@serfab/cadre-core 1.14.0 → 1.16.0

package/dist/cadre-node.js

@@ -22,22 +22,23 @@ import { MemoryEnrolledMachineStore } from './enrolled-machine-store.js';
 import { JoinedStrandSession, KeyStoreJoinedStrandStore, MemoryJoinedStrandStore } from './joined-strand-store.js';
 import { mergePeerAddrs, groupAddrsByPeerId } from './peer-addr-book.js';
 import { strandFretPeerAddrs } from './strand-fret-addrs.js';
-import { verifyCadrePeerVoucher, verifyInvitationAdmission } from './peer-authorization.js';
+import { verifyCadrePeerVoucher, verifyInvitationAdmission, verifyRevocationSigner } from './peer-authorization.js';
 import { deriveOwnerAnchor } from './owner-anchor-sync.js';
+import { describeMachines, planMachineRemoval, revouchWithinPlan, MachineRemovalRefusedError } from './machine-removal.js';
 import { ed25519PublicKeyB64FromPeerId } from './ed25519-key.js';
-import { signPeerRecord, verifyPeerRecordSignature, isPeerRecordFresh, orderSignalingFirst, isSignalingAddr, trailingPeerId, withTrailingPeerId, currentMemberTrustPolicy, DEFAULT_PEER_RECORD_MAX_AGE_MS, DEFAULT_PEER_RECORD_HEARTBEAT_MS } from './peer-record.js';
+import { signPeerRecord, verifyPeerRecordSignature, isPeerRecordFresh, orderSignalingFirst, isSignalingAddr, currentMemberTrustPolicy, DEFAULT_PEER_RECORD_MAX_AGE_MS, DEFAULT_PEER_RECORD_HEARTBEAT_MS } from './peer-record.js';
 import { signDeviceTokenRecord, verifyDeviceTokenSignature, isPushPlatform } from './device-token.js';
 import { StrandWatcher } from './strand-watcher.js';
 import { StrandInstanceManager, liveStrandStatus } from './strand-instance-manager.js';
 import { PeerJoinBackfill } from './peer-join-backfill.js';
 import { deriveCohortMembers } from './strand-cohort.js';
 import { selectControlCohortDials, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE } from './control-cohort.js';
-import { dialPeerAddrs, SelfRelayOnlyError, CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS } from './peer-dial.js';
+import { dialPeerAddrs, SelfRelayOnlyError, CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS, trailingPeerId, withTrailingPeerId } from './peer-dial.js';
 import { ADMISSION_DECISION_TIMEOUT_MS, declaredCohortReadDeadlineMs, optimysticDialLimits, peerJoinPushBudget, relayReservationBudgetMs, relayedDialBudgetMs, relayedRequestBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
 import { EnrollmentService } from './enrollment.js';
 import { HibernationManager } from './hibernation-manager.js';
 import { ControlDatabase, generateStampId, isPendingJoinConflict, isStrandIdConflict, pendingJoinId } from './control-database.js';
-import { CadreInviteHandler, encodeCadreInvitation, redeemAtMembers, signRedeemRequest } from './cadre-invite-protocol.js';
+import { CadreInviteHandler, encodeCadreInvitation, redeemInPasses, signRedeemRequest } from './cadre-invite-protocol.js';
 import { FormationPostApprovalError } from './strand-formation-rejection.js';
 import { PendingJoinRunner, membershipInvitesToStage, parseStoredDisclosure, requestedPendingJoin } from './pending-join-runner.js';
 import { SeedBootstrapService, mergeSeedPeers, seedDigest } from './seed-bootstrap.js';
@@ -45,13 +46,14 @@ import { claimSecretTrustPolicy } from './seed-trust-policy.js';
 import { ClaimRefusedError, claimProof, parseClaimSecret } from './claim-proof.js';
 import { StrandSolicitationService } from './strand-solicitation.js';
 import { ControlFormationUsageRecorder } from './control-formation-recorder.js';
-import { selectInvitationSiblingAddrs } from './invitation-bootstrap.js';
+import { cadreInvitationReach, selectCadreInvitationMembers, selectInvitationSiblingAddrs } from './invitation-bootstrap.js';
 import { createMembershipConnectionGater, UnauthorizedReservationBudget } from './membership-connection-gater.js';
 import { controlNetworkName, installControlProtocolGuard } from './control-protocol-guard.js';
 import { StrandWakeService, dialWake } from './strand-wake-protocol.js';
 import { StrandAddrService, collectStrandAddrs } from './strand-addr-protocol.js';
 import { DelegateAdmissionStore, extractCircuitRelayTargets, dueRelayAnnounces, prunePeerStrandKeys, peerStrandKey } from './delegate-admission.js';
 import { relayCircuitAddrs, resolveListenAddrs, resolveTransportOptions, RelayReservationFailedError } from './relay-addrs.js';
+import { nodeTransportsOption } from './node-transports.js';
 import { resolveRelayServer } from './relay-server.js';
 import { replacesAdvertisedAddrs, resolveAnnounceAddrs } from './announce-addrs.js';
 import { superviseRelayReservation, resolveRelayReservationState } from './relay-reservation.js';
@@ -259,8 +261,9 @@ export class CadreNode {
         this.controlBackfill = null;
         /**
          * Devices whose invitation redemption this member has verified and is admitting right now,
-         * each with its count of overlapping redemptions. The control backfill's gate admits them
-         * as it admits a member, for that window only ({@link catchUpRedeemingDevice}).
+         * each with its count of overlapping redemptions. The control backfill's gate and the
+         * control cohort choice (Optimystic's `isNetworkMember`) count them as members, for that
+         * window only ({@link admitRedeemingDevice}); the per-stream gate never does.
          */
         this.admittingDevices = new Map();
         this.strandWatcher = null;
@@ -307,6 +310,8 @@ export class CadreNode {
         this.pushFanoutService = null;
         /** Backing field for the {@link running} / {@link isRunning} getters. */
         this._running = false;
+        /** The {@link stop} in progress, or null; a concurrent `stop()` awaits it. */
+        this.stopInFlight = null;
         /**
          * The control database's own raw storage (cache-wrapped), resolved once per
          * `start()` and released in {@link cleanup}. Owning it is what keeps the
@@ -404,13 +409,15 @@ export class CadreNode {
         this.bootstrapPeerIds = null;
         /**
          * Materialized in-memory snapshot of the AUTHORIZED member peer ids (the
-         * {@link listAuthorizedMembers} result), consulted by the per-stream
-         * control-DB gate ({@link authorizeInboundControlStream}). That predicate
-         * runs on EVERY inbound Optimystic control-DB stream and must never await a
-         * control-DB read: those reads pull blocks over the very protocols the
-         * predicate gates, which closes a circular wait that ends in mutual denial
-         * (the upstream gate is fail-closed on timeout, unlike the fail-open
-         * connection gater). So the set is refreshed OUT OF BAND instead — after
+         * {@link listAuthorizedMembers} result), consulted through
+         * {@link isControlNetworkMember} by the per-stream control-DB gate
+         * ({@link authorizeInboundControlStream}) and by Optimystic's cohort choice
+         * (`isNetworkMember`). The stream gate runs on EVERY inbound Optimystic
+         * control-DB stream and must never await a control-DB read: those reads pull
+         * blocks over the very protocols the predicate gates, which closes a circular
+         * wait that ends in mutual denial (the upstream gate is fail-closed on
+         * timeout, unlike the fail-open connection gater). Optimystic's predicate is
+         * synchronous by contract. So the set is refreshed OUT OF BAND instead — after
          * start, on every {@link reconcileControlCohort} pass (15s cadence), and
          * immediately after every LOCAL membership mutation so a just-vouched peer
          * is admitted without waiting for the timer. That last refresh is AUTOMATIC:
@@ -419,7 +426,11 @@ export class CadreNode {
          * writer has to remember. A change that arrives by REPLICATION is picked up
          * on the next timed refresh — bounded staleness, acceptable because this gate
          * is defense in depth: rows an unadmitted peer manages to write are still
-         * disbelieved at read time by the voucher-anchored predicate.
+         * disbelieved at read time by the voucher-anchored predicate. For cohort
+         * choice the same window means a member whose row arrived by replication is
+         * left out of this node's control-block cohorts until that refresh.
+         * Optimystic reads the predicate live on every lookup, so replacing this set
+         * is the whole re-evaluation; there is no per-peer reclassify call to make.
          */
         this.authorizedControlPeers = new Set();
         /**
@@ -431,6 +442,17 @@ export class CadreNode {
         this.membershipGateDirty = false;
         this.membershipGateDrain = null;
         this.membershipGateDeferDepth = 0;
+        /**
+         * This node's own `CadrePeer` row as a membership refresh last read it live, or null until
+         * one has. Reporting a removal needs it ({@link noteOwnRemoval}). Kept across
+         * stop()→start(), like {@link removal}.
+         */
+        this.ownLiveRow = null;
+        /**
+         * The removal this node learned of ({@link removedFromCadre}), or null. Set once and never
+         * cleared, so `cadre:removed` fires once per node object.
+         */
+        this.removal = null;
         /**
          * In-memory delegate admission grants (see `delegate-admission.ts`): the
          * strand-node transport peerIds this party's members have announced over the
@@ -673,9 +695,11 @@ export class CadreNode {
          * When this node last PUBLISHED its own `CadrePeer` address record (inserted or
          * refreshed), or null if it never has in this session. Stamped by
          * {@link noteSelfRecordPublished} on every successful publish, wherever it was driven
-         * from — the boot pass, the heartbeat, an address change, a drain or an explicit call.
+         * from — the boot pass, the heartbeat, an address change, a drain, a reconcile pass or an
+         * explicit call.
          *
-         * Read by {@link escalateIfSelfRecordStale} for the one consequence worth an operator's
+         * Read by {@link publishFirstSelfRecord}, which stops trying once it is set, and by
+         * {@link escalateIfSelfRecordStale} for the one consequence worth an operator's
          * attention: once this gap exceeds {@link DEFAULT_PEER_RECORD_MAX_AGE_MS}, every other
          * machine in the party is already discarding this node's address as stale.
          */
@@ -1039,7 +1063,7 @@ export class CadreNode {
             this.cadreInviteHandler = new CadreInviteHandler({
                 partyId: this.config.controlNetwork.partyId,
                 store: this.controlDatabase,
-                catchUpDevice: (peerId) => this.catchUpRedeemingDevice(peerId),
+                admitDevice: (peerId) => this.admitRedeemingDevice(peerId),
             });
             await this.cadreInviteHandler.register(this.controlNode);
             // A node waiting to be claimed listens for its claim seed from the start: nobody
@@ -1128,10 +1152,26 @@ export class CadreNode {
      * Stop the cadre node
      */
     async stop() {
+        // A second call while one is in flight joins it rather than running cleanup() twice
+        // concurrently: `_running` stays true until cleanup() ends, and an event raised by a
+        // refresh still in flight (`cadre:removed`, whose embedder stops the node) can reach a
+        // handler that calls stop() mid-teardown.
