@serfab/cadre-core 1.16.0 → 1.18.0

package/src/joined-strand-store.ts

@@ -2,7 +2,7 @@
  * The strands this party joined from ANOTHER party, held in two records.
  *
  * A party's own strands come back after a restart through its control database: the
- * `Strand` table holds their rows, the strand watcher polls it, and each row no sApp
+ * `Strand` table holds their rows, the strand watcher reads it, and each row no sApp
  * config claims is offered as `strand:discovered`. A strand joined through formation with
  * another party (`CadreNode.formStrand`) has its `Strand` row in the OTHER party's control
  * database, so it needs a record of its own (gotchoices/sereus#18):
@@ -17,7 +17,7 @@
  *    published". A machine that is not an owner never publishes; its joins stay here.
  *
  * {@link JoinedStrandSession} moves joins between the two and is what the strand watcher
- * polls beside the control rows.
+ * reads beside the control rows.
  *
  * Two store implementations:
  *  - {@link MemoryJoinedStrandStore} — joins die with the process. The default only for a
@@ -69,11 +69,15 @@ export interface JoinedStrandStore {
 
 /**
  * The {@link StrandRow} a record stands for — the shape `addStrand` and `strand:discovered`
- * carry. `FounderOwnerKey` is null because a joiner never founds; `CadreNode.launchStrand`
- * reads null as "not mine" and joins.
+ * carry. The founder columns are null because a joiner never founds; `CadreNode.launchStrand`
+ * reads a null `FounderPeerId` as "not mine" and joins.
  */
 export function joinedStrandRow(record: JoinedStrandRecord): StrandRow {
-	return { Id: record.Id, Type: record.Type, MemberPrivateKey: record.MemberPrivateKey, FounderOwnerKey: null };
+	return { Id: record.Id, Type: record.Type, MemberPrivateKey: record.MemberPrivateKey, FounderOwnerKey: null, FounderPeerId: null };
+}
+
+function isSameJoin(record: JoinedStrandRecord, row: StrandRow): boolean {
+	return record.Type === row.Type && record.MemberPrivateKey === row.MemberPrivateKey;
 }
 
 /**
@@ -124,9 +128,9 @@ const SLOT_PREFIX = 'cadre/joined-strand/';
  * arbitrary text, and base64url never contains the `/` that ends the segment.
  *
  * Loads every slot once, at the first {@link list}, then answers from memory and writes
- * through, so the strand watcher's five-second poll does not read the enclave on every
- * pass. A load that fails — `KeyStoreAccessError` from a refused unlock prompt, say —
- * is rethrown rather than read as "no joins" and retried at the next call, exactly as
+ * through, so a strand watcher run does not read the enclave each time. A load that
+ * fails — `KeyStoreAccessError` from a refused unlock prompt, say — is rethrown rather
+ * than read as "no joins" and retried at the next call, exactly as
  * `loadOrCreateIdentityKey` treats the identity slot. A slot that does not parse as a
  * record for its own id is dropped with a log and its siblings kept: refusing to start
  * repairs nothing, and the other joins are still good.
@@ -176,9 +180,10 @@ export class KeyStoreJoinedStrandStore implements JoinedStrandStore {
 		return result;
 	}
 
