@serfab/cadre-core 1.16.0 → 1.18.0

package/src/seed-bootstrap.ts

@@ -1,6 +1,6 @@
 import debug from 'debug';
 import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
-import { digest, sign, verify, getPublicKey } from '@optimystic/quereus-plugin-crypto';
+import { digest, verify } from '@optimystic/quereus-plugin-crypto';
 import type { Libp2p, Connection, PeerId, Stream } from '@libp2p/interface';
 import { multiaddr, type Multiaddr } from '@multiformats/multiaddr';
 import { peerIdFromString } from '@libp2p/peer-id';
@@ -17,6 +17,7 @@ import { relayedRequestBudgetMs } from './link-budget.js';
 import type {
   ControlNetworkSeed,
   SeedPeer,
+  SeedDialTarget,
   SeedMessage,
   SeedAckMessage,
   SeedRefusalCode,
@@ -26,14 +27,15 @@ import type {
   AddDroneOptions,
   DroneInitResult,
   CadreInviteRow,
+  OwnerGrantRow,
   NodeProfile,
   PeerAddressRecord,
   DeviceTokenRecord,
   RevocationRow,
-  RevocationLedgerOpenResult
+  MachineRemovalResult
 } from './types.js';
-import type { ControlDatabase, MachineRemovalWrites } from './control-database.js';
-import { generateStampId } from './control-database.js';
+import type { CadrePeerRetouchMode, CadrePeerRetouchOutcome, ControlDatabase } from './control-database.js';
+import { generateStampId, ownerKeyLabel } from './control-database.js';
 import { canonicalJson } from './canonical-json.js';
 import { deviceTokenAddDigest } from './peer-authorization.js';
 import { ed25519PublicKeyB64FromPeerId } from './ed25519-key.js';
@@ -43,6 +45,8 @@ import {
   anchoredTrustPolicy,
 } from './seed-trust-policy.js';
 import type { TrustedOwnerStore } from './trusted-owner-store.js';
+import { withinOwnerApproval, type OwnerSign, type OwnerSigner } from './owner-signer.js';
+import { namedOwnerKey } from './owner-keys.js';
 
 const log = debug('sereus:cadre:seed-bootstrap');
 
@@ -114,7 +118,29 @@ export function seedDigest(seed: Pick<ControlNetworkSeed, 'partyId' | 'peers'>):
 }
 
 /**
- * An {@link ApplySeedResult} for a seed refused before the owner-dial loop ran,
+ * The peers `seed` nominates for dialing: its preferred peers (`SeedPeer.preferred`: the machine
+ * that minted it and every always-on machine) that have an address and are not `selfPeerId`.
+ *
+ * Self is dropped because `createSeed` projects every non-revoked CadrePeer row, so a preferred
+ * machine applying a seed minted after it joined finds itself in the list, and a dial of self
+ * always throws. An undefined `selfPeerId` matches nothing.
+ */
+export function seedDialTargets(seed: ControlNetworkSeed, selfPeerId: string | undefined): SeedDialTarget[] {
+  return seed.peers
+    .filter((peer) => peer.preferred && peer.multiaddrs.length > 0 && peer.peerId !== selfPeerId)
+    .map(({ peerId, multiaddrs }) => ({ peerId, multiaddrs }));
+}
+
+/** Add `relayAddr` to the entry for `selfPeerId` in `peers`, when that entry exists and lacks it. */
+function addSelfRelayAddr(peers: SeedPeer[], selfPeerId: string, relayAddr: string): void {
+  const self = peers.find((peer) => peer.peerId === selfPeerId);
+  if (self && !self.multiaddrs.includes(relayAddr)) {
+    self.multiaddrs.push(relayAddr);
+  }
+}
+
+/**
+ * An {@link ApplySeedResult} for a seed refused before the dial loop ran,
  * so the dial counters read zero rather than being absent.
  */
 function seedRejected(error: string, code?: SeedRefusalCode): ApplySeedResult {
@@ -123,8 +149,8 @@ function seedRejected(error: string, code?: SeedRefusalCode): ApplySeedResult {
     peersAdded: 0,
     error,
     ...(code !== undefined ? { code } : {}),
-    ownerDialsAttempted: 0,
-    ownerDialsFailed: 0,
+    preferredDialsAttempted: 0,
+    preferredDialsFailed: 0,
   };
 }
 
@@ -138,8 +164,8 @@ interface SeedApplyOptions {
   remotePeerId?: string;
 }
 
-/** What dialing a seed's owner peers produced — the owner-dial half of an {@link ApplySeedResult}. */
-type OwnerDialCounts = Pick<ApplySeedResult, 'ownerDialsAttempted' | 'ownerDialsFailed'>;
+/** What dialing a seed's preferred peers produced — the dial half of an {@link ApplySeedResult}. */
+type PreferredDialCounts = Pick<ApplySeedResult, 'preferredDialsAttempted' | 'preferredDialsFailed'>;
 
 /**
  * Parse each address, dropping (and logging) any that is malformed, so one bad
@@ -209,10 +235,12 @@ function deliveryDialAddrs(peerId: string, addrs: readonly string[]): Multiaddr[
 export interface SeedBootstrapConfig {
   /** Party ID for this cadre */
   partyId: string;
-  /** Owner private key for signing seeds and peer authorizations (base64url) */
-  ownerPrivateKey?: string;
-  /** Owner public key (base64url) - derived from private key if not provided */
-  ownerPublicKey?: string;
+  /**
+   * The owner signer every seed and owner-signed write of this service goes through
+   * (`owner-signer.ts`). Unset for a listener-only service, which receives and applies seeds
+   * but refuses every owner write.
+   */
+  ownerSigner?: OwnerSigner;
   /**
    * Trust anchor for incoming seeds. Decides whether a signature-verified
    * `signerKey` should be trusted, against the receiver's anchored owner
@@ -269,7 +297,7 @@ export interface SeedBootstrapConfig {
    * sized for the forms that dial inside it. Delivery does not set `runOnLimitedConnection`,
    * so it does not use a limited relayed connection today; the relayed-dial count is the upper
    * bound on the dial it can use, the same choice `CadreNode.controlDialBudget` makes for every
-   * address. It holds only link work because the receiver acks before its owner dials.
+   * address. It holds only link work because the receiver acks before it dials the seed's peers.
    *
    * NOTE: no transfer allowance — a seed is a peer list of a few KB, and `MAX_SEED_SIZE` (1 MiB)
    * is a defensive cap. If seeds ever grow toward that cap, add an allowance the way
@@ -278,7 +306,7 @@ export interface SeedBootstrapConfig {
   seedDeliverTimeoutMs?: number;
   /**
    * Time limits for each peer this service dials from a list of addresses —
-   * {@link SeedBootstrapService.applySeed}'s owner dials and
+   * {@link SeedBootstrapService.applySeed}'s dials of the seed's preferred peers and
    * {@link SeedBootstrapService.deliverSeed}'s dial of a peer id with addresses — per
    * address and per peer (see `peer-dial.ts`). Defaults to {@link DEFAULT_PEER_DIAL_BUDGET}; a `CadreNode`
    * passes its `network.controlCohort` limits.
@@ -293,12 +321,13 @@ export interface SeedEventCallbacks {
   /** Called when a seed is received via the protocol */
   onSeedReceived?: (partyId: string, peerId: string) => void;
   /**
-   * Called when a seed is successfully applied.
+   * Called when a seed delivered over the protocol has been verified, merged and
+   * acknowledged; the dials of its preferred peers follow, so this waits on no connection.
    *
    * `seed` is the applied seed itself: the inbound protocol handler applies it
    * INSIDE the service, so this callback is the only seam through which a
    * `CadreNode` sees a wire-delivered seed's contents — which it needs to
-   * retain the owner-flagged peers as cold-start bootstrap dial targets.
+   * retain the preferred peers as cold-start bootstrap dial targets.
    */
   onSeedApplied?: (partyId: string, peersAdded: number, seed: ControlNetworkSeed) => void;
   /** Called when seed application fails */
@@ -316,7 +345,6 @@ export class SeedBootstrapService {
   private readonly config: SeedBootstrapConfig;
   private libp2pNode: Libp2p | null = null;
   private controlDatabase: ControlDatabase | null = null;
-  private readonly ownerPublicKey: string | null;
   private readonly trustPolicy: SeedTrustPolicy;
   private readonly seedReadTimeoutMs: number;
   private readonly maxConcurrentSeeds: number;
@@ -333,19 +361,6 @@ export class SeedBootstrapService {
     this.maxConcurrentSeeds = config.maxConcurrentSeeds ?? DEFAULT_MAX_CONCURRENT_SEEDS;
     this.seedDeliverTimeoutMs = config.seedDeliverTimeoutMs ?? relayedRequestBudgetMs(config.linkRoundTripMs);
     this.dialBudget = config.dialBudget ?? DEFAULT_PEER_DIAL_BUDGET;
-
-    // Derive public key from private key if not provided
-    if (config.ownerPrivateKey && !config.ownerPublicKey) {
-      this.ownerPublicKey = getPublicKey(
-        config.ownerPrivateKey,
-        'ed25519',
-        'base64url',
-        'base64url'
-      ) as string;
-    } else {
-      this.ownerPublicKey = config.ownerPublicKey ?? null;
-    }
-
     log('SeedBootstrapService created for party: %s', config.partyId);
   }
 
