish then falls through to the
+     *   UPDATE path (re-reading and re-signing against the row that landed) rather
+     *   than leaving the authorize's null `Sig` in place, and reports `refreshed`.
      * - Otherwise: logs and returns (a non-owner node with no row yet must
      *   wait for an owner to insert it; it can then self-refresh).
      *
@@ -599,27 +1201,59 @@ export class CadreNode {
         const peerId = this.controlNode.peerId.toString();
         const addrs = await this.collectSelfAddrs();
         const existing = await this.controlDatabase.queryPeerRecord(peerId);
-        // Strictly increase UpdatedAt even on a same-millisecond re-publish.
-        const updatedAt = Math.max(Date.now(), (existing?.updatedAt ?? 0) + 1);
-        const record = signPeerRecord({ peerId, publicKey: signingKey.publicKeyB64, addrs, updatedAt }, signingKey.privateKeyB64);
-        if (existing) {
-            await this.controlDatabase.updateSelfPeerRecord(record);
-            if (this.committedAlone())
-                this.pendingSelfPeerWrite = true;
-            log('registerSelf: refreshed own CadrePeer record (updatedAt=%d, %d addrs)', updatedAt, addrs.length);
-            return 'refreshed';
-        }
-        if (this.seedBootstrapService) {
+        if (!existing) {
+            if (!this.seedBootstrapService) {
+                log('registerSelf: not yet a CadrePeer member and no owner service to self-insert; skipping (an owner must add this peer first)');
+                return 'skipped';
+            }
             // First-time row: requires an owner signature (the node is its own
             // owner). insertSelfPeerRecord throws if no owner key is present.
-            await this.seedBootstrapService.insertSelfPeerRecord(record);
-            if (this.committedAlone())
-                this.pendingSelfPeerWrite = true;
-            log('registerSelf: inserted own CadrePeer record (owner-signed, updatedAt=%d, %d addrs)', updatedAt, addrs.length);
-            return 'inserted';
+            const record = this.signSelfRecord(peerId, signingKey, addrs, null);
+            if (await this.seedBootstrapService.insertSelfPeerRecord(record)) {
+                if (this.committedAlone())
+                    this.pendingSelfPeerWrite = true;
+                log('registerSelf: inserted own CadrePeer record (owner-signed, updatedAt=%d, %d addrs, sig=%s…)', record.updatedAt, addrs.length, record.sig.slice(0, 16));
+                return 'inserted';
+            }
+            // An owner authorize of this node's OWN peer id seated the row (null `Sig`)
+            // inside the read-then-insert window, so the idempotent insert no-op'd. Fall
+            // through to the self-update path, which re-signs against the row that landed.
+            //
+            // NOTE: this path reports 'refreshed' — honest about the write, which really was
+            // an UPDATE, though the caller's intent was a first publish. No caller branches on
+            // 'inserted' today (the CLI only logs it); if one ever needs "this was the row's
+            // first publish", add a fourth SelfRegistrationOutcome rather than re-labelling.
+            log('registerSelf: own CadrePeer row appeared mid-publish (concurrent authorize); self-updating to carry the signature');
+        }
+        // Null only on the fall-through above, where the pre-race read missed the row a
+        // concurrent authorize then seated — so re-read to get that row's `UpdatedAt`, which
+        // the strictly-greater self-update rule is measured against.
+        //
+        // NOTE: when `existing` is set it predates this publish, so a removePeer(self) racing
+        // in would leave the UPDATE below matching no rows while still reporting 'refreshed'.
+        // Closing that needs updateSelfPeerRecord to report rows-affected — only worth doing
+        // if removing self ever becomes something that happens concurrently in practice.
+        const current = existing ?? await this.controlDatabase.queryPeerRecord(peerId);
+        if (!current) {
+            log('registerSelf: own CadrePeer row vanished mid-publish; skipping (next refresh re-inserts)');
+            return 'skipped';
         }
-        log('registerSelf: not yet a CadrePeer member and no owner service to self-insert; skipping (an owner must add this peer first)');
-        return 'skipped';
+        const record = this.signSelfRecord(peerId, signingKey, addrs, current);
+        await this.controlDatabase.updateSelfPeerRecord(record);
+        if (this.committedAlone())
+            this.pendingSelfPeerWrite = true;
+        log('registerSelf: refreshed own CadrePeer record (updatedAt=%d, %d addrs, sig=%s…)', record.updatedAt, addrs.length, record.sig.slice(0, 16));
+        return 'refreshed';
+    }
+    /**
+     * Sign this node's address record for publication, stamped strictly later than
+     * `existing` (the row it is about to replace, or null for a first insert) so a
+     * same-millisecond re-publish still satisfies the monotonic `UpdatedAt` rule the
+     * `CadrePeer.AuthorizedUpdate` self-branch enforces.
+     */
+    signSelfRecord(peerId, signingKey, addrs, existing) {
+        const updatedAt = Math.max(Date.now(), (existing?.updatedAt ?? 0) + 1);
+        return signPeerRecord({ peerId, publicKey: signingKey.publicKeyB64, addrs, updatedAt }, signingKey.privateKeyB64);
     }
     /**
      * The ed25519 keypair (base64url) the node signs its own record with — the key
@@ -751,13 +1385,17 @@ export class CadreNode {
         this.turnConnectionOpenHandler = null;
         this.turnConnectionCloseHandler = null;
         // Reset the write-while-alone re-replication state so a stop()→start() cycle
-        // re-arms the growth edge and re-runs the first-growth reconstruction. Any
-        // queued local-only writes are moot once the node is torn down; owner
-        // inserts are re-covered by reconstruction on the next start, and the
-        // (already-loudly-logged) delete gap is tracked for follow-up.
+        // re-arms the growth edge and re-runs BOTH one-shot passes. Any queued
+        // local-only writes are moot once the node is torn down: owner inserts are
+        // re-covered by the next start's reconstruction, and delete tombstones by its
+        // first-growth revocation sweep — which is why the sweep flag must reset too,
+        // or the second lifetime would skip the sweep and strand exactly the
+        // committed-alone tombstones it exists to carry.
         this.hasControlConnection = false;
         this.reconstructedLocalOnlyWrites = false;
+        this.reissuedHeldRevocations = false;
         this.pendingPeerWrites.clear();
+        this.pendingRevocations.clear();
         this.pendingSelfPeerWrite = false;
         this.pendingSelfDeviceWrite = false;
     }
@@ -795,7 +1433,10 @@ export class CadreNode {
         }
         // Self-signature over (peerId, addrs, updatedAt).
         if (!verifyPeerRecordSignature(record)) {
-            log('resolvePeerAddrs: signature verification failed for %s', peerId);
+            // Field detail distinguishes "holding the owner-vouch revision (Sig null,
+            // no addrs — a not-yet-self-published row)" from a genuinely corrupt or
+            // mixed-revision row. Sig/addrs are public replicated data.
+            log('resolvePeerAddrs: signature verification failed for %s (updatedAt=%d, addrs=%o, sig=%s)', peerId, record.updatedAt, record.addrs, record.sig ? `${record.sig.slice(0, 16)}…` : '(empty)');
             return [];
         }
         // Freshness: never hand back a dead relay reservation.
@@ -884,15 +1525,80 @@ export class CadreNode {
         if (!this._running || !this.controlNode || !this.controlDatabase) {
             return;
         }
+        // Ride this pass's cadence to refresh the per-stream gate's materialized
+        // authorized set — membership changes that ARRIVED BY REPLICATION (rather
+        // than a local write) are picked up here, bounding the snapshot's staleness
+        // to the reconcile interval.
+        // NOTE: this refresh and the sibling enumeration below each run their own
+        // CadrePeer query (two reads per pass); if those reads ever get costly,
+        // share one row-set across both.
+        await this.refreshMembershipGate('reconcile');
+        if (!this._running || !this.controlNode || !this.controlDatabase) {
+            return;
+        }
+        // Refresh relay delegate grants BEFORE the sibling enumeration below: a
+        // solo cadre with a party relay has no siblings to dial but must still keep
+        // its running strands' grants alive (a dropped relay connection re-dials
+        // the reservation and faces the connection gate again).
+        await this.refreshDelegateGrants();
+        if (!this._running || !this.controlNode || !this.controlDatabase) {
+            return;
+        }
         const selfPeerId = this.controlNode.peerId.toString();
+        // Reap guarded rows this node still holds for incarnations an already-committed
+        // Revocation tombstone retires — the half of a removal replication cannot carry
+        // (a delete of an already-absent row replays as nothing). Connected-only: a reap
+        // is a write, and a write committed alone is local-only and forks this node's own
+        // history, which is the condition this work exists to stop creating
+        // (tickets/blocked/forked-control-collection-sync-livelocks.md). Nothing is urgent
+        // here — the stale row already reads as absent everywhere — so waiting for
+        // connectivity costs nothing and keeps the reap fork-CLOSING rather than
+        // fork-creating.
+        //
+        // BEFORE step 1, not after: the pass early-returns when it finds no siblings, and a
+        // cadre whose only sibling row is the tombstoned one lands in exactly that branch
+        // (listMembers() filters retired stamps, so the row needing the reap is invisible to
+        // the sibling count). Placed after step 1 it would never run for the smallest and
+        // most likely case.
+        //
+        // Shares no mutable state with drainPendingRevocations, which re-issues tombstones
+        // while this consumes them: different tables (Revocation update vs guarded-row
+        // delete) and both take the write lock per statement. The two can overlap freely —
+        // do not add a mutex.
+        //
+        // NOTE: the gate is sampled ONCE for the whole sweep, so a disconnect landing
+        // mid-sweep lets the remaining rows commit alone — the fork this gate exists to
+        // avoid. Bounded by how long a sweep runs, which is bounded by the backlog of
+        // unreaped rows (0 in steady state). If that backlog can ever be large, move the
+        // check inside reapRevokedRows' loop via an injected predicate.
+        if (this.getControlConnectionCount() > 0) {
+            try {
+                const reaped = await this.controlDatabase.reapRevokedRows(selfPeerId);
+                if (reaped > 0) {
+                    log('reconcileControlCohort: reaped %d revoked control row(s)', reaped);
+                }
+            }
+            catch (error) {
+                // Best-effort like every other step in this pass: reconnecting siblings
+                // outranks garbage collection, so a reap failure never aborts the reconcile.
+                log('reconcileControlCohort: reap pass failed (continuing): %o', error);
+            }
+            if (!this._running || !this.controlNode || !this.controlDatabase) {
+                return;
+            }
+        }
         // 1. Enumerate known siblings. This membership read is itself a pull-on-read
         //    that helps the CadrePeer table converge — a reader-only node converges
         //    purely by these reads.
         const members = await this.listMembers();
         const siblings = members.filter((m) => m.peerId !== selfPeerId);
         if (siblings.length === 0) {
-            // Genuinely alone (cold start with no rows, or a solo cadre): nothing to
-            // dial. Must not throw or busy-loop.
+            // No rows to dial from. Either a solo cadre (nothing to do) or a COLD
+            // START whose seed dial never landed — and those look identical from here,
+            // because filling this table needs a connection and getting a connection
+            // needs this table. Fall back to the seed's bootstrap addresses; a solo
+            // cadre has none and this is a no-op. Must not throw or busy-loop.
+            await this.dialColdStartBootstrap();
             return;
         }
         // Re-guard after the await: a stop() may have raced the membership read.
@@ -900,6 +1606,11 @@ export class CadreNode {
             return;
         }
         // 2. Classify backbone (owner) members and select a bounded dial set.
