@serfab/cadre-core 1.17.0 → 1.19.0

package/src/pending-join-runner.ts

@@ -6,10 +6,11 @@
  * is described in `docs/strands.md` → "Joining while the inviter is offline".
  *
  * `CadreNode` owns every side effect and hands this module plain functions
- * ({@link PendingJoinRunnerDeps}): read the joins, run one attempt (its own `formStrand`), write
- * an outcome, say whether this machine is an owner, and the clock. This module owns the policy:
- * when to attempt, how to read an attempt's failure, and how to settle an outcome write that
- * another machine's write beat.
+ * ({@link PendingJoinRunnerDeps}): read the joins, hear a change to the tables they are read
+ * from, run one attempt (its own `formStrand`), write an outcome, say whether this machine is an
+ * owner, and the clock. This module owns the policy: when to read the joins, when to attempt,
+ * how to read an attempt's failure, and how to settle an outcome write that another machine's
+ * write beat.
  *
  * Only owner machines run it, because every pending-join write is owner-signed. Letting a
  * machine without an owner key finish a join is `blocked/decide-non-owner-machine-completes-a-pending-join`;
@@ -30,12 +31,28 @@ import { PendingJoinChangedError, type JoinRequestFields, type PendingJoinFields
 import { FormationPostApprovalError, FormationRejectedError, FormationUnreachableError } from './strand-formation-rejection.js';
 import { formationDeadlines } from './strand-formation-deadlines.js';
 import { MEMBERSHIP_INVITE_TTL_MS } from './strand-formation-manager.js';
+import { scheduleRuns, type TableChangeWatch, type TableChangeWatchOptions } from './table-change-watch.js';
 import { defaultTimeoutScheduler, type TimeoutScheduler } from './timeout-scheduler.js';
 
 const log = debug('sereus:cadre:pending-join');
 
-/** How often an owner machine re-reads the party's pending joins (it also reads once right after start). */
-export const PENDING_JOIN_POLL_MS = 30_000;
+/**
+ * The longest an owner machine goes without re-reading the party's pending joins when no change
+ * to their tables is heard. It covers a change that arrives without a storage event, and the
+ * time-driven removal of a finished join, which lands up to this much late.
+ *
+ * NOTE: on a cadre larger than `CONTROL_REPLICATION_BREADTH` (16), a machine outside a join
+ * table's cohort hears no change event, so a dismissal or another machine's outcome reaches it
+ * up to this much late. The worst effect is one more attempt on a dismissed join, whose outcome
+ * write then finds the request gone, or a `token-spent` answer whose re-read adopts the other
+ * machine's outcome. A 30 s pass while any join is pending was declined: a join can stay pending
+ * for {@link MAX_PENDING_JOIN_MS}, and those reads are what this backstop removes. Revisit if a
+ * cadre above 16 machines is seen attempting dismissed joins.
+ */
+export const PENDING_JOIN_BACKSTOP_MS = 10 * 60_000;
+
+/** How soon a pass runs again after one failed, or after an outcome write gave up to another machine's writes. */
+const PENDING_JOIN_PASS_RETRY_MS = 30_000;
 
 /** Ceiling on the wait between two attempts of one join on one machine, before jitter. */
 export const PENDING_JOIN_MAX_BACKOFF_MS = 10 * 60_000;
@@ -52,7 +69,7 @@ const MAX_BACKGROUND_ATTEMPTS = 2;
 /** Each retry delay is moved by up to this fraction either way, so machines that failed together do not retry together. */
 const RETRY_JITTER = 0.2;
 