@@ -358,15 +373,19 @@ export class SeedBootstrapService {
   }
 
   /**
-   * Whether this service holds an owner private key, i.e. can produce the
-   * owner signatures that gate `CadrePeer` / `DeviceToken` inserts, deletes,
-   * and re-authorizations. A seed-listener-only service (`enableSeedListener`,
-   * no owner key) returns false: it can receive/apply seeds but cannot author
-   * or re-issue owner writes. Used by the write-while-alone re-replication
-   * drain to skip owner work on a non-owner node.
+   * Whether this service holds an owner signer, i.e. can produce the owner signatures that
+   * gate `CadrePeer` / `DeviceToken` inserts, deletes, and re-authorizations. A
+   * seed-listener-only service (`enableSeedListener`, no signer) returns false: it can
+   * receive/apply seeds but cannot author or re-issue owner writes. Used by the
+   * write-while-alone re-replication drain to skip owner work on a non-owner node.
    */
   canAuthorize(): boolean {
-    return !!this.config.ownerPrivateKey;
+    return this.config.ownerSigner !== undefined;
+  }
+
+  /** The owner signer this service was built with, or null for a listener-only service. */
+  get ownerSigner(): OwnerSigner | null {
+    return this.config.ownerSigner ?? null;
   }
 
   /**
@@ -374,7 +393,7 @@ export class SeedBootstrapService {
    *
    * `registerHandler` (default true) gates registration of the shared inbound
    * `/sereus/seed/1.0.0` handler on `libp2pNode`. Persistent services
-   * (`initializeSeedBootstrap`, `enableSeedListener`) own that handler and leave
+   * (`CadreNode.useOwnerSigner`, `enableSeedListener`) own that handler and leave
    * it on. The throwaway temp service CadreNode builds in `applySeed` passes
    * `false`: it only needs the stored `libp2pNode` / `controlDatabase` for
    * dialing and known-key lookup, and must NOT bind a discarded closure to the
@@ -412,8 +431,11 @@ export class SeedBootstrapService {
    * `UpdatedAt` but no self-signature (`Sig` null) — the owner cannot produce
    * the peer's self-signature, so the peer must self-publish (see
    * {@link CadreNode.registerSelf}) before the row resolves.
+   *
+   * @param sign - The signature function of an owner approval the caller already holds, so a
+   *   multi-step action asks once; omitted, this write asks for its own approval.
    */
-  async authorizePeer(options: AuthorizePeerOptions): Promise<void> {
+  async authorizePeer(options: AuthorizePeerOptions, sign?: OwnerSign): Promise<void> {
     const { peerId, multiaddrs } = options;
     log('Authorizing peer: %s', peerId);
     // CadrePeer.Multiaddr stores a comma-joined list; use '' when no addrs provided.
@@ -425,7 +447,7 @@ export class SeedBootstrapService {
       updatedAt: Date.now(),
       sig: null,
       profile: null,
-    });
+    }, `Add the machine ${peerId} to the cadre`, sign);
     log('Peer %s authorized successfully', peerId);
   }
 
@@ -442,7 +464,7 @@ export class SeedBootstrapService {
    *   in which case the row in the database is NOT this record and carries whatever
    *   `Sig` that writer had, so the caller must self-update to publish its signature.
    */
-  async insertSelfPeerRecord(record: PeerAddressRecord): Promise<boolean> {
+  async insertSelfPeerRecord(record: PeerAddressRecord, sign?: OwnerSign): Promise<boolean> {
     return await this.insertCadrePeerRow({
       peerId: record.peerId,
       publicKey: record.publicKey,
@@ -450,19 +472,18 @@ export class SeedBootstrapService {
       updatedAt: record.updatedAt,
       sig: record.sig,
       profile: record.profile,
-    });
+    }, 'Publish this machine\'s own address record', sign);
   }
 
   /**
-   * Shared owner-signed `CadrePeer` INSERT — the row fields and the owner-key
+   * Shared owner-signed `CadrePeer` INSERT — the row fields and the owner-signer
    * precondition; the stamp mint, voucher signature, write lock, existence check and
    * membership notify are all {@link ControlDatabase.insertCadrePeer}'s (see there for
    * the anti-replay and insert-race rationale). No `CadrePeer` write may bypass that
    * method: the write is what admits the peer's traffic.
    *
-   * The DB check precedes the owner-key check here, matching the order this method has
-   * always surfaced them (the owner-key error used to come out of the signer, after the
-   * DB check).
+   * The DB check precedes the owner-signer check here, matching the order this method has
+   * always surfaced them.
    *
    * @returns `true` when this call performed the INSERT, `false` when the row was
    *   already seated by a concurrent writer. The loser needs to know: an authorize seats
@@ -476,14 +497,11 @@ export class SeedBootstrapService {
     updatedAt: number;
     sig: string | null;
     profile: NodeProfile | null;
-  }): Promise<boolean> {
-    if (!this.controlDatabase) {
-      throw new Error('Control database not initialized');
-    }
-    const ownerKey = this.requireOwnerPublicKey();
-    return await this.controlDatabase.insertCadrePeer(
-      row, ownerKey, message => this.signMessageBytes(message),
-    );
+  }, action: string, sign: OwnerSign | undefined): Promise<boolean> {
+    const controlDatabase = this.requireControlDatabase();
+    const ownerKey = this.requireOwnerSigner().publicKey;
+    return await this.withOwnerSign(action, sign, (approved) =>
+      controlDatabase.insertCadrePeer(row, ownerKey, approved));
   }
 