+        if (this.stopInFlight) {
+            return this.stopInFlight;
+        }
         if (!this._running) {
             log('CadreNode not running');
             return;
         }
+        this.stopInFlight = this.stopRunning();
+        try {
+            await this.stopInFlight;
+        }
+        finally {
+            this.stopInFlight = null;
+        }
+    }
+    async stopRunning() {
         log('Stopping CadreNode');
         await this.cleanup();
         this.emit('control:disconnected', undefined);
@@ -1301,7 +1341,7 @@ export class CadreNode {
      * {@link start} has built the anchor.
      *
      * While true the node admits strangers' CONNECTIONS (the claim seed has to ride one)
-     * and refuses their control-database streams ({@link authorizeInboundControlStream})
+     * and refuses them control-database streams and cohort places ({@link isControlNetworkMember})
      * and relay reservations ({@link admitControlRelayReservation}): an unclaimed node has
      * no siblings to replicate from and must not become a public relay while it waits.
      * cadre-cli reports this on `/status`; `claim:accepted` is the event form.
@@ -1309,6 +1349,15 @@ export class CadreNode {
     isAwaitingClaim() {
         return this.config.claim !== undefined && this.trustedOwnerStore?.all().size === 0;
     }
+    /**
+     * The removal from the cadre this node has learned of, or null: the query form of
+     * `cadre:removed`, for an embedder that subscribed after it fired. Kept once set, across
+     * stop()→start() and a later re-admission, because the embedder acts on it once (stops this
+     * node, deletes the cadre's data); a re-added machine joins again from a fresh node.
+     */
+    removedFromCadre() {
+        return this.removal;
+    }
     /**
      * Construct (or adopt) the node-local cold-start bootstrap-peer store (see
      * {@link bootstrapPeerStore}). Synchronous: an injected store has already
@@ -1433,6 +1482,38 @@ export class CadreNode {
     getStrandNetworkStateStore() {
         return this.strandNetworkStateStore;
     }
+    /**
+     * The strands this machine joined from another party and has not published party-wide
+     * (see {@link CadreNodeConfig.joinedStrands}). Publication needs a control connection,
+     * so a one-node party's joins live here until it holds one; `exportStrandBundle` reads
+     * it beside the `JoinedStrand` table.
+     *
+     * @throws when the node is not started.
+     */
+    listUnpublishedJoinedStrands() {
+        if (!this.joinedStrands) {
+            throw new Error('CadreNode must be started before listing its unpublished joined strands');
+        }
+        return this.joinedStrands.unpublishedRecords();
+    }
+    /**
+     * The strand-network addresses a formation carried for `strandId` (see
+     * {@link formationStrandAddrs}), as kept: attributed per peer. Empty when none were
+     * carried or the strand's peers were forgotten. A copy; the node keeps its own list.
+     */
+    getCarriedStrandAddrs(strandId) {
+        return [...(this.formationStrandAddrs.get(strandId) ?? [])];
+    }
+    /**
+     * Seat `addrs` as the addresses a formation carried for `strandId`, exactly as a
+     * formation of this node's own would ({@link recordFormationStrandAddrs}): a strand
+     * move seats the exporting node's list here so the first launch has a cross-party
+     * seed. The usual rules apply: a list naming a peer replaces the strand's earlier
+     * one, and a list naming none records nothing.
+     */
+    recordCarriedStrandAddrs(strandId, addrs) {
+        return this.recordFormationStrandAddrs(strandId, addrs, 'recordCarriedStrandAddrs');
+    }
     /**
      * The node-local trusted-owner anchor (null before {@link start}). This is
      * the set the authorized-membership predicate and seed-trust anchor consult —
@@ -1516,7 +1597,7 @@ export class CadreNode {
      * connect-then-authorize — on every committed membership change via
      * {@link refreshAuthorizedControlPeers}'s `scheduleConnectedPeers()` call.
      * The one non-member the gate admits is a device whose invitation
-     * redemption this member is admitting ({@link catchUpRedeemingDevice}).
+     * redemption this member is admitting ({@link admitRedeemingDevice}).
      *
      * No-ops (logged) when the embedder configured no control storage or the
      * node exposes no key network — the backfill would have nothing to read or
@@ -1573,29 +1654,50 @@ export class CadreNode {
         this.controlBackfill.start();
     }
     /**
-     * Push this member's control store to a device whose invitation redemption has verified,
-     * and wait for the push, before the redemption seats the invitation's row and writes the
-     * device's rows (the handler's `catchUpDevice`; `CadreInviteHandler.catchUpDeviceIfLive`
-     * says why those writes need it).
-     * The device is admitted at the backfill's gate for the length of the push only.
+     * Admit a device whose invitation redemption has verified to this member's control
+     * replication until the returned release is called (the handler's `admitDevice`;
+     * `CadreInviteHandler.admitDeviceIfLive` says why the redemption's writes need it): push it
+     * this member's control store and wait for the push, with the device counted as a member by
+     * the backfill's gate and by the control cohort choice ({@link admittingDevices}), so the
+     * seat and the admission that follow are written to the device too. A failed push releases
+     * at once and rethrows: in the cohort without the store, the device would refuse the
+     * commits and tear the writes. With no backfill on this node nothing is admitted.
      *
      * Through {@link PeerJoinBackfill.forceCatchUpPeer}, not `catchUpPeer`: the device's own
      * `peer:identify` scheduled a run a moment earlier, which was denied if it passed the gate
      * before the device was added here, and `catchUpPeer` would answer that run's in-flight
      * status with an empty result.
      */
-    async catchUpRedeemingDevice(peerId) {
+    async admitRedeemingDevice(peerId) {
         const backfill = this.controlBackfill;
         if (!backfill) {
-            log('No control backfill on this node; device %s is not caught up before its admission', peerId);
-            return;
-        }
-        this.admittingDevices.set(peerId, (this.admittingDevices.get(peerId) ?? 0) + 1);
+            log('No control backfill on this node; device %s is neither caught up nor admitted before its admission', peerId);
+            return () => undefined;
+        }
+        // NOTE: counted in before the push, because the backfill's gate must admit the device to
+        // push to it; so for the push's length any other control write this member makes includes
+        // a device without the base revisions, which refuses it and the write retries. If that
+        // shows up as retried control writes during redemptions, count the device into the cohort
+        // choice only once the push resolves (a second set beside this one).
+        const release = this.countAdmittingDevice(peerId);
         try {
             const result = await backfill.forceCatchUpPeer(peerIdFromString(peerId));
             log('Device %s caught up before its admission: offered=%d accepted=%d rejected=%d', peerId, result.offered, result.accepted, result.rejected.length);
+            return release;
         }
-        finally {
+        catch (error) {
+            release();
+            throw error;
+        }
+    }
+    /** Count one more redemption admitting `peerId`; the returned release undoes it, once. */
+    countAdmittingDevice(peerId) {
+        this.admittingDevices.set(peerId, (this.admittingDevices.get(peerId) ?? 0) + 1);
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
             const remaining = (this.admittingDevices.get(peerId) ?? 1) - 1;
             if (remaining > 0) {
                 this.admittingDevices.set(peerId, remaining);
@@ -1603,7 +1705,7 @@ export class CadreNode {
             else {
                 this.admittingDevices.delete(peerId);
             }
-        }
+        };
     }
     /**
      * The control database's cache-wrapped raw storage, resolved from
@@ -1747,7 +1849,13 @@ export class CadreNode {
             }),
             arachnode: { enableRingZulu: profile === 'storage' },
             ...(identityKey && { privateKey: identityKey }),
-            ...(network?.transports && { transports: network.transports }),
+            // With `network.relayAddrs` set, built with libp2p's relay discovery off (given a
+            // transport list to wrap — `node-transports.ts`), so the supervisor
+            // `driveControlRelayReservation` starts is the only thing that fills the search slot:
+            // otherwise a member's control node running the relay server, which this node
+            // identifies (same party namespace), can take it first (`relay-reservation.ts`,
+            // "WHY LIBP2P'S RELAY DISCOVERY IS SWITCHED OFF").
+            ...nodeTransportsOption(network, transportOptions, (network?.relayAddrs ?? []).length > 0),
             ...(network?.noiseCrypto && { noiseCrypto: network.noiseCrypto }),
             // Always present, unlike the conditional spreads around it: an absent
             // `connectionMonitor` would leave libp2p's 5s ping deadline, which drops a peer
@@ -1766,7 +1874,9 @@ export class CadreNode {
             ...optimysticDialLimits(network?.linkRoundTripMs),
             // `{ wsPort }` when a listen entry names WebSocket, otherwise `{}` — and always
             // `{}` when `network.transports` is set, since the embedder owns transport policy
-            // then. Spread NEXT to `transports` because the two answer the same question.
+            // then. Spread NEXT to `transports` because the two answer the same question, and a
+            // no-op whenever a list is passed there — with `relayAddrs` set that list comes from
+            // `network.defaultTransports` when the embedder gave none, on the same switch.
             ...transportOptions,
             // Configured `listenAddrs`, plus the bare `/p2p-circuit` search listener when
             // `network.relayAddrs` is set — that listener registers the pending reservation
@@ -1796,7 +1906,14 @@ export class CadreNode {
             // (installControlProtocolGuard) checks these four with this same predicate
             // first; Optimystic's own check is kept because it is a working, supported
             // upstream defence, not a second policy.
-            authorizeInboundStream: (remotePeerId, protocol) => this.authorizeInboundControlStream(remotePeerId, protocol)
+            authorizeInboundStream: (remotePeerId, protocol) => this.authorizeInboundControlStream(remotePeerId, protocol),
+            // Who this node SENDS control writes to (cohort and coordinator choice), where
+            // `authorizeInboundStream` is who may send to it. Without it Optimystic picks cohort
+            // members from the protocols a peer's peer-store record lists, which any connected
+            // peer can fill. The stream gate's rule, unlogged (Optimystic asks several times per
+            // peer per cohort assembly and counts refusals on its own debug line), plus a device
+            // whose verified redemption is being written, which must hold the rows that admit it.
+            isNetworkMember: (peerId) => this.isControlNetworkMember(peerId) || this.admittingDevices.has(peerId)
         };
         return nodeOptions;
     }
@@ -2027,13 +2144,17 @@ export class CadreNode {
         return this.getBootstrapPeerIds().has(remotePeerId);
     }
     /**
-     * Per-stream authorization for the protocol guard's `members-snapshot` class
-     * (`control-protocol-guard.ts`): the four Optimystic control-DB protocols
-     * (`/optimystic/control-<party>/{repo,cluster,sync,block-transfer}/…`), FRET's
-     * five, and any protocol nobody classed. Also wired as Optimystic's
-     * `authorizeInboundStream` in {@link createControlNode} for the four DB
-     * protocols. The fail-closed layer behind the fail-open connection gater.