+        // NOTE: deliberately the REPLICATED table, not the node-local anchor — this
+        // only *prefers* owner peers as dial targets, so pollution costs a wasted
+        // dial while anchoring would drop legitimate co-owners this node never
+        // pinned. Same call as `SeedPeer.isOwner` in seed-bootstrap.ts. Move it to
+        // the anchor if owner status here ever gates something trusted.
         const ownerKeys = await this.controlDatabase.getOwnerKeys();
         if (!this._running || !this.controlNode) {
             return;
@@ -993,6 +1704,149 @@ export class CadreNode {
             return [];
         }
     }
+    /**
+     * Retain a just-applied seed's owner-flagged peers as cold-start bootstrap
+     * dial targets (see {@link bootstrapPeerStore}).
+     *
+     * Called for every seed this node accepts, on BOTH intake paths — the
+     * {@link applySeed} wrapper (which may run on a throwaway service, so the
+     * service itself is the wrong place to keep this) and the inbound
+     * `/sereus/seed/1.0.0` handler via `onSeedApplied`. Peers with no address are
+     * skipped: there is nothing to dial.
+     *
+     * `isOwner` is the seed's own claim about its peers, exactly as
+     * `SeedBootstrapService.applySeed` uses it to choose its dial targets. That is
+     * sound here for the same reason it is sound there — the whole seed is
+     * signature-checked against a trust-anchored signer before this runs, and the
+     * flag only *selects a dial target*; a dial grants no authority.
+     *
+     * Self is excluded. `createSeed` projects EVERY `CadrePeer` row, so an owner
+     * that applies a seed minted after it joined finds itself in the owner list;
+     * retaining that would make the cold-start pass dial this node forever (the
+     * steady-state pass filters self out of its sibling list for the same reason).
+     */
+    recordSeedBootstrapPeers(seed) {
+        const store = this.bootstrapPeerStore;
+        if (!store) {
+            // Unreachable in production: start() builds the store before any network
+            // bring-up, and both intake paths need a started node (an uninitialized
+            // SeedBootstrapService rejects the seed, so noteAppliedSeed returns early).
+            log('recordSeedBootstrapPeers: no bootstrap-peer store yet; retaining nothing');
+            return;
+        }
+        const selfPeerId = this.controlNode?.peerId.toString();
+        for (const peer of seed.peers) {
+            if (!peer.isOwner || peer.multiaddrs.length === 0 || peer.peerId === selfPeerId) {
+                continue;
+            }
+            // Sync-visible by contract; the promise tracks durability only. A persist
+            // failure costs restart survival, never this session's retry set — the same
+            // trade `SeedBootstrapService.anchorAcceptedSigner` makes — so log and carry
+            // on rather than failing the seed that was already accepted.
+            void store.record(peer.peerId, peer.multiaddrs).catch((error) => {
+                log('recordSeedBootstrapPeers: persisting bootstrap peer %s failed (retained in memory): %o', peer.peerId, error);
+            });
+        }
+    }
+    /**
+     * Cold-start branch of the reconcile pass: re-dial the seed's owner peers
+     * while the control database still has no siblings to dial.
+     *
+     * `SeedBootstrapService.applySeed` dials those owners exactly ONCE, best-effort.
+     * When that single dial fails — owner momentarily down, relay reservation not
+     * up yet, NAT traversal lost the race — the joining node has an empty
+     * `CadrePeer` table and no connection, and the steady-state pass above cannot
+     * help: it dials only siblings enumerated from that very table. Retrying here
+     * is the only way back in.
+     *
+     * Unbounded, at the reconcile cadence, with no backoff: the branch is already
+     * gated by "the control database has no siblings", so it stops the moment the
+     * node is actually in the party, and a node that is stranded MUST keep trying —
+     * a give-up rule would turn a transient outage into a permanent one. The steady
+     * cost is one dial per bootstrap peer per pass (seeds nominate one or a few
+     * owners), each failing fast against an unreachable address.
+     * NOTE: if seeds ever carry many owner peers, or the reconcile cadence tightens
+     * well below its 15 s default, add per-peer backoff here.
+     *
+     * Best-effort per peer, exactly like {@link dialControlSibling}: one dead
+     * address never aborts the pass.
+     */
+    async dialColdStartBootstrap() {
+        const controlNode = this.controlNode;
+        // Snapshot up front: the store hands back a copy, so a seed applied mid-pass
+        // cannot mutate what we are iterating.
+        const targets = this.bootstrapPeerStore?.all();
+        if (!controlNode || !targets || targets.size === 0) {
+            return;
+        }
+        // Same skip rule as step 3 of the steady-state pass: no churn on live links.
+        const connected = new Set(controlNode.getConnections().map((c) => c.remotePeer.toString()));
+        let dialed = 0;
+        for (const [peerId, entry] of targets) {
+            if (!this._running || !this.controlNode) {
+                return;
+            }
+            if (connected.has(peerId)) {
+                continue;
+            }
+            if (await this.dialBootstrapPeer(peerId, entry.addrs)) {
+                dialed++;
+            }
+        }
+        log('reconcileControlCohort: cold-start pass complete (bootstrap=%d, connected=%d, dialed=%d)', targets.size, connected.size, dialed);
+    }
+    /**
+     * Bind a bootstrap peer's seed addresses to its peer id, so the dial
+     * authenticates the peer it is aiming at rather than trusting whoever answers.
+     *
+     * An address that already carries `/p2p/<id>` must carry THIS peer's id or it
+     * is dropped (a seed that disagrees with itself is not a dial target); one
+     * that carries none — an `addressOverrides`-published record, say — gets the
+     * id encapsulated. Unencapsulatable addresses are dropped rather than dialed
+     * bare.
+     */
+    bootstrapDialAddrs(peerId, addrs) {
+        const out = [];
+        for (const addr of this.parseMultiaddrs(addrs)) {
+            const embedded = trailingPeerId(addr);
+            if (embedded === peerId) {
+                out.push(addr);
+                continue;
+            }
+            if (embedded !== null) {
+                log('reconcileControlCohort(cold-start): addr %s names peer %s, not %s; dropping', addr.toString(), embedded, peerId);
+                continue;
+            }
+            try {
+                out.push(addr.encapsulate(`/p2p/${peerId}`));
+            }
+            catch (error) {
+                log('reconcileControlCohort(cold-start): cannot bind %s to %s: %o', addr.toString(), peerId, error);
+            }
+        }
+        return out;
+    }
+    /** Dial one cold-start bootstrap peer, best-effort. Returns whether it connected. */
+    async dialBootstrapPeer(peerId, addrs) {
+        const controlNode = this.controlNode;
+        if (!controlNode) {
+            return false;
+        }
+        const parsed = this.bootstrapDialAddrs(peerId, addrs);
+        if (parsed.length === 0) {
+            log('reconcileControlCohort(cold-start): no dialable address for bootstrap peer %s; skipping', peerId);
+            return false;
+        }
+        try {
+            log('reconcileControlCohort(cold-start): dialing bootstrap peer %s (%d addr(s))', peerId, parsed.length);
+            await controlNode.dial(parsed);
+            return true;
+        }
+        catch (error) {
+            log('reconcileControlCohort(cold-start): dial of bootstrap peer %s failed (continuing): %o', peerId, error);
+            return false;
+        }
+    }
     // ============================================================================
     // Write-while-alone re-replication (control-write-ensure-replicated)
     //
@@ -1017,9 +1871,12 @@ export class CadreNode {
      * is caught by the cohort's periodic pull-on-read instead. Re-issuing an already-
      * replicated row is harmless (an idempotent monotonic bump), so the coarse proxy
      * is acceptable as the agreed first cut.
+     *
+     * Reads {@link getControlConnectionCount} — the public, embedder-facing form of
+     * the same sample — so the two cannot drift.
      */
     committedAlone() {
-        return (this.controlNode?.getConnections().length ?? 0) === 0;
+        return this.getControlConnectionCount() === 0;
     }
     /**
      * Record (or clear) a just-committed owner membership write in the
@@ -1028,27 +1885,47 @@ export class CadreNode {
      * cohort grows; otherwise the write replicated and any stale queue entry for this
      * subject is dropped.
      *
-     * A `remove` that commits alone is a security-relevant durability gap (a revoked
-     * peer may persist as a member elsewhere), so it is logged loudly — and, because
-     * a physical delete leaves no local trace to re-issue from, its on-growth
-     * re-issue is best-effort only (see {@link drainPendingPeerWrites}).
+     * A `remove` never queues here — a delete's re-replicable half is its
+     * `Revocation` tombstone, which the committed-delete seam routes into
+     * {@link pendingRevocations} ({@link noteGuardedDelete}). The `remove` arm only
+     * drops any queued authorize for the subject (the row is gone; re-issuing the
+     * insert would resurrect it) and, when the commit was alone, logs the
+     * security-relevant window loudly.
      */
     noteControlWrite(peerId, kind) {
-        if (!this.committedAlone()) {
+        if (kind === 'remove') {
             this.pendingPeerWrites.delete(peerId);
+            if (this.committedAlone()) {
+                log('removePeer(%s) committed while ALONE (0 control connections): the deletion is ' +
+                    'local-only, so a revoked peer may persist in the cohort until the queued ' +
+                    'Revocation tombstone is re-issued on cohort growth (drainPendingRevocations).', peerId);
+            }
             return;
         }
-        this.pendingPeerWrites.set(peerId, kind);
-        if (kind === 'remove') {
-            log('removePeer(%s) committed while ALONE (0 control connections): the deletion is ' +
-                'local-only, so a revoked peer may persist in the cohort until re-replication. The ' +
-                'on-growth re-issue is best-effort (a physical delete cannot be replayed without a ' +
-                'schema tombstone — see control-delete-while-alone-tombstone).', peerId);
+        if (!this.committedAlone()) {
+            this.pendingPeerWrites.delete(peerId);
+            return;
         }
-        else {
-            log('authorizePeer(%s) committed while alone (0 control connections); queued for ' +
-                're-replication on cohort growth', peerId);
+        this.pendingPeerWrites.set(peerId, 'authorize');
+        log('authorizePeer(%s) committed while alone (0 control connections); queued for ' +
+            're-replication on cohort growth', peerId);
+    }
+    /**
+     * Committed-delete seam handler ({@link GuardedDeleteListener}, wired in
+     * {@link start}): a guarded-table delete and its `Revocation` tombstone
+     * committed. If the node was alone the tombstone is local-only — queue it for
+     * an owner-signed re-issue on cohort growth; otherwise it broadcast, so drop
+     * any stale queue entry for the stamp. Synchronous by contract — bookkeeping
+     * only, never throws into the delete path.
+     */
+    noteGuardedDelete(revocation) {
+        if (!this.committedAlone()) {
+            this.pendingRevocations.delete(revocation.stampId);
+            return;
         }
+        this.pendingRevocations.set(revocation.stampId, revocation);
+        log('%s delete of %s committed while alone (0 control connections); Revocation tombstone ' +
+            '(stamp %s) queued for re-issue on cohort growth', revocation.tableName, revocation.rowKey, revocation.stampId);
     }
     /**
      * Drain the write-while-alone re-replication queue: re-issue the writes that
@@ -1079,8 +1956,19 @@ export class CadreNode {
             return;
         }
         const firstGrowth = !this.reconstructedLocalOnlyWrites;
-        log('Draining control re-replication (reason=%s, firstGrowth=%s, pendingPeers=%d, self=%s, deviceToken=%s)', reason, firstGrowth, this.pendingPeerWrites.size, this.pendingSelfPeerWrite, this.pendingSelfDeviceWrite);
-        // 1. Self rows. On the first growth always re-touch (covers a self row carried
+        log('Draining control re-replication (reason=%s, firstGrowth=%s, pendingPeers=%d, pendingRevocations=%d, self=%s, deviceToken=%s)', reason, firstGrowth, this.pendingPeerWrites.size, this.pendingRevocations.size, this.pendingSelfPeerWrite, this.pendingSelfDeviceWrite);
+        // 1. Revocation tombstones FIRST: a removal that never reached the cohort
+        //    leaves a revoked peer live elsewhere, which outranks every re-touch
+        //    below. Ordering is not cosmetic — every `CadrePeer` write here (self row
+        //    included) can burn tens of seconds in upstream retry livelock after a
+        //    collection fork, while the tombstone lives in a different collection
+        //    that is merely behind, not forked. No membership-gate refresh around
+        //    this step: a re-issue only bumps `ReissuedAt` — LOCAL membership
+        //    visibility changed at delete time (deleteCadrePeer already notified),
+        //    and receiving-node staleness is the pre-existing pull-on-read /
+        //    periodic-refresh property.