   /**
@@ -503,17 +521,17 @@ export class SeedBootstrapService {
    * fresh signature — unaffected by the cleared row's retired stamp
    * (`DeviceToken.NotRevoked`).
    */
-  async insertSelfDeviceToken(record: DeviceTokenRecord): Promise<void> {
+  async insertSelfDeviceToken(record: DeviceTokenRecord, sign?: OwnerSign): Promise<void> {
+    const ownerKey = this.requireOwnerSigner().publicKey;
+    const controlDatabase = this.requireControlDatabase();
     const stampId = generateStampId(record.peerId);
-    const signature = this.signDigest(deviceTokenAddDigest(this.config.partyId, { ...record, stampId }));
-    if (!this.controlDatabase) {
-      throw new Error('Control database not initialized');
-    }
-    await this.controlDatabase.execWrite(`
+    const digestBytes = uint8ArrayFromString(deviceTokenAddDigest(this.config.partyId, { ...record, stampId }), 'base64url');
+    const signature = await this.withOwnerSign('Publish this machine\'s push token', sign, (approved) => approved(digestBytes));
+    await controlDatabase.execWrite(`
       insert into CadreControl.DeviceToken (PeerId, Platform, Token, UpdatedAt, Sig, StampId)
         with context OwnerKey = ?, Signature = ?
         values (?, ?, ?, ?, ?, ?)
-    `, [this.ownerPublicKey, signature, record.peerId, record.platform, record.token, record.updatedAt, record.sig, stampId], 'device-token-insert');
+    `, [ownerKey, signature, record.peerId, record.platform, record.token, record.updatedAt, record.sig, stampId], 'device-token-insert');
     log('Device token inserted (owner-signed): %s', record.peerId);
   }
 
@@ -535,79 +553,48 @@ export class SeedBootstrapService {
    * Both digests, the stamp read, and the transaction come from
    * {@link ControlDatabase.deleteDeviceToken} — one shared implementation across
    * `CadrePeer` / `DeviceToken` / `Strand` / `ValidationKey`. What stays here is the
-   * owner-key precondition; a no-op on an already-absent row is the shared body's
+   * owner-signer precondition; a no-op on an already-absent row is the shared body's
    * behavior, and unlike {@link removePeer} nothing here rides on it.
    */
-  async deleteDeviceToken(peerId: string): Promise<void> {
-    // Fail fast on a keyless service BEFORE the DB read, so a non-owner gets the
-    // owner-key error rather than a silent no-op on an absent row.
-    const ownerKey = this.requireOwnerPublicKey();
-    if (!this.controlDatabase) {
-      throw new Error('Control database not initialized');
-    }
-    await this.controlDatabase.deleteDeviceToken(
-      peerId, ownerKey, message => this.signMessageBytes(message),
-    );
+  async deleteDeviceToken(peerId: string, sign?: OwnerSign): Promise<void> {
+    // Fail fast on a signerless service BEFORE the DB read, so a non-owner gets the
+    // owner-signer error rather than a silent no-op on an absent row.
+    const ownerKey = this.requireOwnerSigner().publicKey;
+    const controlDatabase = this.requireControlDatabase();
+    await this.withOwnerSign(`Clear the push token of ${peerId}`, sign, (approved) =>
+      controlDatabase.deleteDeviceToken(peerId, ownerKey, approved));
   }
 
   /**
-   * Return the configured owner private key, or throw if none is set. The single
-   * precondition gate for every owner-signed write. {@link removePeer} /
-   * {@link reauthorizePeer} read the row's `StampId` from the DB BEFORE they sign, so
-   * they call this up front — otherwise a keyless service would either surface the
-   * wrong "Control database not initialized" error or, worse, silently no-op when the
-   * target row is absent (the early `stampId === null` return) instead of rejecting.
+   * Return the configured owner signer, or throw if none is set. The single precondition
+   * gate for every owner-signed write. {@link removePeer} / {@link reauthorizePeer} read the
+   * row from the DB BEFORE they sign, so they call this up front — otherwise a signerless
+   * service would either surface the wrong "Control database not initialized" error or,
+   * worse, silently no-op when the target row is absent (their early absent return) instead
+   * of rejecting.
    */
-  private requireOwnerPrivateKey(): string {
-    if (!this.config.ownerPrivateKey) {
-      throw new Error('Owner private key required to authorize peers');
+  private requireOwnerSigner(): OwnerSigner {
+    if (!this.config.ownerSigner) {
+      throw new Error('Owner signer required to authorize peers');
     }
-    return this.config.ownerPrivateKey;
+    return this.config.ownerSigner;
   }
 
-  /**
-   * The owner PUBLIC key that rides in every owner-signed write's context, non-null.
-   *
-   * The field is nullable because a read-only service carries no owner key at all, but the
-   * constructor derives the public key whenever `ownerPrivateKey` is set — so gating on
-   * {@link requireOwnerPrivateKey} first makes the pair inseparable and the second throw
-   * unreachable. Callers that must reject a keyless service BEFORE any DB read use this as
-   * their first line and get the owner-key precondition for free.
-   */
-  private requireOwnerPublicKey(): string {
-    this.requireOwnerPrivateKey();
-    if (!this.ownerPublicKey) {
-      throw new Error('Owner public key required to authorize peers');
+  /** The control database {@link initialize} attached, or a throw. */
+  private requireControlDatabase(): ControlDatabase {
+    if (!this.controlDatabase) {
+      throw new Error('Control database not initialized');
     }
-    return this.ownerPublicKey;
-  }
-
-  /**
-   * Sign a base64url digest with the owner key (ed25519). The single place the
-   * owner private key is applied; callers pass the canonical domain-tagged digest for
-   * the specific action ({@link deviceTokenAddDigest}), or the raw-bytes form via
-   * {@link signMessageBytes}. Throws if no owner key is set.
-   */
-  private signDigest(digestB64url: string): string {
-    return sign(
-      digestB64url,
-      this.requireOwnerPrivateKey(),
-      'ed25519',
-      'base64url',
-      'base64url',
-      'base64url'
-    ) as string;
+    return this.controlDatabase;
   }
 
   /**
-   * Adapt the control database's raw-bytes `signMessage` callback (every guarded delete
-   * takes one) to {@link signDigest}'s base64url-string form. Both encodings hash to the
-   * same signed bytes (`sign` decodes its base64url input), so a signature minted here
-   * satisfies the same schema CHECK as one from the callers that sign the bytes directly — see
-   * `control-revocation-replay.spec.ts`'s "raw-bytes and digest-string signers agree".
+   * Run `body` with an owner signature function: the caller's `sign` when it passes one (a
+   * `CadreNode` action already inside its approval), otherwise one approval of this service's
+   * signer for `action`, the plain-words description a prompting signer shows.
    */
-  private signMessageBytes(message: Uint8Array): string {
-    return this.signDigest(uint8ArrayToString(message, 'base64url'));
+  private async withOwnerSign<T>(action: string, sign: OwnerSign | undefined, body: (sign: OwnerSign) => Promise<T>): Promise<T> {
+    return await withinOwnerApproval(this.requireOwnerSigner(), { partyId: this.config.partyId, action }, sign, body);
   }
 
