@serfab/cadre-core 0.9.0 → 0.10.0

package/src/cadre-node.ts

@@ -1,8 +1,7 @@
 import debug from 'debug';
 import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
 import type { Libp2p, PeerId, PrivateKey, Connection } from '@libp2p/interface';
-import { generateKeyPair, privateKeyToProtobuf, privateKeyFromProtobuf } from '@libp2p/crypto/keys';
-import { peerIdFromString } from '@libp2p/peer-id';
+import { peerIdFromString, peerIdFromPrivateKey } from '@libp2p/peer-id';
 import { createLibp2pNode } from '@optimystic/db-p2p';
 import { multiaddr } from '@multiformats/multiaddr';
 import type { Multiaddr } from '@multiformats/multiaddr';
@@ -30,12 +29,20 @@ import type {
   Libp2pNodeWithRepo,
   PushPlatform,
   DeviceTokenRecord,
+  CadrePeerVoucherFields,
+  CadrePeerRow,
+  PeerAddressRecord,
   ResolveDeviceTokenOpts
 } from './types.js';
-import { DEFAULT_CHECKIN_WINDOW_MS } from './types.js';
+import { CONTROL_CLUSTER_POLICY, CONTROL_REPLICATION_BREADTH, DEFAULT_CHECKIN_WINDOW_MS } from './types.js';
 import { sign } from '@optimystic/quereus-plugin-crypto';
-import { ed25519KeyPairFromLibp2p, type Ed25519KeyPair } from './ed25519-key.js';
+import { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, requireEd25519PublicKeyB64, type Ed25519KeyPair } from './ed25519-key.js';
+import { strandTransportKey } from './strand-transport-key.js';
 import { DEFAULT_IDENTITY_KEY_ID } from './key-store.js';
+import { loadOrCreateIdentityKey } from './identity-key.js';
+import { MemoryTrustedOwnerStore, type TrustedOwnerStore, type TrustSource } from './trusted-owner-store.js';
+import { MemoryBootstrapPeerStore, type BootstrapPeerStore } from './bootstrap-peer-store.js';
+import { verifyCadrePeerVoucher } from './peer-authorization.js';
 import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
 import {
   signPeerRecord,
@@ -43,6 +50,7 @@ import {
   isPeerRecordFresh,
   orderSignalingFirst,
   isSignalingAddr,
+  trailingPeerId,
   currentMemberTrustPolicy,
   DEFAULT_PEER_RECORD_MAX_AGE_MS,
   DEFAULT_PEER_RECORD_HEARTBEAT_MS
@@ -63,15 +71,32 @@ import {
 } from './control-cohort.js';
 import { EnrollmentService } from './enrollment.js';
 import { HibernationManager, type HibernationCallbacks } from './hibernation-manager.js';
-import { ControlDatabase } from './control-database.js';
-import { SeedBootstrapService } from './seed-bootstrap.js';
+import { ControlDatabase, type RevokedRowRef } from './control-database.js';
+import { SeedBootstrapService, type SeedEventCallbacks } from './seed-bootstrap.js';
 import type { SeedTrustPolicy } from './seed-trust-policy.js';
 import {
   StrandSolicitationService,
   type StrandSolicitationServiceOptions
 } from './strand-solicitation.js';
+import { createMembershipConnectionGater, DEFAULT_ENROLLMENT_WINDOW_MS } from './membership-connection-gater.js';
 import { StrandWakeService, dialWake } from './strand-wake-protocol.js';
-import { StrandAddrService, collectStrandAddrs } from './strand-addr-protocol.js';
+import { StrandAddrService, collectStrandAddrs, type StrandAddrPeer } from './strand-addr-protocol.js';
+import {
+  DelegateAdmissionStore,
+  extractCircuitRelayTargets,
+  dueRelayAnnounces,
+  pruneStoppedStrandAnnounces,
+  peerStrandKey,
+  type CircuitRelayTarget
+} from './delegate-admission.js';
+import { resolveListenAddrs } from './relay-addrs.js';
+import {
+  superviseRelayReservation,
+  resolveRelayReservationState,
+  type RelayReservationState,
+  type RelayReservationSupervisor,
+  type RelayReservationSupervisorOptions
+} from './relay-reservation.js';
 import { PushFanoutService } from './push-fanout.js';
 import type { WakeAck, WakeRequest } from './types.js';
 import {
@@ -94,6 +119,37 @@ const TURN_CONSUME_WINDOW_MS = 1000;
 
 type EventHandler<T> = (data: T) => void;
 
+/**
+ * A circuit relay as a strand-addr RPC target: dialed by peerId, with its
+ * direct addr riding along as the fallback for a relay we hold no connection to.
+ */
+function relayStrandAddrPeer(relay: CircuitRelayTarget): StrandAddrPeer {
+  return { peerId: relay.relayPeerId, addrs: [multiaddr(relay.relayAddr)] };
+}
+
+/**
+ * Build the signing callback the `ControlDatabase` writers expect: they hand it the
+ * canonical row-bound message BYTES (see `buildAuthorizationMessage`), and it ed25519-signs
+ * them directly (no pre-hash) with the owner private key, returning a base64url signature.
+ */
+function signMessageWith(privateKeyB64: string): (message: Uint8Array) => string {
+  return (message: Uint8Array): string =>
+    sign(message, privateKeyB64, 'ed25519', 'bytes', 'base64url', 'base64url') as string;
+}
+
+/**
+ * Reject a blank identifier before it reaches the control database, where it would fail an
+ * authorization CHECK as an opaque constraint error rather than an actionable message.
+ * Returns the trimmed value so callers write the same bytes they validated.
+ */
+function requireNonBlank(value: string, label: string): string {
+  const trimmed = value.trim();
+  if (trimmed.length === 0) {
+    throw new Error(`A ${label} is required (received an empty or whitespace-only value)`);
+  }
+  return trimmed;
+}
+
 /**
  * CadreNode is the main entry point for a cadre member.
  * It manages:
@@ -114,6 +170,15 @@ export class CadreNode implements SAppIdLookup {
    * launch) reads this resolved field, never `config.privateKey` directly.
    */
   private identityKey: PrivateKey | undefined;
+  /**
+   * Node-local, NON-replicated trusted-owner anchor (see
+   * `trusted-owner-store.ts`). Constructed (or adopted from
+   * `config.trustedOwners.store`) by {@link initializeTrustedOwnerStore} during
+   * {@link start}; deliberately NOT cleared by {@link cleanup}, so an in-memory
+   * anchor survives a stop()→start() cycle of the same node instance. Never
+   * sourced from replicated control state.
+   */
+  private trustedOwnerStore: TrustedOwnerStore | null = null;
   private controlNode: Libp2p | null = null;
   private controlDatabase: ControlDatabase | null = null;
   private strandWatcher: StrandWatcher | null = null;
@@ -154,6 +219,26 @@ export class CadreNode implements SAppIdLookup {
   private windowWaiters: Set<{ timer: ReturnType<typeof setTimeout>; resolve: () => void }> = new Set();
   private eventHandlers: Map<keyof CadreNodeEvents, Set<EventHandler<never>>> = new Map();
 
+  /**
+   * Relay multiaddrs the caller asked {@link reserveRelays} to reserve through.
+   * Empty (the default) means nobody asked, so {@link getRelayReservationState}
+   * reports `none` — this whole surface is opt-in and dormant for the CLI/host
+   * nodes, which use the configured `network.relayAddrs` route instead.
+   */
+  private relayReserveAddrs: string[] = [];
+  /**
+   * The running retry loop for {@link relayReserveAddrs}, or `null` when nobody
+   * asked for a reservation / there was no control node to supervise. It owns the
+   * in-flight flag, the last failure and the next-attempt time; this class only
+   * starts it, stops it and reads it.
+   */
+  private relayReserveSupervisor: RelayReservationSupervisor | null = null;
+  /**
+   * Reason {@link reserveRelays} produced no reservation when there is no
+   * supervisor to hold one — i.e. the pre-start `control node unavailable` case.
+   */
+  private relayReserveError: string | null = null;
+
   /** Map of strandId -> sAppConfig for sAppId filtering and management */
   private sAppConfigs: Map<string, SAppConfig> = new Map();
 
@@ -165,6 +250,113 @@ export class CadreNode implements SAppIdLookup {
    */
   private latestInviteAddresses: string[] | null = null;
 
+  /**
+   * Epoch ms until which the control-network inbound gate admits
+   * not-yet-authorized peers (see {@link admitInboundControlConnection} /
+   * {@link openEnrollmentWindow}). 0 = no window open. Opened automatically by
+   * {@link createInvite}; deliberately NOT reset on stop() — a stop/start cycle
+   * inside an outstanding invite's validity must not strand the invitee.
+   *
+   * NOTE: in-memory only, so a PROCESS restart mid-invite closes the door until
+   * the owner re-mints or the invitee is authorized. Fine while invites are
+   * short-lived and redeemed promptly; if long-lived invites or restart-prone
+   * hosts become normal, persist the window (or derive it from the issued-invite
+   * records `SeedBootstrapService` already keeps).
+   */
+  private enrollmentWindowUntil = 0;
+
+  /**
+   * Lazily-parsed PeerIds of `controlNetwork.bootstrapNodes` (see
+   * {@link getBootstrapPeerIds}) — infrastructure the inbound gate always admits.
+   */
+  private bootstrapPeerIds: Set<string> | null = null;
+
+  /**
+   * Materialized in-memory snapshot of the AUTHORIZED member peer ids (the
+   * {@link listAuthorizedMembers} result), consulted by the per-stream
+   * control-DB gate ({@link authorizeInboundControlStream}). That predicate
+   * runs on EVERY inbound Optimystic control-DB stream and must never await a
+   * control-DB read: those reads pull blocks over the very protocols the
+   * predicate gates, which closes a circular wait that ends in mutual denial
+   * (the upstream gate is fail-closed on timeout, unlike the fail-open
+   * connection gater). So the set is refreshed OUT OF BAND instead — after
+   * start, on every {@link reconcileControlCohort} pass (15s cadence), and
+   * immediately after every LOCAL membership mutation so a just-vouched peer
+   * is admitted without waiting for the timer. That last refresh is AUTOMATIC:
+   * the control database notifies {@link refreshMembershipGate} after every
+   * committed `CadrePeer` write (see `ControlDatabase.mutateCadrePeer`), so no
+   * writer has to remember. A change that arrives by REPLICATION is picked up
+   * on the next timed refresh — bounded staleness, acceptable because this gate
+   * is defense in depth: rows an unadmitted peer manages to write are still
+   * disbelieved at read time by the voucher-anchored predicate.
+   */
+  private authorizedControlPeers: Set<string> = new Set();
+
+  /**
+   * Coalescing state for {@link refreshMembershipGate}: a pending "the snapshot
+   * is stale" flag, the single in-flight drain that consumes it, and the depth
+   * of open {@link deferMembershipGateRefresh} scopes (a burst of writes inside
+   * one scope collapses to a single refresh at scope exit).
+   */
+  private membershipGateDirty = false;
+  private membershipGateDrain: Promise<void> | null = null;
+  private membershipGateDeferDepth = 0;
+
+  /**
+   * In-memory delegate admission grants (see `delegate-admission.ts`): the
+   * strand-node transport peerIds this party's members have announced over the
+   * strand-addr RPC, admitted at the CONNECTION level so a member's NAT'd
+   * strand node can hold a circuit-relay reservation on this node. Consulted
+   * ONLY by {@link admitInboundControlConnection}; the fail-closed per-stream
+   * gate ({@link authorizeInboundControlStream}) never honors it.
+   */
+  private readonly delegateAdmission = new DelegateAdmissionStore();
+
+  /**
+   * When this node last ANNOUNCED a delegate, keyed `<targetPeerId>\n<strandId>`
+   * (the peer announced TO, not the delegate). Throttles
+   * {@link refreshDelegateGrants} to once per `DELEGATE_GRANT_TTL_MS / 2` per
+   * (relay, strand) so the 15 s reconcile tick never becomes per-tick RPC
+   * chatter; the launch/resume announce passes record here too. Keys whose
+   * strand is no longer running are pruned on each reconcile pass.
+   */
+  private readonly delegateAnnounceAt = new Map<string, number>();
+
+  /**
+   * Cold-start bootstrap dial targets: the owner-flagged peers of every seed
+   * this node has applied, keyed by peer id, valued by the seed's multiaddr
+   * strings (parsed lazily, at dial time). Written by
+   * {@link recordSeedBootstrapPeers}; read only by
+   * {@link dialColdStartBootstrap} while the control database still has no
+   * siblings to dial.
+   *
+   * A STORE rather than a plain map (see `bootstrap-peer-store.ts`), because the
+   * targets must outlive the process: a node seeded into a party it could not
+   * reach has nothing else on disk naming that party's addresses (`applySeed`
+   * writes no control row, and `CadrePeer` fills in only after a connection
+   * succeeds), so an in-memory-only set left it stranded permanently across a
+   * restart. Constructed (or adopted from `config.bootstrapPeers.store`) by
+   * {@link initializeBootstrapPeerStore} during {@link start}; deliberately NOT
+   * cleared by {@link cleanup}, so it survives a stop()→start() cycle of the same
+   * node instance — same lifecycle as {@link trustedOwnerStore}. Durability
+   * depends on the injected backend: Node gets a file-backed store from the CLI,
+   * RN/browser stay ephemeral for now.
+   *
+   * Deliberately NOT the libp2p peer store, which {@link peerStoreAddrs} already
+   * reads for the steady-state path. The peer store is shared with everything
+   * libp2p discovers, so "dial every entry" would grow into dialing arbitrary
+   * discovered peers as the node lives longer; this store holds exactly the peers
+   * an owner-signed, trust-anchored seed nominated as owners. `applySeed` merges
+   * the same addresses into the peer store as well, so the two never disagree —
+   * this one is just the precisely-scoped subset.
+   *
+   * A later seed OVERWRITES an entry rather than merging, so a re-seed after an
+   * owner's address changes replaces the stale address instead of accumulating
+   * dead ones. Entries are never evicted: they are the node's only way back into
+   * the party if it is ever stranded again.
+   */
+  private bootstrapPeerStore: BootstrapPeerStore | null = null;
+
   /** Initial self-registration timer (see {@link scheduleSelfRegistration}). */
   private selfRegistrationTimer: ReturnType<typeof setTimeout> | null = null;
   /** TTL heartbeat that re-publishes the self record before it goes stale. */
@@ -195,15 +387,38 @@ export class CadreNode implements SAppIdLookup {
 
   // ── Write-while-alone re-replication (control-write-ensure-replicated) ──────
   /**
-   * Re-replication queue for owner control writes that committed while this
-   * node was alone — `controlNode.getConnections().length === 0` at write time
-   * means the Optimystic commit was local-only (the block's cluster was ≤1) and
-   * never broadcast. Maps the affected subject peerId → the write to re-issue once
-   * the cohort grows. A later op for the same subject overwrites an earlier one
-   * (authorize then remove → remove wins). Drained on the 0→≥1 control-connection
-   * transition by {@link drainPendingControlReplication}.
+   * Re-replication queue for owner `authorizePeer` writes that committed while
+   * this node was alone — `controlNode.getConnections().length === 0` at write
+   * time means the Optimystic commit was local-only (the block's cluster was ≤1)
+   * and never broadcast. Maps the affected subject peerId → 'authorize', to
+   * re-issue once the cohort grows. Removals are NOT tracked here — a delete
+   * leaves a `Revocation` tombstone, tracked by {@link pendingRevocations}; a
+   * removePeer also clears any queued authorize for the same subject (the row is
+   * gone, so re-issuing the insert would be wrong). Drained on the 0→≥1
+   * control-connection transition by {@link drainPendingControlReplication}.
+   */
+  private pendingPeerWrites: Map<string, 'authorize'> = new Map();
+  /**
+   * Re-replication queue for `Revocation` tombstones that committed while this
+   * node was alone, keyed on the retired `StampId`. Fed by the control DB's
+   * committed-delete seam ({@link noteGuardedDelete}), so one queue covers all
+   * four guarded tables (`CadrePeer` / `DeviceToken` / `Strand` /
+   * `ValidationKey`). Drained (owner-signed `ReissuedAt` bump, which re-broadcasts
+   * the tombstone) by {@link drainPendingRevocations}. Cleared on stop alongside
+   * {@link pendingPeerWrites} — the tombstone rows are durable, so the next
+   * lifetime's first-growth sweep re-covers anything dropped here.
+   */
+  private pendingRevocations: Map<string, RevokedRowRef> = new Map();
+  /**
+   * Guards the once-per-lifetime first-growth revocation sweep (re-issue EVERY
+   * locally-held tombstone, covering removals from before this node started).
+   * Deliberately separate from {@link reconstructedLocalOnlyWrites} and set only
+   * after a sweep pass SUCCEEDS (including the nothing-held case) — a throwing
+   * sweep retries on the next growth edge instead of being lost for the lifetime.
+   * Reset on stop, so a stop()→start() cycle sweeps again (that second start is
+   * exactly a "removals from before this lifetime" case).
    */
-  private pendingPeerWrites: Map<string, 'authorize' | 'remove'> = new Map();
+  private reissuedHeldRevocations = false;
   /** This node's own `CadrePeer` self-write committed local-only (re-touched on growth). */
   private pendingSelfPeerWrite = false;
   /** This node's own `DeviceToken` self-write committed local-only (re-touched on growth). */
@@ -380,6 +595,17 @@ export class CadreNode implements SAppIdLookup {
 
     log('Starting CadreNode for party: %s', this.config.controlNetwork.partyId);
 