-     * Control node ONLY: strand cohort nodes legitimately serve cross-party peers.
+     * The membership rule this control node applies to a remote peer, without logging. Two
+     * consumers: the per-stream gate ({@link authorizeInboundControlStream}, who may SEND to
+     * this node on a members-only protocol) and Optimystic's `isNetworkMember` (who this node
+     * sends control writes TO — which peers can be a control block's cohort member or
+     * coordinator), which adds only a device whose verified invitation redemption is being
+     * written ({@link admittingDevices}). One rule for both keeps the outbound choice as
+     * permissive as the inbound acceptance: a joining node's cohort must include the inviter
+     * its empty anchor or empty snapshot lets replicate to it, or it would see a self-only
+     * cohort, rule an existing collection absent and found a second copy. Sereus builds the
+     * control node with `bootstrapNodes: []`, so Optimystic's refused-bootstrap-peer guard
+     * does not cover that.
      *
      * The STRICT SUBSET of {@link admitInboundControlConnection}: the same
      * "no basis to judge" admissions (shared via
@@ -2042,57 +2163,74 @@ export class CadreNode {
      * grant). The first two exist so a stranger can reach `/sereus/formation/1.0.0`
      * and `/sereus/cadre-invite/1.0.0` — neither is gated here, and admitting a
      * stranger to `repo` while an invitation is live is exactly the hole this
-     * gate closes. A DELEGATE-admitted connection (a member's strand node
+     * rule closes. A DELEGATE-admitted connection (a member's strand node
      * holding a circuit-relay reservation, see `delegate-admission.ts`) is
-     * likewise exactly a case this gate must still refuse: the delegate gets
-     * the connection and never the control DB.
+     * likewise refused: the delegate gets the connection and never the control DB.
      *
      * Refuses everyone, ahead of every admission below, while this node is waiting to be
      * claimed ({@link isAwaitingClaim}). The empty-anchor and empty-snapshot admissions
      * exist so a brand-new node can take replication from the siblings that will
      * authorize it; an unclaimed node has no siblings yet, and the rows that will
      * authorize anyone arrive only after the claim, over the owner's streams that the
-     * same two admissions then let in. Configured bootstrap infra is refused too: a
-     * relay opens no control-database stream.
+     * same two admissions then let in. Its cohort is itself alone meanwhile, which costs
+     * nothing: it built its control database with zero connections. Configured bootstrap
+     * infra is refused too: a relay opens no control-database stream.
      *
      * Otherwise admits when ANY of:
      *  1. a shared-baseline check admits (not running / no DB, empty anchor,
-     *     configured bootstrap infra);
+     *     configured bootstrap infra — which Optimystic still classifies `foreign`,
+     *     since a relay serves none of the party's database protocols);
      *  2. the materialized authorized set is empty — cold start, before the
      *     rows that would authorize anyone have replicated in;
      *  3. the peer IS in the materialized authorized set.
      *
      * Deliberately SYNCHRONOUS and pure in-memory — see
      * {@link authorizedControlPeers} for why a control-DB read here would
-     * deadlock into mutual denial. With a sync predicate the upstream deadline
-     * (`authorizeInboundStreamTimeoutMs`) never trips, so it stays at its
-     * default.
+     * deadlock into mutual denial.
      *
      * NOTE: the snapshot keys on PEER ID, so a node with no persistent identity
      * key never lands a `CadrePeer` row ({@link registerSelf} skips) and its
-     * siblings deny its control-DB streams once their own snapshot is non-empty —
-     * owner status is a KEY, not a peer id, so being the owner does not exempt it.
-     * Harmless today (a real deployment persists its identity; the ephemeral-owner
-     * case appears only in tests, which configure the owner as bootstrap infra —
-     * `push-wake-e2e.integration.ts` design note 3). If an ephemeral-identity node
-     * ever becomes a supported deployment, this gate needs a key-based admission.
-     */
-    authorizeInboundControlStream(remotePeerId, protocol) {
+     * siblings deny its control-DB streams, and leave it out of their cohorts, once
+     * their own snapshot is non-empty — owner status is a KEY, not a peer id, so
+     * being the owner does not exempt it. Harmless today (a real deployment persists
+     * its identity; the ephemeral-owner case appears only in tests, which configure
+     * the owner as bootstrap infra — `push-wake-e2e.integration.ts` design note 3).
+     * If an ephemeral-identity node ever becomes a supported deployment, this rule
+     * needs a key-based admission.
+     */
+    isControlNetworkMember(remotePeerId) {
         if (this.isAwaitingClaim()) {
-            log('authorizeInboundControlStream: DENYING %s on %s — this node is unclaimed and replicates with nobody until it is', remotePeerId, protocol);
             return false;
         }
         if (this.admitControlPeerUnconditionally(remotePeerId)) {
             return true;
         }
-        if (this.authorizedControlPeers.size === 0) {
-            return true;
-        }
-        if (this.authorizedControlPeers.has(remotePeerId)) {
+        return this.authorizedControlPeers.size === 0 || this.authorizedControlPeers.has(remotePeerId);
+    }
+    /**
+     * Per-stream authorization for the protocol guard's `members-snapshot` class
+     * (`control-protocol-guard.ts`): the four Optimystic control-DB protocols
+     * (`/optimystic/control-<party>/{repo,cluster,sync,block-transfer}/…`), FRET's
+     * five, and any protocol nobody classed. Also wired as Optimystic's
+     * `authorizeInboundStream` in {@link createControlNode} for the four DB
+     * protocols. The fail-closed layer behind the fail-open connection gater.
+     * Control node ONLY: strand cohort nodes legitimately serve cross-party peers.
+     *
+     * Admits exactly the peers {@link isControlNetworkMember} does, and logs why it
+     * refused one. With a sync predicate the upstream deadline
+     * (`authorizeInboundStreamTimeoutMs`) never trips, so it stays at its default.
+     */
+    authorizeInboundControlStream(remotePeerId, protocol) {
+        if (this.isControlNetworkMember(remotePeerId)) {
             return true;
         }
         // Upstream logs its own denial line; this one carries the WHY.
-        log('authorizeInboundControlStream: DENYING %s on %s — not in the materialized authorized set (%d member(s))', remotePeerId, protocol, this.authorizedControlPeers.size);
+        if (this.isAwaitingClaim()) {
+            log('authorizeInboundControlStream: DENYING %s on %s — this node is unclaimed and replicates with nobody until it is', remotePeerId, protocol);
+        }
+        else {
+            log('authorizeInboundControlStream: DENYING %s on %s — not in the materialized authorized set (%d member(s))', remotePeerId, protocol, this.authorizedControlPeers.size);
+        }
         return false;
     }
     /**
@@ -2112,7 +2250,9 @@ export class CadreNode {
      *
      * The trusted-owner anchor sync ({@link syncOwnerAnchor}) runs FIRST, so the snapshot
      * built here judges `CadrePeer` rows against the anchor as the `OwnerKey` table now
-     * has it. The invitation chain both reads may need is loaded at most once per refresh.
+     * has it. The invitation chain both reads may need, and the tombstone list the sync and
+     * the two end-of-refresh checks ({@link hangUpRevokedControlPeers}, then
+     * {@link noteOwnRemoval}) read, are each loaded at most once per refresh.
      */
     async refreshAuthorizedControlPeers(reason) {
         if (!this._running || !this.controlDatabase) {
@@ -2120,8 +2260,10 @@ export class CadreNode {
         }
         try {
             const loadChain = this.invitationChainSource(this.controlDatabase, false);
-            await this.syncOwnerAnchor(reason, false, loadChain);
-            const members = await this.collectAuthorizedMembers(this.controlDatabase, false, loadChain);
+            const loadTombstones = this.revocationSource(this.controlDatabase, false);
+            await this.syncOwnerAnchor(reason, false, loadChain, loadTombstones);
+            const rows = await this.controlDatabase.queryCadrePeers(false);
+            const members = this.authorizedAmong(rows, await this.chainFor(rows, loadChain));
             this.authorizedControlPeers = new Set(members.map((m) => m.peerId));
             log('refreshAuthorizedControlPeers(%s): %d authorized peer(s)', reason, this.authorizedControlPeers.size);
             // Remember the party's size for the NEXT launch's control-node repair yardstick
@@ -2188,11 +2330,136 @@ export class CadreNode {
             // re-arming peers whose last pass was denied under the SAME membership
             // snapshot instead of re-arming unconditionally.
             void this.controlBackfill?.scheduleConnectedPeers();
+            await this.hangUpRevokedControlPeers(rows, loadTombstones);
+            await this.noteOwnRemoval(rows, loadTombstones);
         }
         catch (error) {
             log('refreshAuthorizedControlPeers(%s) failed — keeping previous snapshot: %o', reason, error);
         }
     }
+    /**
+     * Hang up this node's control connections to every peer that a `CadrePeer` tombstone names
+     * and that has no live `CadrePeer` row: a machine removed from the cadre, whose streams the
+     * protocol guard already refuses but whose open connection would otherwise stay up until it
+     * dropped on its own. Runs at the end of every membership refresh: on the remover from the
+     * removal's own membership notification, so the connection is closed before
+     * {@link removeMachine} returns; on every other machine from the refresh that follows the
+     * replicated tombstone.
+     *
+     * Denies only on evidence held, the strand enforcer's rule (`strand-revocation-enforcer.ts`):
+     * a peer that merely dropped out of the authorized snapshot (an anchor read that failed, a
+     * voucher whose owner is gone) keeps its connection, self is never hung up, and a peer with a
+     * tombstone AND a live row under a fresh stamp was re-admitted and keeps its connection too.
+     * The tombstones are the refresh's own read (`loadTombstones`, shared with
+     * {@link syncOwnerAnchor}), taken only when some connected peer has no live row, so a cadre
+     * with every connection accounted for costs nothing here. A failed `hangUp` is logged and
+     * retried by the next refresh. Never rejects.
+     */
+    async hangUpRevokedControlPeers(rows, loadTombstones) {
+        const node = this.controlNode;
+        if (!node) {
+            return;
+        }
+        const selfPeerId = node.peerId.toString();
+        const live = new Set(rows.map((row) => row.peerId));
+        const rowless = new Map();
+        for (const connection of node.getConnections()) {
+            const remote = connection.remotePeer.toString();
+            if (remote !== selfPeerId && !live.has(remote)) {
+                rowless.set(remote, connection.remotePeer);
+            }
+        }
+        if (rowless.size === 0) {
+            return;
+        }
+        // NOTE: on a node whose anchor is empty the anchor sync skips its tombstone read, so a
+        // connection to a peer with no row (a configured relay or bootstrap peer) makes this the
+        // refresh's one `Revocation` read; bounded at one per refresh. If an un-enrolled node's
+        // refresh ever shows up in the consult budget, skip this read while the anchor is empty.