   /**
@@ -632,16 +619,14 @@ export class SeedBootstrapService {
    * Both digests, the stamp read, the transaction, and the post-commit membership notify
    * come from {@link ControlDatabase.deleteCadrePeer} — one shared implementation across
    * `CadrePeer` / `DeviceToken` / `Strand` / `ValidationKey`. What stays here is the
-   * owner-key precondition and the absent-row gate the notify depends on (below).
+   * owner-signer precondition and the absent-row gate the notify depends on (below).
    */
-  async removePeer(peerId: string): Promise<void> {
-    // Fail fast on a keyless service BEFORE any DB read: a non-owner cannot sign the
-    // remove digest, and this precedence (owner key, then control DB) is what the
+  async removePeer(peerId: string, sign?: OwnerSign): Promise<void> {
+    // Fail fast on a signerless service BEFORE any DB read: a non-owner cannot sign the
+    // remove digest, and this precedence (owner signer, then control DB) is what the
     // unit contract asserts.
-    const ownerKey = this.requireOwnerPublicKey();
-    if (!this.controlDatabase) {
-      throw new Error('Control database not initialized');
-    }
+    const ownerKey = this.requireOwnerSigner().publicKey;
+    const controlDatabase = this.requireControlDatabase();
     // This absent-row gate must stay OUTSIDE the delete, even though the delete repeats it
     // internally: deleteCadrePeer's membership notify fires whenever its body resolves,
     // with no idea whether the body wrote anything, so delegating an absent peer would
@@ -649,7 +634,7 @@ export class SeedBootstrapService {
     // NOTE: deleteCadrePeer re-reads the StampId, so a peer removed by another writer
     // between the two reads no-ops silently yet still notifies. Narrow concurrent-removal
     // window only — the common "already absent" case is caught here.
-    const stampId = await this.controlDatabase.queryCadrePeerStampId(peerId);
+    const stampId = await controlDatabase.queryCadrePeerStampId(peerId);
     if (stampId === null) {
       log('removePeer: no CadrePeer row for %s (already absent)', peerId);
       return;
@@ -657,118 +642,117 @@ export class SeedBootstrapService {
 
     log('Removing peer: %s', peerId);
 
-    await this.controlDatabase.deleteCadrePeer(
-      peerId, ownerKey, message => this.signMessageBytes(message),
-    );
+    await this.withOwnerSign(`Remove the machine ${peerId} from the cadre`, sign, (approved) =>
+      controlDatabase.deleteCadrePeer(peerId, ownerKey, approved));
 
     log('Peer %s removed successfully (stamp retired)', peerId);
   }
 
   /**
-   * Seat `ownerPublicKey` as a further owner, signed by this service's owner key. The
+   * Seat `ownerPublicKey` as a further owner, signed by this service's owner signer. The
    * liveness check, the stamp, the signature and the membership notify are
-   * {@link ControlDatabase.insertOwnerKeyVouched}'s; what stays here is the owner-key
+   * {@link ControlDatabase.insertOwnerKeyVouched}'s; what stays here is the owner-signer
    * precondition, checked before any read (see {@link removePeer}).
    *
+   * @param label - the user's name for the key, bound into the signature
+   *   ({@link ControlDatabase.insertOwnerKey} has the rule).
    * @returns `true` when the row was seated, `false` when the key is already a live owner.
    */
-  async addOwner(ownerPublicKey: string): Promise<boolean> {
-    const ownerKey = this.requireOwnerPublicKey();
-    if (!this.controlDatabase) {
-      throw new Error('Control database not initialized');
-    }
-    return await this.controlDatabase.insertOwnerKeyVouched(
-      ownerPublicKey, ownerKey, message => this.signMessageBytes(message),
-    );
+  async addOwner(ownerPublicKey: string, label?: string, sign?: OwnerSign): Promise<boolean> {
+    const ownerKey = this.requireOwnerSigner().publicKey;
+    const controlDatabase = this.requireControlDatabase();
+    // Checked before the approval opens, so a label the row would refuse never prompts the user.
+    const storedLabel = ownerKeyLabel(label);
+    return await this.withOwnerSign(`Add owner key ${namedOwnerKey(ownerPublicKey, storedLabel)}`, sign, (approved) =>
+      controlDatabase.insertOwnerKeyVouched(ownerPublicKey, ownerKey, approved, storedLabel));
   }
 
   /**
-   * Remove `ownerPublicKey` from the owners, signed by this service's owner key: the delete
+   * Remove `ownerPublicKey` from the owners, signed by this service's owner signer: the delete
    * and its `Revocation` tombstone in one transaction. The by-name refusals (self-removal,
    * the last owner), the digests and the membership notify are
-   * {@link ControlDatabase.deleteOwnerKey}'s; what stays here is the owner-key precondition,
+   * {@link ControlDatabase.deleteOwnerKey}'s; what stays here is the owner-signer precondition,
    * checked before any read (see {@link removePeer}).
    *
    * @returns `true` when the row was removed, `false` when the key is not a live owner here.
    */
-  async removeOwner(ownerPublicKey: string): Promise<boolean> {
-    const ownerKey = this.requireOwnerPublicKey();
-    if (!this.controlDatabase) {
-      throw new Error('Control database not initialized');
-    }
-    return await this.controlDatabase.deleteOwnerKey(
-      ownerPublicKey, ownerKey, message => this.signMessageBytes(message),
-    );
+  async removeOwner(ownerPublicKey: string, sign?: OwnerSign): Promise<boolean> {
+    const ownerKey = this.requireOwnerSigner().publicKey;
+    const controlDatabase = this.requireControlDatabase();
+    return await this.withOwnerSign(`Remove owner key ${ownerPublicKey}`, sign, (approved) =>
+      controlDatabase.deleteOwnerKey(ownerPublicKey, ownerKey, approved));
   }
 
   /**
-   * Re-vouch another owner's row under this service's owner key, so it stands on a remaining
+   * Re-vouch another owner's row under this service's owner signer, so it stands on a remaining
    * owner's signature before the owner that added it is removed
-   * ({@link ControlDatabase.revouchOwnerKey}; for `CadreNode.removeMachine` only). What stays
-   * here is the owner-key precondition, checked before any read (see {@link removePeer}).
+   * ({@link ControlDatabase.revouchOwnerKey}; for `CadreNode.removeOwner` only). What stays
+   * here is the owner-signer precondition, checked before any read (see {@link removePeer}).
    *
    * @returns `true` when the row was re-vouched, `false` when the key is not a live owner here.
    */
-  async revouchOwner(ownerPublicKey: string): Promise<boolean> {
-    const ownerKey = this.requireOwnerPublicKey();
-    if (!this.controlDatabase) {
-      throw new Error('Control database not initialized');
-    }
-    return await this.controlDatabase.revouchOwnerKey(
-      ownerPublicKey, ownerKey, message => this.signMessageBytes(message),
-    );
+  async revouchOwner(ownerPublicKey: string, sign?: OwnerSign): Promise<boolean> {
+    const ownerKey = this.requireOwnerSigner().publicKey;
+    const controlDatabase = this.requireControlDatabase();
+    return await this.withOwnerSign(`Re-vouch owner key ${ownerPublicKey}`, sign, (approved) =>
+      controlDatabase.revouchOwnerKey(ownerPublicKey, ownerKey, approved));
   }
 