-	// NOTE: a failed load is retried at the next list(), which is every strand-watcher poll;
-	// over a backend that gates reads behind an unlock prompt the user keeps declining, that
-	// is a prompt every five seconds. Every KeyStore shipped today is ungated for this reason
+	// NOTE: a failed load is retried at the next list(), which is every strand-watcher run (a
+	// change to `Strand` or `JoinedStrand`, a local join, a retry, the backstop); over a backend
+	// that gates reads behind an unlock prompt the user keeps declining, that is a prompt per
+	// run. Every KeyStore shipped today is ungated for this reason
 	// (see `SecureStoreKeyStoreOptions.requireAuthentication`); if one is ever gated, back
 	// off the retry here.
 	private async loaded(): Promise<Map<string, JoinedStrandRecord>> {
@@ -234,7 +239,7 @@ function parseRecord(strandId: string, bytes: Uint8Array): JoinedStrandRecord |
  * key; this module sees only the seam, so it stays free of the runtime.
  */
 export interface PartyJoinedStrandLedger {
-	/** Every party-wide join, as offerable rows (`FounderOwnerKey: null`). */
+	/** Every party-wide join, as offerable rows (null founder columns). */
 	list(): Promise<StrandRow[]>;
 	/** Whether this party's control database names `strandId`, as its own strand or as a party-wide join. */
 	names(strandId: string): Promise<boolean>;
@@ -251,7 +256,7 @@ export interface PartyJoinedStrandLedger {
  * the moves between them. Rebuilt at every start, which is what ends the per-session state
  * below.
  *
- * The watcher reads a row missing from a poll as a removal and detaches the strand, so this
+ * The watcher reads a row missing from a run's read as a removal and detaches the strand, so this
  * holds the state a plain union would get wrong:
  *  - the last list each record answered, reused when a later read fails, so a failed read
  *    is not "every join was forgotten";
@@ -262,6 +267,8 @@ export interface PartyJoinedStrandLedger {
 export class JoinedStrandSession {
 	private lastUnpublished: JoinedStrandRecord[] = [];
 	private lastPartyWide: StrandRow[] = [];
+	/** Whether the last party-wide read in {@link withControlRows} succeeded; see {@link lastReadPartial}. */
+	private lastPartyWideFresh = true;
 	private readonly keptForSession = new Map<string, StrandRow>();
 	/** Strands whose party-wide row {@link syncWithParty} removes, queued by a self-revocation. */
 	private readonly pendingRemovals = new Set<string>();
@@ -272,13 +279,23 @@ export class JoinedStrandSession {
 	 */
 	private exclusive: Promise<unknown> = Promise.resolve();
 
-	constructor(private readonly store: JoinedStrandStore, private readonly ledger: PartyJoinedStrandLedger) {}
+	/**
+	 * @param onLocalChange - Called after a move changes what {@link withControlRows} merges in
+	 *   from outside the control database (this machine's unpublished joins, the joins kept for
+	 *   this session), which no control-table change event reports. `CadreNode` wakes its strand
+	 *   watcher with it.
+	 */
+	constructor(
+		private readonly store: JoinedStrandStore,
+		private readonly ledger: PartyJoinedStrandLedger,
+		private readonly onLocalChange: () => void = () => {}
+	) {}
 
 	/**
 	 * `control` plus every join, one row per id, in this precedence: the control rows (the
 	 * party's own strands), then the party-wide joins, then this machine's unpublished joins
 	 * and the joins kept for this session. A local record named by either of the first two in
-	 * a read that succeeded this poll is stale — published, or the strand is the party's own
+	 * a read that succeeded this run is stale — published, or the strand is the party's own
 	 * now — so it is forgotten here; this also cleans up after a crash between a publish and
 	 * its local forget. One named only by the last-good party-wide list is kept: that list may
 	 * predate a leave the record re-joined after.
@@ -289,7 +306,7 @@ export class JoinedStrandSession {
 		const offered = new Map<string, StrandRow>(control.map((row) => [row.Id, row]));
 		const partyWide = await this.partyWide();
 		// NOTE: a party-wide join whose id the party's own `Strand` table also holds (the party
-		// founded AND joined it — contrived) is shadowed here, not deleted: a watcher poll must
+		// founded AND joined it — contrived) is shadowed here, not deleted: a watcher run must
 		// not make owner-signed writes. If the party later unpublishes its own row the join row
 		// resurfaces; if that is ever seen, remove the join row inside `unpublishStrand`.
 		for (const row of partyWide.rows) {
@@ -317,10 +334,18 @@ export class JoinedStrandSession {
 		return [...offered.values()];
 	}
 
+	/**
+	 * True when the last {@link withControlRows} offered the party-wide joins from the last
+	 * list that answered, because its read of `JoinedStrand` failed.
+	 */
+	lastReadPartial(): boolean {
+		return !this.lastPartyWideFresh;
+	}
+
 	/**
 	 * This machine's unpublished joins, straight from the store (never the last-good list a
 	 * failed read stands in with). What a strand move exports beside the `JoinedStrand`
-	 * table: a machine publishes only while it holds a control connection, so until then its
+	 * table: a machine publishes only while a sibling is reachable, so until then its
 	 * joins live only here.
 	 */
 	unpublishedRecords(): Promise<JoinedStrandRecord[]> {
@@ -331,21 +356,32 @@ export class JoinedStrandSession {
 	async remember(record: JoinedStrandRecord): Promise<void> {
 		this.pendingRemovals.delete(record.Id);
 		await this.store.record(record);
+		this.onLocalChange();
 	}
 