+        await this.drainPendingRevocations();
+        // 2. Self rows. On the first growth always re-touch (covers a self row carried
         //    over from a prior process that committed local-only before this start);
         //    afterwards only when a self-write-while-alone was recorded this session.
         //    registerSelf is idempotent + single-flight, so this never races a
@@ -1093,15 +1981,15 @@ export class CadreNode {
             await this.retouchSelfDeviceToken();
             this.pendingSelfDeviceWrite = false;
         }
-        // 2. First growth: an owner reconstructs membership rows it may have
+        // 3. First growth: an owner reconstructs membership rows it may have
         //    authored that never replicated (covers writes from before this process
         //    started). Rows already tracked in the in-memory queue are handled by
-        //    step 3 — skipped here to avoid a double re-touch.
+        //    step 4 — skipped here to avoid a double re-touch.
         if (firstGrowth) {
             this.reconstructedLocalOnlyWrites = true;
             await this.reconstructAuthoredMembership();
         }
-        // 3. In-session pending owner membership writes (authorize / remove).
+        // 4. In-session pending owner authorize writes.
         await this.drainPendingPeerWrites();
     }
     /**
@@ -1127,6 +2015,69 @@ export class CadreNode {
             log('drain: retouch self DeviceToken failed: %o', error);
         }
     }
+    /**
+     * Re-issue `Revocation` tombstones so a removal that committed while alone
+     * still reaches the cohort. Two regimes, one method:
+     *
+     * - **First successful pass per process** ({@link reissuedHeldRevocations}
+     *   false): sweep EVERY locally-held tombstone from `queryRevocations()` — the
+     *   only cover for a removal made before this process started, since the
+     *   in-memory queue does not survive a restart. Queued stamps are part of that
+     *   same batch (exactly once — one transaction, no double bump).
+     * - **Later passes**: only the tombstones queued in-session by
+     *   {@link noteGuardedDelete}.
+     *
+     * Owner-gated: a node with no owner key cannot sign a re-issue, so stray queue
+     * entries are dropped (mirrors {@link drainPendingPeerWrites}). Best-effort — a
+     * failure is logged and leaves the queue (and the sweep flag) untouched for the
+     * next growth edge. A successful `reissueRevocations` exec is NOT proof of
+     * broadcast (the connection that fired the growth edge may not be in the
+     * affected block's cluster — see
+     * tickets/backlog/control-rereplication-broadcast-confirmation); the drain
+     * inherits that known gap, and a full disconnect→reconnect (or the next
+     * process's sweep) re-covers it.
+     *
+     * NOTE: the sweep is O(all tombstones ever) row-updates — plus one owner
+     * signature each — in one transaction, once per lifetime. `Revocation` is
+     * append-only and unbounded growth is declared acceptable for a cadre-sized
+     * party. If the tombstone table ever gets large, bound the sweep (e.g. persist
+     * a node-local high-water mark of what has been re-issued while connected)
+     * instead of re-touching everything; note the `Math.max(...)` spread below also
+     * caps out around 10^5 rows (V8 argument limit) before the size becomes merely
+     * a latency problem.
+     */
+    async drainPendingRevocations() {
+        const sweep = !this.reissuedHeldRevocations;
+        if (!sweep && this.pendingRevocations.size === 0) {
+            return;
+        }
+        if (!this._running || !this.controlNode || !this.controlDatabase) {
+            return;
+        }
+        if (!this.seedBootstrapService?.canAuthorize()) {
+            // A non-owner node cannot sign a re-issue; drop any stray entries.
+            this.pendingRevocations.clear();
+            return;
+        }
+        try {
+            const held = await this.controlDatabase.queryRevocations();
+            const rows = sweep ? held : held.filter((r) => this.pendingRevocations.has(r.stampId));
+            if (rows.length > 0) {
+                const reissuedAt = Math.max(Date.now(), Math.max(...rows.map((r) => r.reissuedAt)) + 1);
+                await this.seedBootstrapService.reissueRevocations(rows, reissuedAt);
+                log('drain: re-issued %d revocation tombstone(s)%s', rows.length, sweep ? ' (first-growth sweep)' : '');
+            }
+            this.reissuedHeldRevocations = true;
+            // Per-stamp clear (not clear()) so an entry queued concurrently mid-drain
+            // survives for the next growth edge.
+            for (const row of rows) {
+                this.pendingRevocations.delete(row.stampId);
+            }
+        }
+        catch (error) {
+            log('drain: revocation re-issue failed; leaving queued for next growth: %o', error);
+        }
+    }
     /**
      * One-shot, first-cohort-growth reconstruction of the write-while-alone queue for
      * an OWNER node: re-touch every membership row that may be an unreplicated
@@ -1139,9 +2090,10 @@ export class CadreNode {
      * row is a no-op-equivalent).
      *
      * A node with no owner private key skips this entirely — it cannot re-sign
-     * rows for other peers, and rows it merely holds are not its to re-issue. DELETEs
-     * cannot be reconstructed here (a removed row leaves no local trace and the schema
-     * carries no tombstone) — see the delete-path note in {@link drainPendingPeerWrites}.
+     * rows for other peers, and rows it merely holds are not its to re-issue.
+     * DELETEs are not reconstructed here — the `Revocation` tombstone sweep in
+     * {@link drainPendingRevocations} covers them (a removed row leaves no
+     * `CadrePeer` trace, but its tombstone is re-issuable).
      */
     async reconstructAuthoredMembership() {
         if (!this.controlDatabase || !this.controlNode) {
@@ -1152,10 +2104,25 @@ export class CadreNode {
         }
         const selfPeerId = this.controlNode.peerId.toString();
         const members = await this.controlDatabase.queryCadrePeers();
+        // One gate refresh for the whole sweep: every re-touch is a notifying
+        // `CadrePeer` write, and these rows are already in the local snapshot (they
+        // committed here, just local-only), so per-row refreshes would be O(rows)
+        // membership reads for a snapshot that does not change.
+        const touched = await this.deferMembershipGateRefresh('drain-reconstruct', () => this.reissueAuthoredMembershipRows(selfPeerId, members));
+        if (touched > 0) {
+            log('drain: reconstructed %d owner-authored membership row(s) on first cohort growth', touched);
+        }
+    }
+    /**
+     * Body of {@link reconstructAuthoredMembership}'s sweep: re-issue each candidate
+     * owner-authored row, returning how many were re-touched. A per-row failure is
+     * logged and skipped; a teardown mid-sweep stops it.
+     */
+    async reissueAuthoredMembershipRows(selfPeerId, members) {
         let touched = 0;
         for (const member of members) {
             if (!this._running || !this.controlNode || !this.controlDatabase) {
-                return;
+                return touched;
             }
             if (member.peerId === selfPeerId || this.pendingPeerWrites.has(member.peerId)) {
                 continue;
@@ -1173,26 +2140,18 @@ export class CadreNode {
                 log('drain: reconstruction re-touch of %s failed (continuing): %o', member.peerId, error);
             }
         }
-        if (touched > 0) {
-            log('drain: reconstructed %d owner-authored membership row(s) on first cohort growth', touched);
-        }
+        return touched;
     }
     /**
      * Drain the in-session write-while-alone queue: re-issue each pending owner
-     * membership write now that the cohort can broadcast it. Sequential (no fan-out)
-     * to avoid a thundering re-touch; an entry is cleared only on success, so a
-     * failure (or a still-alone re-commit) leaves it queued for the next growth.
-     *
-     * - `authorize`: re-issue as an idempotent monotonic owner UPDATE
-     *   ({@link reissuePeerAuthorize}). Skipped (and cleared) if the row vanished
-     *   (raced a delete) or now carries a self-`Sig` (the peer self-published and owns
-     *   its republish).
-     * - `remove` (security-relevant): a removePeer-while-alone physically removed the
-     *   row locally, so a re-issued DELETE matches nothing and does NOT propagate —
-     *   full delete durability requires a schema tombstone (deferred:
-     *   `control-delete-while-alone-tombstone`). We still attempt the re-issue
-     *   (harmless, and it propagates in the row-still-present case); the commit-alone
-     *   was already logged loudly in {@link noteControlWrite}.
+     * authorize as an idempotent monotonic owner UPDATE
+     * ({@link reissuePeerAuthorize}) now that the cohort can broadcast it.
+     * Sequential (no fan-out) to avoid a thundering re-touch; an entry is cleared
+     * only on success, so a failure (or a still-alone re-commit) leaves it queued
+     * for the next growth. An entry is skipped (and cleared) if the row vanished
+     * (raced a delete) or now carries a self-`Sig` (the peer self-published and owns
+     * its republish). Removals are drained by {@link drainPendingRevocations}, not
+     * here.
      */
     async drainPendingPeerWrites() {
         if (this.pendingPeerWrites.size === 0) {
@@ -1203,29 +2162,33 @@ export class CadreNode {
             this.pendingPeerWrites.clear();
             return;
         }
-        for (const [peerId, kind] of [...this.pendingPeerWrites]) {
-            if (!this._running || !this.controlNode || !this.controlDatabase) {
+        // One gate refresh for the whole drain, not one per entry: these re-issues
+        // replay writes this node already applied locally (and already refreshed
+        // for), so the snapshot only has to be correct once the drain settles.
+        await this.deferMembershipGateRefresh('drain-reissue', () => this.reissuePendingPeerWrites());
+    }
+    /**
+     * Body of {@link drainPendingPeerWrites}' loop. An entry is cleared only on
+     * success (or when there is nothing left to re-issue); a failure is logged and
+     * the entry stays queued for the next cohort growth.
+     */
+    async reissuePendingPeerWrites() {
+        for (const peerId of [...this.pendingPeerWrites.keys()]) {
+            if (!this._running || !this.controlNode || !this.controlDatabase || !this.seedBootstrapService) {
                 return;
             }
             try {
-                if (kind === 'authorize') {
-                    const record = await this.controlDatabase.queryPeerRecord(peerId);
-                    if (!record || record.sig) {
-                        // Removed since, or peer self-published — nothing for the owner to re-issue.
-                        this.pendingPeerWrites.delete(peerId);
-                        continue;
-                    }
-                    await this.reissuePeerAuthorize(peerId, record.updatedAt);
-                }
-                else {
-                    // Best-effort delete re-issue (see method doc): propagates only if the row
-                    // is somehow still present locally.
-                    await this.seedBootstrapService.removePeer(peerId);
+                const record = await this.controlDatabase.queryPeerRecord(peerId);
+                if (!record || record.sig) {
+                    // Removed since, or peer self-published — nothing for the owner to re-issue.