   /**
-   * Remove a machine completely, signed by this service's owner key: its `CadrePeer` row, its
-   * `OwnerKey` row when `target.ownerKey` names one, its `DeviceToken` row, and the
-   * withdrawal of every invitation in `target.inviteKeys`, all in one transaction
-   * ({@link ControlDatabase.removeMachine}). What stays here is the owner-key precondition,
-   * checked before any read (see {@link removePeer}).
+   * Remove a machine completely, signed by this service's owner signer: its `CadrePeer` row, its
+   * `DeviceToken` row, and the withdrawal of every invitation in `target.inviteKeys`, all in one
+   * transaction ({@link ControlDatabase.removeMachine}). What stays here is the owner-signer
+   * precondition, checked before any read (see {@link removePeer}).
    */
-  async removeMachine(target: Parameters<ControlDatabase['removeMachine']>[0]): Promise<MachineRemovalWrites> {
-    const ownerKey = this.requireOwnerPublicKey();
-    if (!this.controlDatabase) {
-      throw new Error('Control database not initialized');
-    }
-    return await this.controlDatabase.removeMachine(
-      target, ownerKey, message => this.signMessageBytes(message),
-    );
+  async removeMachine(target: Parameters<ControlDatabase['removeMachine']>[0], sign?: OwnerSign): Promise<MachineRemovalResult> {
+    const ownerKey = this.requireOwnerSigner().publicKey;
+    const controlDatabase = this.requireControlDatabase();
+    return await this.withOwnerSign(`Remove the machine ${target.peerId} from the cadre`, sign, (approved) =>
+      controlDatabase.removeMachine(target, ownerKey, approved));
   }
 
   /**
-   * Owner "re-touch" of an existing `CadrePeer` membership row: bump `UpdatedAt` and
-   * re-vouch the row so it is re-emitted as a fresh, broadcasting transaction. This is
-   * the write-while-alone re-replication primitive (`control-write-ensure-replicated`):
-   * a membership row that committed local-only (its block's cluster ≤1 at insert) is
-   * pushed to the cohort once it grows.
+   * Owner "re-touch" of an existing `CadrePeer` membership row, in one of two modes
+   * ({@link CadrePeerRetouchMode}): `'rebroadcast'` bumps `UpdatedAt` and re-vouches the row so
+   * it is re-emitted as a fresh, broadcasting transaction — the write-while-alone re-replication
+   * primitive (`control-write-ensure-replicated`): a membership row that committed local-only
+   * (its block's cluster ≤1 at insert) is pushed to the cohort once it grows — and writes only
+   * while the machine has not self-published; `'revouch'` rebinds the voucher to this node's
+   * owner key, leaving `UpdatedAt` alone, whether or not the machine has self-published
+   * (`CadreNode.removeOwner`).
    *
-   * The stamp read, the voucher signature, the write lock and the membership notify are
+   * The row read, the mode's decision, the stamp bump, the voucher signature, the write lock,
+   * the lost-update retry and the membership notify are
    * {@link ControlDatabase.reauthorizeCadrePeer}'s — including the caveat that it rebinds
-   * `VouchOwner` to this node's owner key. What stays here is the owner-key precondition.
-   *
-   * A no-op (no throw, no notify) when the row does not exist.
+   * `VouchOwner` to this node's owner key. What stays here is the owner-signer precondition.
    *
    * @param peerId - the membership row to re-touch.
-   * @param updatedAt - the strictly-increasing freshness stamp to write.
-   * @throws if no owner private key is configured (a non-owner cannot
+   * @param mode - re-broadcast or re-vouch.
+   * @returns what was found and done ({@link CadrePeerRetouchOutcome}); an absent row, or a
+   *   self-published one in `'rebroadcast'` mode, writes nothing and does not throw.
+   * @throws if no owner signer is configured (a non-owner cannot
    *   re-sign another peer's row) or the control database is not initialized.
    */
-  async reauthorizePeer(peerId: string, updatedAt: number): Promise<void> {
-    // Fail fast on a keyless service before any DB read (see removePeer): a non-owner
+  async reauthorizePeer(peerId: string, mode: CadrePeerRetouchMode, sign?: OwnerSign): Promise<CadrePeerRetouchOutcome> {
+    // Fail fast on a signerless service before any DB read (see removePeer): a non-owner
     // cannot re-sign the voucher, and must not silently no-op on an absent row.
-    const ownerKey = this.requireOwnerPublicKey();
-    if (!this.controlDatabase) {
-      throw new Error('Control database not initialized');
-    }
-    const retouched = await this.controlDatabase.reauthorizeCadrePeer(
-      peerId, updatedAt, ownerKey, message => this.signMessageBytes(message),
-    );
-    if (!retouched) {
-      log('reauthorizePeer: no CadrePeer row for %s (nothing to re-touch)', peerId);
-      return;
+    const ownerKey = this.requireOwnerSigner().publicKey;
+    const controlDatabase = this.requireControlDatabase();
+    const action = mode === 'revouch' ? `Re-vouch the machine ${peerId}` : `Re-issue the membership of ${peerId}`;
+    const outcome = await this.withOwnerSign(action, sign, (approved) =>
+      controlDatabase.reauthorizeCadrePeer(peerId, mode, ownerKey, approved));
+    switch (outcome) {
+      case 'absent':
+        log('reauthorizePeer(%s): no CadrePeer row for %s (nothing to re-touch)', mode, peerId);
+        break;
+      case 'self-published':
+        log('reauthorizePeer(%s): %s has self-published; its row is its own to refresh', mode, peerId);
+        break;
+      case 'retouched':
+        log('Peer %s re-authorized (%s)', peerId, mode);
+        break;
     }
-    log('Peer %s re-authorized (UpdatedAt=%d) for write-while-alone re-replication', peerId, updatedAt);
+    return outcome;
   }
 
   /**
@@ -781,123 +765,140 @@ export class SeedBootstrapService {
    *
    * The signatures, the single transaction, and the strictly-monotonic
    * `reissuedAt` contract are {@link ControlDatabase.reissueRevocations}'s. What
-   * stays here is the owner-key precondition.
+   * stays here is the owner-signer precondition.
    *
    * @returns how many tombstones were re-issued (`rows.length` on success).
-   * @throws if no owner private key is configured or the control database is not
+   * @throws if no owner signer is configured or the control database is not
    *   initialized.
    */
-  async reissueRevocations(rows: readonly RevocationRow[], reissuedAt: number): Promise<number> {
-    // Fail fast on a keyless service before any DB work (see removePeer): a
+  async reissueRevocations(rows: readonly RevocationRow[], reissuedAt: number, sign?: OwnerSign): Promise<number> {
+    // Fail fast on a signerless service before any DB work (see removePeer): a
     // non-owner cannot sign the reissue digests.
-    const ownerKey = this.requireOwnerPublicKey();
-    if (!this.controlDatabase) {
-      throw new Error('Control database not initialized');
-    }
-    return this.controlDatabase.reissueRevocations(
-      rows, reissuedAt, ownerKey, message => this.signMessageBytes(message),
-    );
-  }
-
-  /**
-   * Owner filing of the singleton `Revocation` ledger marker, so the table is never a
-   * never-written block that the storage layer re-consults on every read.
-   *
-   * The signature, the insert-if-absent guard and the `'already-open'` mapping are
-   * {@link ControlDatabase.openRevocationLedger}'s. What stays here is the owner-key
-   * precondition.
-   *
-   * @throws if no owner private key is configured or the control database is not
-   *   initialized.
-   */
-  async openRevocationLedger(): Promise<RevocationLedgerOpenResult> {
-    // Fail fast on a keyless service before any DB work (see removePeer): a
-    // non-owner cannot sign the marker's append digest.
-    const ownerKey = this.requireOwnerPublicKey();
-    if (!this.controlDatabase) {
-      throw new Error('Control database not initialized');
-    }
-    return this.controlDatabase.openRevocationLedger(
-      ownerKey, message => this.signMessageBytes(message),
-    );
+    const ownerKey = this.requireOwnerSigner().publicKey;
+    const controlDatabase = this.requireControlDatabase();
+    return await this.withOwnerSign(`Re-send ${rows.length} removal record(s) to the cadre`, sign, (approved) =>
+      controlDatabase.reissueRevocations(rows, reissuedAt, ownerKey, approved));
   }
 