+    // NOTE: the only direct `console.*` in this library — a boot-time operator warning, not a
+    // diagnostic trace (those use `debug`, which an operator never sees without `DEBUG=`). If a
+    // second such warning ever appears here, route both through a `CadreNodeEvents` entry the
+    // embedder surfaces instead of growing a console surface inside a library.
+    if (this.config.network?.announceAddrs && this.config.network.announceAddrs.length > 0) {
+      console.warn(
+        'network.announceAddrs is set but not yet supported (no upstream db-p2p option to apply it) ' +
+        '— this node will keep advertising its listen/relay addresses instead.'
+      );
+    }
+
     try {
       const tTotal = performance.now();
 
@@ -393,6 +619,18 @@ export class CadreNode implements SAppIdLookup {
       // store fails closed before a node is created.
       await this.resolveIdentityKey();
 
+      // Bring up the node-local trusted-owner anchor (and seed config pins)
+      // before any network bring-up: a mis-scoped injected store fails closed
+      // here, and out-of-band pins are anchored before the first seed/peer
+      // interaction could consult them.
+      await this.initializeTrustedOwnerStore();
+
+      // Bring up the node-local cold-start bootstrap-peer store alongside the
+      // anchor, and for the same two reasons: a mis-scoped injected store fails
+      // closed before any network bring-up, and the retained dial targets are
+      // loaded before the first reconcile pass could consult them.
+      this.initializeBootstrapPeerStore();
+
       // Create the control network libp2p node
       let t0 = performance.now();
       this.controlNode = await this.createControlNode();
@@ -417,6 +655,16 @@ export class CadreNode implements SAppIdLookup {
       timing('[start] controlDatabase.initialize: %dms', Math.round(performance.now() - t0));
       log('Control database initialized');
 
+      // Attach the per-stream gate to the control DB's membership hub, so every
+      // committed `CadrePeer` write re-materializes the authorized snapshot on its
+      // own. Wired before anything can write. `_running` is still false for the
+      // rest of start() and the refresh early-returns while it is — a write in that
+      // window is covered by start's own pass below.
+      this.controlDatabase.setMembershipChangeListener((reason) => this.refreshMembershipGate(reason));
+      // Committed-delete seam → write-while-alone revocation queue. Same wiring
+      // window argument as the membership listener above.
+      this.controlDatabase.setGuardedDeleteListener((revocation) => this.noteGuardedDelete(revocation));
+
       // Create strand queryable using the control database
       const queryable = this.createStrandQueryable();
 
@@ -454,9 +702,15 @@ export class CadreNode implements SAppIdLookup {
       // resolving a strand's bootstrap seed asks us for our live strand-network
       // multiaddrs (its CadrePeer row only knows our *control* address). Gated on
       // AUTHORIZED membership; answers only for strands we are actively meshing.
+      // The same RPC doubles as the delegate-announce channel: a member's request
+      // may carry the derived peerId its strand node runs as, and we record an
+      // admission grant so our connection gate (and thus our relay server, when
+      // enabled) admits it — see delegate-admission.ts.
       this.strandAddrService = new StrandAddrService({
         isMember: (peerId) => this.isAuthorizedMember(peerId),
         getStrandMultiaddrs: (strandId) => this.getStrandMultiaddrs(strandId),
+        onDelegateAnnounce: (announcer, strandId, delegate) =>
+          this.grantDelegateAdmission(announcer, strandId, delegate),
       });
       this.strandAddrService.initialize(this.controlNode);
 
@@ -476,6 +730,12 @@ export class CadreNode implements SAppIdLookup {
       // write-while-alone re-replication drain must fire on the first 0→≥1 edge.
       this.wireControlConnectionListeners();
 
+      // Seed the per-stream gate's materialized authorized set now that the
+      // control DB is up (non-blocking; the helper never rejects). Until it
+      // lands the snapshot is empty, which the stream gate treats as cold
+      // start and admits.
+      void this.refreshMembershipGate('start');
+
       // Schedule self-registration in background
       this.scheduleSelfRegistration();
 
@@ -522,7 +782,18 @@ export class CadreNode implements SAppIdLookup {
     }
 
     log('Stopping CadreNode');
+    // Stop the retry loop BEFORE tearing the node down, not after: `cleanup()`
+    // stops the control node partway through, and a tick that fires during it
+    // would dial and then poll a half-torn-down node for the whole reserve
+    // timeout — logging spurious dial failures and holding the process open.
+    this.relayReserveSupervisor?.stop();
+    this.relayReserveSupervisor = null;
     await this.cleanup();
+    // Drop the rest of the relay-reservation posture: a stopped node holds no
+    // reservation, so a restarted instance must not report the previous run's
+    // `reserved`.
+    this.relayReserveAddrs = [];
+    this.relayReserveError = null;
     this._running = false;
     this.emit('control:disconnected', undefined);
     log('CadreNode stopped');
@@ -567,11 +838,11 @@ export class CadreNode implements SAppIdLookup {
    * before any network bring-up. Resolution order:
    *
    * 1. Both `keyStore` and `privateKey` set ⇒ configuration error (throws).
-   * 2. `keyStore` set ⇒ load protobuf bytes from `identityKeyId` (default
-   *    {@link DEFAULT_IDENTITY_KEY_ID}). Found ⇒ deserialize; empty ⇒ generate a
-   *    fresh Ed25519 key, persist it, and use it. A rejected `get` (access denied
-   *    / backend failure) PROPAGATES — we never generate a new key on a read
-   *    error, which would silently orphan the real identity.
+   * 2. `keyStore` set ⇒ {@link loadOrCreateIdentityKey} against `identityKeyId`
+   *    (default {@link DEFAULT_IDENTITY_KEY_ID}): load when the slot is present,
+   *    generate + persist when it is empty. A rejected `get` (access denied /
+   *    backend failure) PROPAGATES — we never generate a new key on a read error,
+   *    which would silently orphan the real identity.
    * 3. `privateKey` set ⇒ use it directly.
    * 4. Neither ⇒ leave undefined; libp2p generates an ephemeral key.
    *
@@ -592,21 +863,11 @@ export class CadreNode implements SAppIdLookup {
     }
 
     if (keyStore) {
-      const keyId = identityKeyId ?? DEFAULT_IDENTITY_KEY_ID;
-      // A rejection here (e.g. KeyStoreAccessError) must propagate — do NOT fall
-      // through to generation, which would orphan an existing but unreadable key.
-      const bytes = await keyStore.get(keyId);
-      if (bytes) {
-        // Corrupt/garbage bytes throw here; surface loudly rather than
-        // regenerating (which would orphan the real identity).
-        this.identityKey = privateKeyFromProtobuf(bytes);
-        log('Identity key loaded from key store (slot present)');
-        return;
-      }
-      const generated = await generateKeyPair('Ed25519');
-      await keyStore.set(keyId, privateKeyToProtobuf(generated));
-      this.identityKey = generated;
-      log('Identity key generated and persisted to key store (first run)');
+      // Shared with the embedding app: `reference-app-rn` resolves the very same
+      // key before constructing this node so it can sign its ICE-manifest request
+      // with it (identity-key.ts). One copy of the rule, so neither side can
+      // drift into generating a second identity.
+      this.identityKey = await loadOrCreateIdentityKey(keyStore, identityKeyId ?? DEFAULT_IDENTITY_KEY_ID);
       return;
     }
 
@@ -617,9 +878,129 @@ export class CadreNode implements SAppIdLookup {
     // Neither configured: libp2p generates an ephemeral key internally.
   }
 
+  /**
+   * Construct (or adopt) the node-local trusted-owner anchor and seed the
+   * out-of-band pinned keys from `config.trustedOwners`. The store is NEVER
+   * sourced from the replicated control DB — its entries come only from
+   * genesis self-trust ({@link initializeSeedBootstrap}), config pins (here),
+   * or runtime enrollment pins ({@link trustOwnerKeys}).
+   *
+   * Idempotent across stop()→start(): the store instance is kept, and
+   * re-seeding config pins is a no-op ({@link TrustedOwnerStore.trust} is
+   * idempotent). An injected store scoped to a different party is a
+   * configuration error (fail closed before any network bring-up).
+   */
+  private async initializeTrustedOwnerStore(): Promise<void> {
+    const { trustedOwners } = this.config;
+    const partyId = this.config.controlNetwork.partyId;
+    if (!this.trustedOwnerStore) {
+      const store = trustedOwners?.store ?? new MemoryTrustedOwnerStore(partyId);
+      if (store.partyId !== partyId) {
+        throw new Error(
+          `CadreNodeConfig: trustedOwners.store is scoped to party ${store.partyId}, ` +
+          `but this node serves party ${partyId} — refusing to mix trust anchors`
+        );
+      }
+      this.trustedOwnerStore = store;
+    }
+    // Validate every pin before trusting any: a malformed entry must not leave
+    // earlier, valid pins anchored while start() then fails on a later one —
+    // config pins land all-or-nothing, same as the runtime seam below.
+    const pinnedKeys = (trustedOwners?.pinnedKeys ?? []).map(key => requireEd25519PublicKeyB64(key, 'pinned owner key'));
+    for (const key of pinnedKeys) {
+      await this.trustedOwnerStore.trust(key, trustedOwners?.pinnedSource ?? 'operator');
+    }
+  }
+
+  /**
+   * Construct (or adopt) the node-local cold-start bootstrap-peer store (see
+   * {@link bootstrapPeerStore}). Synchronous: an injected store has already
+   * loaded its persisted targets by the time it is handed in (its `open` is the
+   * async part), and the in-memory fallback has nothing to load.
+   *
+   * Idempotent across stop()→start(): the store instance is kept, so retained
+   * targets survive a restart of the same node instance even with the ephemeral
+   * default. An injected store scoped to a different party is a configuration
+   * error (fail closed before any network bring-up) — a foreign party's addresses
+   * must never enter this node's dial loop.
+   */
+  private initializeBootstrapPeerStore(): void {
+    const partyId = this.config.controlNetwork.partyId;
+    if (this.bootstrapPeerStore) {
+      return;
+    }
+    const store = this.config.bootstrapPeers?.store ?? new MemoryBootstrapPeerStore(partyId);
+    if (store.partyId !== partyId) {
+      throw new Error(
+        `CadreNodeConfig: bootstrapPeers.store is scoped to party ${store.partyId}, ` +
+        `but this node serves party ${partyId} — refusing to mix cold-start dial targets`
+      );
+    }
+    this.bootstrapPeerStore = store;
+  }
+
+  /**
+   * The node-local cold-start bootstrap-peer store (null before {@link start}) —
+   * the retained owner addresses {@link reconcileControlCohort}'s cold-start
+   * branch re-dials. Exposed for diagnostics and for a host that wants to show
+   * "what would this node dial if it is stranded?".
+   */
+  getBootstrapPeerStore(): BootstrapPeerStore | null {
+    return this.bootstrapPeerStore;
+  }
+
+  /**
+   * The node-local trusted-owner anchor (null before {@link start}). This is
+   * the set the authorized-membership predicate and seed-trust anchor consult —
+   * never the replicated `OwnerKey` table, which any stranger can pollute.
+   */
+  getTrustedOwnerStore(): TrustedOwnerStore | null {
+    return this.trustedOwnerStore;
+  }
+
+  /**
+   * Persist out-of-band-established owner keys into the node-local anchor —
+   * the runtime enrollment seam: call with `CadreInvite.ownerKeys` when
+   * redeeming an invite (BEFORE the first `applySeed`, so the anchor already
+   * holds the pins when seed trust consults it), or with an operator-supplied
+   * pin. Idempotent. ('genesis' provenance is reserved for the node's own
+   * founding key, seeded internally by {@link initializeSeedBootstrap}.)
+   *
+   * Validates every key's shape before trusting any of them (all-or-nothing):
+   * a malformed entry anywhere in `keys` rejects the whole call before a
+   * single key is anchored. For the invite route this means a `CadreInvite`
+   * carrying one malformed `ownerKeys` entry fails the redemption outright —
+   * consistent with the anchor's existing whole-record-or-nothing policy for
+   * a corrupt persisted entry (see `trusted-owner-store.ts`'s
+   * `unusableEntry: 'discard-all'`) — rather than silently anchoring a subset
+   * and leaving the caller to notice a key went missing.
+   */
+  async trustOwnerKeys(keys: Iterable<string>, source: Exclude<TrustSource, 'genesis'>): Promise<void> {
+    if (!this.trustedOwnerStore) {
+      throw new Error('CadreNode must be started before trusting owner keys');
+    }
+    const validated = Array.from(keys, key => requireEd25519PublicKeyB64(key, 'pinned owner key'));
+    for (const key of validated) {
+      await this.trustedOwnerStore.trust(key, source);
+    }
+  }
+
   private async createControlNode(): Promise<Libp2p> {
+    return await createLibp2pNode(this.buildControlNodeOptions());
+  }
+
+  /**
+   * Map this node's config onto the control network's libp2p node options.
+   *
+   * Split out of {@link createControlNode} purely so the mapping is assertable without
+   * standing up a real libp2p node — `packages/cadre-core/test/cadre-node-control-node-options.spec.ts`
+   * calls it on a bare `new CadreNode(config)`. Read nothing else into the split; the
+   * only caller in production is `createControlNode`.
+   */
+  private buildControlNodeOptions(): Parameters<typeof createLibp2pNode>[0] {
     const { controlNetwork, network, storage, profile } = this.config;
     const identityKey = this.identityKey;
+    const listenAddrs = resolveListenAddrs(network);
 
     // Determine relay mode: if explicitly set in config, use that;
     // otherwise default to true for storage profile nodes (better connectivity/uptime)
@@ -640,16 +1021,290 @@ export class CadreNode implements SAppIdLookup {
       storage: controlStorageProvider,
       fretProfile: profile === 'storage' ? 'core' : 'edge',
       relay: enableRelay,
-      clusterSize: 3,
-      clusterPolicy: { allowDownsize: true, sizeTolerance: 0.5 },
-      arachnode: { enableRingZulu: this.config.profile === 'storage' },
+      // Fixed, and deliberately above any party's node count: every member reads the
+      // whole control database, so a cohort that excludes a member leaves it dependent
+      // on read repair — which cannot converge at a two-member cohort. Not a knob;
+      // see CONTROL_REPLICATION_BREADTH. `assumedClusterSize: 2` is declared explicitly in
+      // CONTROL_CLUSTER_POLICY: only the admission gate defaults to 2, while the read-repair
+      // corroboration floor would otherwise fall back to this clusterSize of 16.
+      clusterSize: CONTROL_REPLICATION_BREADTH,
+      clusterPolicy: CONTROL_CLUSTER_POLICY,
+      arachnode: { enableRingZulu: profile === 'storage' },
       ...(identityKey && { privateKey: identityKey }),
       ...(network?.transports && { transports: network.transports }),
-      ...(network?.listenAddrs && { listenAddrs: network.listenAddrs }),
-      ...(network?.connectionGater && { connectionGater: network.connectionGater })
+      // Configured `listenAddrs`, plus a `/p2p-circuit` listener for every
+      // `network.relayAddrs` entry — that listener is what reserves the relay slot.
+      ...(listenAddrs && { listenAddrs }),
+      // The CONTROL node composes the membership admission gate onto any
+      // caller-supplied gater (deny from either wins on inbound; all other
+      // hooks pass through). Strand cohort nodes keep the raw configured gater
+      // (see strand-instance-manager.ts) — their peers are legitimately
+      // cross-party, so cadre membership must not gate them.
+      connectionGater: createMembershipConnectionGater(
+        { admitInbound: (remotePeerId) => this.admitInboundControlConnection(remotePeerId) },
+        network?.connectionGater
+      ),
+      // Fail-closed per-stream authorization for the four Optimystic control-DB
+      // protocols — the members-only layer the connection gater's stranger
+      // carve-outs cannot express (see authorizeInboundControlStream). Control
+      // node only: strand cohort nodes serve cross-party peers.
+      authorizeInboundStream: (remotePeerId, protocol) =>
+        this.authorizeInboundControlStream(remotePeerId, protocol)
     };
 