+                    this.pendingPeerWrites.delete(peerId);
+                    continue;
                 }
+                await this.reissuePeerAuthorize(peerId, record.updatedAt);
                 this.pendingPeerWrites.delete(peerId);
             }
             catch (error) {
-                log('drain: re-issue of %s (%s) failed; leaving queued for next growth: %o', peerId, kind, error);
+                log('drain: re-issue of %s (authorize) failed; leaving queued for next growth: %o', peerId, error);
             }
         }
     }
@@ -1384,6 +2347,13 @@ export class CadreNode {
             return;
         }
         if (this.seedBootstrapService) {
+            // NOTE: the `CadrePeer` twin of this read-then-insert needed race recovery because an
+            // owner `authorizePeer` can seat a peer's row for it. Nothing seats a `DeviceToken`
+            // row on a peer's behalf, and this insert has no in-lock existence check, so a lost
+            // race would THROW rather than silently drop the record. If an owner-driven
+            // device-token seeding path is ever added, or two first-publishes can run
+            // concurrently (this method has no single-flight guard, unlike `registerSelf`),
+            // revisit — see `publishSelfRecord`'s fall-through.
             await this.seedBootstrapService.insertSelfDeviceToken(record);
             if (this.committedAlone())
                 this.pendingSelfDeviceWrite = true;
@@ -1404,8 +2374,10 @@ export class CadreNode {
      *   2. `publicKey <-> peerId` binding — the stored key's libp2p identity is the
      *      requested peerId,
      *   3. a `DeviceToken` row exists with a known {@link PushPlatform},
-     *   4. self-signature verifies against the bound `CadrePeer.PublicKey`,
-     *   5. freshness — `updatedAt` is positive and within `opts.maxAgeMs` (default:
+     *   4. the row's `StampId` is NOT retired in `CadreControl.Revocation` — the
+     *      read-side half of the clear (see below),
+     *   5. self-signature verifies against the bound `CadrePeer.PublicKey`,
+     *   6. freshness — `updatedAt` is positive and within `opts.maxAgeMs` (default:
      *      no ceiling, since a push token is valid until it rotates).
      *
      * A peer that is not a current member, or whose token has no backing `CadrePeer`
@@ -1436,6 +2408,22 @@ export class CadreNode {
             log('resolveDeviceToken: unknown platform %s for %s', record.platform, peerId);
             return null;
         }
+        // Retired stamp: the read-side mitigation for the write-time race, mirroring what
+        // listAuthorizedMembers does for CadrePeer. Clearing a token retires its StampId
+        // into Revocation, but the schema's NotRevoked CHECK only sees LOCALLY visible
+        // tombstones — a node that converged on a replayed insert before the tombstone can
+        // hold both rows, so the reader must drop the resurrected one.
+        //
+        // NOTE: the freshness ceiling below defaults to INFINITE by design (a suspended
+        // phone must stay push-reachable long after it published), so unlike a peer address
+        // record a stale token never ages out. Stamp retirement is the ONLY thing that
+        // retires a cleared token — do not weaken this check on the assumption that
+        // staleness will eventually cover it.
+        const revokedStamps = await this.controlDatabase.queryRevokedStamps('DeviceToken');
+        if (revokedStamps.has(record.stampId)) {
+            log('resolveDeviceToken: StampId for %s is retired (cleared token, resurrected row)', peerId);
+            return null;
+        }
         // Self-signature over (peerId, platform, token, updatedAt), verified against the
         // CadrePeer.PublicKey bound to this peerId.
         if (!verifyDeviceTokenSignature(record, peerRecord.publicKey)) {
@@ -1531,17 +2519,21 @@ export class CadreNode {
                 strandId: strand.Id,
                 error: error instanceof Error ? error : new Error(String(error))
             });
+            // Rethrow after the event: the only caller is the StrandWatcher's
+            // onStrandAdded callback, which uses the rejection to decide whether the
+            // strand was really added. Swallowing it here would have the watcher mark
+            // the strand as known-and-added, so no later poll would ever retry it.
+            // The watcher catches and logs, so this never escapes as an unhandled
+            // rejection.
+            throw error;
         }
     }
     async handleStrandRemoved(strandId) {
         log('Handling strand removed: %s', strandId);
         try {
-            // Untrack from hibernation
-            this.hibernationManager.untrackStrand(strandId);
-            // Remove sApp config
-            this.sAppConfigs.delete(strandId);
-            await this.strandManager.stopStrand(strandId);
-            this.emit('strand:stopped', { strandId });
+            // Same local teardown the explicit stop performs — deliberately NOT stopStrand
+            // itself, whose `_running` guard would throw on a poll that lands during shutdown.
+            await this.detachStrand(strandId);
         }
         catch (error) {
             log('Error stopping strand %s: %o', strandId, error);
@@ -1599,8 +2591,18 @@ export class CadreNode {
         await this.strandManager.stopAll();
         // Clear sApp configs
         this.sAppConfigs.clear();
-        // Close control database (this also shuts down the collection factory)
+        // Drop delegate-admission state: the grants are scoped to the session that
+        // recorded them, so a stop()/start() cycle on this object must not keep
+        // admitting delegates announced under the previous one, nor carry stale
+        // announce timestamps that would suppress the next session's refresh.
+        this.delegateAdmission.clear();
+        this.delegateAnnounceAt.clear();
+        // Close control database (this also shuts down the collection factory).
+        // Detach the membership hub first: nothing this teardown does should drive a
+        // gate refresh, and a notification arriving after this point is a no-op.
         if (this.controlDatabase) {
+            this.controlDatabase.setMembershipChangeListener(null);
+            this.controlDatabase.setGuardedDeleteListener(null);
             await this.controlDatabase.close();
             this.controlDatabase = null;
         }
@@ -1684,7 +2686,13 @@ export class CadreNode {
      * (returns the live instance unchanged) as a backstop against double-resume.
      */
     async resumeStrandRuntime(strandId) {
-        const seed = await this.resolveCohortSeed(strandId);
+        // Re-derive the transport peerId (deterministic and cheap — a quiesced
+        // instance has no `libp2pNode` to read it from) so the seed pass announces
+        // the delegate before `resumeStrand` runs `libp2p.start()`.
+        const delegatePeerId = this.identityKey
+            ? peerIdFromPrivateKey(await strandTransportKey(this.identityKey, strandId)).toString()
+            : undefined;
+        const seed = await this.resolveCohortSeed(strandId, delegatePeerId);
         const mode = selectStrandMode(undefined, seed.hasOtherPeers);
         await this.strandManager.resumeStrand(strandId, {
             bootstrapNodes: seed.bootstrapNodes,
@@ -1816,6 +2824,14 @@ export class CadreNode {
     /**
      * Add a strand with its sApp configuration.
      * The hosting application must provide the sApp schema when creating a strand.
+     *
+     * A rejected call leaves nothing running but DOES leave the sApp config
+     * registered, deliberately: both an explicit retry and the {@link StrandWatcher}'s
+     * automatic relaunch need it. So once the strand's row is visible on the control
+     * network (via {@link publishStrand} or another member), a failed launch keeps
+     * being re-attempted in the background — each failure re-emitting `strand:error`
+     * — until it succeeds. {@link detachStrand} (reached via {@link stopStrand}) is
+     * what abandons a strand for good.
      */
     async addStrand(config) {
         if (!this._running) {
@@ -1846,7 +2862,7 @@ export class CadreNode {
      * {@link ed25519KeyPairFromLibp2p} also exposes as the node's owner keypair,
      * so peer identity and owner key are one and the same. That key must be
      * enrolled in `OwnerKey` (e.g. via {@link ControlDatabase.ensureOwnerKey}
-     * at genesis) or the schema's `Strand.Authorized` constraint rejects the write.
+     * at genesis) or the schema's `Strand.AuthorizedInsert` constraint rejects the write.
      * Failing loudly here is intentional: a silently-unpublished strand would run
      * as a local-only island that no peer could ever discover or join.
      *
@@ -1854,30 +2870,99 @@ export class CadreNode {
      *   {@link addStrand}).
      * @param type - `'o'` for open (default) or `'c'` for closed.
      * @param memberPrivateKey - Optional membership key for a closed strand.
-     * @throws if the node is not started, exposes no owner signing key, or the
-     *   control DB rejects the (unauthorized) insert.
+     * @throws if the node is not started, exposes no owner signing key, the id is blank, or
+     *   the control DB rejects the (unauthorized) insert.
      */
     async publishStrand(strandId, type = 'o', memberPrivateKey) {
-        if (!this._running || !this.controlDatabase) {
-            throw new Error('CadreNode must be started before publishing a strand');
-        }
-        const signingKey = this.getSelfSigningKey();
-        if (!signingKey) {
-            throw new Error(`Cannot publish strand ${strandId}: no owner signing key available ` +
-                '(node identity is unavailable or does not match the node PeerId). Run owner ' +
-                'genesis (ensureOwnerKey + initializeSeedBootstrap) before publishing.');
+        const signingKey = this.requireOwnerSigningKey(`publish strand ${strandId}`);
+        // Trim/reject here so the id that lands matches the one unpublishStrand looks up: it
+        // trims too, and an untrimmed row would be unreachable by the same string.
+        const trimmed = requireNonBlank(strandId, 'strand id');
+        await this.controlDatabase.insertStrand(trimmed, type, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64), memberPrivateKey);
+        log('Published strand %s (type %s) to control DB under owner %s', trimmed, type, signingKey.publicKeyB64);
+    }
+    /**
+     * Remove this party's `Strand` row from the shared control database — the owner-signed
+     * inverse of {@link publishStrand}.
+     *
+     * Party-wide, unlike {@link stopStrand}, which only stops the strand on THIS node: every
+     * cadre node watching the table sees the row vanish on its next poll (default 5 s) and
+     * stops its own instance. This node converges immediately — the method forces a watcher
+     * poll and stops any still-running local instance before resolving. Removing the row
+     * removes OUR party's participation only: other parties in the strand keep their own
+     * rows and the strand network carries on, so no cross-party sign-off is involved — this
+     * is an owner-signed control-plane write like every other, not "destroy the network".
+     *
+     * Irreversible for a closed strand (`Type='c'`): the row carries `MemberPrivateKey`,
+     * this party's membership secret for that network, and it is stored nowhere else.
+     * With it gone the party can never again admit a member to that closed strand, and a
+     * re-published row would carry a DIFFERENT key that does not match the membership
+     * already written into the strand's RBAC layer. The strand id itself is NOT
+     * blacklisted: a fresh owner-signed {@link publishStrand} re-seats it under a new
+     * stamp — only the unsigned consent re-seat is permanently foreclosed (the removal's
+     * `Revocation` tombstone names the id, which the consent branch of
+     * `Strand.AuthorizedInsert` refuses ever after). Outstanding `FormationInvite` rows
+     * bound to the removed strand are unredeemable while the row is absent (the formation
+     * recorder resolves the strand as missing and rejects cleanly).
+     *
+     * Convergence caveats, same class as {@link enrollValidationKey}'s: a sibling that has
+     * not yet synced keeps running the strand until its own watcher observes the missing
+     * row; a sibling whose `strandFilter` never admitted this strand never observes the
+     * removal AT ALL and keeps running its instance indefinitely — opting out of watching a
+     * strand is also opting out of its party-wide removal, so such a node's only stop is its
+     * own local {@link stopStrand}/`unpublishStrand` call; and a removal committed while
+     * ALONE (0 control connections) deletes the row local-only. The accompanying
+     * `Revocation` tombstone IS queued and re-issued on the next cohort-growth edge
+     * ({@link noteGuardedDelete}/{@link drainPendingRevocations}), so the stamp retirement
+     * — and with it the consent re-seat foreclosure — does propagate; but the physical row
+     * deletion cannot be replayed, and `queryStrands` reads raw (no retired-stamp filter),
+     * so siblings that already hold the row keep running the strand until the collection
+     * itself converges (logged loudly; see the delete-while-alone durability note in
+     * docs/architecture.md).