 	/**
 	 * Record `row`, joined by `addStrand`, unless this party's control database already names
 	 * it (its own strand, or a join already published) or an identical record is already here
-	 * (an app re-claiming a remembered join on every start). Keeps the first `joinedAt`. Like
+	 * (an app re-claiming a remembered join on every start, or `addStrand` right after
+	 * `formStrand`). The store is asked first: it answers from memory once loaded, so the
+	 * common re-claim reads no control row. Keeps the first `joinedAt`. Like
 	 * {@link remember}, cancels a queued removal.
 	 */
 	async rememberForeign(row: StrandRow): Promise<void> {
 		this.pendingRemovals.delete(row.Id);
+		const early = await this.storedRecord(row.Id).catch((error: unknown) => {
+			// Asked again below only when the party does not name the strand; a second failure throws.
+			log('joined strand %s: store lookup failed; asking the control database first: %o', row.Id, error);
+			return null;
+		});
+		if (early && isSameJoin(early, row)) {
+			return;
+		}
 		if (await this.namedByParty(row.Id)) {
 			return;
 		}
-		const existing = (await this.store.list()).find((record) => record.Id === row.Id);
-		if (existing?.Type === row.Type && existing.MemberPrivateKey === row.MemberPrivateKey) {
+		const existing = early === null ? await this.storedRecord(row.Id) : early;
+		if (existing && isSameJoin(existing, row)) {
 			return;
 		}
 		await this.store.record({
@@ -354,6 +390,7 @@ export class JoinedStrandSession {
 			MemberPrivateKey: row.MemberPrivateKey,
 			joinedAt: existing?.joinedAt ?? Date.now()
 		});
+		this.onLocalChange();
 	}
 
 	/**
@@ -367,6 +404,7 @@ export class JoinedStrandSession {
 			this.keptForSession.delete(strandId);
 			this.lastPartyWide = this.lastPartyWide.filter((row) => row.Id !== strandId);
 			await this.store.forget(strandId);
+			this.onLocalChange();
 		});
 	}
 
@@ -385,13 +423,14 @@ export class JoinedStrandSession {
 			if (!row) {
 				return;
 			}
-			// Kept BEFORE the store forgets, so no poll can union without it. Queued even for a
+			// Kept BEFORE the store forgets, so no watcher run can union without it. Queued even for a
 			// local-only join, which a sibling may have published already.
 			this.keptForSession.set(strandId, row);
 			this.pendingRemovals.add(strandId);
 			if (local) {
 				await this.store.forget(strandId);
 			}
+			this.onLocalChange();
 		});
 	}
 
@@ -423,15 +462,16 @@ export class JoinedStrandSession {
 	}
 
 	// NOTE: a sibling that joined the same strand and has not yet published publishes it after
-	// a leave, bringing the strand back party-wide. Needs two devices joining one strand within
-	// a reconcile interval of the leave; if it is ever seen, check the strand's `Revocation`
+	// a leave, bringing the strand back party-wide. Needs a second device to have joined the
+	// strand and not yet run a connected reconcile pass when the leave lands (a join starts no
+	// pass, so up to the 2-minute backstop); if it is ever seen, check the strand's `Revocation`
 	// tombstone before publishing.
 	private async publish(record: JoinedStrandRecord): Promise<void> {
 		try {
 			if (!(await this.ledger.names(record.Id))) {
 				await this.ledger.publish(record);
 				// Into the last-good list too: its local record goes next, so a party-wide read that
-				// fails before one succeeds would otherwise drop the strand from the poll and hide it
+				// fails before one succeeds would otherwise drop the strand from the watcher's read and hide it
 				// from a self-revocation.
 				this.lastPartyWide = [...this.lastPartyWide.filter((row) => row.Id !== record.Id), joinedStrandRow(record)];
 				log('joined strand %s published party-wide (party=%s)', record.Id, this.store.partyId);
@@ -457,19 +497,20 @@ export class JoinedStrandSession {
 	private async partyWide(): Promise<{ rows: StrandRow[]; fresh: boolean }> {
 		try {
 			this.lastPartyWide = await this.ledger.list();
-			return { rows: this.lastPartyWide, fresh: true };
+			this.lastPartyWideFresh = true;
 		} catch (error) {
 			log('party-wide joined-strand read failed; offering the last list it answered (%d join(s)): %o',
 				this.lastPartyWide.length, error);
-			return { rows: this.lastPartyWide, fresh: false };
+			this.lastPartyWideFresh = false;
 		}
+		return { rows: this.lastPartyWide, fresh: this.lastPartyWideFresh };
 	}
 