-    return await createLibp2pNode(nodeOptions);
+    return nodeOptions;
+  }
+
+  /**
+   * Decide whether an inbound CONTROL-network connection from `remotePeerId`
+   * should be admitted — the policy behind the connection gater wired in
+   * {@link createControlNode}. Deny only on a positive "unauthorized outsider
+   * while no stranger path is open" determination; everything ambiguous admits
+   * and defers to the fail-closed per-stream gates (see
+   * `membership-connection-gater.ts` for the layer's rationale and the
+   * stranger-open protocol allowlist).
+   *
+   * Admits when ANY of:
+   *  1. a shared-baseline check admits ({@link admitControlPeerUnconditionally}
+   *     — not running / DB torn down, absent-or-empty trusted-owner anchor, or
+   *     configured bootstrap/relay infrastructure);
+   *  2. an enrollment window is open ({@link openEnrollmentWindow}, opened by
+   *     {@link createInvite}) — the invitee dials in before it is authorized;
+   *  3. the peer holds a live DELEGATE ADMISSION GRANT — an authorized member
+   *     announced it (over the strand-addr RPC) as the transport peerId of its
+   *     own strand node, so a NAT'd member's strand node can hold a
+   *     circuit-relay reservation here (see `delegate-admission.ts`).
+   *     Connection only: the per-stream gate below never honors a grant;
+   *  4. the authorized-member set is empty — cold start: the rows that would
+   *     authorize anyone arrive by replication over these very connections;
+   *  5. the peer IS an authorized member; or
+   *  6. an open invitation is OUTSTANDING — at least one unexpired,
+   *     not-fully-consumed invitation this node minted or persisted (see
+   *     `StrandSolicitationService.hasOutstandingInvitation`). A formation
+   *     initiator is another party's peer by design and its token is only
+   *     checkable inside the protocol, so the gate asks the coarser question
+   *     "does this node expect a stranger at all?". Merely REGISTERING the
+   *     responder ({@link initializeStrandSolicitation}) no longer suspends
+   *     stranger denial — eager registration (as `reference-app-rn` does at
+   *     bring-up) and `formStrand`'s lazy initialization both leave the gate
+   *     armed, because neither mints an invitation.
+   *
+   * Ordering is semantically free (the checks are OR'd) but decides who pays:
+   * checks 1-3 are in-memory, 4/5 share one control-DB read, and only a peer
+   * already on the deny path reaches check 6's invitation lookup.
+   *
+   * Caveats of check 6, both self-healing:
+   *  - the in-memory mint registry dies with the process, so after a restart
+   *    only invitations persisted as `FormationInvite` rows still hold the
+   *    exemption open (re-mint otherwise — same story as the enrollment window);
+   *  - a peer holding a token whose `FormationInvite` row has not replicated to
+   *    this node yet is denied even though the formation handler would have
+   *    accepted it, exactly like the unreplicated-membership-row case below.
+   *
+   * NOTE: check 4/5 runs a control-DB read per inbound connection
+   * (`listAuthorizedMembers`); connections are rare and cadres small, and this
+   * layer is fail-open behind `ADMISSION_DECISION_TIMEOUT_MS`, so the live
+   * read is safe here — unlike the per-stream gate, which must consult the
+   * materialized {@link authorizedControlPeers} snapshot instead.
+   * NOTE: a sibling whose membership row has not yet replicated to
+   * this node is denied until the row converges (typically via the owner);
+   * either side's next outbound reconcile dial (outbound is never gated)
+   * re-establishes the link — self-healing, but visible as a transient deny.
+   */
+  private async admitInboundControlConnection(remotePeerId: string): Promise<boolean> {
+    if (this.admitControlPeerUnconditionally(remotePeerId)) {
+      return true;
+    }
+    if (Date.now() < this.enrollmentWindowUntil) {
+      return true;
+    }
+    if (this.delegateAdmission.has(remotePeerId)) {
+      return true;
+    }
+    const authorized = await this.listAuthorizedMembers();
+    if (authorized.length === 0) {
+      return true;
+    }
+    if (authorized.some((m) => m.peerId === remotePeerId)) {
+      return true;
+    }
+    try {
+      if (await this.strandSolicitationService?.hasOutstandingInvitation()) {
+        return true;
+      }
+    } catch (error) {
+      log('admitInboundControlConnection: outstanding-invitation check threw for %s — admitting (fail-open): %o', remotePeerId, error);
+      return true;
+    }
+    log('admitInboundControlConnection: DENYING inbound from %s — not an authorized member and no enrollment path open', remotePeerId);
+    return false;
+  }
+
+  /**
+   * Hold the control-network inbound gate open for not-yet-authorized peers
+   * until `untilEpochMs` (extends, never shrinks, an already-open window).
+   * {@link createInvite} calls this automatically; a host running an
+   * out-of-band enrollment flow (e.g. accepting a phone whose invite this node
+   * never minted) can open it explicitly before the stranger dials in.
+   */
+  openEnrollmentWindow(untilEpochMs: number): void {
+    this.enrollmentWindowUntil = Math.max(this.enrollmentWindowUntil, untilEpochMs);
+    log('Enrollment window open until %d', this.enrollmentWindowUntil);
+  }
+
+  /**
+   * Record (or refresh) a delegate admission grant: `delegatePeerId` is the
+   * transport peerId of `announcerPeerId`'s strand-`strandId` node, admitted
+   * at the CONNECTION level (all a circuit-relay reservation needs) for
+   * `DELEGATE_GRANT_TTL_MS`. Called by the strand-addr responder after its
+   * authorized-membership gate has passed; public so tests can drive the
+   * admission policy without a full strand launch. A re-announce for the same
+   * (announcer, strand) REPLACES the previous delegate rather than
+   * accumulating. Never honored by {@link authorizeInboundControlStream}.
+   */
+  grantDelegateAdmission(announcerPeerId: string, strandId: string, delegatePeerId: string): void {
+    this.delegateAdmission.grant(announcerPeerId, strandId, delegatePeerId);
+  }
+
+  /** Is `remotePeerId` covered by a live delegate admission grant? */
+  hasDelegateAdmission(remotePeerId: string): boolean {
+    return this.delegateAdmission.has(remotePeerId);
+  }
+
+  /**
+   * The admission checks SHARED by the connection gate
+   * ({@link admitInboundControlConnection}) and the per-stream control-DB gate
+   * ({@link authorizeInboundControlStream}) — factored so the two layers cannot
+   * drift. All in-memory and cheap (the stream gate runs this per inbound
+   * stream). Returns true when the peer must be admitted BEFORE any membership
+   * source is consulted:
+   *  - the node is not fully up (`start()` in progress / DB torn down) — both
+   *    gates exist from libp2p bring-up, before the control DB does;
+   *  - the trusted-owner anchor is absent or empty — an un-enrolled node has
+   *    no basis to judge anyone and MUST accept its enrollment seed;
+   *  - the peer is one of the configured control bootstrap/relay nodes —
+   *    operator-configured infrastructure, not cadre members.
+   * False only means "no unconditional admit": the caller then judges the peer
+   * against its own membership source (a live DB read for the fail-open
+   * connection gate; the materialized snapshot for the fail-closed stream gate).
+   */
+  private admitControlPeerUnconditionally(remotePeerId: string): boolean {
+    if (!this._running || !this.controlDatabase) {
+      return true;
+    }
+    if (!this.trustedOwnerStore || this.trustedOwnerStore.all().size === 0) {
+      return true;
+    }
+    return this.getBootstrapPeerIds().has(remotePeerId);
+  }
+
+  /**
+   * Per-stream authorization for the four Optimystic control-DB protocols
+   * (`/optimystic/control-<party>/{repo,cluster,sync,block-transfer}/…`),
+   * wired as `authorizeInboundStream` in {@link createControlNode} — the
+   * fail-closed layer behind the fail-open connection gater. Control node
+   * ONLY: strand cohort nodes legitimately serve cross-party peers.
+   *
+   * The STRICT SUBSET of {@link admitInboundControlConnection}: the same
+   * "no basis to judge" admissions (shared via
+   * {@link admitControlPeerUnconditionally}), minus the stranger carve-outs
+   * (enrollment window, outstanding open invitation, delegate admission
+   * grant). The first two exist so a stranger can reach `/sereus/seed/1.0.0`
+   * and `/sereus/formation/1.0.0` — neither is gated here, and admitting a
+   * stranger to `repo` during an enrollment window is exactly the hole this
+   * gate closes. A DELEGATE-admitted connection (a member's strand node
+   * holding a circuit-relay reservation, see `delegate-admission.ts`) is
+   * likewise exactly a case this gate must still refuse: the delegate gets
+   * the connection and never the control DB.
+   *
+   * Admits when ANY of:
+   *  1. a shared-baseline check admits (not running / no DB, empty anchor,
+   *     configured bootstrap infra);
+   *  2. the materialized authorized set is empty — cold start, before the
+   *     rows that would authorize anyone have replicated in;
+   *  3. the peer IS in the materialized authorized set.
+   *
+   * Deliberately SYNCHRONOUS and pure in-memory — see
+   * {@link authorizedControlPeers} for why a control-DB read here would
+   * deadlock into mutual denial. With a sync predicate the upstream deadline
+   * (`authorizeInboundStreamTimeoutMs`) never trips, so it stays at its
+   * default.
+   *
+   * NOTE: the snapshot keys on PEER ID, so a node with no persistent identity
+   * key never lands a `CadrePeer` row ({@link registerSelf} skips) and its
+   * siblings deny its control-DB streams once their own snapshot is non-empty —
+   * owner status is a KEY, not a peer id, so being the owner does not exempt it.
+   * Harmless today (a real deployment persists its identity; the ephemeral-owner
+   * case appears only in tests, which configure the owner as bootstrap infra —
+   * `push-wake-e2e.integration.ts` design note 3). If an ephemeral-identity node
+   * ever becomes a supported deployment, this gate needs a key-based admission.
+   */
+  private authorizeInboundControlStream(remotePeerId: string, protocol: string): boolean {
+    if (this.admitControlPeerUnconditionally(remotePeerId)) {
+      return true;
+    }
+    if (this.authorizedControlPeers.size === 0) {
+      return true;
+    }
+    if (this.authorizedControlPeers.has(remotePeerId)) {
+      return true;
+    }
+    // Upstream logs its own denial line; this one carries the WHY.
+    log('authorizeInboundControlStream: DENYING %s on %s — not in the materialized authorized set (%d member(s))',
+      remotePeerId, protocol, this.authorizedControlPeers.size);
+    return false;
+  }
+
+  /**
+   * Refresh {@link authorizedControlPeers} from the control DB, best-effort: a
+   * failed read keeps the previous snapshot (never clears it), so a transient
+   * DB error can neither flip the stream gate's cold-start carve-out back open
+   * nor drop a legitimate member mid-flight. Never rejects.
+   *
+   * The SOLE caller is {@link drainMembershipGate}, which serializes refreshes —
+   * so two reads can no longer settle out of order.
+   */
+  private async refreshAuthorizedControlPeers(reason: string): Promise<void> {
+    if (!this._running || !this.controlDatabase) {
+      return;
+    }
+    try {
+      const members = await this.listAuthorizedMembers();
+      this.authorizedControlPeers = new Set(members.map((m) => m.peerId));
+      log('refreshAuthorizedControlPeers(%s): %d authorized peer(s)', reason, this.authorizedControlPeers.size);
+    } catch (error) {
+      log('refreshAuthorizedControlPeers(%s) failed — keeping previous snapshot: %o', reason, error);
+    }
+  }
+
+  /**
+   * PeerIds of the configured control bootstrap nodes (relay/bootstrap
+   * infrastructure — always admitted inbound). Parsed once, lazily; an
+   * address without a `/p2p/<id>` component contributes nothing.
+   */
+  private getBootstrapPeerIds(): Set<string> {
+    if (!this.bootstrapPeerIds) {
+      const ids = new Set<string>();
+      for (const addr of this.config.controlNetwork.bootstrapNodes) {
+        try {
+          // Last `/p2p/<id>` component: on a plain bootstrap addr the node's own
+          // id; on a circuit addr the dial target (which is what gets admitted).
+          let id: string | undefined;
+          for (const component of multiaddr(addr).getComponents()) {
+            if (component.name === 'p2p' && component.value) {
+              id = component.value;
+            }
+          }
+          if (id) {
+            ids.add(id);
+          }
+        } catch (error) {
+          log('getBootstrapPeerIds: skipping unparsable bootstrap addr %s: %o', addr, error);
+        }
+      }
+      this.bootstrapPeerIds = ids;
+    }
+    return this.bootstrapPeerIds;
   }
 
   private createStrandQueryable(): StrandQueryable {
@@ -702,7 +1357,11 @@ export class CadreNode implements SAppIdLookup {
    *   PeerId (the resolved node identity from `keyStore`/`config.privateKey`).
    * - If the row already exists: a self-signed UPDATE bumping `UpdatedAt`.
    * - If not, and the node is its own owner: an owner-signed INSERT that
-   *   also carries the self-signature.
+   *   also carries the self-signature. That INSERT is idempotent, so if an owner
+   *   {@link authorizePeer} of this node's own id seated the row inside the
+   *   read-then-insert window it no-ops — the publish then falls through to the
+   *   UPDATE path (re-reading and re-signing against the row that landed) rather
+   *   than leaving the authorize's null `Sig` in place, and reports `refreshed`.
    * - Otherwise: logs and returns (a non-owner node with no row yet must
    *   wait for an owner to insert it; it can then self-refresh).
    *
@@ -746,29 +1405,67 @@ export class CadreNode implements SAppIdLookup {
     const addrs = await this.collectSelfAddrs();
     const existing = await this.controlDatabase.queryPeerRecord(peerId);
 
-    // Strictly increase UpdatedAt even on a same-millisecond re-publish.
+    if (!existing) {
+      if (!this.seedBootstrapService) {
+        log('registerSelf: not yet a CadrePeer member and no owner service to self-insert; skipping (an owner must add this peer first)');
+        return 'skipped';
+      }
+      // First-time row: requires an owner signature (the node is its own
+      // owner). insertSelfPeerRecord throws if no owner key is present.
+      const record = this.signSelfRecord(peerId, signingKey, addrs, null);
+      if (await this.seedBootstrapService.insertSelfPeerRecord(record)) {
+        if (this.committedAlone()) this.pendingSelfPeerWrite = true;
+        log('registerSelf: inserted own CadrePeer record (owner-signed, updatedAt=%d, %d addrs, sig=%s…)', record.updatedAt, addrs.length, record.sig.slice(0, 16));
+        return 'inserted';
+      }
+      // An owner authorize of this node's OWN peer id seated the row (null `Sig`)
+      // inside the read-then-insert window, so the idempotent insert no-op'd. Fall
+      // through to the self-update path, which re-signs against the row that landed.
+      //
+      // NOTE: this path reports 'refreshed' — honest about the write, which really was
+      // an UPDATE, though the caller's intent was a first publish. No caller branches on
+      // 'inserted' today (the CLI only logs it); if one ever needs "this was the row's
+      // first publish", add a fourth SelfRegistrationOutcome rather than re-labelling.
+      log('registerSelf: own CadrePeer row appeared mid-publish (concurrent authorize); self-updating to carry the signature');
+    }
+
+    // Null only on the fall-through above, where the pre-race read missed the row a
+    // concurrent authorize then seated — so re-read to get that row's `UpdatedAt`, which
+    // the strictly-greater self-update rule is measured against.
+    //
+    // NOTE: when `existing` is set it predates this publish, so a removePeer(self) racing
+    // in would leave the UPDATE below matching no rows while still reporting 'refreshed'.
+    // Closing that needs updateSelfPeerRecord to report rows-affected — only worth doing
+    // if removing self ever becomes something that happens concurrently in practice.
+    const current = existing ?? await this.controlDatabase.queryPeerRecord(peerId);
+    if (!current) {
+      log('registerSelf: own CadrePeer row vanished mid-publish; skipping (next refresh re-inserts)');
+      return 'skipped';
+    }
+    const record = this.signSelfRecord(peerId, signingKey, addrs, current);
+    await this.controlDatabase.updateSelfPeerRecord(record);
+    if (this.committedAlone()) this.pendingSelfPeerWrite = true;
+    log('registerSelf: refreshed own CadrePeer record (updatedAt=%d, %d addrs, sig=%s…)', record.updatedAt, addrs.length, record.sig.slice(0, 16));
+    return 'refreshed';
+  }
+
+  /**
+   * Sign this node's address record for publication, stamped strictly later than
+   * `existing` (the row it is about to replace, or null for a first insert) so a
+   * same-millisecond re-publish still satisfies the monotonic `UpdatedAt` rule the
+   * `CadrePeer.AuthorizedUpdate` self-branch enforces.
+   */
+  private signSelfRecord(
+    peerId: string,
+    signingKey: { privateKeyB64: string; publicKeyB64: string },
+    addrs: string[],
+    existing: PeerAddressRecord | null
+  ): PeerAddressRecord {
     const updatedAt = Math.max(Date.now(), (existing?.updatedAt ?? 0) + 1);
-    const record = signPeerRecord(
+    return signPeerRecord(
       { peerId, publicKey: signingKey.publicKeyB64, addrs, updatedAt },
       signingKey.privateKeyB64
     );
-
-    if (existing) {
-      await this.controlDatabase.updateSelfPeerRecord(record);
-      if (this.committedAlone()) this.pendingSelfPeerWrite = true;
-      log('registerSelf: refreshed own CadrePeer record (updatedAt=%d, %d addrs)', updatedAt, addrs.length);
-      return 'refreshed';
-    }
-    if (this.seedBootstrapService) {
-      // First-time row: requires an owner signature (the node is its own
-      // owner). insertSelfPeerRecord throws if no owner key is present.
-      await this.seedBootstrapService.insertSelfPeerRecord(record);
-      if (this.committedAlone()) this.pendingSelfPeerWrite = true;
-      log('registerSelf: inserted own CadrePeer record (owner-signed, updatedAt=%d, %d addrs)', updatedAt, addrs.length);
-      return 'inserted';
-    }
-    log('registerSelf: not yet a CadrePeer member and no owner service to self-insert; skipping (an owner must add this peer first)');
-    return 'skipped';
   }
 
   /**
@@ -914,13 +1611,17 @@ export class CadreNode implements SAppIdLookup {
     this.turnConnectionCloseHandler = null;
 
     // Reset the write-while-alone re-replication state so a stop()→start() cycle
-    // re-arms the growth edge and re-runs the first-growth reconstruction. Any
-    // queued local-only writes are moot once the node is torn down; owner
-    // inserts are re-covered by reconstruction on the next start, and the
-    // (already-loudly-logged) delete gap is tracked for follow-up.
+    // re-arms the growth edge and re-runs BOTH one-shot passes. Any queued
+    // local-only writes are moot once the node is torn down: owner inserts are
+    // re-covered by the next start's reconstruction, and delete tombstones by its
+    // first-growth revocation sweep — which is why the sweep flag must reset too,
+    // or the second lifetime would skip the sweep and strand exactly the
+    // committed-alone tombstones it exists to carry.
     this.hasControlConnection = false;
     this.reconstructedLocalOnlyWrites = false;
+    this.reissuedHeldRevocations = false;
     this.pendingPeerWrites.clear();
+    this.pendingRevocations.clear();
     this.pendingSelfPeerWrite = false;
     this.pendingSelfDeviceWrite = false;
   }
@@ -962,7 +1663,12 @@ export class CadreNode implements SAppIdLookup {
 