+        let revoked;
+        try {
+            revoked = new Set((await loadTombstones()).filter((tombstone) => tombstone.tableName === 'CadrePeer').map((tombstone) => tombstone.rowKey));
+        }
+        catch (error) {
+            log('membership refresh: tombstone read for the hang-up of removed peers failed; next refresh retries: %o', error);
+            return;
+        }
+        // NOTE: awaited inside the membership listener, so under the control database's write
+        // lock; libp2p bounds each connection's close at its 1 s `connectionCloseTimeout`, so a
+        // silent peer holds local writes for at most that. If several removed peers ever pile up
+        // here, hang them up concurrently or move the call after the listener returns.
+        for (const [remote, peer] of rowless) {
+            if (!revoked.has(remote)) {
+                continue;
+            }
+            try {
+                await node.hangUp(peer);
+                log('membership refresh: hung up %s (its CadrePeer row is tombstoned and no live row replaced it)', remote);
+            }
+            catch (error) {
+                log('membership refresh: hangUp of removed peer %s failed; next refresh retries: %o', remote, error);
+            }
+        }
+    }
+    /**
+     * Learn that an owner removed this node from the cadre, at the end of every membership
+     * refresh: a `CadrePeer` tombstone names this node's peer id, `rows` (the refresh's own
+     * retired-stamp-filtered read) has no live row for it, and an earlier refresh of this process
+     * saw one ({@link ownLiveRow}). Then it records {@link removal} and emits `cadre:removed`,
+     * once. Nothing is stopped here: stopping and deleting are the embedder's, whose storage,
+     * saved starts and process lifetime they are.
+     *
+     * The "seen live" condition keeps a machine joining again, whose fresh store can sync the old
+     * tombstone before its new row, from reporting itself removed. A re-admission under a fresh
+     * stamp is a live row, so a tombstone plus a live row is never a removal. The tombstones are
+     * the refresh's shared read, taken only once the own row is missing. Never rejects.
+     */
+    async noteOwnRemoval(rows, loadTombstones) {
+        const selfPeerId = this.controlNode?.peerId.toString();
+        if (selfPeerId === undefined || this.removal !== null) {
+            return;
+        }
+        const own = rows.find((row) => row.peerId === selfPeerId);
+        if (own) {
+            this.ownLiveRow = own;
+            return;
+        }
+        // NOTE: a machine that synced its tombstone and restarted before its embedder acted never
+        // reports, since the new process never saw its row live. The embedders persist what they
+        // did (a marker, a deleted party), so the window is a crash between this event and that
+        // action; if it is ever hit, persist the removal here.
+        const lastLive = this.ownLiveRow;
+        if (lastLive === null) {
+            return;
+        }
+        let tombstones;
+        try {
+            tombstones = (await loadTombstones()).filter((tombstone) => tombstone.tableName === 'CadrePeer' && tombstone.rowKey === selfPeerId);
+        }
+        catch (error) {
+            log('membership refresh: tombstone read for this node\'s own removal failed; next refresh retries: %o', error);
+            return;
+        }
+        if (tombstones.length === 0 || !this._running || !this.controlDatabase) {
+            return;
+        }
+        const tombstone = tombstones.find((candidate) => candidate.stampId === lastLive.stampId) ?? tombstones[0];
+        this.removal = { partyId: this.partyId, stampId: tombstone.stampId, signerKey: this.anchoredRevocationSigner(tombstone), at: Date.now() };
+        log('membership refresh: this node was removed from cadre %s (tombstone %s, signer %s)', this.partyId, tombstone.stampId, tombstone.signerKey);
+        this.emit('cadre:removed', this.removal);
+    }
+    /**
+     * The tombstone's signer when its signature verifies and the key is in this node's
+     * trusted-owner anchor, else null. A tombstone that fails this is still a removal (every
+     * other machine honours it, and this node's own row is gone), so it is logged, not refused.
+     */
+    anchoredRevocationSigner(tombstone) {
+        if (verifyRevocationSigner(this.partyId, tombstone) && this.trustedOwnerStore?.has(tombstone.signerKey)) {
+            return tombstone.signerKey;
+        }
+        log('membership refresh: the tombstone removing this node (%s) is not signed by an owner anchored here (signer %s)', tombstone.stampId, tombstone.signerKey);
+        return null;
+    }
     /**
      * Add the configured `controlNetwork.bootstrapNodes` to the control node's address book
      * and dial each peer once — what `@libp2p/bootstrap` would have done had the node been
@@ -2323,12 +2590,31 @@ export class CadreNode {
      * reference apps), and a write it signed would only be refused.
      */
     async enrolledOwnerSigningKey() {
-        const signingKey = this.seedBootstrapService?.canAuthorize() ? this.getSelfSigningKey() : null;
+        const signingKey = this.ownerSigningKeyCandidate();
         if (!signingKey || !this.controlDatabase) {
             return null;
         }
         return (await this.controlDatabase.getOwnerKeys()).has(signingKey.publicKeyB64) ? signingKey : null;
     }
+    /**
+     * Whether this node can act as an owner of its cadre: its identity key is wired as its
+     * owner signing key ({@link initializeSeedBootstrap}) and enrolled in the live `OwnerKey`
+     * set ({@link enrolledOwnerSigningKey}). What the owner-only flows (`createCadreInvitation`,
+     * `claimNode`, `rentNode`) need; false before `start()`, and on a machine that joined as a
+     * member. The reference apps' "is this device an owner" check.
+     */
+    async isOwner() {
+        return (await this.enrolledOwnerSigningKey()) !== null;
+    }
+    /** {@link enrolledOwnerSigningKey} judged against an owner set the caller has already read. */
+    ownerSigningKeyEnrolledIn(ownerKeys) {
+        const signingKey = this.ownerSigningKeyCandidate();
+        return signingKey !== null && ownerKeys.has(signingKey.publicKeyB64) ? signingKey : null;
+    }
+    /** This machine's identity key as an owner signing key, when its seed bootstrap is wired to sign; enrollment not yet checked. */
+    ownerSigningKeyCandidate() {
+        return this.seedBootstrapService?.canAuthorize() ? this.getSelfSigningKey() : null;
+    }
     /**
      * Schedule the node's initial self-record publish + ongoing refresh shortly
      * after start (non-blocking). {@link registerSelf} is idempotent and safely
@@ -2342,12 +2628,11 @@ export class CadreNode {
                     await this.registerSelf();
                 }
                 catch (error) {
-                    // Background task — a failed publish must not crash the node.
-                    // NOTE: a restarted machine whose own CadrePeer row replicates in while this update
-                    // runs fails here with ConcurrentModificationError (seen on the owner's restart in
-                    // every traced run of cadre-invite-any-member), leaving its record unrefreshed until
-                    // the next heartbeat. If a restarted machine's changed addresses must publish sooner,
-                    // retry once here.
+                    // Background task — a failed publish must not crash the node. A restarted machine
+                    // whose own CadrePeer row replicates in while this update runs fails here with
+                    // ConcurrentModificationError (seen on the owner's restart in every traced run of
+                    // cadre-invite-any-member); the next connected reconcile pass retries
+                    // (publishFirstSelfRecord).
                     log('Self-registration failed: %o', error);
                 }
                 // Wire the ongoing refresh + control-cohort reconcile cadence, then run
@@ -2413,23 +2698,26 @@ export class CadreNode {
             return 'skipped';
         }
         const peerId = this.controlNode.peerId.toString();
-        const addrs = await this.collectSelfAddrs();
         const existing = await this.controlDatabase.queryPeerRecord(peerId);
-        if (!existing) {
-            // A listener-only service (`enableSeedListener`, a claim node's) holds no owner key and
-            // cannot sign the insert, so it is "no owner service" here too.
-            if (!this.seedBootstrapService?.canAuthorize()) {
-                // "No row" also covers "revoked": queryPeerRecord reads a row whose StampId is
-                // retired in Revocation as absent, so a removed node lands here every heartbeat
-                // and stops refreshing its own record — correct, but say so, or the message reads
-                // as "never added" for a node that was removed.
-                log('registerSelf: no readable CadrePeer row for self (never added, or removed and its stamp retired) and no owner service to self-insert; skipping');
-                return 'skipped';
-            }
+        // A listener-only service (`enableSeedListener`, a claim node's) holds no owner key and
+        // cannot sign the insert, so it is "no owner service" here too.
+        const ownerService = this.seedBootstrapService?.canAuthorize() ? this.seedBootstrapService : null;
+        if (!existing && !ownerService) {
+            // "No row" also covers "revoked": queryPeerRecord reads a row whose StampId is
+            // retired in Revocation as absent, so a removed node lands here every heartbeat
+            // and stops refreshing its own record — correct, but say so, or the message reads
+            // as "never added" for a node that was removed.
+            log('registerSelf: no readable CadrePeer row for self (never added, or removed and its stamp retired) and no owner service to self-insert; skipping');
+            return 'skipped';
+        }
+        // Collected only past that skip, which a node waiting for its row replicated in takes on
+        // every connected reconcile pass ({@link publishFirstSelfRecord}).
+        const addrs = await this.collectSelfAddrs();
+        if (!existing && ownerService) {
             // First-time row: requires an owner signature (the node is its own
             // owner). insertSelfPeerRecord throws if no owner key is present.
             const record = this.signSelfRecord(peerId, signingKey, addrs, null);
-            if (await this.seedBootstrapService.insertSelfPeerRecord(record)) {
+            if (await ownerService.insertSelfPeerRecord(record)) {
                 if (this.committedAlone())
                     this.pendingSelfPeerWrite = true;
                 this.noteSelfRecordPublished();
@@ -2553,7 +2841,7 @@ export class CadreNode {
      */
     signSelfRecord(peerId, signingKey, addrs, existing) {
         const updatedAt = Math.max(Date.now(), (existing?.updatedAt ?? 0) + 1);
-        return signPeerRecord(this.partyId, { peerId, publicKey: signingKey.publicKeyB64, addrs, updatedAt }, signingKey.privateKeyB64);
+        return signPeerRecord(this.partyId, { peerId, publicKey: signingKey.publicKeyB64, addrs, updatedAt, profile: this.config.profile }, signingKey.privateKeyB64);
     }
     /**
      * The ed25519 keypair (base64url) the node signs its own record with — the key
@@ -2629,25 +2917,39 @@ export class CadreNode {
         return ed25519KeyPairFromLibp2p(this.identityKey);
     }
     /**
-     * Publish this node's own address record from the reconcile pass, for a CLAIMED node that
-     * has not published one this session. Its owner writes its `CadrePeer` row only after the
-     * claim is accepted (`claimNode`), so the row reaches this node by replication, after the
-     * boot-time publish and the first-growth drain have both found nothing to publish; without
-     * this the record would wait for the heartbeat ({@link startRecordRefresh}), and the cadre
-     * could not resolve the node's addresses until then. The reconcile pass is where replicated
-     * membership is picked up, so each pass tries until the first publish lands. A try before
-     * the row has arrived is a `skipped` publish: one `CadrePeer` read. A claimed node later
-     * removed from its cadre never publishes again, so it pays that read on every pass.