   /**
    * Owner-signed INSERT of a `CadreInvite` row — an invitation any member machine can redeem
    * on this owner's behalf ({@link ControlDatabase.insertCadreInvite}). The keypair mint, the
    * expiry and use-count defaults, and the bundle the holder receives are
-   * `CadreNode.createCadreInvitation`'s; what stays here is the owner-key precondition and
-   * the signature, as {@link insertSelfDeviceToken} keeps them for device tokens.
+   * `CadreNode.createCadreInvitation`'s; what stays here is the owner-signer precondition and
+   * the approval, as {@link insertSelfDeviceToken} keeps them for device tokens.
    *
    * @returns the row as stored, which the invitation bundle carries verbatim.
-   * @throws if no owner private key is configured or the control database is not initialized.
+   * @throws if no owner signer is configured or the control database is not initialized.
    */
-  async insertCadreInvite(invite: Parameters<ControlDatabase['insertCadreInvite']>[0]): Promise<CadreInviteRow> {
-    // Fail fast on a keyless service before any DB work (see removePeer).
-    const ownerKey = this.requireOwnerPublicKey();
-    if (!this.controlDatabase) {
-      throw new Error('Control database not initialized');
-    }
-    return await this.controlDatabase.insertCadreInvite(invite, ownerKey, message => this.signMessageBytes(message));
+  async insertCadreInvite(invite: Parameters<ControlDatabase['insertCadreInvite']>[0], sign?: OwnerSign): Promise<CadreInviteRow> {
+    // Fail fast on a signerless service before any DB work (see removePeer).
+    const ownerKey = this.requireOwnerSigner().publicKey;
+    const controlDatabase = this.requireControlDatabase();
+    return await this.withOwnerSign('Create a machine invitation to the cadre', sign, (approved) =>
+      controlDatabase.insertCadreInvite(invite, ownerKey, approved));
   }
 
   /**
    * Owner-signed WITHDRAWAL of a `CadreInvite`: the `Revocation` tombstone over its stamp, with
    * the row kept ({@link ControlDatabase.withdrawCadreInvite}). What stays here is the
-   * owner-key precondition.
+   * owner-signer precondition.
    *
    * @returns `true` when this call filed the tombstone, `false` when the row is absent here or
    *   already withdrawn.
-   * @throws if no owner private key is configured or the control database is not initialized.
+   * @throws if no owner signer is configured or the control database is not initialized.
    */
-  async withdrawCadreInvite(key: string): Promise<boolean> {
-    const ownerKey = this.requireOwnerPublicKey();
-    if (!this.controlDatabase) {
-      throw new Error('Control database not initialized');
-    }
-    return await this.controlDatabase.withdrawCadreInvite(key, ownerKey, message => this.signMessageBytes(message));
+  async withdrawCadreInvite(key: string, sign?: OwnerSign): Promise<boolean> {
+    const ownerKey = this.requireOwnerSigner().publicKey;
+    const controlDatabase = this.requireControlDatabase();
+    return await this.withOwnerSign(`Withdraw the cadre invitation ${key}`, sign, (approved) =>
+      controlDatabase.withdrawCadreInvite(key, ownerKey, approved));
+  }
+
+  /**
+   * Owner-signed INSERT of an `OwnerGrant` row — a grant of ownership any member machine can
+   * redeem on this owner's behalf ({@link ControlDatabase.insertOwnerGrant}). The keypair mint,
+   * the lifetime default and the bundle the holder receives are `CadreNode.createOwnerGrant`'s;
+   * what stays here is the owner-signer precondition and the approval, as for
+   * {@link insertCadreInvite}. The label is checked before the approval opens, so one the row
+   * would refuse never prompts the user.
+   *
+   * @returns the row as stored, which the grant bundle carries verbatim.
+   * @throws if no owner signer is configured, the control database is not initialized, or the label is too long.
+   */
+  async insertOwnerGrant(grant: Parameters<ControlDatabase['insertOwnerGrant']>[0], sign?: OwnerSign): Promise<OwnerGrantRow> {
+    const ownerKey = this.requireOwnerSigner().publicKey;
+    const controlDatabase = this.requireControlDatabase();
+    const label = ownerKeyLabel(grant.label);
+    const named = label === null ? 'an owner grant' : `the owner grant "${label}"`;
+    return await this.withOwnerSign(`Create ${named}: whoever holds it can become an owner of the cadre`, sign, (approved) =>
+      controlDatabase.insertOwnerGrant({ ...grant, label }, ownerKey, approved));
+  }
+
+  /**
+   * Owner-signed WITHDRAWAL of an `OwnerGrant`: the `Revocation` tombstone over its stamp, with
+   * the row kept ({@link ControlDatabase.withdrawOwnerGrant}). What stays here is the
+   * owner-signer precondition.
+   *
+   * @returns `true` when this call filed the tombstone, `false` when the row is absent here or
+   *   already withdrawn.
+   * @throws if no owner signer is configured or the control database is not initialized.
+   */
+  async withdrawOwnerGrant(key: string, sign?: OwnerSign): Promise<boolean> {
+    const ownerKey = this.requireOwnerSigner().publicKey;
+    const controlDatabase = this.requireControlDatabase();
+    return await this.withOwnerSign(`Withdraw the owner grant ${key}`, sign, (approved) =>
+      controlDatabase.withdrawOwnerGrant(key, ownerKey, approved));
   }
 
   /**
    * Create a seed from the current control network state.
-   * The seed contains peer information and is signed by an owner.
+   * The seed contains peer information and is signed by an owner; its `signerKey` is the
+   * owner signer's key.
    */
-  async createSeed(): Promise<ControlNetworkSeed> {
-    if (!this.config.ownerPrivateKey || !this.ownerPublicKey) {
+  async createSeed(sign?: OwnerSign): Promise<ControlNetworkSeed> {
+    return await this.mintSeed(sign, null);
+  }
+
+  /**
+   * {@link createSeed}, with `selfRelayAddr` added to this node's own peer entry before the
+   * seed is signed: the signature covers every address ({@link seedDigest}), so nothing may
+   * be added after it.
+   */
+  private async mintSeed(sign: OwnerSign | undefined, selfRelayAddr: string | null): Promise<ControlNetworkSeed> {
+    const signer = this.config.ownerSigner;
+    if (!signer) {
       throw new Error('Owner key required to create seeds');
     }
-    
+
     if (!this.controlDatabase || !this.libp2pNode) {
       throw new Error('Service not initialized');
     }
-    
+
     log('Creating seed for party: %s', this.config.partyId);
-    
+
     // Query all peers from the control database
-    const peers = await this.queryPeers();
-    
+    const selfPeerId = this.libp2pNode.peerId.toString();
+    const peers = await this.queryPeers(selfPeerId);
+    if (selfRelayAddr !== null) {
+      addSelfRelayAddr(peers, selfPeerId, selfRelayAddr);
+    }
+
     // Create the seed data (without signature)
     const seedData = {
       partyId: this.config.partyId,
       peers,
     };
-    
+
     // Sign the seed over its canonical byte representation
-    const signature = sign(
-      seedDigest(seedData),
-      this.config.ownerPrivateKey,
-      'ed25519',
-      'base64url',
-      'base64url',
-      'base64url'
-    ) as string;
-    
+    const digestBytes = uint8ArrayFromString(seedDigest(seedData), 'base64url');
+    const signature = await this.withOwnerSign('Mint a seed for a machine joining the cadre', sign, (approved) => approved(digestBytes));
+
     const seed: ControlNetworkSeed = {
       ...seedData,
       signature,
-      signerKey: this.ownerPublicKey,
+      signerKey: signer.publicKey,
     };
-    
+
     log('Created seed with %d peers', peers.length);
     return seed;
   }
@@ -909,9 +910,8 @@ export class SeedBootstrapService {
    * `signerKey` that does NOT come from the seed body: the receiver's
    * node-local {@link SeedBootstrapConfig.trustedOwners} anchor, optionally
    * augmented by pinned keys or TOFU via the configured/overriding
-   * `SeedTrustPolicy`. A forged self-asserting seed — one that merely lists its
-   * own signer as an owner peer — no longer passes, and neither does one signed
-   * by a key a stranger genesis-inserted into the replicated `OwnerKey` table.
+   * `SeedTrustPolicy`. A forged self-signed seed does not pass, and neither does
+   * one signed by a key a stranger genesis-inserted into the replicated `OwnerKey` table.
    *
    * A key accepted via a pin/TOFU is persisted into the anchor (the policy says
    * so via `SeedTrustDecision.anchorAs`), so the next seed from that owner is
@@ -930,13 +930,13 @@ export class SeedBootstrapService {
     if (!merged.success) {
       return merged;
     }
-    return { ...merged, ...await this.dialSeedOwners(seed) };
+    return { ...merged, ...await this.dialPreferredPeers(seed) };
   }
 