     // Self-signature over (peerId, addrs, updatedAt).
     if (!verifyPeerRecordSignature(record)) {
-      log('resolvePeerAddrs: signature verification failed for %s', peerId);
+      // Field detail distinguishes "holding the owner-vouch revision (Sig null,
+      // no addrs — a not-yet-self-published row)" from a genuinely corrupt or
+      // mixed-revision row. Sig/addrs are public replicated data.
+      log('resolvePeerAddrs: signature verification failed for %s (updatedAt=%d, addrs=%o, sig=%s)',
+        peerId, record.updatedAt, record.addrs,
+        record.sig ? `${record.sig.slice(0, 16)}…` : '(empty)');
       return [];
     }
 
@@ -1056,16 +1762,81 @@ export class CadreNode implements SAppIdLookup {
     if (!this._running || !this.controlNode || !this.controlDatabase) {
       return;
     }
+    // Ride this pass's cadence to refresh the per-stream gate's materialized
+    // authorized set — membership changes that ARRIVED BY REPLICATION (rather
+    // than a local write) are picked up here, bounding the snapshot's staleness
+    // to the reconcile interval.
+    // NOTE: this refresh and the sibling enumeration below each run their own
+    // CadrePeer query (two reads per pass); if those reads ever get costly,
+    // share one row-set across both.
+    await this.refreshMembershipGate('reconcile');
+    if (!this._running || !this.controlNode || !this.controlDatabase) {
+      return;
+    }
+    // Refresh relay delegate grants BEFORE the sibling enumeration below: a
+    // solo cadre with a party relay has no siblings to dial but must still keep
+    // its running strands' grants alive (a dropped relay connection re-dials
+    // the reservation and faces the connection gate again).
+    await this.refreshDelegateGrants();
+    if (!this._running || !this.controlNode || !this.controlDatabase) {
+      return;
+    }
     const selfPeerId = this.controlNode.peerId.toString();
 
+    // Reap guarded rows this node still holds for incarnations an already-committed
+    // Revocation tombstone retires — the half of a removal replication cannot carry
+    // (a delete of an already-absent row replays as nothing). Connected-only: a reap
+    // is a write, and a write committed alone is local-only and forks this node's own
+    // history, which is the condition this work exists to stop creating
+    // (tickets/blocked/forked-control-collection-sync-livelocks.md). Nothing is urgent
+    // here — the stale row already reads as absent everywhere — so waiting for
+    // connectivity costs nothing and keeps the reap fork-CLOSING rather than
+    // fork-creating.
+    //
+    // BEFORE step 1, not after: the pass early-returns when it finds no siblings, and a
+    // cadre whose only sibling row is the tombstoned one lands in exactly that branch
+    // (listMembers() filters retired stamps, so the row needing the reap is invisible to
+    // the sibling count). Placed after step 1 it would never run for the smallest and
+    // most likely case.
+    //
+    // Shares no mutable state with drainPendingRevocations, which re-issues tombstones
+    // while this consumes them: different tables (Revocation update vs guarded-row
+    // delete) and both take the write lock per statement. The two can overlap freely —
+    // do not add a mutex.
+    //
+    // NOTE: the gate is sampled ONCE for the whole sweep, so a disconnect landing
+    // mid-sweep lets the remaining rows commit alone — the fork this gate exists to
+    // avoid. Bounded by how long a sweep runs, which is bounded by the backlog of
+    // unreaped rows (0 in steady state). If that backlog can ever be large, move the
+    // check inside reapRevokedRows' loop via an injected predicate.
+    if (this.getControlConnectionCount() > 0) {
+      try {
+        const reaped = await this.controlDatabase.reapRevokedRows(selfPeerId);
+        if (reaped > 0) {
+          log('reconcileControlCohort: reaped %d revoked control row(s)', reaped);
+        }
+      } catch (error) {
+        // Best-effort like every other step in this pass: reconnecting siblings
+        // outranks garbage collection, so a reap failure never aborts the reconcile.
+        log('reconcileControlCohort: reap pass failed (continuing): %o', error);
+      }
+      if (!this._running || !this.controlNode || !this.controlDatabase) {
+        return;
+      }
+    }
+
     // 1. Enumerate known siblings. This membership read is itself a pull-on-read
     //    that helps the CadrePeer table converge — a reader-only node converges
     //    purely by these reads.
     const members = await this.listMembers();
     const siblings = members.filter((m) => m.peerId !== selfPeerId);
     if (siblings.length === 0) {
-      // Genuinely alone (cold start with no rows, or a solo cadre): nothing to
-      // dial. Must not throw or busy-loop.
+      // No rows to dial from. Either a solo cadre (nothing to do) or a COLD
+      // START whose seed dial never landed — and those look identical from here,
+      // because filling this table needs a connection and getting a connection
+      // needs this table. Fall back to the seed's bootstrap addresses; a solo
+      // cadre has none and this is a no-op. Must not throw or busy-loop.
+      await this.dialColdStartBootstrap();
       return;
     }
     // Re-guard after the await: a stop() may have raced the membership read.
@@ -1074,6 +1845,11 @@ export class CadreNode implements SAppIdLookup {
     }
 
     // 2. Classify backbone (owner) members and select a bounded dial set.
+    // NOTE: deliberately the REPLICATED table, not the node-local anchor — this
+    // only *prefers* owner peers as dial targets, so pollution costs a wasted
+    // dial while anchoring would drop legitimate co-owners this node never
+    // pinned. Same call as `SeedPeer.isOwner` in seed-bootstrap.ts. Move it to
+    // the anchor if owner status here ever gates something trusted.
     const ownerKeys = await this.controlDatabase.getOwnerKeys();
     if (!this._running || !this.controlNode) {
       return;
@@ -1173,6 +1949,154 @@ export class CadreNode implements SAppIdLookup {
     }
   }
 
+  /**
+   * Retain a just-applied seed's owner-flagged peers as cold-start bootstrap
+   * dial targets (see {@link bootstrapPeerStore}).
+   *
+   * Called for every seed this node accepts, on BOTH intake paths — the
+   * {@link applySeed} wrapper (which may run on a throwaway service, so the
+   * service itself is the wrong place to keep this) and the inbound
+   * `/sereus/seed/1.0.0` handler via `onSeedApplied`. Peers with no address are
+   * skipped: there is nothing to dial.
+   *
+   * `isOwner` is the seed's own claim about its peers, exactly as
+   * `SeedBootstrapService.applySeed` uses it to choose its dial targets. That is
+   * sound here for the same reason it is sound there — the whole seed is
+   * signature-checked against a trust-anchored signer before this runs, and the
+   * flag only *selects a dial target*; a dial grants no authority.
+   *
+   * Self is excluded. `createSeed` projects EVERY `CadrePeer` row, so an owner
+   * that applies a seed minted after it joined finds itself in the owner list;
+   * retaining that would make the cold-start pass dial this node forever (the
+   * steady-state pass filters self out of its sibling list for the same reason).
+   */
+  private recordSeedBootstrapPeers(seed: ControlNetworkSeed): void {
+    const store = this.bootstrapPeerStore;
+    if (!store) {
+      // Unreachable in production: start() builds the store before any network
+      // bring-up, and both intake paths need a started node (an uninitialized
+      // SeedBootstrapService rejects the seed, so noteAppliedSeed returns early).
+      log('recordSeedBootstrapPeers: no bootstrap-peer store yet; retaining nothing');
+      return;
+    }
+    const selfPeerId = this.controlNode?.peerId.toString();
+    for (const peer of seed.peers) {
+      if (!peer.isOwner || peer.multiaddrs.length === 0 || peer.peerId === selfPeerId) {
+        continue;
+      }
+      // Sync-visible by contract; the promise tracks durability only. A persist
+      // failure costs restart survival, never this session's retry set — the same
+      // trade `SeedBootstrapService.anchorAcceptedSigner` makes — so log and carry
+      // on rather than failing the seed that was already accepted.
+      void store.record(peer.peerId, peer.multiaddrs).catch((error: unknown) => {
+        log('recordSeedBootstrapPeers: persisting bootstrap peer %s failed (retained in memory): %o',
+          peer.peerId, error);
+      });
+    }
+  }
+
+  /**
+   * Cold-start branch of the reconcile pass: re-dial the seed's owner peers
+   * while the control database still has no siblings to dial.
+   *
+   * `SeedBootstrapService.applySeed` dials those owners exactly ONCE, best-effort.
+   * When that single dial fails — owner momentarily down, relay reservation not
+   * up yet, NAT traversal lost the race — the joining node has an empty
+   * `CadrePeer` table and no connection, and the steady-state pass above cannot
+   * help: it dials only siblings enumerated from that very table. Retrying here
+   * is the only way back in.
+   *
+   * Unbounded, at the reconcile cadence, with no backoff: the branch is already
+   * gated by "the control database has no siblings", so it stops the moment the
+   * node is actually in the party, and a node that is stranded MUST keep trying —
+   * a give-up rule would turn a transient outage into a permanent one. The steady
+   * cost is one dial per bootstrap peer per pass (seeds nominate one or a few
+   * owners), each failing fast against an unreachable address.
+   * NOTE: if seeds ever carry many owner peers, or the reconcile cadence tightens
+   * well below its 15 s default, add per-peer backoff here.
+   *
+   * Best-effort per peer, exactly like {@link dialControlSibling}: one dead
+   * address never aborts the pass.
+   */
+  private async dialColdStartBootstrap(): Promise<void> {
+    const controlNode = this.controlNode;
+    // Snapshot up front: the store hands back a copy, so a seed applied mid-pass
+    // cannot mutate what we are iterating.
+    const targets = this.bootstrapPeerStore?.all();
+    if (!controlNode || !targets || targets.size === 0) {
+      return;
+    }
+    // Same skip rule as step 3 of the steady-state pass: no churn on live links.
+    const connected = new Set(controlNode.getConnections().map((c) => c.remotePeer.toString()));
+    let dialed = 0;
+    for (const [peerId, entry] of targets) {
+      if (!this._running || !this.controlNode) {
+        return;
+      }
+      if (connected.has(peerId)) {
+        continue;
+      }
+      if (await this.dialBootstrapPeer(peerId, entry.addrs)) {
+        dialed++;
+      }
+    }
+    log('reconcileControlCohort: cold-start pass complete (bootstrap=%d, connected=%d, dialed=%d)',
+      targets.size, connected.size, dialed);
+  }
+
+  /**
+   * Bind a bootstrap peer's seed addresses to its peer id, so the dial
+   * authenticates the peer it is aiming at rather than trusting whoever answers.
+   *
+   * An address that already carries `/p2p/<id>` must carry THIS peer's id or it
+   * is dropped (a seed that disagrees with itself is not a dial target); one
+   * that carries none — an `addressOverrides`-published record, say — gets the
+   * id encapsulated. Unencapsulatable addresses are dropped rather than dialed
+   * bare.
+   */
+  private bootstrapDialAddrs(peerId: string, addrs: string[]): Multiaddr[] {
+    const out: Multiaddr[] = [];
+    for (const addr of this.parseMultiaddrs(addrs)) {
+      const embedded = trailingPeerId(addr);
+      if (embedded === peerId) {
+        out.push(addr);
+        continue;
+      }
+      if (embedded !== null) {
+        log('reconcileControlCohort(cold-start): addr %s names peer %s, not %s; dropping',
+          addr.toString(), embedded, peerId);
+        continue;
+      }
+      try {
+        out.push(addr.encapsulate(`/p2p/${peerId}`));
+      } catch (error) {
+        log('reconcileControlCohort(cold-start): cannot bind %s to %s: %o', addr.toString(), peerId, error);
+      }
+    }
+    return out;
+  }
+
+  /** Dial one cold-start bootstrap peer, best-effort. Returns whether it connected. */
+  private async dialBootstrapPeer(peerId: string, addrs: string[]): Promise<boolean> {
+    const controlNode = this.controlNode;
+    if (!controlNode) {
+      return false;
+    }
+    const parsed = this.bootstrapDialAddrs(peerId, addrs);
+    if (parsed.length === 0) {
+      log('reconcileControlCohort(cold-start): no dialable address for bootstrap peer %s; skipping', peerId);
+      return false;
+    }
+    try {
+      log('reconcileControlCohort(cold-start): dialing bootstrap peer %s (%d addr(s))', peerId, parsed.length);
+      await controlNode.dial(parsed);
+      return true;
+    } catch (error) {
+      log('reconcileControlCohort(cold-start): dial of bootstrap peer %s failed (continuing): %o', peerId, error);
+      return false;
+    }
+  }
+
   // ============================================================================
   // Write-while-alone re-replication (control-write-ensure-replicated)
   //
@@ -1198,9 +2122,12 @@ export class CadreNode implements SAppIdLookup {
    * is caught by the cohort's periodic pull-on-read instead. Re-issuing an already-
    * replicated row is harmless (an idempotent monotonic bump), so the coarse proxy
    * is acceptable as the agreed first cut.
+   *
+   * Reads {@link getControlConnectionCount} — the public, embedder-facing form of
+   * the same sample — so the two cannot drift.
    */
   private committedAlone(): boolean {
-    return (this.controlNode?.getConnections().length ?? 0) === 0;
+    return this.getControlConnectionCount() === 0;
   }
 
   /**
@@ -1210,26 +2137,48 @@ export class CadreNode implements SAppIdLookup {
    * cohort grows; otherwise the write replicated and any stale queue entry for this
    * subject is dropped.
    *
-   * A `remove` that commits alone is a security-relevant durability gap (a revoked
-   * peer may persist as a member elsewhere), so it is logged loudly — and, because
-   * a physical delete leaves no local trace to re-issue from, its on-growth
-   * re-issue is best-effort only (see {@link drainPendingPeerWrites}).
+   * A `remove` never queues here — a delete's re-replicable half is its
+   * `Revocation` tombstone, which the committed-delete seam routes into
+   * {@link pendingRevocations} ({@link noteGuardedDelete}). The `remove` arm only
+   * drops any queued authorize for the subject (the row is gone; re-issuing the
+   * insert would resurrect it) and, when the commit was alone, logs the
+   * security-relevant window loudly.
    */
   private noteControlWrite(peerId: string, kind: 'authorize' | 'remove'): void {
+    if (kind === 'remove') {
+      this.pendingPeerWrites.delete(peerId);
+      if (this.committedAlone()) {
+        log('removePeer(%s) committed while ALONE (0 control connections): the deletion is ' +
+          'local-only, so a revoked peer may persist in the cohort until the queued ' +
+          'Revocation tombstone is re-issued on cohort growth (drainPendingRevocations).', peerId);
+      }
+      return;
+    }
     if (!this.committedAlone()) {
       this.pendingPeerWrites.delete(peerId);
       return;
     }
-    this.pendingPeerWrites.set(peerId, kind);
-    if (kind === 'remove') {
-      log('removePeer(%s) committed while ALONE (0 control connections): the deletion is ' +
-        'local-only, so a revoked peer may persist in the cohort until re-replication. The ' +
-        'on-growth re-issue is best-effort (a physical delete cannot be replayed without a ' +
-        'schema tombstone — see control-delete-while-alone-tombstone).', peerId);
-    } else {
-      log('authorizePeer(%s) committed while alone (0 control connections); queued for ' +
-        're-replication on cohort growth', peerId);
+    this.pendingPeerWrites.set(peerId, 'authorize');
+    log('authorizePeer(%s) committed while alone (0 control connections); queued for ' +
+      're-replication on cohort growth', peerId);
+  }
+
+  /**
+   * Committed-delete seam handler ({@link GuardedDeleteListener}, wired in
+   * {@link start}): a guarded-table delete and its `Revocation` tombstone
+   * committed. If the node was alone the tombstone is local-only — queue it for
+   * an owner-signed re-issue on cohort growth; otherwise it broadcast, so drop
+   * any stale queue entry for the stamp. Synchronous by contract — bookkeeping
+   * only, never throws into the delete path.
+   */
+  private noteGuardedDelete(revocation: RevokedRowRef): void {
+    if (!this.committedAlone()) {
+      this.pendingRevocations.delete(revocation.stampId);
+      return;
     }
+    this.pendingRevocations.set(revocation.stampId, revocation);
+    log('%s delete of %s committed while alone (0 control connections); Revocation tombstone ' +
+      '(stamp %s) queued for re-issue on cohort growth', revocation.tableName, revocation.rowKey, revocation.stampId);
   }
 
   /**
@@ -1261,10 +2210,23 @@ export class CadreNode implements SAppIdLookup {
       return;
     }
     const firstGrowth = !this.reconstructedLocalOnlyWrites;
-    log('Draining control re-replication (reason=%s, firstGrowth=%s, pendingPeers=%d, self=%s, deviceToken=%s)',
-      reason, firstGrowth, this.pendingPeerWrites.size, this.pendingSelfPeerWrite, this.pendingSelfDeviceWrite);
-
-    // 1. Self rows. On the first growth always re-touch (covers a self row carried
+    log('Draining control re-replication (reason=%s, firstGrowth=%s, pendingPeers=%d, pendingRevocations=%d, self=%s, deviceToken=%s)',
+      reason, firstGrowth, this.pendingPeerWrites.size, this.pendingRevocations.size,
+      this.pendingSelfPeerWrite, this.pendingSelfDeviceWrite);
+
+    // 1. Revocation tombstones FIRST: a removal that never reached the cohort
+    //    leaves a revoked peer live elsewhere, which outranks every re-touch
+    //    below. Ordering is not cosmetic — every `CadrePeer` write here (self row
+    //    included) can burn tens of seconds in upstream retry livelock after a
+    //    collection fork, while the tombstone lives in a different collection
+    //    that is merely behind, not forked. No membership-gate refresh around
+    //    this step: a re-issue only bumps `ReissuedAt` — LOCAL membership
+    //    visibility changed at delete time (deleteCadrePeer already notified),
+    //    and receiving-node staleness is the pre-existing pull-on-read /
+    //    periodic-refresh property.
+    await this.drainPendingRevocations();
+
+    // 2. Self rows. On the first growth always re-touch (covers a self row carried
     //    over from a prior process that committed local-only before this start);
     //    afterwards only when a self-write-while-alone was recorded this session.
     //    registerSelf is idempotent + single-flight, so this never races a
@@ -1278,16 +2240,16 @@ export class CadreNode implements SAppIdLookup {
       this.pendingSelfDeviceWrite = false;
     }
 