-     */
-    async publishSelfRecordOnceClaimed() {
-        if (!this.config.claim || this.isAwaitingClaim() || this.lastSelfRecordPublishAt !== null) {
+     * Publish this node's own address record from the reconcile pass until its first publish of
+     * this session lands. A node with no owner key — seeded (`addDrone`, `cadre enroll add`),
+     * claimed (`claimNode`) or otherwise authorized after it booted — cannot insert its own
+     * `CadrePeer` row; the row an owner wrote for it reaches it by replication once the two
+     * connect, usually after the boot-time publish and the first-growth drain have both found
+     * nothing to publish. Without this the record would wait for the heartbeat
+     * ({@link startRecordRefresh}), and the cadre could not resolve the node's addresses until
+     * then. The reconcile pass is where replicated membership is picked up, so each pass tries.
+     * It also retries an owner's boot-time publish that failed.
+     *
+     * A try before the row has arrived is a `skipped` publish: one `CadrePeer` read. Not tried
+     * while the node waits to be claimed (it has no row and no party yet) or once it has learned
+     * it was removed (nothing to publish). A removed node that never saw its own row live in this
+     * process does not learn it was removed ({@link noteOwnRemoval}), and pays that read on every
+     * pass.
+     *
+     * Connected-only: a row written elsewhere arrives over a connection, and an owner's publish
+     * committed alone is local-only and forks its own history — a restarted owner whose embedder
+     * runs a pass before it reconnects would write its row on the stale side of the fork, and
+     * then never see rows written while it was down (`cadre-invite-any-member` runs that pass and
+     * fails every time without this condition). The boot-time publish and the first-growth drain already try at the node's lone and
+     * first-connection moments; this retries on the passes after.
+     */
+    async publishFirstSelfRecord() {
+        if (this.lastSelfRecordPublishAt !== null || this.isAwaitingClaim() || this.removal !== null
+            || this.getControlConnectionCount() === 0) {
             return;
         }
         const outcome = await this.registerSelf().catch((error) => {
-            log('reconcileControlCohort: claimed-node self-record publish failed (continuing): %o', error);
+            log('reconcileControlCohort: first self-record publish failed (continuing): %o', error);
             return 'skipped';
         });
-        log('reconcileControlCohort: claimed node self-record publish: %s', outcome);
+        log('reconcileControlCohort: first self-record publish: %s', outcome);
     }
     /**
      * Collect this node's current dialable addresses for publication, signaling
@@ -2690,25 +2992,21 @@ export class CadreNode {
             reconcile('self:peer:update');
         };
         this.controlNode.addEventListener('self:peer:update', this.selfPeerUpdateHandler);
-        // NOTE: a node AUTHORIZED AFTER IT BOOTED can wait a whole heartbeat (7.5 min)
-        // to publish its address. `registerSelf` no-ops while a node has no readable
-        // `CadrePeer` row, so its boot-time publish does nothing, and the two triggers
-        // wired here are the only ones after that: `self:peer:update` needs an ADDRESS
-        // CHANGE, and a relay-only node's addresses stop changing the moment its
-        // reservation lands — inside `start()`, before this listener exists (on the
-        // `network.requireRelay: false` posture the reservation may instead land LATER,
-        // from the retry supervisor, and then this listener is what publishes the
-        // `/p2p-circuit` address the boot-time publish could not carry). Harmless
-        // where a late-authorized node's addresses keep churning (NAT/relay rotation
-        // fire the event anyway), and invisible while parties authorize members before
-        // they boot. A claimed node is always authorized after it boots, and the reconcile
-        // pass publishes for it ({@link publishSelfRecordOnceClaimed}). If late enrollment
-        // becomes the normal path for other nodes too — an invited phone is exactly that —
-        // drop that method's claim condition rather than lengthening this list of triggers:
-        // the membership-change seam (`ControlDatabase.setMembershipChangeListener`) fires
-        // on LOCAL commits only, and the row a late-authorized node waits for is written
-        // elsewhere. Measured while writing `relay-only-control-addr.integration.ts` case 4,
-        // which drives `registerSelf()` explicitly because neither trigger is dependable there.
+        // A node AUTHORIZED AFTER IT BOOTED (seeded, claimed, invited) gets its first
+        // publish from the reconcile pass ({@link publishFirstSelfRecord}), not from the
+        // two triggers wired here. `registerSelf` no-ops while a node has no readable
+        // `CadrePeer` row, so its boot-time publish does nothing, and neither trigger is
+        // dependable after that: `self:peer:update` needs an ADDRESS CHANGE, and a
+        // relay-only node's addresses stop changing the moment its reservation lands —
+        // inside `start()`, before this listener exists (on the `network.requireRelay:
+        // false` posture the reservation may instead land LATER, from the retry
+        // supervisor, and then this listener is what publishes the `/p2p-circuit` address
+        // the boot-time publish could not carry); the heartbeat is 7.5 min away. Nor is
+        // the membership-change seam (`ControlDatabase.setMembershipChangeListener`): it
+        // fires on LOCAL commits only, and the row a late-authorized node waits for is
+        // written elsewhere. Measured while writing `relay-only-control-addr.integration.ts`
+        // case 4, which drives `registerSelf()` explicitly because neither trigger is
+        // dependable there.
         this.recordRefreshTimer = setInterval(() => republish('heartbeat'), DEFAULT_PEER_RECORD_HEARTBEAT_MS);
         this.recordRefreshTimer?.unref?.();
         const reconcileMs = this.config.network?.controlCohort?.reconcileMs ?? DEFAULT_CONTROL_COHORT_RECONCILE_MS;
@@ -2863,8 +3161,9 @@ export class CadreNode {
      * ({@link bootstrapDialAddrs}).
      *
      * An address naming a DIFFERENT trailing peer id is dropped: it does not reach
-     * `peerId`, so it does not belong in this peer's candidate list (libp2p's own
-     * dial queue filters the same shape out one layer lower).
+     * `peerId`, so it does not belong in this peer's candidate list (`dialPeerAddrs`
+     * binds every address to the peer it is given and drops the same shape one
+     * layer lower; here it is dropped before it can reach the address book).
      */
     normalizeDialAddrs(addrs, peerId) {
         // Keyed by the NORMALIZED string, so two entries differing only by the suffix
@@ -2995,7 +3294,7 @@ export class CadreNode {
         if (!this._running || !this.controlNode || !this.controlDatabase) {
             return { dialed: [] };
         }
-        await this.publishSelfRecordOnceClaimed();
+        await this.publishFirstSelfRecord();
         if (!this._running || !this.controlNode || !this.controlDatabase) {
             return { dialed: [] };
         }
@@ -3347,7 +3646,7 @@ export class CadreNode {
         }
         try {
             log('reconcileControlCohort: dialing sibling %s (%d addr(s))', sibling.peerId, addrs.length);
-            await dialPeerAddrs(controlNode, addrs, this.controlDialBudget(), `reconcileControlCohort dial of sibling ${sibling.peerId}`);
+            await dialPeerAddrs(controlNode, sibling.peerId, addrs, this.controlDialBudget(), `reconcileControlCohort dial of sibling ${sibling.peerId}`);
             return true;
         }
         catch (error) {
@@ -3380,9 +3679,9 @@ export class CadreNode {
      *
      * The list may name transports this node cannot dial (a lent node reports TCP
      * and `/ws` addresses to a phone that dials WebSockets only). That needs no
-     * filtering here: libp2p's dial queue (`calculateMultiaddrs`, libp2p 3.3.11)
-     * rejects an address no transport can dial before touching the network, so
-     * such an address costs a log line.
+     * filtering here: libp2p's transport manager rejects an address no transport
+     * can dial before touching the network (`TransportUnavailableError`), so such
+     * an address costs a log line.
      *
      * The list is NOT handed to one `dial()`. libp2p tries a multi-address dial's
      * addresses one after another under a single deadline, and sorts loopback
@@ -3599,7 +3898,7 @@ export class CadreNode {
         }
         try {
             log('reconcileControlCohort(cold-start): dialing bootstrap peer %s (%d addr(s))', peerId, parsed.length);
-            await dialPeerAddrs(controlNode, parsed, this.controlDialBudget(), `reconcileControlCohort cold-start dial of bootstrap peer ${peerId}`);
+            await dialPeerAddrs(controlNode, peerId, parsed, this.controlDialBudget(), `reconcileControlCohort cold-start dial of bootstrap peer ${peerId}`);
             return true;
         }
         catch (error) {
@@ -3815,7 +4114,10 @@ export class CadreNode {
      */
     async drainPendingRevocations() {
         const sweep = !this.reissuedHeldRevocations;
-        if (!sweep && this.pendingRevocations.size === 0) {
+        // A removed machine's owner key went with its row (`removeMachine`), so the schema's
+        // live-owner clause refuses every re-issue it could sign; reconstructAuthoredMembership
+        // and drainPendingPeerWrites stop on the same test.
+        if (this.removal !== null || (!sweep && this.pendingRevocations.size === 0)) {
             return;
         }
         if (!this._running || !this.controlNode || !this.controlDatabase) {
@@ -3842,12 +4144,10 @@ export class CadreNode {
             }
         }
         catch (error) {
-            // NOTE: a device whose owner key has been removed keeps running this drain (and the
-            // membership re-touches of reissuePendingPeerWrites / reissueAuthoredMembershipRows)
-            // on every growth edge, and once its own tombstone has reached it every attempt
-            // fails the schema's live-owner clause and lands here. Noise, not harm; a node that
-            // learns it has been revoked shutting itself down belongs to the device-removal plan
-            // ticket (remove-a-device-or-app-from-a-cadre).
+            // NOTE: an owner whose key alone was removed (`removeOwner`, its machine still a member,
+            // so not a removal this node reports) keeps running these drains, and every attempt
+            // fails the schema's live-owner clause and lands here on each growth edge. Noise, not
+            // harm; if it shows up, gate the drains on this node's key being a live owner.
             log('drain: revocation re-issue failed; leaving queued for next growth: %o', error);
         }
     }
@@ -3869,7 +4169,7 @@ export class CadreNode {
      * `CadrePeer` trace, but its tombstone is re-issuable).
      */
     async reconstructAuthoredMembership() {
-        if (!this.controlDatabase || !this.controlNode) {
+        if (!this.controlDatabase || !this.controlNode || this.removal !== null) {
             return;
         }
         if (!this.seedBootstrapService?.canAuthorize()) {
@@ -3927,7 +4227,7 @@ export class CadreNode {
      * here.