-/** Re-read-and-rewrite rounds after another machine's write won, before the next pass decides instead. */
+/** Re-read-and-rewrite rounds after another machine's write won, before a pass {@link PENDING_JOIN_PASS_RETRY_MS} later decides instead. */
 const MAX_OUTCOME_WRITE_ROUNDS = 3;
 
 type AttemptError = NonNullable<PendingJoinStatus['lastError']>;
@@ -68,6 +85,10 @@ export interface PendingJoinRunnerDeps {
   /** Whether this machine may write pending joins now. Asked every pass. */
   isOwner(): Promise<boolean>;
   readRows(): Promise<PendingJoin[]>;
+  /** Subscribe `onChange` to the tables a pass reads. Absent: passes come from `start`, `kick`, retries and the backstop only (tests). */
+  watchChanges?(onChange: () => Promise<void>, options: TableChangeWatchOptions): TableChangeWatch;
+  /** Run a pass at least this long after the last one settled; default {@link PENDING_JOIN_BACKSTOP_MS}. */
+  backstopMs?: number;
   readRow(id: string): Promise<PendingJoin | null>;
   /** One formation attempt for the request's invitation and disclosure (`CadreNode.formStrand`). */
   attempt(join: PendingJoin): Promise<FormStrandResult>;
@@ -77,7 +98,7 @@ export interface PendingJoinRunnerDeps {
   rewrite(expectedStampId: string, next: PendingJoinFields): Promise<PendingJoin>;
   /** `ControlDatabase.deletePendingJoin`, owner-signed. */
   remove(id: string): Promise<boolean>;
-  /** Whether this machine has no control connection now, so a write it commits reaches no other machine. */
+  /** Whether this machine reaches no sibling now (`CadreNode.hasReachableControlSibling`), so a write it commits reaches no other machine. */
   isAlone(): boolean;
   /** The sApp the request's invitation names. */
   sAppIdOf(join: PendingJoin): string;
@@ -231,7 +252,7 @@ function stableFraction(key: string): number {
 
 export class PendingJoinRunner {
   private readonly tracked = new Map<string, TrackedJoin>();
-  /** Joins whose latest write by this machine committed with no control connection: id → the request stamp written. */
+  /** Joins whose latest write by this machine committed with no sibling reachable: id → the request stamp written. */
   private readonly writtenAlone = new Map<string, string>();
   private readonly dueQueue: TrackedJoin[] = [];
   private readonly scheduler: TimeoutScheduler;
@@ -242,9 +263,8 @@ export class PendingJoinRunner {
   /** How long a `token-spent` answer waits before its confirming attempt: long enough for a sibling's `joined` write to replicate. */
   private readonly spentConfirmDelayMs: number;
   private running = false;
-  private pollTimer: unknown;
-  private passInFlight: Promise<void> | null = null;
-  private passAgain = false;
+  /** Every pass runs on it, one at a time; present between {@link start} and {@link stop}. */
+  private watch: TableChangeWatch | null = null;
   private backgroundAttempts = 0;
 
   constructor(private readonly deps: PendingJoinRunnerDeps) {
@@ -256,11 +276,21 @@ export class PendingJoinRunner {
     this.spentConfirmDelayMs = 2 * deadlines.sessionMs;
   }
 
-  /** Start passes: one at once, then every {@link PENDING_JOIN_POLL_MS}. */
+  /**
+   * Start passes: one at once, then one whenever a table a pass reads changes, and at the latest
+   * {@link PENDING_JOIN_BACKSTOP_MS} after the last. Throws when the change subscription cannot
+   * be made.
+   *
+   * NOTE: a pass from before a {@link stop} that is still in flight runs alongside the new
+   * watch's passes, since each watch keeps only its own runs to one at a time. `CadreNode` builds
+   * a fresh runner per start, so nothing restarts one; if something comes to, make that pass
+   * check which start it belongs to.
+   */
   start(): void {
     if (this.running) return;
+    this.watch = this.subscribe();
     this.running = true;
-    this.schedulePass(0);
+    this.watch.trigger(0);
   }
 