-    // 2. First growth: an owner reconstructs membership rows it may have
+    // 3. First growth: an owner reconstructs membership rows it may have
     //    authored that never replicated (covers writes from before this process
     //    started). Rows already tracked in the in-memory queue are handled by
-    //    step 3 — skipped here to avoid a double re-touch.
+    //    step 4 — skipped here to avoid a double re-touch.
     if (firstGrowth) {
       this.reconstructedLocalOnlyWrites = true;
       await this.reconstructAuthoredMembership();
     }
 
-    // 3. In-session pending owner membership writes (authorize / remove).
+    // 4. In-session pending owner authorize writes.
     await this.drainPendingPeerWrites();
   }
 
@@ -1314,6 +2276,69 @@ export class CadreNode implements SAppIdLookup {
     }
   }
 
+  /**
+   * Re-issue `Revocation` tombstones so a removal that committed while alone
+   * still reaches the cohort. Two regimes, one method:
+   *
+   * - **First successful pass per process** ({@link reissuedHeldRevocations}
+   *   false): sweep EVERY locally-held tombstone from `queryRevocations()` — the
+   *   only cover for a removal made before this process started, since the
+   *   in-memory queue does not survive a restart. Queued stamps are part of that
+   *   same batch (exactly once — one transaction, no double bump).
+   * - **Later passes**: only the tombstones queued in-session by
+   *   {@link noteGuardedDelete}.
+   *
+   * Owner-gated: a node with no owner key cannot sign a re-issue, so stray queue
+   * entries are dropped (mirrors {@link drainPendingPeerWrites}). Best-effort — a
+   * failure is logged and leaves the queue (and the sweep flag) untouched for the
+   * next growth edge. A successful `reissueRevocations` exec is NOT proof of
+   * broadcast (the connection that fired the growth edge may not be in the
+   * affected block's cluster — see
+   * tickets/backlog/control-rereplication-broadcast-confirmation); the drain
+   * inherits that known gap, and a full disconnect→reconnect (or the next
+   * process's sweep) re-covers it.
+   *
+   * NOTE: the sweep is O(all tombstones ever) row-updates — plus one owner
+   * signature each — in one transaction, once per lifetime. `Revocation` is
+   * append-only and unbounded growth is declared acceptable for a cadre-sized
+   * party. If the tombstone table ever gets large, bound the sweep (e.g. persist
+   * a node-local high-water mark of what has been re-issued while connected)
+   * instead of re-touching everything; note the `Math.max(...)` spread below also
+   * caps out around 10^5 rows (V8 argument limit) before the size becomes merely
+   * a latency problem.
+   */
+  private async drainPendingRevocations(): Promise<void> {
+    const sweep = !this.reissuedHeldRevocations;
+    if (!sweep && this.pendingRevocations.size === 0) {
+      return;
+    }
+    if (!this._running || !this.controlNode || !this.controlDatabase) {
+      return;
+    }
+    if (!this.seedBootstrapService?.canAuthorize()) {
+      // A non-owner node cannot sign a re-issue; drop any stray entries.
+      this.pendingRevocations.clear();
+      return;
+    }
+    try {
+      const held = await this.controlDatabase.queryRevocations();
+      const rows = sweep ? held : held.filter((r) => this.pendingRevocations.has(r.stampId));
+      if (rows.length > 0) {
+        const reissuedAt = Math.max(Date.now(), Math.max(...rows.map((r) => r.reissuedAt)) + 1);
+        await this.seedBootstrapService.reissueRevocations(rows, reissuedAt);
+        log('drain: re-issued %d revocation tombstone(s)%s', rows.length, sweep ? ' (first-growth sweep)' : '');
+      }
+      this.reissuedHeldRevocations = true;
+      // Per-stamp clear (not clear()) so an entry queued concurrently mid-drain
+      // survives for the next growth edge.
+      for (const row of rows) {
+        this.pendingRevocations.delete(row.stampId);
+      }
+    } catch (error) {
+      log('drain: revocation re-issue failed; leaving queued for next growth: %o', error);
+    }
+  }
+
   /**
    * One-shot, first-cohort-growth reconstruction of the write-while-alone queue for
    * an OWNER node: re-touch every membership row that may be an unreplicated
@@ -1326,9 +2351,10 @@ export class CadreNode implements SAppIdLookup {
    * row is a no-op-equivalent).
    *
    * A node with no owner private key skips this entirely — it cannot re-sign
-   * rows for other peers, and rows it merely holds are not its to re-issue. DELETEs
-   * cannot be reconstructed here (a removed row leaves no local trace and the schema
-   * carries no tombstone) — see the delete-path note in {@link drainPendingPeerWrites}.
+   * rows for other peers, and rows it merely holds are not its to re-issue.
+   * DELETEs are not reconstructed here — the `Revocation` tombstone sweep in
+   * {@link drainPendingRevocations} covers them (a removed row leaves no
+   * `CadrePeer` trace, but its tombstone is re-issuable).
    */
   private async reconstructAuthoredMembership(): Promise<void> {
     if (!this.controlDatabase || !this.controlNode) {
@@ -1339,10 +2365,29 @@ export class CadreNode implements SAppIdLookup {
     }
     const selfPeerId = this.controlNode.peerId.toString();
     const members = await this.controlDatabase.queryCadrePeers();
+    // One gate refresh for the whole sweep: every re-touch is a notifying
+    // `CadrePeer` write, and these rows are already in the local snapshot (they
+    // committed here, just local-only), so per-row refreshes would be O(rows)
+    // membership reads for a snapshot that does not change.
+    const touched = await this.deferMembershipGateRefresh(
+      'drain-reconstruct',
+      () => this.reissueAuthoredMembershipRows(selfPeerId, members)
+    );
+    if (touched > 0) {
+      log('drain: reconstructed %d owner-authored membership row(s) on first cohort growth', touched);
+    }
+  }
+
+  /**
+   * Body of {@link reconstructAuthoredMembership}'s sweep: re-issue each candidate
+   * owner-authored row, returning how many were re-touched. A per-row failure is
+   * logged and skipped; a teardown mid-sweep stops it.
+   */
+  private async reissueAuthoredMembershipRows(selfPeerId: string, members: CadrePeerRow[]): Promise<number> {
     let touched = 0;
     for (const member of members) {
       if (!this._running || !this.controlNode || !this.controlDatabase) {
-        return;
+        return touched;
       }
       if (member.peerId === selfPeerId || this.pendingPeerWrites.has(member.peerId)) {
         continue;
@@ -1359,27 +2404,19 @@ export class CadreNode implements SAppIdLookup {
         log('drain: reconstruction re-touch of %s failed (continuing): %o', member.peerId, error);
       }
     }
-    if (touched > 0) {
-      log('drain: reconstructed %d owner-authored membership row(s) on first cohort growth', touched);
-    }
+    return touched;
   }
 
   /**
    * Drain the in-session write-while-alone queue: re-issue each pending owner
-   * membership write now that the cohort can broadcast it. Sequential (no fan-out)
-   * to avoid a thundering re-touch; an entry is cleared only on success, so a
-   * failure (or a still-alone re-commit) leaves it queued for the next growth.
-   *
-   * - `authorize`: re-issue as an idempotent monotonic owner UPDATE
-   *   ({@link reissuePeerAuthorize}). Skipped (and cleared) if the row vanished
-   *   (raced a delete) or now carries a self-`Sig` (the peer self-published and owns
-   *   its republish).
-   * - `remove` (security-relevant): a removePeer-while-alone physically removed the
-   *   row locally, so a re-issued DELETE matches nothing and does NOT propagate —
-   *   full delete durability requires a schema tombstone (deferred:
-   *   `control-delete-while-alone-tombstone`). We still attempt the re-issue
-   *   (harmless, and it propagates in the row-still-present case); the commit-alone
-   *   was already logged loudly in {@link noteControlWrite}.
+   * authorize as an idempotent monotonic owner UPDATE
+   * ({@link reissuePeerAuthorize}) now that the cohort can broadcast it.
+   * Sequential (no fan-out) to avoid a thundering re-touch; an entry is cleared
+   * only on success, so a failure (or a still-alone re-commit) leaves it queued
+   * for the next growth. An entry is skipped (and cleared) if the row vanished
+   * (raced a delete) or now carries a self-`Sig` (the peer self-published and owns
+   * its republish). Removals are drained by {@link drainPendingRevocations}, not
+   * here.
    */
   private async drainPendingPeerWrites(): Promise<void> {
     if (this.pendingPeerWrites.size === 0) {
@@ -1390,27 +2427,33 @@ export class CadreNode implements SAppIdLookup {
       this.pendingPeerWrites.clear();
       return;
     }
-    for (const [peerId, kind] of [...this.pendingPeerWrites]) {
-      if (!this._running || !this.controlNode || !this.controlDatabase) {
+    // One gate refresh for the whole drain, not one per entry: these re-issues
+    // replay writes this node already applied locally (and already refreshed
+    // for), so the snapshot only has to be correct once the drain settles.
+    await this.deferMembershipGateRefresh('drain-reissue', () => this.reissuePendingPeerWrites());
+  }
+
+  /**
+   * Body of {@link drainPendingPeerWrites}' loop. An entry is cleared only on
+   * success (or when there is nothing left to re-issue); a failure is logged and
+   * the entry stays queued for the next cohort growth.
+   */
+  private async reissuePendingPeerWrites(): Promise<void> {
+    for (const peerId of [...this.pendingPeerWrites.keys()]) {
+      if (!this._running || !this.controlNode || !this.controlDatabase || !this.seedBootstrapService) {
         return;
       }
       try {
-        if (kind === 'authorize') {
-          const record = await this.controlDatabase.queryPeerRecord(peerId);
-          if (!record || record.sig) {
-            // Removed since, or peer self-published — nothing for the owner to re-issue.
-            this.pendingPeerWrites.delete(peerId);
-            continue;
-          }
-          await this.reissuePeerAuthorize(peerId, record.updatedAt);
-        } else {
-          // Best-effort delete re-issue (see method doc): propagates only if the row
-          // is somehow still present locally.
-          await this.seedBootstrapService.removePeer(peerId);
+        const record = await this.controlDatabase.queryPeerRecord(peerId);
+        if (!record || record.sig) {
+          // Removed since, or peer self-published — nothing for the owner to re-issue.
+          this.pendingPeerWrites.delete(peerId);
+          continue;
         }
+        await this.reissuePeerAuthorize(peerId, record.updatedAt);
         this.pendingPeerWrites.delete(peerId);
       } catch (error) {
-        log('drain: re-issue of %s (%s) failed; leaving queued for next growth: %o', peerId, kind, error);
+        log('drain: re-issue of %s (authorize) failed; leaving queued for next growth: %o', peerId, error);
       }
     }
   }
@@ -1582,6 +2625,13 @@ export class CadreNode implements SAppIdLookup {
       return;
     }
     if (this.seedBootstrapService) {
+      // NOTE: the `CadrePeer` twin of this read-then-insert needed race recovery because an
+      // owner `authorizePeer` can seat a peer's row for it. Nothing seats a `DeviceToken`
+      // row on a peer's behalf, and this insert has no in-lock existence check, so a lost
+      // race would THROW rather than silently drop the record. If an owner-driven
+      // device-token seeding path is ever added, or two first-publishes can run
+      // concurrently (this method has no single-flight guard, unlike `registerSelf`),
+      // revisit — see `publishSelfRecord`'s fall-through.
       await this.seedBootstrapService.insertSelfDeviceToken(record);
       if (this.committedAlone()) this.pendingSelfDeviceWrite = true;
       log('registerDeviceToken: inserted own DeviceToken (owner-signed, platform=%s, updatedAt=%d)', platform, updatedAt);
@@ -1604,8 +2654,10 @@ export class CadreNode implements SAppIdLookup {
    *   2. `publicKey <-> peerId` binding — the stored key's libp2p identity is the
    *      requested peerId,
    *   3. a `DeviceToken` row exists with a known {@link PushPlatform},
-   *   4. self-signature verifies against the bound `CadrePeer.PublicKey`,
-   *   5. freshness — `updatedAt` is positive and within `opts.maxAgeMs` (default:
+   *   4. the row's `StampId` is NOT retired in `CadreControl.Revocation` — the
+   *      read-side half of the clear (see below),
+   *   5. self-signature verifies against the bound `CadrePeer.PublicKey`,
+   *   6. freshness — `updatedAt` is positive and within `opts.maxAgeMs` (default:
    *      no ceiling, since a push token is valid until it rotates).
    *
    * A peer that is not a current member, or whose token has no backing `CadrePeer`
@@ -1639,6 +2691,23 @@ export class CadreNode implements SAppIdLookup {
       return null;
     }
 
+    // Retired stamp: the read-side mitigation for the write-time race, mirroring what
+    // listAuthorizedMembers does for CadrePeer. Clearing a token retires its StampId
+    // into Revocation, but the schema's NotRevoked CHECK only sees LOCALLY visible
+    // tombstones — a node that converged on a replayed insert before the tombstone can
+    // hold both rows, so the reader must drop the resurrected one.
+    //
+    // NOTE: the freshness ceiling below defaults to INFINITE by design (a suspended
+    // phone must stay push-reachable long after it published), so unlike a peer address
+    // record a stale token never ages out. Stamp retirement is the ONLY thing that
+    // retires a cleared token — do not weaken this check on the assumption that
+    // staleness will eventually cover it.
+    const revokedStamps = await this.controlDatabase.queryRevokedStamps('DeviceToken');
+    if (revokedStamps.has(record.stampId)) {
+      log('resolveDeviceToken: StampId for %s is retired (cleared token, resurrected row)', peerId);
+      return null;
+    }
+
     // Self-signature over (peerId, platform, token, updatedAt), verified against the
     // CadrePeer.PublicKey bound to this peerId.
     if (!verifyDeviceTokenSignature(record, peerRecord.publicKey)) {
@@ -1741,6 +2810,13 @@ export class CadreNode implements SAppIdLookup {
         strandId: strand.Id,
         error: error instanceof Error ? error : new Error(String(error))
       });
+      // Rethrow after the event: the only caller is the StrandWatcher's
+      // onStrandAdded callback, which uses the rejection to decide whether the
+      // strand was really added. Swallowing it here would have the watcher mark
+      // the strand as known-and-added, so no later poll would ever retry it.
+      // The watcher catches and logs, so this never escapes as an unhandled
+      // rejection.
+      throw error;
     }
   }
 
@@ -1748,14 +2824,9 @@ export class CadreNode implements SAppIdLookup {
     log('Handling strand removed: %s', strandId);
 
     try {
-      // Untrack from hibernation
-      this.hibernationManager.untrackStrand(strandId);
-
-      // Remove sApp config
-      this.sAppConfigs.delete(strandId);
-
-      await this.strandManager.stopStrand(strandId);
-      this.emit('strand:stopped', { strandId });
+      // Same local teardown the explicit stop performs — deliberately NOT stopStrand
+      // itself, whose `_running` guard would throw on a poll that lands during shutdown.
+      await this.detachStrand(strandId);
     } catch (error) {
       log('Error stopping strand %s: %o', strandId, error);
       this.emit('strand:error', {
@@ -1825,8 +2896,19 @@ export class CadreNode implements SAppIdLookup {
     // Clear sApp configs
     this.sAppConfigs.clear();
 