 	/**
 	 * {@link PartyJoinedStrandLedger.names}, answering false when the control database cannot
 	 * be read (a machine cut off from its party before it received the `JoinedStrand` block).
 	 * Recording is the safe side: a local record the party turns out to name is forgotten by
-	 * the next poll that reads it, while a join with no record is not offered after a restart.
+	 * the next watcher run that reads it, while a join with no record is not offered after a restart.
 	 */
 	private async namedByParty(strandId: string): Promise<boolean> {
 		try {
@@ -480,6 +521,10 @@ export class JoinedStrandSession {
 		}
 	}
 
+	private async storedRecord(strandId: string): Promise<JoinedStrandRecord | undefined> {
+		return (await this.store.list()).find((record) => record.Id === strandId);
+	}
+
 	/** Run `work` after every earlier serialized move settles; see {@link exclusive}. */
 	private serialized<T>(work: () => Promise<T>): Promise<T> {
 		const result = this.exclusive.then(work);
@@ -502,7 +547,7 @@ export class JoinedStrandSession {
 			await this.store.forget(strandId);
 			log('joined strand %s is named by this party\'s control database — local record forgotten', strandId);
 		} catch (error) {
-			log('forgetting superseded joined strand %s failed; the next poll retries: %o', strandId, error);
+			log('forgetting superseded joined strand %s failed; the next watcher run retries: %o', strandId, error);
 		}
 	}
 }

package/src/key-store.ts

@@ -2,10 +2,10 @@
  * Backend-agnostic store for raw private key material.
  *
  * Mobile cadre nodes hold sensitive key material at rest: the libp2p
- * peer/node identity key and (in the single-key reference model) the owner
- * signing key derived from it. This module defines the seam those keys flow
- * through so a platform-secure backend (iOS Keychain / Android Keystore) can be
- * plugged in without `@serfab/cadre-core` taking any platform dependency.
+ * peer/node identity key and, on a device the user made an owner, an owner key
+ * in a slot of its own (`owner-key-store.ts`). This module defines the seam those
+ * keys flow through so a platform-secure backend (iOS Keychain / Android Keystore)
+ * can be plugged in without `@serfab/cadre-core` taking any platform dependency.
  *
  * This file is dependency-free (no node:/RN imports) so it is safe in every
  * entry graph. The Node reference {@link FileKeyStore} lives in a separate
@@ -23,6 +23,12 @@ export type KeyId = string;
  */
 export const DEFAULT_IDENTITY_KEY_ID: KeyId = 'cadre/identity';
 
+/**
+ * Default slot id for an owner key (`owner-key-store.ts`). Not party-scoped: one
+ * owner key may own several cadres, each owner signature binding its party id.
+ */
+export const DEFAULT_OWNER_KEY_ID: KeyId = 'cadre/owner';
+
 /**
  * Backend-agnostic store for raw private key material. Implementations may be
  * file-based, OS-keyring, or platform secure-enclave backed (iOS Keychain /