   /**
@@ -274,18 +304,21 @@ export class PendingJoinRunner {
    */
   stop(): void {
     this.running = false;
-    this.clearPollTimer();
+    // A pass already in flight finishes; `running` keeps it from scheduling anything further.
+    this.watch?.dispose();
+    this.watch = null;
     for (const entry of this.tracked.values()) this.cancelTimer(entry);
     this.tracked.clear();
     this.dueQueue.length = 0;
     this.writtenAlone.clear();
   }
 
-  /** Run a pass now, for a change that may make one useful (this machine just became an owner). */
+  /**
+   * Run a pass now, for a change the watched tables do not show (this machine's owner signer was
+   * just wired). A pass in flight is followed by one more.
+   */
   kick(): void {
-    if (!this.running) return;
-    this.clearPollTimer();
-    void this.pass();
+    this.watch?.trigger(0);
   }
 
   /**
@@ -327,8 +360,8 @@ export class PendingJoinRunner {
 
   /**
    * Re-write, with identical content under a fresh stamp, each join this machine last wrote while
-   * it had no control connection, so the other machines receive it. Called on the control
-   * connection growth edge. A join someone wrote since is left alone.
+   * no sibling was reachable, so the other machines receive it. Called on the control cohort's
+   * growth edge, when a sibling becomes reachable. A join someone wrote since is left alone.
    *
    * NOTE: in memory only, so a join written alone by a process that stopped before it reconnected
    * reaches the party only with that join's next write. A sweep of every join this machine wrote,
@@ -359,41 +392,29 @@ export class PendingJoinRunner {
     }
   }
 
-  private schedulePass(delayMs: number): void {
-    if (!this.running) return;
-    this.clearPollTimer();
-    this.pollTimer = this.scheduler.setTimeout(() => {
-      this.pollTimer = undefined;
-      void this.pass();
-    }, delayMs);
+  /** The watch every pass runs on: the deps' change subscription, or a timer-only one. */
+  private subscribe(): TableChangeWatch {
+    const onChange = (): Promise<void> => this.pass();
+    const options: TableChangeWatchOptions = {
+      label: 'pending-join',
+      backstopMs: this.deps.backstopMs ?? PENDING_JOIN_BACKSTOP_MS,
+      scheduler: this.scheduler,
+    };
+    return this.deps.watchChanges?.(onChange, options) ?? scheduleRuns(onChange, options);
   }
 
-  private clearPollTimer(): void {
-    if (this.pollTimer !== undefined) {
-      this.scheduler.clearTimeout(this.pollTimer);
-      this.pollTimer = undefined;
+  /** One pass; a failed one runs again {@link PENDING_JOIN_PASS_RETRY_MS} later. */
+  private async pass(): Promise<void> {
+    try {
+      await this.runPass();
+    } catch (error) {
+      log('pending-join pass failed; retried in 30 s: %s', errorText(error));
+      this.retryPass();
     }
   }
 
-  /** One pass at a time; a kick during a pass runs one more after it. */
-  private pass(): Promise<void> {
-    if (this.passInFlight) {
-      this.passAgain = true;
-      return this.passInFlight;
-    }
-    const run = this.runPass()
-      .catch((error: unknown) => log('pending-join pass failed; the next one retries: %s', errorText(error)))
-      .finally(() => {
-        this.passInFlight = null;
-        if (this.passAgain && this.running) {
-          this.passAgain = false;
-          void this.pass();
-          return;
-        }
-        this.schedulePass(PENDING_JOIN_POLL_MS);
-      });
-    this.passInFlight = run;
-    return run;
+  private retryPass(): void {
+    this.watch?.trigger(PENDING_JOIN_PASS_RETRY_MS);
   }
 
   private async runPass(): Promise<void> {
@@ -415,7 +436,8 @@ export class PendingJoinRunner {
       try {
         await this.consider(join);
       } catch (error) {
-        log('pending join %s: this pass could not handle it; the next one retries: %s', join.Id, errorText(error));
+        log('pending join %s: this pass could not handle it; retried in 30 s: %s', join.Id, errorText(error));
+        this.retryPass();
       }
     }
   }
@@ -663,7 +685,8 @@ export class PendingJoinRunner {
       }
       expected = live!;
     }
-    log('pending join %s: another machine kept changing the join; the next pass decides', entry.row.Id);
+    log('pending join %s: another machine kept changing the join; a pass in 30 s decides', entry.row.Id);
+    this.retryPass();
   }
 