-    // Close control database (this also shuts down the collection factory)
+    // Drop delegate-admission state: the grants are scoped to the session that
+    // recorded them, so a stop()/start() cycle on this object must not keep
+    // admitting delegates announced under the previous one, nor carry stale
+    // announce timestamps that would suppress the next session's refresh.
+    this.delegateAdmission.clear();
+    this.delegateAnnounceAt.clear();
+
+    // Close control database (this also shuts down the collection factory).
+    // Detach the membership hub first: nothing this teardown does should drive a
+    // gate refresh, and a notification arriving after this point is a no-op.
     if (this.controlDatabase) {
+      this.controlDatabase.setMembershipChangeListener(null);
+      this.controlDatabase.setGuardedDeleteListener(null);
       await this.controlDatabase.close();
       this.controlDatabase = null;
     }
@@ -1919,7 +3001,13 @@ export class CadreNode implements SAppIdLookup {
    * (returns the live instance unchanged) as a backstop against double-resume.
    */
   private async resumeStrandRuntime(strandId: string): Promise<void> {
-    const seed = await this.resolveCohortSeed(strandId);
+    // Re-derive the transport peerId (deterministic and cheap — a quiesced
+    // instance has no `libp2pNode` to read it from) so the seed pass announces
+    // the delegate before `resumeStrand` runs `libp2p.start()`.
+    const delegatePeerId = this.identityKey
+      ? peerIdFromPrivateKey(await strandTransportKey(this.identityKey, strandId)).toString()
+      : undefined;
+    const seed = await this.resolveCohortSeed(strandId, delegatePeerId);
     const mode = selectStrandMode(undefined, seed.hasOtherPeers);
     await this.strandManager.resumeStrand(strandId, {
       bootstrapNodes: seed.bootstrapNodes,
@@ -2059,6 +3147,14 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Add a strand with its sApp configuration.
    * The hosting application must provide the sApp schema when creating a strand.
+   *
+   * A rejected call leaves nothing running but DOES leave the sApp config
+   * registered, deliberately: both an explicit retry and the {@link StrandWatcher}'s
+   * automatic relaunch need it. So once the strand's row is visible on the control
+   * network (via {@link publishStrand} or another member), a failed launch keeps
+   * being re-attempted in the background — each failure re-emitting `strand:error`
+   * — until it succeeds. {@link detachStrand} (reached via {@link stopStrand}) is
+   * what abandons a strand for good.
    */
   async addStrand(config: StrandConfig): Promise<StrandInstance> {
     if (!this._running) {
@@ -2094,7 +3190,7 @@ export class CadreNode implements SAppIdLookup {
    * {@link ed25519KeyPairFromLibp2p} also exposes as the node's owner keypair,
    * so peer identity and owner key are one and the same. That key must be
    * enrolled in `OwnerKey` (e.g. via {@link ControlDatabase.ensureOwnerKey}
-   * at genesis) or the schema's `Strand.Authorized` constraint rejects the write.
+   * at genesis) or the schema's `Strand.AuthorizedInsert` constraint rejects the write.
    * Failing loudly here is intentional: a silently-unpublished strand would run
    * as a local-only island that no peer could ever discover or join.
    *
@@ -2102,34 +3198,111 @@ export class CadreNode implements SAppIdLookup {
    *   {@link addStrand}).
    * @param type - `'o'` for open (default) or `'c'` for closed.
    * @param memberPrivateKey - Optional membership key for a closed strand.
-   * @throws if the node is not started, exposes no owner signing key, or the
-   *   control DB rejects the (unauthorized) insert.
+   * @throws if the node is not started, exposes no owner signing key, the id is blank, or
+   *   the control DB rejects the (unauthorized) insert.
    */
   async publishStrand(strandId: string, type: 'o' | 'c' = 'o', memberPrivateKey?: string): Promise<void> {
-    if (!this._running || !this.controlDatabase) {
-      throw new Error('CadreNode must be started before publishing a strand');
-    }
-    const signingKey = this.getSelfSigningKey();
-    if (!signingKey) {
-      throw new Error(
-        `Cannot publish strand ${strandId}: no owner signing key available ` +
-        '(node identity is unavailable or does not match the node PeerId). Run owner ' +
-        'genesis (ensureOwnerKey + initializeSeedBootstrap) before publishing.'
-      );
+    const signingKey = this.requireOwnerSigningKey(`publish strand ${strandId}`);
+    // Trim/reject here so the id that lands matches the one unpublishStrand looks up: it
+    // trims too, and an untrimmed row would be unreachable by the same string.
+    const trimmed = requireNonBlank(strandId, 'strand id');
+    await this.controlDatabase!.insertStrand(
+      trimmed,
+      type,
+      signingKey.publicKeyB64,
+      signMessageWith(signingKey.privateKeyB64),
+      memberPrivateKey
+    );
+    log('Published strand %s (type %s) to control DB under owner %s', trimmed, type, signingKey.publicKeyB64);
+  }
+
+  /**
+   * Remove this party's `Strand` row from the shared control database — the owner-signed
+   * inverse of {@link publishStrand}.
+   *
+   * Party-wide, unlike {@link stopStrand}, which only stops the strand on THIS node: every
+   * cadre node watching the table sees the row vanish on its next poll (default 5 s) and
+   * stops its own instance. This node converges immediately — the method forces a watcher
+   * poll and stops any still-running local instance before resolving. Removing the row
+   * removes OUR party's participation only: other parties in the strand keep their own
+   * rows and the strand network carries on, so no cross-party sign-off is involved — this
+   * is an owner-signed control-plane write like every other, not "destroy the network".
+   *
+   * Irreversible for a closed strand (`Type='c'`): the row carries `MemberPrivateKey`,
+   * this party's membership secret for that network, and it is stored nowhere else.
+   * With it gone the party can never again admit a member to that closed strand, and a
+   * re-published row would carry a DIFFERENT key that does not match the membership
+   * already written into the strand's RBAC layer. The strand id itself is NOT
+   * blacklisted: a fresh owner-signed {@link publishStrand} re-seats it under a new
+   * stamp — only the unsigned consent re-seat is permanently foreclosed (the removal's
+   * `Revocation` tombstone names the id, which the consent branch of
+   * `Strand.AuthorizedInsert` refuses ever after). Outstanding `FormationInvite` rows
+   * bound to the removed strand are unredeemable while the row is absent (the formation
+   * recorder resolves the strand as missing and rejects cleanly).
+   *
+   * Convergence caveats, same class as {@link enrollValidationKey}'s: a sibling that has
+   * not yet synced keeps running the strand until its own watcher observes the missing
+   * row; a sibling whose `strandFilter` never admitted this strand never observes the
+   * removal AT ALL and keeps running its instance indefinitely — opting out of watching a
+   * strand is also opting out of its party-wide removal, so such a node's only stop is its
+   * own local {@link stopStrand}/`unpublishStrand` call; and a removal committed while
+   * ALONE (0 control connections) deletes the row local-only. The accompanying
+   * `Revocation` tombstone IS queued and re-issued on the next cohort-growth edge
+   * ({@link noteGuardedDelete}/{@link drainPendingRevocations}), so the stamp retirement
+   * — and with it the consent re-seat foreclosure — does propagate; but the physical row
+   * deletion cannot be replayed, and `queryStrands` reads raw (no retired-stamp filter),
+   * so siblings that already hold the row keep running the strand until the collection
+   * itself converges (logged loudly; see the delete-while-alone durability note in
+   * docs/architecture.md).
+   *
+   * A no-op (no throw, no tombstone) when the row is already absent — but a
+   * locally-running instance of that id is still stopped.
+   *
+   * NOTE: control-plane only — the strand's local durable storage is retained. Stopping the
+   * instance closes the `StrandDatabase` and its libp2p node but purges no blocks, so a
+   * closed strand's content stays readable on disk to anyone with the data directory. If a
+   * caller ever needs removal to mean "and erase the local copy", that is a separate purge
+   * step, not a widening of this method.
+   *
+   * @param strandId - The `Strand` row id to remove (as passed to {@link publishStrand}).
+   * @throws if the node is not started, exposes no owner signing key, the id is blank, or
+   *   the signer is not an enrolled owner (the schema's `Strand.AuthorizedDelete` rejects
+   *   the write and the row survives). A rejection does NOT imply the row survived: the
+   *   local stop runs after the control-plane delete has already committed, so a failure
+   *   there throws over a completed removal.
+   */
+  async unpublishStrand(strandId: string): Promise<void> {
+    const signingKey = this.requireOwnerSigningKey(`unpublish strand ${strandId}`);
+    const trimmed = requireNonBlank(strandId, 'strand id');
+    const removed = await this.controlDatabase!.deleteStrand(
+      trimmed,
+      signingKey.publicKeyB64,
+      signMessageWith(signingKey.privateKeyB64)
+    );
+    // Gate on `removed`: the absent-row no-op wrote nothing, so warning about an
+    // unreplicated deletion there would send an operator chasing a phantom.
+    if (removed && this.committedAlone()) {
+      log('unpublishStrand(%s) committed while ALONE (0 control connections): the deletion is ' +
+        'local-only. Its Revocation tombstone is queued for re-issue on cohort growth, but the ' +
+        'row deletion itself cannot be replayed, so other nodes may keep running the strand ' +
+        'until the collection converges.', trimmed);
+    }
+    // Converge locally now rather than waiting up to a poll interval. The watcher fires
+    // onStrandRemoved for a strand it tracked; the explicit stop below covers a node whose
+    // strandFilter never admitted this strand (the watcher never knew it, so it will never
+    // fire). StrandInstanceManager.stopStrand no-ops on an unknown id, so the two paths
+    // cannot double-stop into an error.
+    await this.strandWatcher?.forcePoll();
+    if (this.strandManager.getInstance(trimmed)) {
+      await this.stopStrand(trimmed);
     }
-    // insertStrand hands this callback the canonical row-bound message BYTES (see
-    // buildAuthorizationMessage); ed25519-sign them directly (no pre-hash) with
-    // the owner private key, returning a base64url signature.
-    const signMessage = (message: Uint8Array): string =>
-      sign(message, signingKey.privateKeyB64, 'ed25519', 'bytes', 'base64url', 'base64url') as string;
-    await this.controlDatabase.insertStrand(strandId, type, signingKey.publicKeyB64, signMessage, memberPrivateKey);
-    log('Published strand %s (type %s) to control DB under owner %s', strandId, type, signingKey.publicKeyB64);
+    log('Unpublished strand %s from control DB under owner %s', trimmed, signingKey.publicKeyB64);
   }
 
   /**
    * Publish an owner-signed `FormationInvite` (open-invitation token) to the
    * shared control database, so a later {@link formStrand} redemption can be
-   * validated against it (the consent branch of `Strand.Authorized`).
+   * validated against it (the consent branch of `Strand.AuthorizedInsert`).
    *
    * Counterpart to {@link createOpenInvitation}, which only mints the
    * out-of-band {@link OpenInvitation} envelope: persisting the matching
@@ -2153,21 +3326,124 @@ export class CadreNode implements SAppIdLookup {
     sAppId: string,
     options: { expiresAtMs?: number; totalUses?: number; validationUrl?: string; strandId?: string } = {}
   ): Promise<void> {
+    const signingKey = this.requireOwnerSigningKey(`publish formation invite ${token}`);
+    await this.controlDatabase!.insertFormationInvite(
+      token,
+      sAppId,
+      signingKey.publicKeyB64,
+      signMessageWith(signingKey.privateKeyB64),
+      options
+    );
+    // A host may publish an invite whose token was minted elsewhere; registering
+    // it locally opens the connection gate's formation exemption immediately
+    // rather than waiting for the durable row to become readable.
+    this.strandSolicitationService?.registerMintedInvitation(
+      token,
+      options.expiresAtMs ?? Number.POSITIVE_INFINITY
+    );
+    log('Published formation invite %s (sApp %s) under owner %s', token, sAppId, signingKey.publicKeyB64);
+  }
+
+  /**
+   * Enroll an approver public key allowed to sign off on `ValidationUrl` redemptions.
+   *
+   * A `FormationInvite` carrying a `ValidationUrl` is only redeemable when the approval
+   * that comes back from that URL is signed by a key present in `CadreControl.ValidationKey`
+   * — this is how a party says which outside approver it trusts. Without an enrollment,
+   * every such invitation is unredeemable.
+   *
+   * Signs with the same self-owner key as {@link publishStrand} (the ed25519 key behind
+   * this node's PeerId, which must be an enrolled `OwnerKey`). Throws loudly if the node
+   * isn't started, exposes no signing key, or the key is blank — a blank key would reach
+   * the database and fail the signature CHECK as an opaque constraint error.
+   *
+   * Enrolling this node's OWN owner key is permitted and harmless: the domain/action tags
+   * baked into each authorization digest mean an owner-key signature can never satisfy the
+   * approval rule and an approval can never satisfy an owner rule. No guard is needed.
+   *
+   * NOTE: enrollment is replicated control state, so a key enrolled here is visible to a
+   * sibling cadre node only once control replication converges. A redemption that arrives
+   * at a node which has not caught up is refused as not-enrolled — the same convergence
+   * gap the schema records on `Strand.StampId`. Enroll before circulating the invitations
+   * that depend on the key.
+   *
+   * @param key - Approver public key to enroll (base64url ed25519 public key).
+   */
+  async enrollValidationKey(key: string): Promise<void> {
+    const signingKey = this.requireOwnerSigningKey('enroll a validation key');
+    const trimmed = requireEd25519PublicKeyB64(key, 'validation key');
+    await this.controlDatabase!.insertValidationKey(
+      trimmed,
+      signingKey.publicKeyB64,
+      signMessageWith(signingKey.privateKeyB64)
+    );
+    log('Enrolled validation key %s under owner %s', trimmed, signingKey.publicKeyB64);
+  }
+
+  /**
+   * Remove an approver public key.
+   *
+   * Narrows who may approve FUTURE redemptions ONLY. The schema's approval CHECKs run at
+   * write time, so a join that was already approved by this key stays valid — removal is
+   * not retroactive and does not re-examine committed rows.
+   *
+   * Rotation is therefore add-then-remove, in that order: removing the only enrolled key
+   * while `ValidationUrl` invitations are outstanding makes every one of them unredeemable
+   * until a new key is enrolled.
+   *
+   * Removing a key that is not enrolled is a silent no-op (no throw, no `Revocation`
+   * tombstone) — see {@link ControlDatabase.deleteValidationKey}.
+   *
+   * @param key - Approver public key to remove (base64url ed25519 public key).
+   */
+  async removeValidationKey(key: string): Promise<void> {
+    const signingKey = this.requireOwnerSigningKey('remove a validation key');
+    const trimmed = requireNonBlank(key, 'validation key');
+    await this.controlDatabase!.deleteValidationKey(
+      trimmed,
+      signingKey.publicKeyB64,
+      signMessageWith(signingKey.privateKeyB64)
+    );
+    log('Removed validation key %s under owner %s', trimmed, signingKey.publicKeyB64);
+  }
+
+  /**
+   * The approver keys currently enrolled, sorted. Read-only, so unlike
+   * {@link enrollValidationKey} / {@link removeValidationKey} it needs no owner signing
+   * key — only a started node.
+   */
+  async listValidationKeys(): Promise<string[]> {
     if (!this._running || !this.controlDatabase) {
-      throw new Error('CadreNode must be started before publishing a formation invite');
+      throw new Error('CadreNode must be started before listing validation keys');
+    }
+    return await this.controlDatabase.queryValidationKeys();
+  }
+
+  /**
+   * Resolve the owner keypair every owner-signed control write needs — {@link publishStrand},
+   * {@link unpublishStrand}, {@link publishFormationInvite}, {@link enrollValidationKey},
+   * {@link removeValidationKey}
+   * — failing loudly in one two-part shape (not started / no signing key, naming owner
+   * genesis as the fix). Narrows `controlDatabase` for the caller: a non-null return means
+   * `this.controlDatabase` is non-null too.
+   *
+   * @param action - Infinitive phrase naming the attempted write, e.g. `'enroll a
+   *   validation key'`; interpolated into both messages.
+   */
+  private requireOwnerSigningKey(action: string): { privateKeyB64: string; publicKeyB64: string } {
+    if (!this._running || !this.controlDatabase) {
+      throw new Error(`CadreNode must be started before attempting to ${action}`);
     }
     const signingKey = this.getSelfSigningKey();
     if (!signingKey) {
       throw new Error(
-        `Cannot publish formation invite ${token}: no owner signing key available ` +
+        `Cannot ${action}: no owner signing key available ` +
         '(node identity is unavailable or does not match the node PeerId). Run owner ' +
-        'genesis (ensureOwnerKey + initializeSeedBootstrap) before publishing.'
+        'genesis (ensureOwnerKey + initializeSeedBootstrap) before writing owner-signed ' +
+        'control state.'
       );
     }
-    const signMessage = (message: Uint8Array): string =>
-      sign(message, signingKey.privateKeyB64, 'ed25519', 'bytes', 'base64url', 'base64url') as string;
-    await this.controlDatabase.insertFormationInvite(token, sAppId, signingKey.publicKeyB64, signMessage, options);
-    log('Published formation invite %s (sApp %s) under owner %s', token, sAppId, signingKey.publicKeyB64);
+    return signingKey;
   }
 
   /**
@@ -2175,6 +3451,15 @@ export class CadreNode implements SAppIdLookup {
    * control-discovered (`handleStrandAdded`) entry points. Resolves the cohort
    * seed, selects the mode, starts the strand, and registers it with the
    * hibernation manager before emitting `strand:started`.
+   *
+   * Idempotent no-op when the strand manager already tracks `strand.Id` — the
+   * ordinary founding sequence is `addStrand` (starts it locally) followed by
+   * `publishStrand` (makes it visible), so this node's own `StrandWatcher`
+   * rediscovers a row it already started and calls this again via
+   * `handleStrandAdded`. Without the guard that re-entry would resolve a fresh
+   * (already-connected) cohort seed and re-emit `strand:started` for an
+   * instance that never stopped. The guard runs before the cohort-seed RPC
+   * fan-out, so a rediscovery costs nothing beyond the map lookup.
    */
   private async launchStrand(
     strand: StrandRow,
@@ -2182,7 +3467,37 @@ export class CadreNode implements SAppIdLookup {
     explicitMode?: StrandMode,
     founder?: boolean
   ): Promise<StrandInstance> {
-    const seed = await this.resolveCohortSeed(strand.Id);
+    const existing = this.strandManager.getInstance(strand.Id);
+    if (existing) {
+      log('launchStrand: strand %s already tracked locally — skipping re-launch', strand.Id);
+      return existing;
+    }
+
+    // Each strand node gets its own transport identity, derived from the cadre
+    // identity key + strandId (see strand-transport-key.ts). Sharing the
+    // control node's key here gave every node one peerId, which collides at a
+    // shared circuit relay (github.com/gotchoices/sereus/issues/1). The
+    // retained launch config carries this derived key, so hibernate → wake
+    // (resumeStrand) reuses the same peerId.
+    //
+    // NOTE: derivation requires an Ed25519 identity key, so a node configured
+    // with some other key type now fails strand launch outright (surfaced as
+    // `strand:error` / a rejected addStrand) where it previously started the
+    // strand on that key. Ed25519 is already required for every control-DB
+    // signing path, so nothing reachable today hits this; if a non-Ed25519
+    // identity is ever supported, fall back to `undefined` here — libp2p then
+    // generates a random per-strand key, which still avoids the collision but
+    // gives up peerId stability across restarts.
+    const transportKey = this.identityKey
+      ? await strandTransportKey(this.identityKey, strand.Id)
+      : undefined;
+
+    // Derived BEFORE seed resolution so the seed pass doubles as the delegate
+    // announcement and every grant is recorded before `startStrand` runs
+    // `libp2p.start()` (the responder records the grant before replying; the
+    // client awaits the replies).
+    const delegatePeerId = transportKey ? peerIdFromPrivateKey(transportKey).toString() : undefined;
+    const seed = await this.resolveCohortSeed(strand.Id, delegatePeerId);
     const mode = selectStrandMode(explicitMode, seed.hasOtherPeers);
 
     const instance = await this.strandManager.startStrand({
@@ -2192,10 +3507,12 @@ export class CadreNode implements SAppIdLookup {
       network: this.config.network,
       profile: this.config.profile,
       defaultLatencyHint: this.config.hibernation?.defaultLatencyHint ?? 'interactive',
-      privateKey: this.identityKey,
+      privateKey: transportKey,
       bootstrapNodes: seed.bootstrapNodes,
       mode,
       requireSignedSchemas: this.config.requireSignedSchemas,
+      clusterSize: this.config.strandClusterSize,
+      backfill: this.config.strandBackfill,
       founder
     });
 