      */
     async drainPendingPeerWrites() {
-        if (this.pendingPeerWrites.size === 0) {
+        if (this.pendingPeerWrites.size === 0 || this.removal !== null) {
             return;
         }
         if (!this.seedBootstrapService?.canAuthorize()) {
@@ -5589,6 +5889,8 @@ export class CadreNode {
             // comes up `'syncing'` announces the moment its database is published.
             firstSync: this.config.strandFirstSync,
             onWritable: (writableStrandId) => this.handleStrandWritable(writableStrandId),
+            onCommitDurability: (commit) => this.emit('strand:commit-durability', commit),
+            onCommitHeld: (held) => this.emit('strand:commit-held', held),
             // Re-announce the delegate to ONE relay before the strand node's reservation
             // supervisor re-drives it (see announceDelegateToRelay). Retained with the
             // launch config, so a hibernation wake's rebuilt supervisors get it too.
@@ -6687,6 +6989,15 @@ export class CadreNode {
      *
      * Passing an empty list stops the supervisor and resets the posture to `none`
      * without dialing or waiting.
+     *
+     * NOTE: on a node with no `network.relayAddrs` (a browser tab with a hand-written
+     * bare `/p2p-circuit`), libp2p's relay discovery stays on, because it was the only
+     * thing filling that slot before this call. Such a tab connected to some other
+     * relay-capable peer it identifies (a party member running the relay server) can
+     * lose its one slot to that peer before this supervisor's request runs, the theft
+     * `nodeTransportsOption` prevents on configured nodes (`relay-reservation.ts`). If a
+     * tab is ever seen reserved through a relay it was not asked to use, build that
+     * node through `withoutRelayDiscovery` too, or have the tab configure `relayAddrs`.
      */
     async reserveRelays(addrs, opts) {
         // Stop first, unconditionally: a second call with a different list must not
@@ -6790,18 +7101,23 @@ export class CadreNode {
         // — anchor it in the node-local store. The in-memory set updates
         // synchronously (see TrustedOwnerStore.trust); only the file persist is
         // fire-and-forget, logged on failure.
-        // NOTE: non-founder members that also wire seed-bootstrap with their own
-        // derived key (e.g. the phone joiner path in runOwnerGenesis, which needs
-        // it to self-publish its CadrePeer row) self-anchor a key that is not a
-        // party authority. The anchor sync (`syncOwnerAnchor`) does not correct this:
-        // a `genesis` entry is base, kept whether or not a live `OwnerKey` row vouches
-        // it. Harmless while such a node never mints an invite: the store does not
-        // replicate, so a node trusting itself grants nothing to others. But
-        // `createCadreInvitation` hands out the anchor's contents as the device's pins,
-        // so the moment a non-founder member mints an invitation it exports its own
-        // non-authority key as a cadre owner key. If that becomes reachable (today only
-        // cadre-cli/cadre-host owners mint invitations), gate this self-anchor on the
-        // actual OwnerKey genesis insert instead.
+        // NOTE: wiring a key that is not a live owner here self-anchors a key that is
+        // no party authority, and the anchor sync (`syncOwnerAnchor`) does not correct
+        // it: a `genesis` entry is base, kept whether or not a live `OwnerKey` row
+        // vouches it. A machine that joined by invitation reaches this only through
+        // `wireOwnKeyIfOwner`, which checks the row first, so a joined non-owner never
+        // self-anchors. Three callers still wire unconditionally on every start, so a
+        // node of theirs started for a party founded elsewhere does: the phone kit's
+        // `runOwnerGenesis` (cadre-rn; only for a party its saved start does not record
+        // as joined, whose starts call `wireOwnKeyIfOwner` instead), the web reference
+        // app's start (`cadre-web.ts`) and `cadre start --owner`. Contained while the store does
+        // not replicate and such a node cannot mint: `createCadreInvitation` hands out
+        // the anchor as the device's pins, but the `CadreInvite` insert needs a live
+        // owner as issuer. If anything hands out the anchor without that check, gate
+        // this self-anchor on a live `OwnerKey` row instead. A non-owner needs no
+        // owner key to publish its own address record: once an owner or a redemption
+        // has written its `CadrePeer` row, `registerSelf` refreshes it with the
+        // identity key alone.
         if (this.trustedOwnerStore) {
             void this.trustedOwnerStore
                 .trust(ed25519PublicKeyFromPrivate(ownerPrivateKey), 'genesis')
@@ -6894,6 +7210,11 @@ export class CadreNode {
      * {@link isMember}). Rows whose stamp is retired in `CadreControl.Revocation`
      * never reach here: {@link ControlDatabase.queryCadrePeers} excludes them, so a
      * revoked peer is not addressable either.
+     *
+     * NOTE: answers the whole `CadrePeerRow`, past the two fields declared; the integration
+     * harness (`owner-cli-node.ts`, `OwnerCliMemberRow.sig`) reads `sig` off it through the admin
+     * channel to tell a row another member seated from one the subject published itself. Narrow
+     * this to the declared fields only together with that reader.
      */
     async listMembers() {
         if (!this.controlDatabase) {
@@ -6982,9 +7303,20 @@ export class CadreNode {
      * source so the membership refresh can share one load with {@link syncOwnerAnchor}.
      */
     async collectAuthorizedMembers(controlDatabase, retry, loadChain) {
-        const selfPeerId = this.peerId?.toString();
         const rows = await controlDatabase.queryCadrePeers(retry);
-        const chain = rows.some(isInvitationAdmitted) ? await loadChain() : null;
+        return this.authorizedAmong(rows, await this.chainFor(rows, loadChain));
+    }
+    /** The invitation chain, loaded only when some row in `rows` is invitation-admitted. */
+    async chainFor(rows, loadChain) {
+        return rows.some(isInvitationAdmitted) ? await loadChain() : null;
+    }
+    /**
+     * The authorized members among `rows`, already read: checks 1 to 4 of
+     * {@link listAuthorizedMembers}' predicate (check 5 is `queryCadrePeers`'s), so the membership
+     * refresh can judge the rows it has to read anyway for the hang-up of removed peers.
+     */
+    authorizedAmong(rows, chain) {
+        const selfPeerId = this.peerId?.toString();
         const authorized = rows
             .filter(row => row.peerId !== selfPeerId && this.hasAnchoredProof(row, chain))
             .map(({ peerId, multiaddr }) => ({ peerId, multiaddr }));
@@ -7045,7 +7377,8 @@ export class CadreNode {
      *
      * NOTE: cost per membership refresh is one `OwnerKey` read and one `Revocation` read (the
      * tombstone list, whose `OwnerKey` stamps are handed to `queryOwnerKeyRows` so it does not
-     * read the retired set again), plus the invitation chain when some owner row is
+     * read the retired set again, and which the hang-up of removed peers shares through
+     * `loadTombstones`), plus the invitation chain when some owner row is
      * invitation-admitted — shared with the membership read through `loadChain`; the memo
      * suggestion on {@link loadInvitationChain} covers that part. Before the Revocation ledger
      * marker is filed that one read is a cohort consult per refresh, which
@@ -7053,8 +7386,9 @@ export class CadreNode {
      *
      * @param retry - forwarded to every read; `false` on the refresh path, for the reason on
      *   {@link refreshAuthorizedControlPeers}.
+     * @param loadTombstones - the refresh's shared tombstone read ({@link revocationSource}).
      */
-    async syncOwnerAnchor(reason, retry, loadChain) {
+    async syncOwnerAnchor(reason, retry, loadChain, loadTombstones) {
         const store = this.trustedOwnerStore;
         const controlDatabase = this.controlDatabase;
         if (!store || !controlDatabase) {
@@ -7066,7 +7400,7 @@ export class CadreNode {
         }
         let target;
         try {
-            const tombstones = await controlDatabase.queryRevocations(retry);
+            const tombstones = await loadTombstones();
             const retired = new Set(tombstones.filter(tombstone => tombstone.tableName === 'OwnerKey').map(tombstone => tombstone.stampId));
             const rows = await controlDatabase.queryOwnerKeyRows(retry, retired);
             const chain = rows.some(isInvitationAdmitted) ? await loadChain() : null;
@@ -7118,6 +7452,11 @@ export class CadreNode {
         let loading = null;
         return () => (loading ?? (loading = this.loadInvitationChain(controlDatabase, retry)));
     }
+    /** A per-refresh {@link RevocationSource}: one `queryRevocations` read, shared by every caller in the pass. */
+    revocationSource(controlDatabase, retry) {
+        let loading = null;
+        return () => (loading ?? (loading = controlDatabase.queryRevocations(retry)));
+    }
     /**
      * The usage and invitation rows {@link hasAnchoredProof} and {@link syncOwnerAnchor}
      * resolve an invitation-admitted row through, keyed for lookup. Both reads honour `retry`
@@ -7429,6 +7768,10 @@ export class CadreNode {
      * Remove a previously-authorized peer from the cadre.
      * Signs the peer ID with the owner key and deletes the CadrePeer row.
      *
+     * Removes the `CadrePeer` row only. The call that removes a machine completely (its owner
+     * key, its push token and the invitations it could come back through, in one transaction)
+     * is {@link removeMachine}.
+     *
      * @param peerId - The peer ID to remove
      */
     async removePeer(peerId) {
@@ -7478,6 +7821,9 @@ export class CadreNode {
      * tombstone rides the committed-delete seam ({@link noteGuardedDelete}), so one committed
      * while alone is re-issued on cohort growth like every other removal.
      *
+     * Removes the `OwnerKey` row only. The call that removes a machine completely, its owner key
+     * included, is {@link removeMachine}.
+     *
      * @param ownerPublicKeyB64 - the owner's ed25519 public key (base64url).
      * @returns `true` when the row was removed, `false` when the key is not a live owner here.
      */
@@ -7488,6 +7834,155 @@ export class CadreNode {
         const key = requireEd25519PublicKeyB64(ownerPublicKeyB64, 'owner key');
         return await this.seedBootstrapService.removeOwner(key);
     }
+    /**
+     * The cadre's machines as an app lists them ({@link CadreMachine}): one entry per live
+     * `CadrePeer` row, judged by this node's membership predicate, plus one per live `OwnerKey`
+     * whose key names a machine with no row (`describeMachines` in `machine-removal.ts`).
+     * Unlocked reads with the default retry.
+     */
+    async listMachines() {
+        if (!this.controlDatabase) {
+            throw new Error('CadreNode must be started before listing machines');
+        }
+        return (await this.readMachines(this.controlDatabase)).machines;
+    }
+    /**
+     * What {@link removeMachine} would do for `peerId`, read without writing, for an app's
+     * confirmation step ({@link MachineRemovalPlan}): whether this node may remove it, whether its
+     * owner key goes with it, which rows that key vouched (so the app can offer to keep them by
+     * re-vouching), which invitations it could come back through, and whether this node's own
+     * rows depend on it (`planMachineRemoval` in `machine-removal.ts`).
+     */
+    async planMachineRemoval(peerId) {
+        if (!this.controlDatabase) {
+            throw new Error('CadreNode must be started before planning a machine removal');
+        }
+        return (await this.planMachineRemovalWith(this.controlDatabase, peerId)).plan;
+    }
+    /**
+     * Remove a machine from the cadre completely, signed by this node's owner key: its
+     * `CadrePeer` row, its `OwnerKey` row when its key is an owner, its `DeviceToken` row (a
+     * removed phone must not be push-woken) and a withdrawal of every live invitation it could
+     * redeem to come back, in ONE transaction ({@link ControlDatabase.removeMachine}), with a
+     * `Revocation` tombstone per row so the removal holds on every machine
+     * ("Deletes made while alone" in docs/architecture.md).