   /**
    * The first half of {@link applySeed}: check the signature and the signer's trust, then merge
    * the seed's peer addresses into the peer store. Every rejection happens here, so this result is
-   * what the inbound handler acks with; the owner dials that follow cannot change it.
+   * what the inbound handler acks with; the dials that follow cannot change it.
    */
   private async verifyAndMergeSeed(
     seed: ControlNetworkSeed,
@@ -976,7 +976,7 @@ export class SeedBootstrapService {
       partyId: seed.partyId,
       signerKey: seed.signerKey,
       knownOwnerKeys,
-      // Optional-chained like `dialSeedOwners`: partial libp2p handles (unit-test doubles)
+      // Optional-chained like `dialPreferredPeers`: partial libp2p handles (unit-test doubles)
       // omit `peerId`. A real node always has one, and a proof bound to a real peer id can
       // only fail against '' — the safe direction.
       localPeerId: this.libp2pNode.peerId?.toString() ?? '',
@@ -991,55 +991,52 @@ export class SeedBootstrapService {
 
     const peersAdded = await mergeSeedPeers(this.libp2pNode, seed.peers);
     log('Merged seed: %d peers added', peersAdded);
-    return { success: true, peersAdded, ownerDialsAttempted: 0, ownerDialsFailed: 0 };
+    return { success: true, peersAdded, preferredDialsAttempted: 0, preferredDialsFailed: 0 };
   }
 
   /**
-   * The second half of {@link applySeed}: dial the seed's owner peers to establish connections.
+   * The second half of {@link applySeed}: dial the seed's preferred peers (`SeedPeer.preferred`:
+   * the machine that minted it and every always-on machine) to establish connections.
    *
-   * Best-effort and COUNTED: an owner that is momentarily down leaves this node seeded but
+   * Best-effort and COUNTED: a peer that is momentarily down leaves this node seeded but
    * unconnected, which the caller can only see if the outcome is reported (see
-   * `ApplySeedResult.ownerDialsFailed`). Recovery is not this loop's job —
+   * `ApplySeedResult.preferredDialsFailed`). Recovery is not this loop's job —
    * `CadreNode.dialColdStartBootstrap` retries these same addresses on every control-cohort
    * reconcile pass until the control database has siblings.
    *
-   * The inbound handler runs this AFTER it has acked and closed the stream
-   * ({@link handleSeedStream}), because an unreachable owner can take `dialBudget.totalMs`.
+   * The inbound handler runs this AFTER it has acked, closed the stream and reported the seed
+   * applied ({@link handleSeedStream}), because an unreachable peer can take `dialBudget.totalMs`.
+   * The node may stop while these dials are in flight (cadre-cli restarts a claimed node on
+   * `seed:applied`): the node's stop aborts the dial in flight and every later one is refused
+   * at once (`dialAddr`), and each is counted as failed here.
    */
-  private async dialSeedOwners(seed: ControlNetworkSeed): Promise<OwnerDialCounts> {
+  private async dialPreferredPeers(seed: ControlNetworkSeed): Promise<PreferredDialCounts> {
     const node = this.libp2pNode;
     if (!node) {
-      log('Seed service shut down before its owner dials; none attempted');
-      return { ownerDialsAttempted: 0, ownerDialsFailed: 0 };
+      log('Seed service shut down before its dials; none attempted');
+      return { preferredDialsAttempted: 0, preferredDialsFailed: 0 };
     }
-    // `createSeed` projects every non-revoked CadrePeer row, so an owner applying
-    // a seed minted after it joined finds ITSELF in the owner list. Dialing self always
-    // throws, which would report a healthy owner as "seeded but stranded".
-    // Optional-chained: partial libp2p handles (unit-test doubles) omit `peerId`,
-    // and an undefined self simply matches nothing.
-    // Every one of an owner's addresses is a candidate, each on its own time limit
-    // (`dialPeerAddrs`), so an owner whose first address never answers neither
+    // Self is not dialed: dialing self always throws, which would report a healthy node as
+    // "seeded but stranded". Optional-chained: partial libp2p handles (unit-test doubles)
+    // omit `peerId`.
+    // Every one of a peer's addresses is a candidate, each on its own time limit
+    // (`dialPeerAddrs`), so a peer whose first address never answers neither
     // stalls seed application nor goes undialed at its other addresses. The seed's
-    // addresses carry no peer id; the dial binds each to the owner's.
-    const selfPeerId = node.peerId?.toString();
-    let ownerDialsAttempted = 0;
-    let ownerDialsFailed = 0;
-    for (const peer of seed.peers.filter(p => p.isOwner)) {
-      if (peer.multiaddrs.length === 0 || peer.peerId === selfPeerId) {
-        continue;
-      }
-      ownerDialsAttempted++;
+    // addresses carry no peer id; the dial binds each to the peer's.
+    const targets = seedDialTargets(seed, node.peerId?.toString());
+    let preferredDialsFailed = 0;
+    for (const peer of targets) {
       try {
         const addrs = parseDialAddrs(peer.multiaddrs);
 
-        log('Dialing owner peer: %s (%d addr(s))', peer.peerId, addrs.length);
-        await dialPeerAddrs(node, peer.peerId, addrs, this.dialBudget, `Owner dial of ${peer.peerId}`);
+        log('Dialing preferred seed peer: %s (%d addr(s))', peer.peerId, addrs.length);
+        await dialPeerAddrs(node, peer.peerId, addrs, this.dialBudget, `Seed dial of ${peer.peerId}`);
       } catch (error) {
-        // Counted even when the owner reaches us only through our own relay: this node is still
-        // not connected to it, and `ownerDialsFailed` is how the caller learns that.
-        ownerDialsFailed++;
+        // Counted even when the peer reaches us only through our own relay: this node is still
+        // not connected to it, and `preferredDialsFailed` is how the caller learns that.
+        preferredDialsFailed++;
         if (error instanceof SelfRelayOnlyError) {
-          log('Owner peer %s is reachable only by relaying through this node; waiting for it to reconnect', peer.peerId);
+          log('Seed peer %s is reachable only by relaying through this node; waiting for it to reconnect', peer.peerId);
         } else {
           log('Failed to dial peer %s: %o', peer.peerId, error);
         }
@@ -1047,8 +1044,8 @@ export class SeedBootstrapService {
       }
     }
 