@@ -2217,8 +3534,19 @@ export class CadreNode implements SAppIdLookup {
    * empty (`[]`) — mode still follows membership, and the empty seed self-heals
    * on the next resume / check-in pass. Returns an empty seed when the control DB
    * or node is absent (not yet started / torn down).
+   *
+   * When `delegatePeerId` is given (a strand launch/resume is imminent), the
+   * pass doubles as the delegate ANNOUNCEMENT: our circuit relays are merged
+   * into the RPC targets and every request carries the delegate peerId, so each
+   * receiver records an admission grant BEFORE `libp2p.start()` (re-)dials the
+   * relay reservation — the gate denial there is fatal, not degraded. A
+   * party-member relay answers the RPC (its control node admits us as a
+   * member); a dedicated ops/ relay does not speak the protocol and the
+   * per-peer failure folds to `[]` — harmless, it has no membership gate and
+   * needs no grant. The relay's direct addr rides along as the dial fallback
+   * for a relay we are not yet connected to.
    */
-  private async resolveCohortSeed(strandId: string): Promise<CohortSeed> {
+  private async resolveCohortSeed(strandId: string, delegatePeerId?: string): Promise<CohortSeed> {
     if (!this.controlDatabase || !this.controlNode) {
       return { bootstrapNodes: [], hasOtherPeers: false };
     }
@@ -2229,13 +3557,118 @@ export class CadreNode implements SAppIdLookup {
     // RPC only siblings we already have a control connection to — they can answer
     // now, and `dialProtocol` by peerId reuses the open connection.
     const connected = new Set(this.controlNode.getConnections().map((c) => c.remotePeer.toString()));
-    const targets = otherPeerIds.filter((id) => connected.has(id));
+    const targets: StrandAddrPeer[] = otherPeerIds
+      .filter((id) => connected.has(id))
+      .map((peerId) => ({ peerId }));
+    const relays = delegatePeerId === undefined ? [] : this.circuitRelayTargets();
+    for (const relay of relays) {
+      if (!targets.some((t) => t.peerId === relay.relayPeerId)) {
+        targets.push(relayStrandAddrPeer(relay));
+      }
+    }
     const bootstrapNodes = targets.length
-      ? await collectStrandAddrs(this.controlNode, targets.map((peerId) => ({ peerId })), strandId)
+      ? await collectStrandAddrs(this.controlNode, targets, strandId, { delegatePeerId })
       : [];
+    // Throttle state for the RELAY targets only — refreshDelegateGrants never
+    // looks up a sibling key, so recording one would only be dead weight.
+    this.recordDelegateAnnounces(relays.map((r) => r.relayPeerId), strandId);
     return { bootstrapNodes, hasOtherPeers };
   }
 
+  /**
+   * The circuit relays this node's strand nodes would reserve through: the
+   * union of the RESOLVED listen addrs' circuits — a hand-written
+   * `network.listenAddrs` circuit entry or a `network.relayAddrs` entry, which
+   * the strand node inherits verbatim either way — and the control node's own
+   * live `/p2p-circuit` multiaddrs (a reservation this node discovered rather
+   * than configured).
+   *
+   * NOTE: a relay the STRAND node discovers on its own (autorelay — in neither
+   * source) gets no announcement, and a membership-gated one will deny it; fine
+   * now, every realistic topology feeds one of the two sources.
+   */
+  private circuitRelayTargets(): CircuitRelayTarget[] {
+    return extractCircuitRelayTargets([
+      ...(resolveListenAddrs(this.config.network) ?? []),
+      ...(this.controlNode?.getMultiaddrs().map(String) ?? [])
+    ]);
+  }
+
+  /**
+   * Record the announce timestamps {@link refreshDelegateGrants} throttles on,
+   * for every relay a delegate-carrying announce pass dialed.
+   *
+   * Recorded OPTIMISTICALLY at announce time: `collectStrandAddrs` folds
+   * per-peer failure to `[]` and reports no per-peer success, and threading
+   * success out would change its API for little gain. A failed INITIAL announce
+   * is fatal-at-start anyway (the relay denies the reservation,
+   * `libp2p.start()` throws, and wake/check-in re-resume retries with a fresh
+   * announce); a failed REFRESH retries within `DELEGATE_GRANT_TTL_MS / 2`
+   * (15 min), still inside the 30 min TTL.
+   */
+  private recordDelegateAnnounces(relayPeerIds: readonly string[], strandId: string, now = Date.now()): void {
+    for (const relayPeerId of relayPeerIds) {
+      this.delegateAnnounceAt.set(peerStrandKey(relayPeerId, strandId), now);
+    }
+  }
+
+  /**
+   * Re-announce every running strand's delegate peerId to this node's circuit
+   * relays, throttled to once per `DELEGATE_GRANT_TTL_MS / 2` per
+   * (relay, strand). A grant must outlive the reservation: a dropped relay
+   * connection makes the strand's circuit-relay transport re-dial and face the
+   * connection gate again, so the relay must still hold a live grant then.
+   * RELAY targets only — siblings get their announce on every launch/resume
+   * seed pass, and a grant only matters where a reservation can be re-dialed.
+   *
+   * Strands announce CONCURRENTLY: this runs ahead of the reconcile pass's
+   * sibling enumeration, and one unreachable relay costs a dial timeout per
+   * target, which must not stack up per strand.
+   */
+  private async refreshDelegateGrants(now = Date.now()): Promise<void> {
+    if (!this.controlNode) {
+      return;
+    }
+    // A running strand's delegate peerId is simply its live node's peerId — no
+    // re-derivation here.
+    const running = new Map<string, string>();
+    for (const [strandId, instance] of this.strandManager.getInstances()) {
+      if (instance.libp2pNode) {
+        running.set(strandId, instance.libp2pNode.peerId.toString());
+      }
+    }
+    pruneStoppedStrandAnnounces(this.delegateAnnounceAt, new Set(running.keys()));
+    if (running.size === 0) {
+      return;
+    }
+    const relays = this.circuitRelayTargets();
+    if (relays.length === 0) {
+      return;
+    }
+    await Promise.all([...running].map(
+      ([strandId, delegatePeerId]) => this.announceDelegateToDueRelays(strandId, delegatePeerId, relays, now)
+    ));
+  }
+
+  /** One strand's share of {@link refreshDelegateGrants}: announce to the relays whose grant is due. */
+  private async announceDelegateToDueRelays(
+    strandId: string,
+    delegatePeerId: string,
+    relays: readonly CircuitRelayTarget[],
+    now: number
+  ): Promise<void> {
+    const controlNode = this.controlNode;
+    if (!controlNode) {
+      return;
+    }
+    const due = dueRelayAnnounces(this.delegateAnnounceAt, relays, strandId, now);
+    if (due.length === 0) {
+      return;
+    }
+    await collectStrandAddrs(controlNode, due.map(relayStrandAddrPeer), strandId, { delegatePeerId });
+    this.recordDelegateAnnounces(due.map((relay) => relay.relayPeerId), strandId, now);
+  }
+
   /**
    * The local strand instance's dialable strand-network multiaddrs for the
    * strand-addr RPC, ordered signaling-first (reusing the control node's
@@ -2254,19 +3687,39 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Remove a strand
+   * Stop a strand on THIS node only: untrack it from hibernation, drop its sApp config,
+   * stop the local instance, and emit `strand:stopped`. The shared `Strand` row is left
+   * intact, so on the next node restart (or watcher poll) the strand is rediscovered and
+   * surfaces as `strand:discovered` again. Party-wide removal is {@link unpublishStrand}.
    */
-  async removeStrand(strandId: string): Promise<void> {
+  async stopStrand(strandId: string): Promise<void> {
     if (!this._running) {
       throw new Error('CadreNode not running');
     }
 
-    // Untrack from hibernation
-    this.hibernationManager.untrackStrand(strandId);
+    await this.detachStrand(strandId);
+  }
 
-    // Remove sApp config
+  /**
+   * Local teardown for one strand, shared by the caller-driven {@link stopStrand} and the
+   * watcher-driven `handleStrandRemoved`: untrack hibernation, drop the sApp config, stop
+   * the instance, emit `strand:stopped`. Touches no control-plane row — which side of the
+   * removal the node is on is the caller's concern, not this method's.
+   *
+   * The stop + emit are skipped when the strand manager holds no instance for `strandId` —
+   * e.g. a party owner that published a strand's row but never ran it locally, or an
+   * explicit {@link stopStrand} for an id this node never started. `hibernationManager`
+   * untrack and the `sAppConfigs` delete stay unconditional (both are no-ops when there is
+   * nothing to remove), so a launch that failed before an instance was ever tracked still
+   * gets its stray sApp config cleared.
+   */
+  private async detachStrand(strandId: string): Promise<void> {
+    this.hibernationManager.untrackStrand(strandId);
     this.sAppConfigs.delete(strandId);
-
+    if (!this.strandManager.hasStrand(strandId)) {
+      log('detachStrand: strand %s not tracked locally — no-op (no stop, no strand:stopped)', strandId);
+      return;
+    }
     await this.strandManager.stopStrand(strandId);
     this.emit('strand:stopped', { strandId });
   }
@@ -2460,6 +3913,76 @@ export class CadreNode implements SAppIdLookup {
     return this.controlNode;
   }
 
+  /**
+   * Start keeping a relay reservation: dial the given relay(s) from the control
+   * node, ask the first one that answers for a reservation slot, wait until the
+   * resulting `/p2p-circuit` address makes this node dialable — and keep a
+   * supervisor running that re-drives whenever the reservation is later lost.
+   *
+   * For nodes that listen on the bare `/p2p-circuit` SEARCH addr (a browser tab)
+   * rather than a configured `network.relayAddrs` circuit listener — see
+   * `relay-reservation.ts` for why the two are alternatives and why configuring
+   * both is a regression. Opt-in: nothing calls this for the CLI/host nodes.
+   *
+   * Resolves once the FIRST attempt has settled, exactly as it did when it drove
+   * once; the retries continue in the background until {@link stop} or the next
+   * `reserveRelays` call. Fail-soft — never throws. An unreachable relay, a
+   * missing control node, or a timeout all resolve to a non-`reserved` status, so
+   * a caller can await this during startup without a dead relay aborting the node.
+   *
+   * Passing an empty list stops the supervisor and resets the posture to `none`
+   * without dialing or waiting.
+   */
+  async reserveRelays(
+    addrs: string[],
+    opts?: RelayReservationSupervisorOptions
+  ): Promise<RelayReservationState> {
+    // Stop first, unconditionally: a second call with a different list must not
+    // leave two loops fighting over one pending reservation slot.
+    this.relayReserveSupervisor?.stop();
+    this.relayReserveSupervisor = null;
+    this.relayReserveAddrs = [...addrs];
+    this.relayReserveError = null;
+    if (addrs.length === 0) {
+      return this.getRelayReservationState();
+    }
+    if (!this.controlNode) {
+      // No node to supervise, so this is the one failure the node records itself.
+      this.relayReserveError = 'control node unavailable';
+      return this.getRelayReservationState();
+    }
+    const supervisor = superviseRelayReservation(this.controlNode, addrs, opts);
+    this.relayReserveSupervisor = supervisor;
+    await supervisor.firstAttempt;
+    // Read through `this`, not `supervisor`: an overlapping call may have replaced
+    // it while the first attempt was in flight, and the newest list is the truth.
+    return this.getRelayReservationState();
+  }
+
+  /**
+   * The node's CURRENT relay-reservation posture, recomputed from the control
+   * node's live multiaddrs on every call.
+   *
+   * Deliberately not memoised: a reservation can be lost after
+   * {@link reserveRelays} succeeds (the relay restarts, the connection drops) and
+   * a cached `reserved` would let a caller mint invitations carrying circuit
+   * addresses that no longer route.
+   *
+   * A lost reservation now recovers on its own — the supervisor {@link reserveRelays}
+   * starts re-drives on a backoff, reporting `retrying` meanwhile. `error` here
+   * means nothing is going to try again: no supervisor, or no control node.
+   */
+  getRelayReservationState(): RelayReservationState {
+    const supervisor = this.relayReserveSupervisor;
+    return resolveRelayReservationState(
+      this.controlNode,
+      this.relayReserveAddrs,
+      supervisor ? supervisor.lastError : this.relayReserveError,
+      supervisor?.driving ?? false,
+      supervisor?.retryAtMs ?? null
+    );
+  }
+
   /**
    * Get the control database (for advanced queries)
    */
@@ -2467,6 +3990,22 @@ export class CadreNode implements SAppIdLookup {
     return this.controlDatabase;
   }
 
+  /**
+   * Open control-network connections right now. A lower-bound proxy for replication
+   * reach: 0 connections ⇒ a control write commits local-only. The private
+   * `committedAlone` write-while-alone seam is defined in terms of this.
+   *
+   * It approximates the precise signal (the block's cluster size), and a caller that
+   * samples it AFTER a write samples a slightly wider window than `committedAlone`
+   * does inside the write itself. It exists so an embedder can warn an owner before a
+   * control write that this machine currently sees none of its siblings, and report
+   * after one that the write may not have travelled — a warning shown unconditionally
+   * is a warning people learn to ignore.
+   */
+  getControlConnectionCount(): number {
+    return this.controlNode?.getConnections().length ?? 0;
+  }
+
   /**
    * Force a poll of the strand watcher (for testing)
    */
@@ -2496,18 +4035,38 @@ export class CadreNode implements SAppIdLookup {
       throw new Error('CadreNode must be started before initializing seed bootstrap');
     }
 
+    // A node wiring seed-bootstrap with an owner PRIVATE key is declaring that
+    // key an authority of its own party (founder genesis / self-signing owner)
+    // — anchor it in the node-local store. The in-memory set updates
+    // synchronously (see TrustedOwnerStore.trust); only the file persist is
+    // fire-and-forget, logged on failure.
+    // NOTE: non-founder members that also wire seed-bootstrap with their own
+    // derived key (e.g. the phone joiner path in runOwnerGenesis, which needs
+    // it to self-publish its CadrePeer row) self-anchor a key that is not a
+    // party authority. Harmless while such a node never mints an invite: the
+    // store does not replicate, so a node trusting itself grants nothing to
+    // others. But `createInvite` now hands out the anchor's contents as the
+    // invitee's pins, so the moment a non-founder member mints an invite it
+    // exports its own non-authority key as a cadre owner key. If that becomes
+    // reachable (today only cadre-cli/cadre-host owners mint invites), gate this
+    // self-anchor on the actual OwnerKey genesis insert instead.
+    if (this.trustedOwnerStore) {
+      void this.trustedOwnerStore
+        .trust(ed25519PublicKeyFromPrivate(ownerPrivateKey), 'genesis')
+        .catch((error) => log('Trusted-owner genesis anchor persist failed: %o', error));
+    }
+
     this.seedBootstrapService = new SeedBootstrapService({
       partyId: this.config.controlNetwork.partyId,
       ownerPrivateKey,
       inviteAddressResolver: () => this.resolveInviteAddresses(),
       trustPolicy: this.config.seedTrustPolicy,
+      // Seed trust anchors on the node-local store (seeded just above with this
+      // node's own genesis key), never on the replicated OwnerKey table.
+      ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
     });
 