+     *
+     * A no-op (no throw, no tombstone) when the row is already absent — but a
+     * locally-running instance of that id is still stopped.
+     *
+     * NOTE: control-plane only — the strand's local durable storage is retained. Stopping the
+     * instance closes the `StrandDatabase` and its libp2p node but purges no blocks, so a
+     * closed strand's content stays readable on disk to anyone with the data directory. If a
+     * caller ever needs removal to mean "and erase the local copy", that is a separate purge
+     * step, not a widening of this method.
+     *
+     * @param strandId - The `Strand` row id to remove (as passed to {@link publishStrand}).
+     * @throws if the node is not started, exposes no owner signing key, the id is blank, or
+     *   the signer is not an enrolled owner (the schema's `Strand.AuthorizedDelete` rejects
+     *   the write and the row survives). A rejection does NOT imply the row survived: the
+     *   local stop runs after the control-plane delete has already committed, so a failure
+     *   there throws over a completed removal.
+     */
+    async unpublishStrand(strandId) {
+        const signingKey = this.requireOwnerSigningKey(`unpublish strand ${strandId}`);
+        const trimmed = requireNonBlank(strandId, 'strand id');
+        const removed = await this.controlDatabase.deleteStrand(trimmed, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64));
+        // Gate on `removed`: the absent-row no-op wrote nothing, so warning about an
+        // unreplicated deletion there would send an operator chasing a phantom.
+        if (removed && this.committedAlone()) {
+            log('unpublishStrand(%s) committed while ALONE (0 control connections): the deletion is ' +
+                'local-only. Its Revocation tombstone is queued for re-issue on cohort growth, but the ' +
+                'row deletion itself cannot be replayed, so other nodes may keep running the strand ' +
+                'until the collection converges.', trimmed);
+        }
+        // Converge locally now rather than waiting up to a poll interval. The watcher fires
+        // onStrandRemoved for a strand it tracked; the explicit stop below covers a node whose
+        // strandFilter never admitted this strand (the watcher never knew it, so it will never
+        // fire). StrandInstanceManager.stopStrand no-ops on an unknown id, so the two paths
+        // cannot double-stop into an error.
+        await this.strandWatcher?.forcePoll();
+        if (this.strandManager.getInstance(trimmed)) {
+            await this.stopStrand(trimmed);
         }
-        // insertStrand hands this callback the canonical row-bound message BYTES (see
-        // buildAuthorizationMessage); ed25519-sign them directly (no pre-hash) with
-        // the owner private key, returning a base64url signature.
-        const signMessage = (message) => sign(message, signingKey.privateKeyB64, 'ed25519', 'bytes', 'base64url', 'base64url');
-        await this.controlDatabase.insertStrand(strandId, type, signingKey.publicKeyB64, signMessage, memberPrivateKey);
-        log('Published strand %s (type %s) to control DB under owner %s', strandId, type, signingKey.publicKeyB64);
+        log('Unpublished strand %s from control DB under owner %s', trimmed, signingKey.publicKeyB64);
     }
     /**
      * Publish an owner-signed `FormationInvite` (open-invitation token) to the
      * shared control database, so a later {@link formStrand} redemption can be
-     * validated against it (the consent branch of `Strand.Authorized`).
+     * validated against it (the consent branch of `Strand.AuthorizedInsert`).
      *
      * Counterpart to {@link createOpenInvitation}, which only mints the
      * out-of-band {@link OpenInvitation} envelope: persisting the matching
@@ -1897,27 +2982,147 @@ export class CadreNode {
      *   `strandId` (bind a closed/pre-existing host strand for provision-then-record).
      */
     async publishFormationInvite(token, sAppId, options = {}) {
+        const signingKey = this.requireOwnerSigningKey(`publish formation invite ${token}`);
+        await this.controlDatabase.insertFormationInvite(token, sAppId, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64), options);
+        // A host may publish an invite whose token was minted elsewhere; registering
+        // it locally opens the connection gate's formation exemption immediately
+        // rather than waiting for the durable row to become readable.
+        this.strandSolicitationService?.registerMintedInvitation(token, options.expiresAtMs ?? Number.POSITIVE_INFINITY);
+        log('Published formation invite %s (sApp %s) under owner %s', token, sAppId, signingKey.publicKeyB64);
+    }
+    /**
+     * Enroll an approver public key allowed to sign off on `ValidationUrl` redemptions.
+     *
+     * A `FormationInvite` carrying a `ValidationUrl` is only redeemable when the approval
+     * that comes back from that URL is signed by a key present in `CadreControl.ValidationKey`
+     * — this is how a party says which outside approver it trusts. Without an enrollment,
+     * every such invitation is unredeemable.
+     *
+     * Signs with the same self-owner key as {@link publishStrand} (the ed25519 key behind
+     * this node's PeerId, which must be an enrolled `OwnerKey`). Throws loudly if the node
+     * isn't started, exposes no signing key, or the key is blank — a blank key would reach
+     * the database and fail the signature CHECK as an opaque constraint error.
+     *
+     * Enrolling this node's OWN owner key is permitted and harmless: the domain/action tags
+     * baked into each authorization digest mean an owner-key signature can never satisfy the
+     * approval rule and an approval can never satisfy an owner rule. No guard is needed.
+     *
+     * NOTE: enrollment is replicated control state, so a key enrolled here is visible to a
+     * sibling cadre node only once control replication converges. A redemption that arrives
+     * at a node which has not caught up is refused as not-enrolled — the same convergence
+     * gap the schema records on `Strand.StampId`. Enroll before circulating the invitations
+     * that depend on the key.
+     *
+     * @param key - Approver public key to enroll (base64url ed25519 public key).
+     */
+    async enrollValidationKey(key) {
+        const signingKey = this.requireOwnerSigningKey('enroll a validation key');
+        const trimmed = requireEd25519PublicKeyB64(key, 'validation key');
+        await this.controlDatabase.insertValidationKey(trimmed, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64));
+        log('Enrolled validation key %s under owner %s', trimmed, signingKey.publicKeyB64);
+    }
+    /**
+     * Remove an approver public key.
+     *
+     * Narrows who may approve FUTURE redemptions ONLY. The schema's approval CHECKs run at
+     * write time, so a join that was already approved by this key stays valid — removal is
+     * not retroactive and does not re-examine committed rows.
+     *
+     * Rotation is therefore add-then-remove, in that order: removing the only enrolled key
+     * while `ValidationUrl` invitations are outstanding makes every one of them unredeemable
+     * until a new key is enrolled.
+     *
+     * Removing a key that is not enrolled is a silent no-op (no throw, no `Revocation`
+     * tombstone) — see {@link ControlDatabase.deleteValidationKey}.
+     *
+     * @param key - Approver public key to remove (base64url ed25519 public key).
+     */
+    async removeValidationKey(key) {
+        const signingKey = this.requireOwnerSigningKey('remove a validation key');
+        const trimmed = requireNonBlank(key, 'validation key');
+        await this.controlDatabase.deleteValidationKey(trimmed, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64));
+        log('Removed validation key %s under owner %s', trimmed, signingKey.publicKeyB64);
+    }
+    /**
+     * The approver keys currently enrolled, sorted. Read-only, so unlike
+     * {@link enrollValidationKey} / {@link removeValidationKey} it needs no owner signing
+     * key — only a started node.
+     */
+    async listValidationKeys() {
+        if (!this._running || !this.controlDatabase) {
+            throw new Error('CadreNode must be started before listing validation keys');
+        }
+        return await this.controlDatabase.queryValidationKeys();
+    }
+    /**
+     * Resolve the owner keypair every owner-signed control write needs — {@link publishStrand},
+     * {@link unpublishStrand}, {@link publishFormationInvite}, {@link enrollValidationKey},
+     * {@link removeValidationKey}
+     * — failing loudly in one two-part shape (not started / no signing key, naming owner
+     * genesis as the fix). Narrows `controlDatabase` for the caller: a non-null return means
+     * `this.controlDatabase` is non-null too.
+     *
+     * @param action - Infinitive phrase naming the attempted write, e.g. `'enroll a
+     *   validation key'`; interpolated into both messages.
+     */
+    requireOwnerSigningKey(action) {
         if (!this._running || !this.controlDatabase) {
-            throw new Error('CadreNode must be started before publishing a formation invite');
+            throw new Error(`CadreNode must be started before attempting to ${action}`);
         }
         const signingKey = this.getSelfSigningKey();
         if (!signingKey) {
-            throw new Error(`Cannot publish formation invite ${token}: no owner signing key available ` +
+            throw new Error(`Cannot ${action}: no owner signing key available ` +
                 '(node identity is unavailable or does not match the node PeerId). Run owner ' +
-                'genesis (ensureOwnerKey + initializeSeedBootstrap) before publishing.');
+                'genesis (ensureOwnerKey + initializeSeedBootstrap) before writing owner-signed ' +
+                'control state.');
         }
-        const signMessage = (message) => sign(message, signingKey.privateKeyB64, 'ed25519', 'bytes', 'base64url', 'base64url');
-        await this.controlDatabase.insertFormationInvite(token, sAppId, signingKey.publicKeyB64, signMessage, options);
-        log('Published formation invite %s (sApp %s) under owner %s', token, sAppId, signingKey.publicKeyB64);
+        return signingKey;
     }
     /**
      * Shared strand launch path for both the explicit (`addStrand`) and the
      * control-discovered (`handleStrandAdded`) entry points. Resolves the cohort
      * seed, selects the mode, starts the strand, and registers it with the
      * hibernation manager before emitting `strand:started`.
+     *
+     * Idempotent no-op when the strand manager already tracks `strand.Id` — the
+     * ordinary founding sequence is `addStrand` (starts it locally) followed by
+     * `publishStrand` (makes it visible), so this node's own `StrandWatcher`
+     * rediscovers a row it already started and calls this again via
+     * `handleStrandAdded`. Without the guard that re-entry would resolve a fresh
+     * (already-connected) cohort seed and re-emit `strand:started` for an
+     * instance that never stopped. The guard runs before the cohort-seed RPC
+     * fan-out, so a rediscovery costs nothing beyond the map lookup.
      */
     async launchStrand(strand, sAppConfig, explicitMode, founder) {
-        const seed = await this.resolveCohortSeed(strand.Id);
+        const existing = this.strandManager.getInstance(strand.Id);
+        if (existing) {
+            log('launchStrand: strand %s already tracked locally — skipping re-launch', strand.Id);
+            return existing;
+        }
+        // Each strand node gets its own transport identity, derived from the cadre
+        // identity key + strandId (see strand-transport-key.ts). Sharing the
+        // control node's key here gave every node one peerId, which collides at a
+        // shared circuit relay (github.com/gotchoices/sereus/issues/1). The
+        // retained launch config carries this derived key, so hibernate → wake
+        // (resumeStrand) reuses the same peerId.
+        //
+        // NOTE: derivation requires an Ed25519 identity key, so a node configured
+        // with some other key type now fails strand launch outright (surfaced as
+        // `strand:error` / a rejected addStrand) where it previously started the
+        // strand on that key. Ed25519 is already required for every control-DB
+        // signing path, so nothing reachable today hits this; if a non-Ed25519
+        // identity is ever supported, fall back to `undefined` here — libp2p then
+        // generates a random per-strand key, which still avoids the collision but
+        // gives up peerId stability across restarts.