-    log('Dialed seed owners: %d/%d owner dial(s) failed', ownerDialsFailed, ownerDialsAttempted);
-    return { ownerDialsAttempted, ownerDialsFailed };
+    log('Dialed preferred seed peers: %d/%d dial(s) failed', preferredDialsFailed, targets.length);
+    return { preferredDialsAttempted: targets.length, preferredDialsFailed };
   }
 
   /**
@@ -1165,7 +1162,7 @@ export class SeedBootstrapService {
     }
     const peerId = peerIdFromString(target.peerId);
     const addrs = deliveryDialAddrs(target.peerId, target.multiaddrs);
-    await mergeSeedPeers(node, [{ peerId: target.peerId, multiaddrs: target.multiaddrs, isOwner: false }]);
+    await mergeSeedPeers(node, [{ peerId: target.peerId, multiaddrs: target.multiaddrs, preferred: false }]);
     if (addrs.length === 0) {
       return (signal) => node.dialProtocol(peerId, SEED_PROTOCOL, { signal });
     }
@@ -1295,16 +1292,16 @@ export class SeedBootstrapService {
   }
 
   /**
-   * The peers a seed carries: the control database's own projection
+   * The peers a seed `minterPeerId` mints carries: the control database's own projection
    * ({@link ControlDatabase.querySeedPeers}, shared with the cadre invitation redemption
-   * reply), which reads through the revocation filter and flags owners from the replicated
-   * `OwnerKey` table — a dial hint, not a trust decision (the NOTE at `projectSeedPeers`).
+   * reply), which reads through the revocation filter and marks the minter and every
+   * always-on machine preferred — a dial hint, not a trust decision.
    */
-  private async queryPeers(): Promise<SeedPeer[]> {
+  private async queryPeers(minterPeerId: string): Promise<SeedPeer[]> {
     if (!this.controlDatabase) {
       return [];
     }
-    return await this.controlDatabase.querySeedPeers();
+    return await this.controlDatabase.querySeedPeers(minterPeerId);
   }
 
   /**
@@ -1323,14 +1320,16 @@ export class SeedBootstrapService {
 
   /**
    * Read one inbound seed frame, verify and merge it, write the ack and close the
-   * stream, then dial the seed's owners.
+   * stream, report the seed applied, then dial the seed's preferred peers.
    *
-   * The ack and the close come BEFORE the owner dials: an unreachable owner can hold
-   * a dial for `dialBudget.totalMs` (86 s at the default declared link), which is not
-   * link time and does not belong inside the sender's delivery deadline. The close is
-   * what releases the sender, which reads the ack to end-of-stream. The stream stays
-   * counted in {@link activeStreams} through the dials, so {@link maxConcurrentSeeds}
-   * still bounds concurrent owner-dial phases.
+   * The ack, the close and `onSeedApplied` come BEFORE those dials: an unreachable peer
+   * can hold a dial for `dialBudget.totalMs` (86 s at the default declared link), which is
+   * not link time and does not belong inside the sender's delivery deadline, nor ahead of
+   * a claimed node's restart (which stops this node, so its dials would be wasted). The
+   * close is what releases the sender, which reads the ack to end-of-stream, and it is
+   * awaited before `onSeedApplied`, so the ack is flushed before anything the callback
+   * starts. The stream stays counted in {@link activeStreams} through the dials, so
+   * {@link maxConcurrentSeeds} still bounds concurrent dial phases.
    *
    * Hardened against a buggy/compromised own-cadre node: a concurrency cap (over
    * {@link maxConcurrentSeeds}, reply without applying), a read timeout (a peer
@@ -1367,8 +1366,8 @@ export class SeedBootstrapService {
       );
 
       if (merged.success) {
-        await this.dialSeedOwners(seed);
         this.eventCallbacks.onSeedApplied?.(seed.partyId, merged.peersAdded, seed);
+        await this.dialPreferredPeers(seed);
       } else {
         this.eventCallbacks.onSeedError?.(seed.partyId, merged.error ?? 'Unknown error');
       }
@@ -1440,19 +1439,22 @@ export class SeedBootstrapService {
    * does not listen. Call `CadreNode.reconcileControlCohort()` after delivering
    * the seed to dial at once.
    *
+   * The vouch and the seed are one owner approval.
+   *
    * @param options - Drone peer info from provider API
    * @returns Seed and encoded seed for drone initialization
    */
-  async addDrone(options: AddDroneOptions): Promise<DroneInitResult> {
+  async addDrone(options: AddDroneOptions, sign?: OwnerSign): Promise<DroneInitResult> {
     const { dronePeerId, droneMultiaddrs } = options;
 
     log('Adding drone: %s', dronePeerId);
 
-    // 1. Authorize the new drone peer
-    await this.authorizePeer({ peerId: dronePeerId, multiaddrs: droneMultiaddrs });
-
-    // 2. Create seed with current state
-    const seed = await this.createSeed();
+    const seed = await this.withOwnerSign(`Add the machine ${dronePeerId} to the cadre`, sign, async (approved) => {
+      // 1. Authorize the new drone peer
+      await this.authorizePeer({ peerId: dronePeerId, multiaddrs: droneMultiaddrs }, approved);
+      // 2. Create seed with current state
+      return await this.createSeed(approved);
+    });
 
     // 3. Encode for transport
     const encodedSeed = this.encodeSeed(seed);
@@ -1469,29 +1471,21 @@ export class SeedBootstrapService {
    * 1. Authorizes the new phone peer
    * 2. Creates a seed with relay addresses for dialing
    *
+   * The vouch and the seed are one owner approval.
+   *
    * @param phonePeerId - Peer ID of the new phone
    * @returns Seed with relay addresses for out-of-band delivery
    */
-  async addPhoneWithRelay(phonePeerId: string): Promise<DroneInitResult> {
+  async addPhoneWithRelay(phonePeerId: string, sign?: OwnerSign): Promise<DroneInitResult> {
     log('Adding phone with relay: %s', phonePeerId);
 
-    // 1. Authorize the new phone peer (no multiaddrs - NAT'd)
-    await this.authorizePeer({ peerId: phonePeerId });
-
-    // 2. Get relay address for this node
     const relayAddr = await this.getRelayAddress();
-
-    // 3. Create seed - will include our relay address if available
-    const seed = await this.createSeed();
-
-    // If we have a relay address, make sure it's in our peer entry
-    if (relayAddr && this.libp2pNode) {
-      const ourPeerId = this.libp2pNode.peerId.toString();
-      const ourPeer = seed.peers.find(p => p.peerId === ourPeerId);
-      if (ourPeer && !ourPeer.multiaddrs.includes(relayAddr)) {
-        ourPeer.multiaddrs.push(relayAddr);
-      }
-    }
+    const seed = await this.withOwnerSign(`Add the phone ${phonePeerId} to the cadre`, sign, async (approved) => {
+      // 1. Authorize the new phone peer (no multiaddrs - NAT'd)
+      await this.authorizePeer({ peerId: phonePeerId }, approved);
+      // 2. Create seed - with our relay address in our own entry, when we have one
+      return await this.mintSeed(approved, relayAddr);
+    });
 
     const encodedSeed = this.encodeSeed(seed);