package/src/link-budget.ts

@@ -392,13 +392,15 @@ export const PUSH_TRANSFER_ALLOWANCE_MS = 6000;
  *   every members-only protocol from the materialized snapshot, and unplaced
  *   relay reservations stay capped (`MAX_UNAUTHORIZED_RELAY_RESERVATIONS`).
  * - **The slow case is bring-up, not steady state.** A membership read consults
- *   the cohort only for a block this node does not hold, or before the
- *   `Revocation` ledger marker exists; once the marker exists every block the
- *   decision reads is held (`control-founding-consult-budget.spec.ts` pins both
- *   states). So the gate always fails open only on a node whose membership reads
- *   still consult: one consult costs about two link round trips, and asking a
- *   silent peer costs the per-peer read deadline ({@link cohortReadDeadlineMs}, 7 s
- *   at the default declaration).
+ *   the cohort only for a block this node does not hold: before a joining
+ *   machine has read it from the cohort, or for a table nobody has written on a
+ *   party founded before genesis created every control collection. Otherwise
+ *   every block the decision reads is held
+ *   (`control-founding-consult-budget.spec.ts` pins that). So the gate always
+ *   fails open only on a node whose membership reads still consult: one consult
+ *   costs about two link round trips, and asking a silent peer costs the
+ *   per-peer read deadline ({@link cohortReadDeadlineMs}, 7 s at the default
+ *   declaration).
  * - **The decision is spent on the dialing machine's clock.** libp2p's listener
  *   runs this gate before it answers the multiplexer negotiation the dialer is
  *   waiting on (`libp2p/dist/src/upgrader.js`), and the listener's own

package/src/machine-removal.ts

@@ -1,17 +1,15 @@
 /**
- * Removing a machine from a cadre: the listing an app shows (`CadreNode.listMachines`), the
- * read-only plan behind its confirmation step (`CadreNode.planMachineRemoval`), and the
- * check that a requested re-vouch stays inside that plan. Pure projections over rows the
- * node has already read; the reads and writes themselves are `CadreNode.removeMachine`'s and
- * `ControlDatabase.removeMachine`'s.
+ * Removing a machine from a cadre: the listing an app shows (`CadreNode.listMachines`) and the
+ * read-only plan behind its confirmation step (`CadreNode.planMachineRemoval`). Pure
+ * projections over rows the node has already read; the reads and writes themselves are
+ * `CadreNode.removeMachine`'s and `ControlDatabase.removeMachine`'s.
  *
- * A machine's owner key is its own identity key: an owner-granting invitation seats
- * `OwnerKey.Key = CadrePeer.PublicKey`, and `addOwner` takes the key behind a peer id. So
- * "this machine is an owner" is "the ed25519 key behind its peer id is a live `OwnerKey`",
- * and an owner key with no machine row is still listed, as the machine it names.
+ * A machine is a `CadrePeer` row and nothing more: an owner key is the person's, so removing a
+ * machine leaves every owner key standing, the one the machine's user signed with included
+ * (removing one is `CadreNode.removeOwner`, `owner-keys.ts`).
  */
 
-import { ed25519PublicKeyB64FromPeerId, peerIdFromEd25519PublicKeyB64 } from './ed25519-key.js';
+import { ed25519PublicKeyB64FromPeerId } from './ed25519-key.js';
 import { verifyPeerRecordSignature } from './peer-record.js';
 import type {
   CadreInviteStatus,
@@ -20,8 +18,6 @@ import type {
   CadrePeerRow,
   MachineRemovalPlan,
   MachineRemovalRefusal,
-  OwnerKeyRow,
-  RemoveMachineOptions,
 } from './types.js';
 
 /**
@@ -42,8 +38,7 @@ export class MachineRemovalRefusedError extends Error {
 
 const MACHINE_REMOVAL_REFUSAL_REASON: Record<MachineRemovalRefusal, string> = {
   'not-an-owner': 'this node holds no enrolled owner key',
-  'self': 'an owner cannot remove its own machine; ask another owner',
-  'last-owner': 'it holds the only live owner key',
+  'self': 'it is this node; leaving a cadre is stopping the node and deleting its data',
 };
 
 /** What {@link describeMachines} projects from: one node's live rows and its own predicate. */
@@ -52,45 +47,21 @@ export interface MachineListingInput {
   selfPeerId: string | null;
   /** Live `CadrePeer` rows (`ControlDatabase.queryCadrePeers`). */
   rows: readonly CadrePeerRow[];
-  /** Live `OwnerKey` rows (`ControlDatabase.queryOwnerKeyRows`). */
-  owners: readonly OwnerKeyRow[];
   /** This node's authorized-membership predicate for one row (`CadreNode.listAuthorizedMembers`'s). */
   trusted: (row: CadrePeerRow) => boolean;
 }
 