   private settle(join: PendingJoin): void {

package/src/seed-bootstrap.ts

@@ -17,6 +17,7 @@ import { relayedRequestBudgetMs } from './link-budget.js';
 import type {
   ControlNetworkSeed,
   SeedPeer,
+  SeedDialTarget,
   SeedMessage,
   SeedAckMessage,
   SeedRefusalCode,
@@ -31,10 +32,9 @@ import type {
   PeerAddressRecord,
   DeviceTokenRecord,
   RevocationRow,
-  RevocationLedgerOpenResult,
   MachineRemovalResult
 } from './types.js';
-import type { ControlDatabase } from './control-database.js';
+import type { CadrePeerRetouchMode, CadrePeerRetouchOutcome, ControlDatabase } from './control-database.js';
 import { generateStampId, ownerKeyLabel } from './control-database.js';
 import { canonicalJson } from './canonical-json.js';
 import { deviceTokenAddDigest } from './peer-authorization.js';
@@ -117,6 +117,20 @@ export function seedDigest(seed: Pick<ControlNetworkSeed, 'partyId' | 'peers'>):
   return digest([canonicalSeedPayload(seed)], 'sha256', 'base64url') as string;
 }
 
+/**
+ * The peers `seed` nominates for dialing: its preferred peers (`SeedPeer.preferred`: the machine
+ * that minted it and every always-on machine) that have an address and are not `selfPeerId`.
+ *
+ * Self is dropped because `createSeed` projects every non-revoked CadrePeer row, so a preferred
+ * machine applying a seed minted after it joined finds itself in the list, and a dial of self
+ * always throws. An undefined `selfPeerId` matches nothing.
+ */
+export function seedDialTargets(seed: ControlNetworkSeed, selfPeerId: string | undefined): SeedDialTarget[] {
+  return seed.peers
+    .filter((peer) => peer.preferred && peer.multiaddrs.length > 0 && peer.peerId !== selfPeerId)
+    .map(({ peerId, multiaddrs }) => ({ peerId, multiaddrs }));
+}
+
 /** Add `relayAddr` to the entry for `selfPeerId` in `peers`, when that entry exists and lacks it. */
 function addSelfRelayAddr(peers: SeedPeer[], selfPeerId: string, relayAddr: string): void {
   const self = peers.find((peer) => peer.peerId === selfPeerId);
@@ -307,7 +321,8 @@ export interface SeedEventCallbacks {
   /** Called when a seed is received via the protocol */
   onSeedReceived?: (partyId: string, peerId: string) => void;
   /**
-   * Called when a seed is successfully applied.
+   * Called when a seed delivered over the protocol has been verified, merged and
+   * acknowledged; the dials of its preferred peers follow, so this waits on no connection.
    *
    * `seed` is the applied seed itself: the inbound protocol handler applies it
    * INSIDE the service, so this callback is the only seam through which a
@@ -553,10 +568,10 @@ export class SeedBootstrapService {
   /**
    * Return the configured owner signer, or throw if none is set. The single precondition
    * gate for every owner-signed write. {@link removePeer} / {@link reauthorizePeer} read the
-   * row's `StampId` from the DB BEFORE they sign, so they call this up front — otherwise a
-   * signerless service would either surface the wrong "Control database not initialized"
-   * error or, worse, silently no-op when the target row is absent (the early
-   * `stampId === null` return) instead of rejecting.
+   * row from the DB BEFORE they sign, so they call this up front — otherwise a signerless
+   * service would either surface the wrong "Control database not initialized" error or,
+   * worse, silently no-op when the target row is absent (their early absent return) instead
+   * of rejecting.
    */
   private requireOwnerSigner(): OwnerSigner {
     if (!this.config.ownerSigner) {
@@ -697,35 +712,47 @@ export class SeedBootstrapService {
   }
 