+        const transportKey = this.identityKey
+            ? await strandTransportKey(this.identityKey, strand.Id)
+            : undefined;
+        // Derived BEFORE seed resolution so the seed pass doubles as the delegate
+        // announcement and every grant is recorded before `startStrand` runs
+        // `libp2p.start()` (the responder records the grant before replying; the
+        // client awaits the replies).
+        const delegatePeerId = transportKey ? peerIdFromPrivateKey(transportKey).toString() : undefined;
+        const seed = await this.resolveCohortSeed(strand.Id, delegatePeerId);
         const mode = selectStrandMode(explicitMode, seed.hasOtherPeers);
         const instance = await this.strandManager.startStrand({
             strandRow: strand,
@@ -1926,10 +3131,12 @@ export class CadreNode {
             network: this.config.network,
             profile: this.config.profile,
             defaultLatencyHint: this.config.hibernation?.defaultLatencyHint ?? 'interactive',
-            privateKey: this.identityKey,
+            privateKey: transportKey,
             bootstrapNodes: seed.bootstrapNodes,
             mode,
             requireSignedSchemas: this.config.requireSignedSchemas,
+            clusterSize: this.config.strandClusterSize,
+            backfill: this.config.strandBackfill,
             founder
         });
         this.hibernationManager.trackStrand(instance);
@@ -1949,8 +3156,19 @@ export class CadreNode {
      * empty (`[]`) — mode still follows membership, and the empty seed self-heals
      * on the next resume / check-in pass. Returns an empty seed when the control DB
      * or node is absent (not yet started / torn down).
+     *
+     * When `delegatePeerId` is given (a strand launch/resume is imminent), the
+     * pass doubles as the delegate ANNOUNCEMENT: our circuit relays are merged
+     * into the RPC targets and every request carries the delegate peerId, so each
+     * receiver records an admission grant BEFORE `libp2p.start()` (re-)dials the
+     * relay reservation — the gate denial there is fatal, not degraded. A
+     * party-member relay answers the RPC (its control node admits us as a
+     * member); a dedicated ops/ relay does not speak the protocol and the
+     * per-peer failure folds to `[]` — harmless, it has no membership gate and
+     * needs no grant. The relay's direct addr rides along as the dial fallback
+     * for a relay we are not yet connected to.
      */
-    async resolveCohortSeed(strandId) {
+    async resolveCohortSeed(strandId, delegatePeerId) {
         if (!this.controlDatabase || !this.controlNode) {
             return { bootstrapNodes: [], hasOtherPeers: false };
         }
@@ -1959,12 +3177,106 @@ export class CadreNode {
         // RPC only siblings we already have a control connection to — they can answer
         // now, and `dialProtocol` by peerId reuses the open connection.
         const connected = new Set(this.controlNode.getConnections().map((c) => c.remotePeer.toString()));
-        const targets = otherPeerIds.filter((id) => connected.has(id));
+        const targets = otherPeerIds
+            .filter((id) => connected.has(id))
+            .map((peerId) => ({ peerId }));
+        const relays = delegatePeerId === undefined ? [] : this.circuitRelayTargets();
+        for (const relay of relays) {
+            if (!targets.some((t) => t.peerId === relay.relayPeerId)) {
+                targets.push(relayStrandAddrPeer(relay));
+            }
+        }
         const bootstrapNodes = targets.length
-            ? await collectStrandAddrs(this.controlNode, targets.map((peerId) => ({ peerId })), strandId)
+            ? await collectStrandAddrs(this.controlNode, targets, strandId, { delegatePeerId })
             : [];
+        // Throttle state for the RELAY targets only — refreshDelegateGrants never
+        // looks up a sibling key, so recording one would only be dead weight.
+        this.recordDelegateAnnounces(relays.map((r) => r.relayPeerId), strandId);
         return { bootstrapNodes, hasOtherPeers };
     }
+    /**
+     * The circuit relays this node's strand nodes would reserve through: the
+     * union of the RESOLVED listen addrs' circuits — a hand-written
+     * `network.listenAddrs` circuit entry or a `network.relayAddrs` entry, which
+     * the strand node inherits verbatim either way — and the control node's own
+     * live `/p2p-circuit` multiaddrs (a reservation this node discovered rather
+     * than configured).
+     *
+     * NOTE: a relay the STRAND node discovers on its own (autorelay — in neither
+     * source) gets no announcement, and a membership-gated one will deny it; fine
+     * now, every realistic topology feeds one of the two sources.
+     */
+    circuitRelayTargets() {
+        return extractCircuitRelayTargets([
+            ...(resolveListenAddrs(this.config.network) ?? []),
+            ...(this.controlNode?.getMultiaddrs().map(String) ?? [])
+        ]);
+    }
+    /**
+     * Record the announce timestamps {@link refreshDelegateGrants} throttles on,
+     * for every relay a delegate-carrying announce pass dialed.
+     *
+     * Recorded OPTIMISTICALLY at announce time: `collectStrandAddrs` folds
+     * per-peer failure to `[]` and reports no per-peer success, and threading
+     * success out would change its API for little gain. A failed INITIAL announce
+     * is fatal-at-start anyway (the relay denies the reservation,
+     * `libp2p.start()` throws, and wake/check-in re-resume retries with a fresh
+     * announce); a failed REFRESH retries within `DELEGATE_GRANT_TTL_MS / 2`
+     * (15 min), still inside the 30 min TTL.
+     */
+    recordDelegateAnnounces(relayPeerIds, strandId, now = Date.now()) {
+        for (const relayPeerId of relayPeerIds) {
+            this.delegateAnnounceAt.set(peerStrandKey(relayPeerId, strandId), now);
+        }
+    }
+    /**
+     * Re-announce every running strand's delegate peerId to this node's circuit
+     * relays, throttled to once per `DELEGATE_GRANT_TTL_MS / 2` per
+     * (relay, strand). A grant must outlive the reservation: a dropped relay
+     * connection makes the strand's circuit-relay transport re-dial and face the
+     * connection gate again, so the relay must still hold a live grant then.
+     * RELAY targets only — siblings get their announce on every launch/resume
+     * seed pass, and a grant only matters where a reservation can be re-dialed.
+     *
+     * Strands announce CONCURRENTLY: this runs ahead of the reconcile pass's
+     * sibling enumeration, and one unreachable relay costs a dial timeout per
+     * target, which must not stack up per strand.
+     */
+    async refreshDelegateGrants(now = Date.now()) {
+        if (!this.controlNode) {
+            return;
+        }
+        // A running strand's delegate peerId is simply its live node's peerId — no
+        // re-derivation here.
+        const running = new Map();
+        for (const [strandId, instance] of this.strandManager.getInstances()) {
+            if (instance.libp2pNode) {
+                running.set(strandId, instance.libp2pNode.peerId.toString());
+            }
+        }
+        pruneStoppedStrandAnnounces(this.delegateAnnounceAt, new Set(running.keys()));
+        if (running.size === 0) {
+            return;
+        }
+        const relays = this.circuitRelayTargets();
+        if (relays.length === 0) {
+            return;
+        }
+        await Promise.all([...running].map(([strandId, delegatePeerId]) => this.announceDelegateToDueRelays(strandId, delegatePeerId, relays, now)));
+    }
+    /** One strand's share of {@link refreshDelegateGrants}: announce to the relays whose grant is due. */
+    async announceDelegateToDueRelays(strandId, delegatePeerId, relays, now) {
+        const controlNode = this.controlNode;
+        if (!controlNode) {
+            return;
+        }
+        const due = dueRelayAnnounces(this.delegateAnnounceAt, relays, strandId, now);
+        if (due.length === 0) {
+            return;
+        }
+        await collectStrandAddrs(controlNode, due.map(relayStrandAddrPeer), strandId, { delegatePeerId });
+        this.recordDelegateAnnounces(due.map((relay) => relay.relayPeerId), strandId, now);
+    }
     /**
      * The local strand instance's dialable strand-network multiaddrs for the
      * strand-addr RPC, ordered signaling-first (reusing the control node's
@@ -1982,16 +3294,37 @@ export class CadreNode {
         return orderSignalingFirst(node.getMultiaddrs().map((ma) => ma.toString()));
     }
     /**
-     * Remove a strand
+     * Stop a strand on THIS node only: untrack it from hibernation, drop its sApp config,
+     * stop the local instance, and emit `strand:stopped`. The shared `Strand` row is left
+     * intact, so on the next node restart (or watcher poll) the strand is rediscovered and
+     * surfaces as `strand:discovered` again. Party-wide removal is {@link unpublishStrand}.
      */
-    async removeStrand(strandId) {
+    async stopStrand(strandId) {
         if (!this._running) {
             throw new Error('CadreNode not running');
         }
-        // Untrack from hibernation
+        await this.detachStrand(strandId);
+    }
+    /**
+     * Local teardown for one strand, shared by the caller-driven {@link stopStrand} and the
+     * watcher-driven `handleStrandRemoved`: untrack hibernation, drop the sApp config, stop
+     * the instance, emit `strand:stopped`. Touches no control-plane row — which side of the
+     * removal the node is on is the caller's concern, not this method's.
+     *
+     * The stop + emit are skipped when the strand manager holds no instance for `strandId` —
+     * e.g. a party owner that published a strand's row but never ran it locally, or an
+     * explicit {@link stopStrand} for an id this node never started. `hibernationManager`
+     * untrack and the `sAppConfigs` delete stay unconditional (both are no-ops when there is
+     * nothing to remove), so a launch that failed before an instance was ever tracked still
+     * gets its stray sApp config cleared.
+     */
+    async detachStrand(strandId) {
         this.hibernationManager.untrackStrand(strandId);
-        // Remove sApp config
         this.sAppConfigs.delete(strandId);
+        if (!this.strandManager.hasStrand(strandId)) {
+            log('detachStrand: strand %s not tracked locally — no-op (no stop, no strand:stopped)', strandId);
+            return;
+        }
         await this.strandManager.stopStrand(strandId);
         this.emit('strand:stopped', { strandId });
     }
@@ -2175,12 +3508,86 @@ export class CadreNode {
     getControlNode() {
         return this.controlNode;
     }
+    /**
+     * Start keeping a relay reservation: dial the given relay(s) from the control
+     * node, ask the first one that answers for a reservation slot, wait until the
+     * resulting `/p2p-circuit` address makes this node dialable — and keep a
+     * supervisor running that re-drives whenever the reservation is later lost.
+     *
+     * For nodes that listen on the bare `/p2p-circuit` SEARCH addr (a browser tab)
+     * rather than a configured `network.relayAddrs` circuit listener — see
+     * `relay-reservation.ts` for why the two are alternatives and why configuring
+     * both is a regression. Opt-in: nothing calls this for the CLI/host nodes.
+     *
+     * Resolves once the FIRST attempt has settled, exactly as it did when it drove
+     * once; the retries continue in the background until {@link stop} or the next
+     * `reserveRelays` call. Fail-soft — never throws. An unreachable relay, a
+     * missing control node, or a timeout all resolve to a non-`reserved` status, so
+     * a caller can await this during startup without a dead relay aborting the node.
+     *
+     * Passing an empty list stops the supervisor and resets the posture to `none`
+     * without dialing or waiting.
+     */
+    async reserveRelays(addrs, opts) {
+        // Stop first, unconditionally: a second call with a different list must not
+        // leave two loops fighting over one pending reservation slot.
+        this.relayReserveSupervisor?.stop();
+        this.relayReserveSupervisor = null;
+        this.relayReserveAddrs = [...addrs];
+        this.relayReserveError = null;
+        if (addrs.length === 0) {
+            return this.getRelayReservationState();
+        }
+        if (!this.controlNode) {
+            // No node to supervise, so this is the one failure the node records itself.