 /**
- * One entry per live `CadrePeer` row, then one per live `OwnerKey` whose key derives a peer
- * id with no row. `profile` and `lastPublishedAt` are reported only when the row's
- * self-signature verifies under the key behind its peer id, as `CadreNode.resolvePeerAddrs`
- * judges the same record: no insert rule constrains `Profile`, and an owner re-vouch may
- * bump `UpdatedAt` without re-signing.
+ * One entry per live `CadrePeer` row. `profile` and `lastPublishedAt` are reported only when
+ * the row's self-signature verifies under the key behind its peer id, as
+ * `CadreNode.resolvePeerAddrs` judges the same record: no insert rule constrains `Profile`, and
+ * an owner re-vouch may bump `UpdatedAt` without re-signing.
  */
 export function describeMachines(input: MachineListingInput): CadreMachine[] {
-  const ownerKeys = new Set(input.owners.map((owner) => owner.key));
-  const machines = input.rows.map((row) => describeMemberRow(input, row, ownerKeys));
-  const listed = new Set(machines.map((machine) => machine.peerId));
-  for (const owner of input.owners) {
-    const peerId = peerIdFromEd25519PublicKeyB64(owner.key);
-    if (peerId === null || listed.has(peerId)) {
-      continue;
-    }
-    listed.add(peerId);
-    machines.push({
-      peerId,
-      publicKey: owner.key,
-      isSelf: peerId === input.selfPeerId,
-      isOwner: true,
-      isMember: false,
-      trusted: false,
-      profile: null,
-      lastPublishedAt: null,
-      vouchedBy: owner.vouchOwner,
-    });
-  }
-  return machines;
+  return input.rows.map((row) => describeMemberRow(input, row));
 }
 
-function describeMemberRow(input: MachineListingInput, row: CadrePeerRow, ownerKeys: ReadonlySet<string>): CadreMachine {
+function describeMemberRow(input: MachineListingInput, row: CadrePeerRow): CadreMachine {
   const publicKey = ed25519PublicKeyB64FromPeerId(row.peerId);
   const selfPublished = publicKey !== null && row.publicKey === publicKey && row.sig !== null
     && verifyPeerRecordSignature(input.partyId, {
@@ -105,8 +76,6 @@ function describeMemberRow(input: MachineListingInput, row: CadrePeerRow, ownerK
     peerId: row.peerId,
     publicKey,
     isSelf: row.peerId === input.selfPeerId,
-    isOwner: publicKey !== null && ownerKeys.has(publicKey),
-    isMember: true,
     trusted: input.trusted(row),
     profile: selfPublished ? row.profile : null,
     lastPublishedAt: selfPublished ? row.updatedAt : null,
@@ -118,99 +87,45 @@ function describeMemberRow(input: MachineListingInput, row: CadrePeerRow, ownerK
 export interface MachineRemovalPlanInput {
   peerId: string;
   machines: readonly CadreMachine[];
-  rows: readonly CadrePeerRow[];
-  owners: readonly OwnerKeyRow[];
   selfPeerId: string | null;
-  /** This node's enrolled owner key (`CadreNode.enrolledOwnerSigningKey`), or null when it cannot sign owner writes. */
-  selfOwnerKey: string | null;
+  /** Whether this node's owner signer is an enrolled owner (`CadreNode.ownerSignerEnrolledIn`), so it can sign the removal. */
+  canSign: boolean;
   invites: readonly CadreInviteStatus[];
   usages: readonly CadreInviteUsageRow[];
 }
 