-    this.seedBootstrapService.setEventCallbacks({
-      onSeedReceived: (partyId, peerId) => this.emit('seed:received', { partyId, peerId }),
-      onSeedApplied: (partyId, peersAdded) => this.emit('seed:applied', { partyId, peersAdded }),
-      onSeedError: (partyId, error) => this.emit('seed:error', { partyId, error }),
-    });
+    this.seedBootstrapService.setEventCallbacks(this.seedEventCallbacks());
 
     this.seedBootstrapService.initialize(this.controlNode, this.controlDatabase);
     log('Seed bootstrap service initialized');
@@ -2538,7 +4097,10 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Enumerate the cadre's `CadrePeer` membership.
+   * Enumerate the cadre's `CadrePeer` membership — the ADDRESSABLE surface (see
+   * {@link isMember}). Rows whose stamp is retired in `CadreControl.Revocation`
+   * never reach here: {@link ControlDatabase.queryCadrePeers} excludes them, so a
+   * revoked peer is not addressable either.
    */
   async listMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
     if (!this.controlDatabase) {
@@ -2552,7 +4114,12 @@ export class CadreNode implements SAppIdLookup {
    *
    * This is the ADDRESSABLE surface ("do I have a dialable address record for this
    * peer") — it includes this node's own self-published row. Address resolution and
-   * push fan-out use this. The trust-facing gate is {@link isAuthorizedMember}.
+   * push fan-out use this. A peer whose stamp is retired in `CadreControl.Revocation`
+   * is excluded here too (the filter lives in
+   * {@link ControlDatabase.queryCadrePeers}): revocation removes a peer from the
+   * addressable surface, not only the trust-facing one, so a revoked peer is no
+   * longer dialed, RPC'd, or handed out as an address. The trust-facing gate is
+   * {@link isAuthorizedMember}.
    */
   async isMember(peerId: string): Promise<boolean> {
     const members = await this.listMembers();
@@ -2561,27 +4128,86 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Enumerate the party's AUTHORIZED members — the trust-facing set, distinct from
-   * the addressable set ({@link listMembers}). Excludes this node itself: a node
-   * publishes its own `CadrePeer` address row so its dialable address rides in seeds,
-   * but "self" is not a peer this node authorized. The control-network wake and
+   * the addressable set ({@link listMembers}). A peer is authorized iff ALL hold:
+   *
+   *  1. it is not this node itself — a node publishes its own `CadrePeer` address
+   *     row so its dialable address rides in seeds, but "self" is not a peer this
+   *     node authorized;
+   *  2. its `CadrePeer` row carries a complete voucher (`StampId`, `VouchOwner`,
+   *     `VouchSig` all non-null);
+   *  3. `VouchOwner` is in the NODE-LOCAL trusted-owner anchor
+   *     ({@link getTrustedOwnerStore}) — never the replicated `OwnerKey` table,
+   *     which any stranger can genesis-pollute; and
+   *  4. `VouchSig` verifies as that owner's signature over the row's voucher
+   *     digest ({@link verifyCadrePeerVoucher}), so the anchored owner really
+   *     vouched THIS peer id under THIS row's nonce; and
+   *  5. the row's `StampId` is NOT retired in `CadreControl.Revocation` — enforced
+   *     upstream in {@link ControlDatabase.queryCadrePeers}, which drops retired rows
+   *     before ANY reader (this predicate included) sees them, so a row resurrected
+   *     by replaying the captured admission approval on a node that had not yet
+   *     converged on the tombstone (the write-time `NotRevoked` CHECK only sees
+   *     local rows) is still inert to every reader that has the tombstone.
+   *
+   * Fail-closed at every step: a missing anchor (pre-start), an empty anchor (a
+   * not-yet-enrolled node authorizes no one), a null/partial voucher, an
+   * unanchored `VouchOwner`, or a bad signature all yield "not authorized" —
+   * having an address row is NOT membership. The control-network wake and
    * strand-address gates consult this set, NOT the addressable one.
    *
-   * NOTE: this is the addressable set minus self for now. The real trust predicate
-   * (voucher recorded on the row ∈ node-local trusted-owner anchor, signature
-   * verified) lands with the `membership-node-local-owner-anchor` /
-   * `membership-authorized-predicate-and-gates` tickets; keeping the filter in this one
-   * method means that change touches a single place.
+   * NOTE (rotation): if a party owner rotates keys and only the NEW key is pinned
+   * in the anchor, rows the OLD key vouched fail check 3 until re-vouched — a
+   * legit member goes un-authorized on readers that only pin the new key. Full
+   * rotation handling (re-vouch on rotate) is the
+   * `flip-strand-membership-rotation-known-gap` work, not this predicate's.
    */
   async listAuthorizedMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
+    if (!this.controlDatabase) {
+      throw new Error('CadreNode must be started before listing members');
+    }
     const selfPeerId = this.peerId?.toString();
-    const members = await this.listMembers();
-    return members.filter(m => m.peerId !== selfPeerId);
+    const rows = await this.controlDatabase.queryCadrePeers();
+    const authorized = rows
+      .filter(row => row.peerId !== selfPeerId && this.hasAnchoredVoucher(row))
+      .map(({ peerId, multiaddr }) => ({ peerId, multiaddr }));
+    // A node whose anchor was never seeded (no invite pin, no operator pin, not a
+    // founder) refuses every wake and strand-addr request, which from the outside
+    // looks like an unexplained "non-member" rejection. Say so once per call rather
+    // than leaving the operator to infer it from silence.
+    if (authorized.length === 0 && rows.length > 0 && (this.trustedOwnerStore?.all().size ?? 0) === 0) {
+      log('listAuthorizedMembers: %d CadrePeer row(s) but the node-local trusted-owner anchor is EMPTY — authorizing no one (this node has no invite/operator owner-key pin)', rows.length);
+    }
+    return authorized;
+  }
+
+  /**
+   * Checks 2–4 of the authorized-membership predicate (see
+   * {@link listAuthorizedMembers}) for one `CadrePeer` row: complete voucher,
+   * `VouchOwner` in the node-local anchor, signature valid over the row's
+   * (PeerId, StampId) voucher digest.
+   *
+   * NOTE: verifies the ed25519 signature on every call (no memo of already-
+   * verified (peerId, stampId, vouchSig) triples). Cadres are a handful of
+   * devices and the gates run per inbound request, so this is cheap today; if
+   * membership or gate traffic ever grows, cache verified triples keyed on the
+   * row's `StampId` (which rotates with every re-vouch).
+   */
+  private hasAnchoredVoucher(row: CadrePeerVoucherFields): boolean {
+    if (row.stampId === null || row.vouchOwner === null || row.vouchSig === null) {
+      return false;
+    }
+    if (!this.trustedOwnerStore?.has(row.vouchOwner)) {
+      return false;
+    }
+    return verifyCadrePeerVoucher(row.peerId, row.stampId, row.vouchOwner, row.vouchSig);
   }
 
   /**
    * Probe whether a given peer is an AUTHORIZED party member (see
    * {@link listAuthorizedMembers}) — the gate the control-network wake and
-   * strand-address responders consult, NOT {@link isMember} (the addressable surface).
+   * strand-address responders consult, NOT {@link isMember} (the addressable
+   * surface). Deliberately scans the full membership (one `CadrePeer` query)
+   * rather than adding a single-row read path: cadres are small, and one code
+   * path keeps the predicate impossible to drift from the list.
    */
   async isAuthorizedMember(peerId: string): Promise<boolean> {
     const members = await this.listAuthorizedMembers();
@@ -2636,13 +4262,13 @@ export class CadreNode implements SAppIdLookup {
       // No owner key - this node only receives seeds
       inviteAddressResolver: () => this.resolveInviteAddresses(),
       trustPolicy: this.config.seedTrustPolicy,
+      // A listener-only node accepts a wire-delivered seed solely against this
+      // anchor (there is no per-call override on the inbound handler): with no
+      // genesis/invite/operator pin it authorizes nobody, which is the point.
+      ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
     });
 
-    this.seedBootstrapService.setEventCallbacks({
-      onSeedReceived: (partyId, peerId) => this.emit('seed:received', { partyId, peerId }),
-      onSeedApplied: (partyId, peersAdded) => this.emit('seed:applied', { partyId, peersAdded }),
-      onSeedError: (partyId, error) => this.emit('seed:error', { partyId, error }),
-    });
+    this.seedBootstrapService.setEventCallbacks(this.seedEventCallbacks());
 
     this.seedBootstrapService.initialize(this.controlNode, this.controlDatabase);
     log('Seed listener enabled');
@@ -2655,6 +4281,123 @@ export class CadreNode implements SAppIdLookup {
     return this.seedBootstrapService;
   }
 
+  /**
+   * The event callbacks every {@link SeedBootstrapService} this node owns is
+   * wired with — shared by the owner-capable service ({@link initializeSeedBootstrap})
+   * and the listener-only one ({@link enableSeedListener}) so the two cannot drift.
+   *
+   * A seed applied by the INBOUND protocol handler writes no `CadrePeer` row of
+   * its own (it merges the libp2p peer store and dials owners), so the automatic
+   * write-driven refresh never fires for it — yet applying it can ANCHOR a new
+   * owner key, which flips rows already present from unauthorized to authorized.
+   * Hence the explicit refresh here; without it a peer the freshly anchored owner
+   * vouched for stays denied until the next timed cohort reconcile.
+   */
+  private seedEventCallbacks(): SeedEventCallbacks {
+    return {
+      onSeedReceived: (partyId, peerId) => this.emit('seed:received', { partyId, peerId }),
+      onSeedApplied: (partyId, peersAdded, seed) => {
+        this.emit('seed:applied', { partyId, peersAdded });
+        // A wire-delivered seed never passes through the `applySeed` wrapper, so
+        // this is where its owner peers become cold-start bootstrap targets.
+        this.recordSeedBootstrapPeers(seed);
+        void this.refreshMembershipGate('seed-applied');
+      },
+      onSeedError: (partyId, error) => this.emit('seed:error', { partyId, error }),
+    };
+  }
+
+  /**
+   * Re-materialize the authorized-peer snapshot that the fail-closed per-stream
+   * control-DB gate ({@link authorizeInboundControlStream}) judges against.
+   *
+   * NO `CadrePeer` writer needs to call this: the control database notifies it
+   * after every committed member-row write (`ControlDatabase.mutateCadrePeer`,
+   * wired in {@link start}), which is exactly what makes the refresh automatic
+   * rather than a caller obligation. It stays public for the changes that write
+   * NO row locally and so raise no notification:
+   *
+   * - a membership row that arrived by REPLICATION (otherwise picked up on the
+   *   next timed cohort reconcile — bounded staleness by design), and
+   * - a newly anchored trusted owner key ({@link applySeed}), which flips rows
+   *   ALREADY present from unauthorized to authorized without touching them.
+   *
+   * Coalescing: marks the snapshot stale and resolves once a refresh that began
+   * after this call has completed, so a caller that awaits it always observes
+   * its own change. Concurrent callers share one read. Idempotent and
+   * best-effort (a failed read keeps the previous snapshot); never rejects.
+   */
+  async refreshMembershipGate(reason = 'external-write'): Promise<void> {
+    this.membershipGateDirty = true;
+    if (this.membershipGateDeferDepth > 0) {
+      // Flushed once when the enclosing scope exits.
+      return;
+    }
+    while (this.membershipGateDirty) {
+      // Re-checked after the await: the drain may have taken its last look at
+      // the flag before we set it, in which case we need a fresh one.
+      this.membershipGateDrain ??= this.drainMembershipGate(reason);
+      await this.membershipGateDrain;
+    }
+  }
+
+  /**
+   * The single in-flight refresh loop behind {@link refreshMembershipGate}: read
+   * until the stale flag stays clear, then release the slot.
+   *
+   * NOTE: correct only because {@link membershipGateDirty} is guaranteed TRUE at
+   * entry — its sole caller sets it synchronously, with no await in between. Were
+   * this ever invoked with the flag already clear, the body would never suspend,
+   * so the `finally` would null the slot BEFORE the caller's `??=` filled it, and
+   * the slot would be left holding an already-settled drain that every later
+   * refresh reuses — an unbreakable await/re-check spin. If a second caller is
+   * ever added, have it mark the flag first (or assert it here).
+   */
+  private async drainMembershipGate(reason: string): Promise<void> {
+    try {
+      while (this.membershipGateDirty) {
+        // Cleared BEFORE the read (not after) so a write landing mid-read marks
+        // the snapshot stale again and earns another pass, and so a throw still
+        // terminates the loop.
+        this.membershipGateDirty = false;
+        await this.refreshAuthorizedControlPeers(reason);
+      }
+    } catch (error) {
+      // Upholds `refreshMembershipGate`'s never-rejects contract. The read helper
+      // already swallows its own failures, so this is defensive — but a rejection
+      // here would otherwise surface out of every awaiting writer.
+      log('membership gate drain (%s) failed — keeping previous snapshot: %o', reason, error);
+    } finally {
+      this.membershipGateDrain = null;
+    }
+  }
+
+  /**
+   * Collapse a burst of `CadrePeer` writes into ONE gate refresh at scope exit.
+   *
+   * For loops that re-touch many rows (the write-while-alone drains), where a
+   * per-row refresh would mean one full membership read per row for a snapshot
+   * that only has to be correct once the loop settles.
+   *
+   * The depth counter is instance-level, so it also suppresses a genuinely
+   * CONCURRENT external write's refresh for the life of the scope: that writer's
+   * promise resolves before its peer is admitted, and admission lands at scope
+   * exit instead. Acceptable — scope exit is milliseconds away (bounded by the
+   * drain), versus the ~15 s reconcile interval that was the alternative before
+   * any of this existed — but it is the reason these scopes stay short and rare.
+   */
+  private async deferMembershipGateRefresh<T>(reason: string, body: () => Promise<T>): Promise<T> {
+    this.membershipGateDeferDepth++;
+    try {
+      return await body();
+    } finally {
+      this.membershipGateDeferDepth--;
+      if (this.membershipGateDeferDepth === 0 && this.membershipGateDirty) {
+        await this.refreshMembershipGate(reason);
+      }
+    }
+  }
+
   /**
    * Authorize a new peer to join the cadre.
    * Signs the peer ID with the owner key and inserts into CadrePeer table.
@@ -2666,6 +4409,8 @@ export class CadreNode implements SAppIdLookup {
     if (!this.seedBootstrapService) {
       throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
+    // The insert notifies the control DB's membership hub, so the per-stream gate
+    // has already admitted the just-vouched peer by the time this resolves.
     await this.seedBootstrapService.authorizePeer({ peerId, multiaddrs });
     // Queue for re-replication if this committed local-only (no connected cohort).
     this.noteControlWrite(peerId, 'authorize');
@@ -2681,6 +4426,8 @@ export class CadreNode implements SAppIdLookup {
     if (!this.seedBootstrapService) {
       throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
+    // The delete notifies the membership hub, so the removed peer is out of the
+    // per-stream gate by the time this resolves.
     await this.seedBootstrapService.removePeer(peerId);
     // Track + loudly flag a delete that committed local-only (security-relevant).
     this.noteControlWrite(peerId, 'remove');
@@ -2725,13 +4472,43 @@ export class CadreNode implements SAppIdLookup {
       const tempService = new SeedBootstrapService({
         partyId: seed.partyId,
         trustPolicy: this.config.seedTrustPolicy,
+        // The anchor is node-scoped, not service-scoped: a throwaway service
+        // must consult (and persist an accepted signer into) the SAME store the
+        // persistent one would, or a cold-start enrollment via this path would
+        // anchor nothing and re-prompt for the pin on every later seed.
+        ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
       });
       if (this.controlNode && this.controlDatabase) {
         tempService.initialize(this.controlNode, this.controlDatabase, { registerHandler: false });
       }
-      return await tempService.applySeed(seed, options);
+      const tempResult = await tempService.applySeed(seed, options);
+      this.noteAppliedSeed(tempResult, seed);
+      // Not a row write (so nothing notifies): applying a seed can anchor a new
+      // owner key, which flips rows ALREADY present into the authorized set.
+      await this.refreshMembershipGate('applySeed');
+      return tempResult;
+    }
+    const result = await this.seedBootstrapService.applySeed(seed, options);
+    this.noteAppliedSeed(result, seed);
+    await this.refreshMembershipGate('applySeed');
+    return result;
+  }
+
+  /**
+   * Post-process an {@link applySeed} outcome: retain the seed's owner peers as
+   * cold-start bootstrap targets, and surface a seed that was accepted but whose
+   * every owner dial failed — the node is now seeded yet unconnected, and the
+   * cold-start reconcile branch is what gets it out of that state.
+   */
+  private noteAppliedSeed(result: ApplySeedResult, seed: ControlNetworkSeed): void {
+    if (!result.success) {
+      return;
+    }
+    this.recordSeedBootstrapPeers(seed);
+    if (result.ownerDialsAttempted > 0 && result.ownerDialsFailed === result.ownerDialsAttempted) {
+      log('applySeed: seeded but no owner reachable (%d/%d dial(s) failed) — cold-start reconcile will retry',
+        result.ownerDialsFailed, result.ownerDialsAttempted);
     }
-    return await this.seedBootstrapService.applySeed(seed, options);
   }
 
   /**
@@ -2789,6 +4566,8 @@ export class CadreNode implements SAppIdLookup {
     if (!this.seedBootstrapService) {
       throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
+    // The drone's `CadrePeer` insert notifies the membership hub on the way to the
+    // seed, so the per-stream gate already admits it here.
     return await this.seedBootstrapService.addDrone(options);
   }
 
@@ -2800,7 +4579,12 @@ export class CadreNode implements SAppIdLookup {
     if (!this.seedBootstrapService) {
       throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
-    return await this.seedBootstrapService.createInvite(token, expiresIn);
+    const result = await this.seedBootstrapService.createInvite(token, expiresIn);
+    // The invitee dials this node BEFORE it is authorized (dialInvite →
+    // acceptPhone), so hold the inbound connection gate open for strangers for
+    // the invite's validity (or a bounded default when it never expires).
+    this.openEnrollmentWindow(result.invite.expiresAt ?? Date.now() + DEFAULT_ENROLLMENT_WINDOW_MS);
+    return result;
   }
 
   /**
@@ -2811,6 +4595,8 @@ export class CadreNode implements SAppIdLookup {
     if (!this.seedBootstrapService) {
       throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
+    // The just-accepted phone opens control-DB streams next; its `CadrePeer` insert
+    // notifies the membership hub, so it is already admitted when this resolves.
     await this.seedBootstrapService.acceptPhone(options, issuedInvite);
   }
 
@@ -2822,6 +4608,10 @@ export class CadreNode implements SAppIdLookup {
     if (!this.seedBootstrapService) {
       throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
+    // The service authorizes the phone (a `CadrePeer` insert, which notifies the
+    // membership hub) on the way to the seed, so the per-stream gate admits it
+    // before this resolves — not on the next reconcile, by which time the phone's
+    // own control-DB schema load may have died denied.
     return await this.seedBootstrapService.addPhoneWithRelay(phonePeerId);
   }