+            this.relayReserveError = 'control node unavailable';
+            return this.getRelayReservationState();
+        }
+        const supervisor = superviseRelayReservation(this.controlNode, addrs, opts);
+        this.relayReserveSupervisor = supervisor;
+        await supervisor.firstAttempt;
+        // Read through `this`, not `supervisor`: an overlapping call may have replaced
+        // it while the first attempt was in flight, and the newest list is the truth.
+        return this.getRelayReservationState();
+    }
+    /**
+     * The node's CURRENT relay-reservation posture, recomputed from the control
+     * node's live multiaddrs on every call.
+     *
+     * Deliberately not memoised: a reservation can be lost after
+     * {@link reserveRelays} succeeds (the relay restarts, the connection drops) and
+     * a cached `reserved` would let a caller mint invitations carrying circuit
+     * addresses that no longer route.
+     *
+     * A lost reservation now recovers on its own — the supervisor {@link reserveRelays}
+     * starts re-drives on a backoff, reporting `retrying` meanwhile. `error` here
+     * means nothing is going to try again: no supervisor, or no control node.
+     */
+    getRelayReservationState() {
+        const supervisor = this.relayReserveSupervisor;
+        return resolveRelayReservationState(this.controlNode, this.relayReserveAddrs, supervisor ? supervisor.lastError : this.relayReserveError, supervisor?.driving ?? false, supervisor?.retryAtMs ?? null);
+    }
     /**
      * Get the control database (for advanced queries)
      */
     getControlDatabase() {
         return this.controlDatabase;
     }
+    /**
+     * Open control-network connections right now. A lower-bound proxy for replication
+     * reach: 0 connections ⇒ a control write commits local-only. The private
+     * `committedAlone` write-while-alone seam is defined in terms of this.
+     *
+     * It approximates the precise signal (the block's cluster size), and a caller that
+     * samples it AFTER a write samples a slightly wider window than `committedAlone`
+     * does inside the write itself. It exists so an embedder can warn an owner before a
+     * control write that this machine currently sees none of its siblings, and report
+     * after one that the write may not have travelled — a warning shown unconditionally
+     * is a warning people learn to ignore.
+     */
+    getControlConnectionCount() {
+        return this.controlNode?.getConnections().length ?? 0;
+    }
     /**
      * Force a poll of the strand watcher (for testing)
      */
@@ -2206,17 +3613,36 @@ export class CadreNode {
         if (!this.controlNode || !this.controlDatabase) {
             throw new Error('CadreNode must be started before initializing seed bootstrap');
         }
+        // A node wiring seed-bootstrap with an owner PRIVATE key is declaring that
+        // key an authority of its own party (founder genesis / self-signing owner)
+        // — anchor it in the node-local store. The in-memory set updates
+        // synchronously (see TrustedOwnerStore.trust); only the file persist is
+        // fire-and-forget, logged on failure.
+        // NOTE: non-founder members that also wire seed-bootstrap with their own
+        // derived key (e.g. the phone joiner path in runOwnerGenesis, which needs
+        // it to self-publish its CadrePeer row) self-anchor a key that is not a
+        // party authority. Harmless while such a node never mints an invite: the
+        // store does not replicate, so a node trusting itself grants nothing to
+        // others. But `createInvite` now hands out the anchor's contents as the
+        // invitee's pins, so the moment a non-founder member mints an invite it
+        // exports its own non-authority key as a cadre owner key. If that becomes
+        // reachable (today only cadre-cli/cadre-host owners mint invites), gate this
+        // self-anchor on the actual OwnerKey genesis insert instead.
+        if (this.trustedOwnerStore) {
+            void this.trustedOwnerStore
+                .trust(ed25519PublicKeyFromPrivate(ownerPrivateKey), 'genesis')
+                .catch((error) => log('Trusted-owner genesis anchor persist failed: %o', error));
+        }
         this.seedBootstrapService = new SeedBootstrapService({
             partyId: this.config.controlNetwork.partyId,
             ownerPrivateKey,
             inviteAddressResolver: () => this.resolveInviteAddresses(),
             trustPolicy: this.config.seedTrustPolicy,
+            // Seed trust anchors on the node-local store (seeded just above with this
+            // node's own genesis key), never on the replicated OwnerKey table.
+            ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
         });
-        this.seedBootstrapService.setEventCallbacks({
-            onSeedReceived: (partyId, peerId) => this.emit('seed:received', { partyId, peerId }),
-            onSeedApplied: (partyId, peersAdded) => this.emit('seed:applied', { partyId, peersAdded }),
-            onSeedError: (partyId, error) => this.emit('seed:error', { partyId, error }),
-        });
+        this.seedBootstrapService.setEventCallbacks(this.seedEventCallbacks());
         this.seedBootstrapService.initialize(this.controlNode, this.controlDatabase);
         log('Seed bootstrap service initialized');
     }
@@ -2243,7 +3669,10 @@ export class CadreNode {
         return this.getMultiaddrs();
     }
     /**
-     * Enumerate the cadre's `CadrePeer` membership.
+     * Enumerate the cadre's `CadrePeer` membership — the ADDRESSABLE surface (see
+     * {@link isMember}). Rows whose stamp is retired in `CadreControl.Revocation`
+     * never reach here: {@link ControlDatabase.queryCadrePeers} excludes them, so a
+     * revoked peer is not addressable either.
      */
     async listMembers() {
         if (!this.controlDatabase) {
@@ -2256,7 +3685,12 @@ export class CadreNode {
      *
      * This is the ADDRESSABLE surface ("do I have a dialable address record for this
      * peer") — it includes this node's own self-published row. Address resolution and
-     * push fan-out use this. The trust-facing gate is {@link isAuthorizedMember}.
+     * push fan-out use this. A peer whose stamp is retired in `CadreControl.Revocation`
+     * is excluded here too (the filter lives in
+     * {@link ControlDatabase.queryCadrePeers}): revocation removes a peer from the
+     * addressable surface, not only the trust-facing one, so a revoked peer is no
+     * longer dialed, RPC'd, or handed out as an address. The trust-facing gate is
+     * {@link isAuthorizedMember}.
      */
     async isMember(peerId) {
         const members = await this.listMembers();
@@ -2264,26 +3698,84 @@ export class CadreNode {
     }
     /**
      * Enumerate the party's AUTHORIZED members — the trust-facing set, distinct from
-     * the addressable set ({@link listMembers}). Excludes this node itself: a node
-     * publishes its own `CadrePeer` address row so its dialable address rides in seeds,
-     * but "self" is not a peer this node authorized. The control-network wake and
+     * the addressable set ({@link listMembers}). A peer is authorized iff ALL hold:
+     *
+     *  1. it is not this node itself — a node publishes its own `CadrePeer` address
+     *     row so its dialable address rides in seeds, but "self" is not a peer this
+     *     node authorized;
+     *  2. its `CadrePeer` row carries a complete voucher (`StampId`, `VouchOwner`,
+     *     `VouchSig` all non-null);
+     *  3. `VouchOwner` is in the NODE-LOCAL trusted-owner anchor
+     *     ({@link getTrustedOwnerStore}) — never the replicated `OwnerKey` table,
+     *     which any stranger can genesis-pollute; and
+     *  4. `VouchSig` verifies as that owner's signature over the row's voucher
+     *     digest ({@link verifyCadrePeerVoucher}), so the anchored owner really
+     *     vouched THIS peer id under THIS row's nonce; and
+     *  5. the row's `StampId` is NOT retired in `CadreControl.Revocation` — enforced
+     *     upstream in {@link ControlDatabase.queryCadrePeers}, which drops retired rows
+     *     before ANY reader (this predicate included) sees them, so a row resurrected
+     *     by replaying the captured admission approval on a node that had not yet
+     *     converged on the tombstone (the write-time `NotRevoked` CHECK only sees
+     *     local rows) is still inert to every reader that has the tombstone.
+     *
+     * Fail-closed at every step: a missing anchor (pre-start), an empty anchor (a
+     * not-yet-enrolled node authorizes no one), a null/partial voucher, an
+     * unanchored `VouchOwner`, or a bad signature all yield "not authorized" —
+     * having an address row is NOT membership. The control-network wake and
      * strand-address gates consult this set, NOT the addressable one.
      *
-     * NOTE: this is the addressable set minus self for now. The real trust predicate
-     * (voucher recorded on the row ∈ node-local trusted-owner anchor, signature
-     * verified) lands with the `membership-node-local-owner-anchor` /
-     * `membership-authorized-predicate-and-gates` tickets; keeping the filter in this one
-     * method means that change touches a single place.
+     * NOTE (rotation): if a party owner rotates keys and only the NEW key is pinned
+     * in the anchor, rows the OLD key vouched fail check 3 until re-vouched — a
+     * legit member goes un-authorized on readers that only pin the new key. Full
+     * rotation handling (re-vouch on rotate) is the
+     * `flip-strand-membership-rotation-known-gap` work, not this predicate's.
      */
     async listAuthorizedMembers() {
+        if (!this.controlDatabase) {
+            throw new Error('CadreNode must be started before listing members');
+        }
         const selfPeerId = this.peerId?.toString();
-        const members = await this.listMembers();
-        return members.filter(m => m.peerId !== selfPeerId);
+        const rows = await this.controlDatabase.queryCadrePeers();
+        const authorized = rows
+            .filter(row => row.peerId !== selfPeerId && this.hasAnchoredVoucher(row))
+            .map(({ peerId, multiaddr }) => ({ peerId, multiaddr }));
+        // A node whose anchor was never seeded (no invite pin, no operator pin, not a
+        // founder) refuses every wake and strand-addr request, which from the outside
+        // looks like an unexplained "non-member" rejection. Say so once per call rather
+        // than leaving the operator to infer it from silence.
+        if (authorized.length === 0 && rows.length > 0 && (this.trustedOwnerStore?.all().size ?? 0) === 0) {
+            log('listAuthorizedMembers: %d CadrePeer row(s) but the node-local trusted-owner anchor is EMPTY — authorizing no one (this node has no invite/operator owner-key pin)', rows.length);
+        }
+        return authorized;
+    }
+    /**
+     * Checks 2–4 of the authorized-membership predicate (see
+     * {@link listAuthorizedMembers}) for one `CadrePeer` row: complete voucher,
+     * `VouchOwner` in the node-local anchor, signature valid over the row's
+     * (PeerId, StampId) voucher digest.
+     *
+     * NOTE: verifies the ed25519 signature on every call (no memo of already-
+     * verified (peerId, stampId, vouchSig) triples). Cadres are a handful of
+     * devices and the gates run per inbound request, so this is cheap today; if
+     * membership or gate traffic ever grows, cache verified triples keyed on the
+     * row's `StampId` (which rotates with every re-vouch).
+     */
+    hasAnchoredVoucher(row) {
+        if (row.stampId === null || row.vouchOwner === null || row.vouchSig === null) {
+            return false;
+        }
+        if (!this.trustedOwnerStore?.has(row.vouchOwner)) {
+            return false;
+        }
+        return verifyCadrePeerVoucher(row.peerId, row.stampId, row.vouchOwner, row.vouchSig);
     }
     /**
      * Probe whether a given peer is an AUTHORIZED party member (see
      * {@link listAuthorizedMembers}) — the gate the control-network wake and
-     * strand-address responders consult, NOT {@link isMember} (the addressable surface).
+     * strand-address responders consult, NOT {@link isMember} (the addressable
+     * surface). Deliberately scans the full membership (one `CadrePeer` query)
+     * rather than adding a single-row read path: cadres are small, and one code
+     * path keeps the predicate impossible to drift from the list.