 /**
- * The plan for removing `peerId` from these rows. The refusals come first and by name: a
- * node that cannot sign, the node itself (an owner cannot sign its own `OwnerKey` removal;
- * refusing the whole self-removal keeps one rule for owners and non-owners), and a machine
- * holding the only live owner key. The last cannot coexist with this node being a different
- * owner, but the local count can be wrong under concurrency, so the name stays.
- *
- * `dependents` are the rows the machine's owner key vouched, which every reader judges
- * against its anchor through `VouchOwner`: once the key is removed they stop passing the
- * membership predicate on every machine unless re-vouched first. This node's own rows are
- * reported as `ownDependency` instead, since it cannot re-vouch them itself.
+ * The plan for removing `peerId` from these rows. The refusals come first and by name: a node
+ * that cannot sign, and the node itself (leaving a cadre is the embedder's flow, which stops
+ * the node and deletes its data; the removal notice a machine acts on is built around another
+ * machine removing it).
  *
  * `invitations` are the live ones the machine could redeem to come back: targeted at it,
  * or already redeemed by it and still redeemable (a multi-use invitation, or an open
- * owner invitation inside its lifetime). The schema's rule: keeping a device out is removing
+ * invitation inside its lifetime). The schema's rule: keeping a device out is removing
  * its row and withdrawing the invitation.
  */
 export function planMachineRemoval(input: MachineRemovalPlanInput): MachineRemovalPlan {
-  const machine = input.machines.find((candidate) => candidate.peerId === input.peerId) ?? null;
-  const key = machine?.isOwner ? machine.publicKey : null;
-  const refusal = refusalFor(input, machine);
-  const removesOwnerKey = key !== null;
   return {
-    machine,
-    refusal,
-    removesOwnerKey,
-    dependents: removesOwnerKey ? dependentsOf(input, key) : { owners: [], peers: [] },
+    machine: input.machines.find((candidate) => candidate.peerId === input.peerId) ?? null,
+    refusal: refusalFor(input),
     invitations: invitationsOpenTo(input),
-    ownDependency: removesOwnerKey && isOwnDependency(input, key),
   };
 }
 
-function refusalFor(input: MachineRemovalPlanInput, machine: CadreMachine | null): MachineRemovalRefusal | null {
-  if (input.selfOwnerKey === null) {
+function refusalFor(input: MachineRemovalPlanInput): MachineRemovalRefusal | null {
+  if (!input.canSign) {
     return 'not-an-owner';
   }
   if (input.peerId === input.selfPeerId) {
     return 'self';
   }
-  if (machine?.isOwner && input.owners.length <= 1) {
-    return 'last-owner';
-  }
   return null;
 }
 
-function dependentsOf(input: MachineRemovalPlanInput, key: string): MachineRemovalPlan['dependents'] {
-  return {
-    owners: input.owners
-      .filter((owner) => owner.vouchOwner === key && owner.key !== key && owner.key !== input.selfOwnerKey)
-      .map((owner) => owner.key),
-    peers: input.rows
-      .filter((row) => row.vouchOwner === key && row.peerId !== input.peerId && row.peerId !== input.selfPeerId)
-      .map((row) => row.peerId),
-  };
-}
-
-function isOwnDependency(input: MachineRemovalPlanInput, key: string): boolean {
-  const ownRow = input.rows.find((row) => row.peerId === input.selfPeerId);
-  const ownOwner = input.owners.find((owner) => owner.key === input.selfOwnerKey);
-  return ownRow?.vouchOwner === key || ownOwner?.vouchOwner === key;
-}
-
 function invitationsOpenTo(input: MachineRemovalPlanInput): string[] {
   const redeemed = new Set(input.usages.filter((usage) => usage.peerId === input.peerId).map((usage) => usage.inviteKey));
   return input.invites
     .filter((status) => status.live && (status.invite.peerId === input.peerId || redeemed.has(status.invite.key)))
     .map((status) => status.invite.key);
 }
-
-/**
- * The re-vouch a caller asked for, checked against the plan: every key and peer must be in
- * `plan.dependents`, so a caller cannot re-vouch a row the removed owner never vouched (nor
- * the machine itself, which `dependents.peers` excludes). Throws naming the offenders, before
- * `CadreNode.removeMachine` writes anything. Duplicates are dropped.
- */
-export function revouchWithinPlan(plan: MachineRemovalPlan, revouch: RemoveMachineOptions['revouch']): MachineRemovalPlan['dependents'] {
-  const owners = [...new Set(revouch?.owners ?? [])];
-  const peers = [...new Set(revouch?.peers ?? [])];
-  const strayOwners = owners.filter((key) => !plan.dependents.owners.includes(key));
-  const strayPeers = peers.filter((peerId) => !plan.dependents.peers.includes(peerId));
-  if (strayOwners.length > 0 || strayPeers.length > 0) {
-    throw new Error(
-      `removeMachine: re-vouch names rows the removed machine did not vouch: ${[...strayOwners, ...strayPeers].join(', ')}`,
-    );
-  }
-  return { owners, peers };
-}