+     *
+     * Steps: re-plan ({@link planMachineRemoval}) and throw {@link MachineRemovalRefusedError} on a
+     * refusal; check `options.revouch` against the plan's dependents and throw before any write
+     * when it names anything else; **re-vouch first**, under this node's key, the dependents the
+     * caller chose to keep (`ControlDatabase.revouchOwnerKey`, `reauthorizePeer`), so they are
+     * never untrusted in between, and stop before the removal if one fails (re-vouches already
+     * made stay, harmlessly); then the removal transaction. Afterwards this node forgets the
+     * machine as a dial target, and the refresh the write notifies hangs up its control
+     * connection ({@link hangUpRevokedControlPeers}) before this resolves.
+     *
+     * Not undone by this call: the machine keeps every row and strand block it already synced
+     * and the party's strand member keys (`tickets/blocked/decide-removed-machine-strand-access`).
+     * A fresh invitation re-admits it later under fresh stamps.
+     *
+     * @returns what was written ({@link MachineRemovalResult}); all false when no live row names
+     *   the machine here (already removed elsewhere).
+     * @throws {MachineRemovalRefusedError} `'not-an-owner'`, `'self'` or `'last-owner'`.
+     */
+    async removeMachine(peerId, options = {}) {
+        const service = this.seedBootstrapService;
+        if (!service || !this.controlDatabase) {
+            throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
+        }
+        const { plan, rows } = await this.planMachineRemovalWith(this.controlDatabase, peerId);
+        if (plan.refusal !== null) {
+            throw new MachineRemovalRefusedError(peerId, plan.refusal);
+        }
+        const revouch = revouchWithinPlan(plan, options.revouch);
+        if (plan.machine === null) {
+            log('removeMachine(%s): no live row names it here; nothing to remove', peerId);
+            return { removedPeer: false, removedOwnerKey: false, removedDeviceToken: false, withdrawnInvitations: [], revouched: { owners: [], peers: [] } };
+        }
+        await this.revouchDependents(service, revouch, rows);
+        const writes = await service.removeMachine({
+            peerId,
+            ownerKey: plan.removesOwnerKey ? plan.machine.publicKey : null,
+            inviteKeys: plan.invitations,
+        });
+        if (writes.removedPeer) {
+            // Track + loudly flag a delete that committed local-only (security-relevant).
+            this.noteControlWrite(peerId, 'remove');
+        }
+        // As removePeer: a removed machine is no longer a dial target, however this node learned
+        // its address. A persist failure only lets the entry reappear after a restart.
+        void this.bootstrapPeerStore?.forget(peerId).catch((error) => {
+            log('removeMachine: persisting the removal of dial target %s failed (forgotten in memory): %o', peerId, error);
+        });
+        log('removeMachine(%s): peer=%s ownerKey=%s deviceToken=%s invitations=%d revouched owners=%d peers=%d', peerId, writes.removedPeer, writes.removedOwnerKey, writes.removedDeviceToken, writes.withdrawnInvitations.length, revouch.owners.length, revouch.peers.length);
+        return { ...writes, revouched: revouch };
+    }
+    /**
+     * The reads behind {@link listMachines}: the live `CadrePeer` and `OwnerKey` rows and the
+     * machines projected from them, with this node's membership predicate as the `trusted` test.
+     */
+    async readMachines(controlDatabase) {
+        const [rows, owners] = await Promise.all([controlDatabase.queryCadrePeers(), controlDatabase.queryOwnerKeyRows()]);
+        const chain = await this.chainFor(rows, this.invitationChainSource(controlDatabase, true));
+        const selfPeerId = this.peerId?.toString() ?? null;
+        const machines = describeMachines({
+            partyId: this.partyId,
+            selfPeerId,
+            rows,
+            owners,
+            trusted: (row) => row.peerId !== selfPeerId && this.hasAnchoredProof(row, chain),
+        });
+        return { machines, rows, owners };
+    }
+    /** {@link planMachineRemoval} with the rows it was judged from, which {@link removeMachine} re-vouches dependents by. */
+    async planMachineRemovalWith(controlDatabase, peerId) {
+        const { machines, rows, owners } = await this.readMachines(controlDatabase);
+        const [invites, usages] = await Promise.all([controlDatabase.listCadreInviteStatuses(), controlDatabase.queryCadreInviteUsages()]);
+        const plan = planMachineRemoval({
+            peerId,
+            machines,
+            rows,
+            owners,
+            selfPeerId: this.peerId?.toString() ?? null,
+            selfOwnerKey: this.ownerSigningKeyEnrolledIn(new Set(owners.map((owner) => owner.key)))?.publicKeyB64 ?? null,
+            invites,
+            usages,
+        });
+        return { plan, rows };
+    }
+    /**
+     * The re-vouch step of {@link removeMachine}: every chosen dependent row is rebound to this
+     * node's key BEFORE the removal, so no reader ever judges it against an owner that is gone.
+     * Owners through `ControlDatabase.revouchOwnerKey` (a delete-and-re-add under a fresh stamp,
+     * the only rebinding `OwnerKey.NoUpdate` allows); peers through the owner re-touch
+     * (`reauthorizePeer`), which rewrites `VouchOwner`/`VouchSig` and clears `VouchUsage`.
+     *
+     * The peer re-touch keeps the row's `UpdatedAt` where it is. The owner branch of
+     * `CadrePeer.AuthorizedUpdate` does not require a bump, and bumping a self-published row
+     * would leave its `Sig` unverifiable, so unresolvable and unlisted as self-published, until
+     * the machine's next heartbeat (the NOTE on that constraint); the write-while-alone drain
+     * bumps because it re-issues an otherwise unchanged row, whereas here the voucher itself
+     * changes. A row never self-published carries no stamp to keep and gets the clock.
+     *
+     * A failure rethrows and stops the call before the removal; re-vouches already made stay
+     * (the row is only re-signed by a current owner) and the caller retries. An owner re-vouch
+     * committed alone is not re-issued on growth (the add half has no re-issue path,
+     * `tickets/backlog/debt-owner-key-add-while-alone-has-no-reissue`), so it is logged as
+     * {@link addOwner} logs it; the peer re-touches are re-issued by the existing drain.
+     */
+    async revouchDependents(service, revouch, rows) {
+        for (const key of revouch.owners) {
+            await service.revouchOwner(key);
+            if (this.committedAlone()) {
+                log('removeMachine: re-vouch of owner %s committed while ALONE (0 control connections): the re-added ' +
+                    'owner row is local-only and is not re-issued on cohort growth, so other machines may never see it.', key);
+            }
+        }
+        for (const dependent of revouch.peers) {
+            const row = rows.find((candidate) => candidate.peerId === dependent);
+            const updatedAt = row !== undefined && row.updatedAt > 0 ? row.updatedAt : Date.now();
+            await service.reauthorizePeer(dependent, updatedAt);
+        }
+    }
     /**
      * Create a seed from the current control network state.
      * The seed contains peer information and is signed by an owner.
@@ -7715,6 +8210,29 @@ export class CadreNode {
     // ============================================================================
     // Cadre Invitation API (redeemable at any member, `/sereus/cadre-invite/1.0.0`)
     // ============================================================================
+    /**
+     * Where a device could redeem a cadre invitation minted now from, once this machine is gone
+     * ({@link CadreInvitationReach}): the same member selection {@link createCadreInvitation}
+     * makes, judged without minting anything. `rentNode` reads it to choose between inviting a
+     * provider's container and claiming it; `local-network` counts as not reachable there, since
+     * the container is never on a member's LAN. Requires a started node.
+     */
+    async invitationReach() {
+        if (!this.controlNode) {
+            throw new Error('CadreNode must be started before judging invitation reach');
+        }
+        return (await this.selectInvitationMembers()).reach;
+    }
+    /**
+     * The `members` a cadre invitation minted now would name, and how far they reach: one
+     * selection behind both {@link createCadreInvitation} and {@link invitationReach}, so the
+     * two cannot disagree.
+     */
+    async selectInvitationMembers() {
+        const { siblings, connected } = await this.resolveInvitationSiblings();
+        const members = selectCadreInvitationMembers(await this.resolveInviteAddresses(), siblings, connected);
+        return { members, reach: cadreInvitationReach(members, this.controlNode.peerId.toString()) };
+    }
     /**
      * Mint an owner-signed cadre invitation that a device can redeem at ANY member machine of
      * this party, the owner offline included ({@link redeemCadreInvitation}). Requires the
@@ -7732,9 +8250,13 @@ export class CadreNode {
      * only, never the raw replicated `OwnerKey` table, because the device anchors whatever
      * arrives and a stranger's genesis-inserted key must not ride an invitation into a fresh
      * node's anchor; an empty anchor is refused because a reply could not be checked), and
-     * the addresses of this machine first
-     * ({@link resolveInviteAddresses}, which honours pushed NAT addresses) then up to three
-     * other members ({@link siblingInvitationAddrs}).
+     * at most six addresses: this machine's first ({@link resolveInviteAddresses}, which
+     * honours pushed NAT addresses), then two each of up to three other members
+     * (`selectCadreInvitationMembers`), so the encoded text fits a QR code.
+     *
+     * The result's `reach` says where a device could redeem it from once this machine is gone
+     * (`cadreInvitationReach`, judged on the other members' addresses only), so an app can warn
+     * before handing over an invitation only it could answer.
      *
      * The row commits locally and replicates like any other control write; minted while
      * alone (a phone with no connection), it reaches the other members through the
@@ -7758,7 +8280,7 @@ export class CadreNode {
         if (!Number.isInteger(uses) || uses < 1) {
             throw new Error(`createCadreInvitation: uses must be a positive integer (received ${String(options.uses)})`);
         }
-        const members = [...await this.resolveInviteAddresses(), ...await this.siblingInvitationAddrs()];
+        const { members, reach } = await this.selectInvitationMembers();
         if (members.length === 0) {
             throw new Error('createCadreInvitation: neither this machine nor any other machine of the party has an address a device could dial');
         }
@@ -7780,8 +8302,8 @@ export class CadreNode {
             ownerKeys,
             members,
         };
-        log('Cadre invitation minted: %s (peer=%s owner=%s uses=%d, %d member address(es))', row.key, row.peerId ?? 'any', row.grantsOwner, uses, members.length);
-        return { invitation, encoded: encodeCadreInvitation(invitation) };
+        log('Cadre invitation minted: %s (peer=%s owner=%s uses=%d, %d member address(es), reach=%s)', row.key, row.peerId ?? 'any', row.grantsOwner, uses, members.length, reach);
+        return { invitation, encoded: encodeCadreInvitation(invitation), reach };
     }
     /**
      * Every cadre invitation this node holds — minted here or replicated in — with its
@@ -7818,7 +8340,7 @@ export class CadreNode {
      * Steps: refuse an invitation for another party; pin its `ownerKeys` into the node-local
      * anchor (`'invite'` provenance — the pin sticks even if the redemption then fails, as it
      * does for a seed invite, so a later attempt or seed from the same owner is anchored);
-     * sign the request; dial the listed members in order ({@link redeemAtMembers}); on
+     * sign the request; dial the listed members in order (`redeemAtMembers`); on
      * acceptance verify the reply against the pinned keys, merge its dial hints into the peer
      * store, retain the answering member as a cold-start dial target, refresh the membership
      * gate and start a cohort reconcile pass. This node then syncs the control database over
@@ -7827,11 +8349,20 @@ export class CadreNode {
      * A device that is already a member (a restart with the invitation still configured) is
      * answered as accepted by the member's idempotent redemption, with no second usage row.