   /**
-   * Owner "re-touch" of an existing `CadrePeer` membership row: bump `UpdatedAt` and
-   * re-vouch the row so it is re-emitted as a fresh, broadcasting transaction. This is
-   * the write-while-alone re-replication primitive (`control-write-ensure-replicated`):
-   * a membership row that committed local-only (its block's cluster ≤1 at insert) is
-   * pushed to the cohort once it grows.
+   * Owner "re-touch" of an existing `CadrePeer` membership row, in one of two modes
+   * ({@link CadrePeerRetouchMode}): `'rebroadcast'` bumps `UpdatedAt` and re-vouches the row so
+   * it is re-emitted as a fresh, broadcasting transaction — the write-while-alone re-replication
+   * primitive (`control-write-ensure-replicated`): a membership row that committed local-only
+   * (its block's cluster ≤1 at insert) is pushed to the cohort once it grows — and writes only
+   * while the machine has not self-published; `'revouch'` rebinds the voucher to this node's
+   * owner key, leaving `UpdatedAt` alone, whether or not the machine has self-published
+   * (`CadreNode.removeOwner`).
    *
-   * The stamp read, the voucher signature, the write lock and the membership notify are
+   * The row read, the mode's decision, the stamp bump, the voucher signature, the write lock,
+   * the lost-update retry and the membership notify are
    * {@link ControlDatabase.reauthorizeCadrePeer}'s — including the caveat that it rebinds
    * `VouchOwner` to this node's owner key. What stays here is the owner-signer precondition.
    *
-   * A no-op (no throw, no notify) when the row does not exist.
-   *
    * @param peerId - the membership row to re-touch.
-   * @param updatedAt - the strictly-increasing freshness stamp to write.
+   * @param mode - re-broadcast or re-vouch.
+   * @returns what was found and done ({@link CadrePeerRetouchOutcome}); an absent row, or a
+   *   self-published one in `'rebroadcast'` mode, writes nothing and does not throw.
    * @throws if no owner signer is configured (a non-owner cannot
    *   re-sign another peer's row) or the control database is not initialized.
    */
-  async reauthorizePeer(peerId: string, updatedAt: number, sign?: OwnerSign): Promise<void> {
+  async reauthorizePeer(peerId: string, mode: CadrePeerRetouchMode, sign?: OwnerSign): Promise<CadrePeerRetouchOutcome> {
     // Fail fast on a signerless service before any DB read (see removePeer): a non-owner
     // cannot re-sign the voucher, and must not silently no-op on an absent row.
     const ownerKey = this.requireOwnerSigner().publicKey;
     const controlDatabase = this.requireControlDatabase();
-    const retouched = await this.withOwnerSign(`Re-issue the membership of ${peerId}`, sign, (approved) =>
-      controlDatabase.reauthorizeCadrePeer(peerId, updatedAt, ownerKey, approved));
-    if (!retouched) {
-      log('reauthorizePeer: no CadrePeer row for %s (nothing to re-touch)', peerId);
-      return;
+    const action = mode === 'revouch' ? `Re-vouch the machine ${peerId}` : `Re-issue the membership of ${peerId}`;
+    const outcome = await this.withOwnerSign(action, sign, (approved) =>
+      controlDatabase.reauthorizeCadrePeer(peerId, mode, ownerKey, approved));
+    switch (outcome) {
+      case 'absent':
+        log('reauthorizePeer(%s): no CadrePeer row for %s (nothing to re-touch)', mode, peerId);
+        break;
+      case 'self-published':
+        log('reauthorizePeer(%s): %s has self-published; its row is its own to refresh', mode, peerId);
+        break;
+      case 'retouched':
+        log('Peer %s re-authorized (%s)', peerId, mode);
+        break;
     }
-    log('Peer %s re-authorized (UpdatedAt=%d) for write-while-alone re-replication', peerId, updatedAt);
+    return outcome;
   }
 