      */
     async isAuthorizedMember(peerId) {
         const members = await this.listAuthorizedMembers();
@@ -2334,12 +3826,12 @@ export class CadreNode {
             // No owner key - this node only receives seeds
             inviteAddressResolver: () => this.resolveInviteAddresses(),
             trustPolicy: this.config.seedTrustPolicy,
+            // A listener-only node accepts a wire-delivered seed solely against this
+            // anchor (there is no per-call override on the inbound handler): with no
+            // genesis/invite/operator pin it authorizes nobody, which is the point.
+            ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
         });
-        this.seedBootstrapService.setEventCallbacks({
-            onSeedReceived: (partyId, peerId) => this.emit('seed:received', { partyId, peerId }),
-            onSeedApplied: (partyId, peersAdded) => this.emit('seed:applied', { partyId, peersAdded }),
-            onSeedError: (partyId, error) => this.emit('seed:error', { partyId, error }),
-        });
+        this.seedBootstrapService.setEventCallbacks(this.seedEventCallbacks());
         this.seedBootstrapService.initialize(this.controlNode, this.controlDatabase);
         log('Seed listener enabled');
     }
@@ -2349,6 +3841,122 @@ export class CadreNode {
     getSeedBootstrapService() {
         return this.seedBootstrapService;
     }
+    /**
+     * The event callbacks every {@link SeedBootstrapService} this node owns is
+     * wired with — shared by the owner-capable service ({@link initializeSeedBootstrap})
+     * and the listener-only one ({@link enableSeedListener}) so the two cannot drift.
+     *
+     * A seed applied by the INBOUND protocol handler writes no `CadrePeer` row of
+     * its own (it merges the libp2p peer store and dials owners), so the automatic
+     * write-driven refresh never fires for it — yet applying it can ANCHOR a new
+     * owner key, which flips rows already present from unauthorized to authorized.
+     * Hence the explicit refresh here; without it a peer the freshly anchored owner
+     * vouched for stays denied until the next timed cohort reconcile.
+     */
+    seedEventCallbacks() {
+        return {
+            onSeedReceived: (partyId, peerId) => this.emit('seed:received', { partyId, peerId }),
+            onSeedApplied: (partyId, peersAdded, seed) => {
+                this.emit('seed:applied', { partyId, peersAdded });
+                // A wire-delivered seed never passes through the `applySeed` wrapper, so
+                // this is where its owner peers become cold-start bootstrap targets.
+                this.recordSeedBootstrapPeers(seed);
+                void this.refreshMembershipGate('seed-applied');
+            },
+            onSeedError: (partyId, error) => this.emit('seed:error', { partyId, error }),
+        };
+    }
+    /**
+     * Re-materialize the authorized-peer snapshot that the fail-closed per-stream
+     * control-DB gate ({@link authorizeInboundControlStream}) judges against.
+     *
+     * NO `CadrePeer` writer needs to call this: the control database notifies it
+     * after every committed member-row write (`ControlDatabase.mutateCadrePeer`,
+     * wired in {@link start}), which is exactly what makes the refresh automatic
+     * rather than a caller obligation. It stays public for the changes that write
+     * NO row locally and so raise no notification:
+     *
+     * - a membership row that arrived by REPLICATION (otherwise picked up on the
+     *   next timed cohort reconcile — bounded staleness by design), and
+     * - a newly anchored trusted owner key ({@link applySeed}), which flips rows
+     *   ALREADY present from unauthorized to authorized without touching them.
+     *
+     * Coalescing: marks the snapshot stale and resolves once a refresh that began
+     * after this call has completed, so a caller that awaits it always observes
+     * its own change. Concurrent callers share one read. Idempotent and
+     * best-effort (a failed read keeps the previous snapshot); never rejects.
+     */
+    async refreshMembershipGate(reason = 'external-write') {
+        this.membershipGateDirty = true;
+        if (this.membershipGateDeferDepth > 0) {
+            // Flushed once when the enclosing scope exits.
+            return;
+        }
+        while (this.membershipGateDirty) {
+            // Re-checked after the await: the drain may have taken its last look at
+            // the flag before we set it, in which case we need a fresh one.
+            this.membershipGateDrain ?? (this.membershipGateDrain = this.drainMembershipGate(reason));
+            await this.membershipGateDrain;
+        }
+    }
+    /**
+     * The single in-flight refresh loop behind {@link refreshMembershipGate}: read
+     * until the stale flag stays clear, then release the slot.
+     *
+     * NOTE: correct only because {@link membershipGateDirty} is guaranteed TRUE at
+     * entry — its sole caller sets it synchronously, with no await in between. Were
+     * this ever invoked with the flag already clear, the body would never suspend,
+     * so the `finally` would null the slot BEFORE the caller's `??=` filled it, and
+     * the slot would be left holding an already-settled drain that every later
+     * refresh reuses — an unbreakable await/re-check spin. If a second caller is
+     * ever added, have it mark the flag first (or assert it here).
+     */
+    async drainMembershipGate(reason) {
+        try {
+            while (this.membershipGateDirty) {
+                // Cleared BEFORE the read (not after) so a write landing mid-read marks
+                // the snapshot stale again and earns another pass, and so a throw still
+                // terminates the loop.
+                this.membershipGateDirty = false;
+                await this.refreshAuthorizedControlPeers(reason);
+            }
+        }
+        catch (error) {
+            // Upholds `refreshMembershipGate`'s never-rejects contract. The read helper
+            // already swallows its own failures, so this is defensive — but a rejection
+            // here would otherwise surface out of every awaiting writer.
+            log('membership gate drain (%s) failed — keeping previous snapshot: %o', reason, error);
+        }
+        finally {
+            this.membershipGateDrain = null;
+        }
+    }
+    /**
+     * Collapse a burst of `CadrePeer` writes into ONE gate refresh at scope exit.
+     *
+     * For loops that re-touch many rows (the write-while-alone drains), where a
+     * per-row refresh would mean one full membership read per row for a snapshot
+     * that only has to be correct once the loop settles.
+     *
+     * The depth counter is instance-level, so it also suppresses a genuinely
+     * CONCURRENT external write's refresh for the life of the scope: that writer's
+     * promise resolves before its peer is admitted, and admission lands at scope
+     * exit instead. Acceptable — scope exit is milliseconds away (bounded by the
+     * drain), versus the ~15 s reconcile interval that was the alternative before
+     * any of this existed — but it is the reason these scopes stay short and rare.
+     */
+    async deferMembershipGateRefresh(reason, body) {
+        this.membershipGateDeferDepth++;
+        try {
+            return await body();
+        }
+        finally {
+            this.membershipGateDeferDepth--;
+            if (this.membershipGateDeferDepth === 0 && this.membershipGateDirty) {
+                await this.refreshMembershipGate(reason);
+            }
+        }
+    }
     /**
      * Authorize a new peer to join the cadre.
      * Signs the peer ID with the owner key and inserts into CadrePeer table.
@@ -2360,6 +3968,8 @@ export class CadreNode {
         if (!this.seedBootstrapService) {
             throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
         }
+        // The insert notifies the control DB's membership hub, so the per-stream gate
+        // has already admitted the just-vouched peer by the time this resolves.
         await this.seedBootstrapService.authorizePeer({ peerId, multiaddrs });
         // Queue for re-replication if this committed local-only (no connected cohort).
         this.noteControlWrite(peerId, 'authorize');
@@ -2374,6 +3984,8 @@ export class CadreNode {
         if (!this.seedBootstrapService) {
             throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
         }
+        // The delete notifies the membership hub, so the removed peer is out of the
+        // per-stream gate by the time this resolves.
         await this.seedBootstrapService.removePeer(peerId);
         // Track + loudly flag a delete that committed local-only (security-relevant).
         this.noteControlWrite(peerId, 'remove');
@@ -2413,13 +4025,41 @@ export class CadreNode {
             const tempService = new SeedBootstrapService({
                 partyId: seed.partyId,
                 trustPolicy: this.config.seedTrustPolicy,
+                // The anchor is node-scoped, not service-scoped: a throwaway service
+                // must consult (and persist an accepted signer into) the SAME store the
+                // persistent one would, or a cold-start enrollment via this path would
+                // anchor nothing and re-prompt for the pin on every later seed.
+                ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
             });
             if (this.controlNode && this.controlDatabase) {
                 tempService.initialize(this.controlNode, this.controlDatabase, { registerHandler: false });
             }
-            return await tempService.applySeed(seed, options);
+            const tempResult = await tempService.applySeed(seed, options);
+            this.noteAppliedSeed(tempResult, seed);
+            // Not a row write (so nothing notifies): applying a seed can anchor a new
+            // owner key, which flips rows ALREADY present into the authorized set.
+            await this.refreshMembershipGate('applySeed');
+            return tempResult;
+        }
+        const result = await this.seedBootstrapService.applySeed(seed, options);
+        this.noteAppliedSeed(result, seed);
+        await this.refreshMembershipGate('applySeed');
+        return result;
+    }
+    /**
+     * Post-process an {@link applySeed} outcome: retain the seed's owner peers as
+     * cold-start bootstrap targets, and surface a seed that was accepted but whose
+     * every owner dial failed — the node is now seeded yet unconnected, and the
+     * cold-start reconcile branch is what gets it out of that state.
+     */
+    noteAppliedSeed(result, seed) {
+        if (!result.success) {
+            return;
+        }
+        this.recordSeedBootstrapPeers(seed);
+        if (result.ownerDialsAttempted > 0 && result.ownerDialsFailed === result.ownerDialsAttempted) {
+            log('applySeed: seeded but no owner reachable (%d/%d dial(s) failed) — cold-start reconcile will retry', result.ownerDialsFailed, result.ownerDialsAttempted);
         }
-        return await this.seedBootstrapService.applySeed(seed, options);
     }
     /**
      * Deliver a seed directly to a peer via the /sereus/seed/1.0.0 protocol.
@@ -2470,6 +4110,8 @@ export class CadreNode {
         if (!this.seedBootstrapService) {
             throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
         }
+        // The drone's `CadrePeer` insert notifies the membership hub on the way to the
+        // seed, so the per-stream gate already admits it here.
         return await this.seedBootstrapService.addDrone(options);
     }
     /**
@@ -2480,7 +4122,12 @@ export class CadreNode {
         if (!this.seedBootstrapService) {
             throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
         }
-        return await this.seedBootstrapService.createInvite(token, expiresIn);
+        const result = await this.seedBootstrapService.createInvite(token, expiresIn);
+        // The invitee dials this node BEFORE it is authorized (dialInvite →
+        // acceptPhone), so hold the inbound connection gate open for strangers for
+        // the invite's validity (or a bounded default when it never expires).
+        this.openEnrollmentWindow(result.invite.expiresAt ?? Date.now() + DEFAULT_ENROLLMENT_WINDOW_MS);
+        return result;
     }
     /**
      * Accept a phone connection using an invite.
@@ -2490,6 +4137,8 @@ export class CadreNode {
         if (!this.seedBootstrapService) {
             throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
         }
+        // The just-accepted phone opens control-DB streams next; its `CadrePeer` insert
+        // notifies the membership hub, so it is already admitted when this resolves.
         await this.seedBootstrapService.acceptPhone(options, issuedInvite);
     }
     /**
@@ -2500,6 +4149,10 @@ export class CadreNode {
         if (!this.seedBootstrapService) {
             throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
         }
+        // The service authorizes the phone (a `CadrePeer` insert, which notifies the
+        // membership hub) on the way to the seed, so the per-stream gate admits it
+        // before this resolves — not on the next reconcile, by which time the phone's
+        // own control-DB schema load may have died denied.
         return await this.seedBootstrapService.addPhoneWithRelay(phonePeerId);
     }
     /**