      *
+     * One pass over the listed members by default. With `options.waitForMember` the call keeps
+     * making passes while every answer is retryable — for a device redeeming while no
+     * always-on member is up — until a member accepts, one refuses finally, the invitation
+     * expires (thrown as the `invite-spent` refusal) or `options.signal` aborts
+     * (`redeemInPasses`). The request is signed once, before the first pass, and every pass
+     * sends it: its `usageStampId` keys the usage row, so a member that admitted this node on a
+     * pass whose reply was lost answers the next as already a member. `options.onProgress`
+     * reports each pass and pause.
+     *
      * When the invitation grants ownership, the member seats this node's key as an `OwnerKey`
-     * row by consent. The caller still has to wire that key for signing afterwards —
-     * `initializeSeedBootstrap(ownKey)`, which anchors it; never `ensureOwnerKey`, the row is
-     * already there. Other machines derive this node's key into their anchors from the row's
-     * stored proof on their next membership refresh ({@link syncOwnerAnchor}).
+     * row by consent. The caller still has to wire that key for signing afterwards, with
+     * {@link wireOwnKeyIfOwner}; never `ensureOwnerKey`, the row is already there. Other
+     * machines derive this node's key into their anchors from the row's stored proof on their
+     * next membership refresh ({@link syncOwnerAnchor}).
      *
      * Limit: the reply check ({@link verifyRedeemReply}) does not authenticate the member. A
      * forged bundle, or a legitimate one whose addresses were swapped, dials a machine that
@@ -7842,10 +8373,10 @@ export class CadreNode {
      *
      * @throws `CadreInviteRejectedError` on a final refusal, `CadreInviteReplyInvalidError` on
      *   an acceptance that fails the reply check, `CadreInviteUnreachableError` when every
-     *   listed address was tried without an acceptance, and a plain `Error` for the
-     *   preconditions above.
+     *   listed address was tried without an acceptance (one pass only), the signal's reason on
+     *   an abort, and a plain `Error` for the preconditions above.
      */
-    async redeemCadreInvitation(invitation) {
+    async redeemCadreInvitation(invitation, options = {}) {
         const controlNode = this.controlNode;
         if (!controlNode || !this.controlDatabase || !this._running) {
             throw new Error('CadreNode must be started before redeeming a cadre invitation');
@@ -7860,11 +8391,14 @@ export class CadreNode {
         await this.trustOwnerKeys(invitation.ownerKeys, 'invite');
         const pinned = new Set(invitation.ownerKeys);
         const request = signRedeemRequest(invitation, { peerKey: signer.publicKeyB64, peerPrivateKey: signer.privateKeyB64 }, generateStampId(controlNode.peerId.toString()), await this.resolveInviteAddresses());
-        const { reply, memberPeerId, memberAddr } = await redeemAtMembers(controlNode, {
+        const { reply, memberPeerId, memberAddr } = await redeemInPasses(controlNode, {
             invitation,
             request,
             isTrustedIssuer: (ownerKey) => pinned.has(ownerKey),
             linkRoundTripMs: this.config.network?.linkRoundTripMs,
+            waitForMember: options.waitForMember ?? false,
+            ...(options.signal ? { signal: options.signal } : {}),
+            ...(options.onProgress ? { onProgress: options.onProgress } : {}),
         });
         log('Cadre invitation %s redeemed at %s (owner=%s)', invitation.invite.key, memberAddr, reply.invite.grantsOwner);
         const selfPeerId = controlNode.peerId.toString();
@@ -7882,6 +8416,38 @@ export class CadreNode {
         void this.reconcileControlCohort().catch((error) => log('redeemCadreInvitation: the post-redemption reconcile pass failed: %o', error));
         return { peerId: memberPeerId, grantsOwner: reply.invite.grantsOwner, redeemedAt: new Date().toISOString() };
     }
+    /**
+     * If this node's identity key is a live `OwnerKey` here, wire it for signing
+     * ({@link initializeSeedBootstrap}) and return true; otherwise change nothing and return
+     * false. For a machine that joined someone else's cadre by invitation: after an
+     * owner-granting redemption, and on every later start. A redemption seats the request's
+     * `peerKey`, the key behind this node's peer id, so the identity key is the one to look for.
+     *
+     * Unlike `ensureOwnerKey` it never inserts an `OwnerKey` row, so a machine that joined a
+     * cadre can never genesis-insert itself into it, and a non-owner never anchors its own key.
+     * An owner whose key is already wired (an earlier call) is answered true with nothing redone.
+     *
+     * NOTE: a node running the listener-only seed service ({@link enableSeedListener}) cannot be
+     * wired this way: libp2p takes one seed handler, and {@link initializeSeedBootstrap} would
+     * register a second. Nothing that joins by invitation enables the listener today; if one
+     * does, replace the listener here rather than beside it.
+     *
+     * @throws when the node is not started.
+     */
+    async wireOwnKeyIfOwner() {
+        if (!this.controlDatabase || !this._running) {
+            throw new Error('CadreNode must be started before wiring its owner key');
+        }
+        const signingKey = this.getSelfSigningKey();
+        if (!signingKey || !(await this.controlDatabase.getOwnerKeys()).has(signingKey.publicKeyB64)) {
+            log('wireOwnKeyIfOwner: this node\'s key is not an owner here; not wiring it');
+            return false;
+        }
+        if (!this.seedBootstrapService?.canAuthorize()) {
+            await this.initializeSeedBootstrap(signingKey.privateKeyB64);
+        }
+        return true;
+    }
     // ============================================================================
     // Strand Solicitation API (native cadre-core formation transport)
     // ============================================================================
@@ -8010,20 +8576,27 @@ export class CadreNode {
         return await this.strandSolicitationService.createOpenInvitation(sAppId, expirationMs, bootstrap);
     }
     /**
-     * Addresses of the party's other machines for an invitation's bootstrap list — an open
-     * strand invitation's ({@link createOpenInvitation}) or a cadre invitation's
-     * ({@link createCadreInvitation}); {@link selectInvitationSiblingAddrs} picks which. The
-     * source is each authorized member's signed `CadrePeer` record ({@link resolvePeerRecord}),
-     * so a machine whose record is missing, stale or untrusted is left out; live connections
-     * only order them.
+     * Addresses of the party's other machines for an open strand invitation's bootstrap list
+     * ({@link createOpenInvitation}); {@link selectInvitationSiblingAddrs} picks which.
+     */
+    async siblingInvitationAddrs() {
+        const { siblings, connected } = await this.resolveInvitationSiblings();
+        return selectInvitationSiblingAddrs(siblings, connected);
+    }
+    /**
+     * The party's other machines an invitation may name — an open strand invitation
+     * ({@link siblingInvitationAddrs}) or a cadre invitation ({@link createCadreInvitation}) —
+     * and which of them this node is connected to. The source is each authorized member's
+     * signed `CadrePeer` record ({@link resolvePeerRecord}), so a machine whose record is
+     * missing, stale or untrusted is left out; live connections only order them.
      *
      * Best-effort: a failed read leaves the invitation naming this machine alone, which is what
      * it named before siblings were added.
      */
-    async siblingInvitationAddrs() {
+    async resolveInvitationSiblings() {
         const controlNode = this.controlNode;
         if (!controlNode || !this.controlDatabase) {
-            return [];
+            return { siblings: [], connected: new Set() };
         }
         try {
             const siblings = [];
@@ -8033,12 +8606,11 @@ export class CadreNode {
                     siblings.push({ peerId, updatedAt: resolved.updatedAt, addrs: resolved.addrs.map(String) });
                 }
             }
-            const connected = new Set(controlNode.getConnections().map((c) => c.remotePeer.toString()));
-            return selectInvitationSiblingAddrs(siblings, connected);
+            return { siblings, connected: new Set(controlNode.getConnections().map((c) => c.remotePeer.toString())) };
         }
         catch (error) {
             log('siblingInvitationAddrs: resolving the other machines failed; the invitation names only this one: %o', error);
-            return [];
+            return { siblings: [], connected: new Set() };
         }
     }
     /**
@@ -8059,7 +8631,7 @@ export class CadreNode {
             await this.initializeStrandSolicitation();
         }
         const result = await this.strandSolicitationService.formStrand(invitation, disclosure, this.controlNode);
-        await this.recordFormationStrandAddrs(result.strandId, result.strandAddrs);
+        await this.recordFormationStrandAddrs(result.strandId, result.strandAddrs, 'formStrand');
         // A closed host strand's approval carries the joiner's own membership invitation —
         // persist this party's identity key and stage the invitation for bring-up to redeem.
         // Runs AFTER the addr recording so a persistence failure (which throws — see the
@@ -8484,15 +9056,15 @@ export class CadreNode {
      * Nothing else would deliver them: the seed is read only at launch and resume, and the
      * refresh pass skips a peer FRET already holds a record for — the stale one, here.
      */
-    async recordFormationStrandAddrs(strandId, strandAddrs) {
+    async recordFormationStrandAddrs(strandId, strandAddrs, caller) {
         const attributed = [...groupAddrsByPeerId([...strandAddrs]).values()]
             .flatMap((peerAddrs) => peerAddrs.map((addr) => addr.toString()));
         if (attributed.length === 0) {
-            log('formStrand: responder disclosed no usable strand addrs for %s (%d carried) — cross-party seed unchanged', strandId, strandAddrs.length);
+            log('%s: no usable strand addrs for %s (%d carried) — cross-party seed unchanged', caller, strandId, strandAddrs.length);
             return;
         }
         this.formationStrandAddrs.set(strandId, attributed);
-        log('formStrand: kept %d of %d cross-party strand addr(s) for %s', attributed.length, strandAddrs.length, strandId);
+        log('%s: kept %d of %d cross-party strand addr(s) for %s', caller, attributed.length, strandAddrs.length, strandId);
         const runningNode = this.strandManager.getInstance(strandId)?.libp2pNode;
         if (runningNode) {
             await this.mergeStrandPeerAddrs(runningNode, attributed, strandId);