   /**
@@ -753,26 +780,6 @@ export class SeedBootstrapService {
       controlDatabase.reissueRevocations(rows, reissuedAt, ownerKey, approved));
   }
 
-  /**
-   * Owner filing of the singleton `Revocation` ledger marker, so the table is never a
-   * never-written block that the storage layer re-consults on every read.
-   *
-   * The signature, the insert-if-absent guard and the `'already-open'` mapping are
-   * {@link ControlDatabase.openRevocationLedger}'s. What stays here is the owner-signer
-   * precondition.
-   *
-   * @throws if no owner signer is configured or the control database is not
-   *   initialized.
-   */
-  async openRevocationLedger(sign?: OwnerSign): Promise<RevocationLedgerOpenResult> {
-    // Fail fast on a signerless service before any DB work (see removePeer): a
-    // non-owner cannot sign the marker's append digest.
-    const ownerKey = this.requireOwnerSigner().publicKey;
-    const controlDatabase = this.requireControlDatabase();
-    return await this.withOwnerSign('Open the cadre\'s removal ledger', sign, (approved) =>
-      controlDatabase.openRevocationLedger(ownerKey, approved));
-  }
-
   /**
    * Owner-signed INSERT of a `CadreInvite` row — an invitation any member machine can redeem
    * on this owner's behalf ({@link ControlDatabase.insertCadreInvite}). The keypair mint, the
@@ -997,8 +1004,11 @@ export class SeedBootstrapService {
    * `CadreNode.dialColdStartBootstrap` retries these same addresses on every control-cohort
    * reconcile pass until the control database has siblings.
    *
-   * The inbound handler runs this AFTER it has acked and closed the stream
-   * ({@link handleSeedStream}), because an unreachable peer can take `dialBudget.totalMs`.
+   * The inbound handler runs this AFTER it has acked, closed the stream and reported the seed
+   * applied ({@link handleSeedStream}), because an unreachable peer can take `dialBudget.totalMs`.
+   * The node may stop while these dials are in flight (cadre-cli restarts a claimed node on
+   * `seed:applied`): the node's stop aborts the dial in flight and every later one is refused
+   * at once (`dialAddr`), and each is counted as failed here.
    */
   private async dialPreferredPeers(seed: ControlNetworkSeed): Promise<PreferredDialCounts> {
     const node = this.libp2pNode;
@@ -1006,23 +1016,16 @@ export class SeedBootstrapService {
       log('Seed service shut down before its dials; none attempted');
       return { preferredDialsAttempted: 0, preferredDialsFailed: 0 };
     }
-    // `createSeed` projects every non-revoked CadrePeer row, so a preferred machine applying
-    // a seed minted after it joined finds ITSELF in the list. Dialing self always throws,
-    // which would report a healthy node as "seeded but stranded".
-    // Optional-chained: partial libp2p handles (unit-test doubles) omit `peerId`,
-    // and an undefined self simply matches nothing.
+    // Self is not dialed: dialing self always throws, which would report a healthy node as
+    // "seeded but stranded". Optional-chained: partial libp2p handles (unit-test doubles)
+    // omit `peerId`.
     // Every one of a peer's addresses is a candidate, each on its own time limit
     // (`dialPeerAddrs`), so a peer whose first address never answers neither
     // stalls seed application nor goes undialed at its other addresses. The seed's
     // addresses carry no peer id; the dial binds each to the peer's.
-    const selfPeerId = node.peerId?.toString();
-    let preferredDialsAttempted = 0;
+    const targets = seedDialTargets(seed, node.peerId?.toString());
     let preferredDialsFailed = 0;
-    for (const peer of seed.peers.filter(p => p.preferred)) {
-      if (peer.multiaddrs.length === 0 || peer.peerId === selfPeerId) {
-        continue;
-      }
-      preferredDialsAttempted++;
+    for (const peer of targets) {
       try {
         const addrs = parseDialAddrs(peer.multiaddrs);
 
@@ -1041,8 +1044,8 @@ export class SeedBootstrapService {
       }
     }
 
-    log('Dialed preferred seed peers: %d/%d dial(s) failed', preferredDialsFailed, preferredDialsAttempted);
-    return { preferredDialsAttempted, preferredDialsFailed };
+    log('Dialed preferred seed peers: %d/%d dial(s) failed', preferredDialsFailed, targets.length);
+    return { preferredDialsAttempted: targets.length, preferredDialsFailed };
   }
 
   /**
@@ -1317,14 +1320,16 @@ export class SeedBootstrapService {
 
   /**
    * Read one inbound seed frame, verify and merge it, write the ack and close the
-   * stream, then dial the seed's preferred peers.
+   * stream, report the seed applied, then dial the seed's preferred peers.
    *
-   * The ack and the close come BEFORE those dials: an unreachable peer can hold
-   * a dial for `dialBudget.totalMs` (86 s at the default declared link), which is not
-   * link time and does not belong inside the sender's delivery deadline. The close is
-   * what releases the sender, which reads the ack to end-of-stream. The stream stays
-   * counted in {@link activeStreams} through the dials, so {@link maxConcurrentSeeds}
-   * still bounds concurrent dial phases.
+   * The ack, the close and `onSeedApplied` come BEFORE those dials: an unreachable peer
+   * can hold a dial for `dialBudget.totalMs` (86 s at the default declared link), which is
+   * not link time and does not belong inside the sender's delivery deadline, nor ahead of
+   * a claimed node's restart (which stops this node, so its dials would be wasted). The
+   * close is what releases the sender, which reads the ack to end-of-stream, and it is
+   * awaited before `onSeedApplied`, so the ack is flushed before anything the callback
+   * starts. The stream stays counted in {@link activeStreams} through the dials, so
+   * {@link maxConcurrentSeeds} still bounds concurrent dial phases.
    *
    * Hardened against a buggy/compromised own-cadre node: a concurrency cap (over
    * {@link maxConcurrentSeeds}, reply without applying), a read timeout (a peer
@@ -1361,8 +1366,8 @@ export class SeedBootstrapService {
       );
 
       if (merged.success) {
-        await this.dialPreferredPeers(seed);
         this.eventCallbacks.onSeedApplied?.(seed.partyId, merged.peersAdded, seed);
+        await this.dialPreferredPeers(seed);
       } else {
         this.eventCallbacks.onSeedError?.(seed.partyId, merged.error ?? 'Unknown error');
       }

package/src/self-address-update.ts

@@ -0,0 +1,19 @@
+import type { PeerUpdate } from '@libp2p/interface';
+
+/**
+ * Whether a libp2p `self:peer:update` changed the node's own addresses — the only part of
+ * the update the self record (`CadrePeer.Multiaddr`) carries.
+ *
+ * libp2p emits the event for any change to the node's own peer-store entry, and registering
+ * or unregistering a protocol handler is one (the registrar merges the node's protocol list).
+ * Cadre registers handlers on a running control node (member redemption, strand formation,
+ * the seed listener), so reacting to every event would make each of those a consensus write
+ * of an unchanged record, racing whatever write the cohort is making to `CadrePeer` at the
+ * time. An update with no `previous` is treated as a change: there is nothing to compare.
+ */
+export function selfAddressesChanged(update: PeerUpdate): boolean {
+	if (update.previous === undefined) return true;
+	const before = new Set(update.previous.addresses.map((address) => address.multiaddr.toString()));
+	const after = update.peer.addresses.map((address) => address.multiaddr.toString());
+	return after.length !== before.size || after.some((address) => !before.has(address));
+}