@serfab/cadre-host 0.8.1 → 0.10.0

package/src/auth/__tests__/trust-circle-integration.test.ts

@@ -1,147 +1,152 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { generateKeyPair } from '@libp2p/crypto/keys';
-import { peerIdFromPrivateKey } from '@libp2p/peer-id';
-import { CadreNode, authorityKeyFromLibp2p } from '@serfab/cadre-core';
-
-import { TrustCircleService } from '../trust-circle.js';
-import { TrustCircleStore } from '../trust-circle-store.js';
-
-/**
- * End-to-end integration test: stand up a real host CadreNode with a real
- * Quereus control DB and exercise the full TrustCircleService issue → redeem
- * → list → remove cycle. The "phone" peerId is derived from a fresh Ed25519
- * key (no second libp2p node) since the test only validates host-side state.
- *
- * This replaces the mock CadreNodeLike in trust-circle.test.ts with the real
- * CadreNode to validate that:
- *  - `acceptPhone` (called from redeemInvite with a sparse reconstructed
- *    invite) actually inserts a CadrePeer row;
- *  - `list()` picks up the new peer via the canonical CadrePeer query;
- *  - `removeMember` deletes the row from CadrePeer via the
- *    DELETE-with-context syntax that cadre-core trusts from
- *    `quereus/docs/sql.md`.
- */
-describe('TrustCircleService — real CadreNode integration', () => {
-  let tmpRoot: string;
-  let host: CadreNode;
-  let store: TrustCircleStore;
-  let service: TrustCircleService;
-  let hostAuthorityPrivateKey: string;
-  let hostAuthorityPublicKey: string;
-
-  beforeEach(async () => {
-    tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-tc-int-'));
-
-    // Own-authority host: the node's libp2p identity key IS its authority key
-    // (the cadre-cli `--authority` shape), so registerSelf can authority-sign the
-    // INSERT of its own CadrePeer row.
-    const hostKey = await generateKeyPair('Ed25519');
-    const authority = authorityKeyFromLibp2p(hostKey);
-    hostAuthorityPrivateKey = authority.privateKeyB64;
-    hostAuthorityPublicKey = authority.publicKeyB64;
-
-    const baseId = Math.random().toString(36).slice(2);
-
-    host = new CadreNode({
-      controlNetwork: { partyId: `host-${baseId}`, bootstrapNodes: [] },
-      privateKey: hostKey,
-      profile: 'transaction'
-    });
-
-    await host.start();
-
-    const db = host.getControlDatabase();
-    expect(db).not.toBeNull();
-    await db!.insertAuthorityKey(hostAuthorityPublicKey);
-
-    host.initializeSeedBootstrap(hostAuthorityPrivateKey);
-
-    // The authority writes its own CadrePeer row up-front (the implement ticket's
-    // CLI change). After this the host's own peerId is a member, so it shows up
-    // alongside any redeemed peers in the trust-circle listing.
-    await host.registerSelf();
-
-    store = new TrustCircleStore(tmpRoot);
-    service = new TrustCircleService({ cadreNode: host, store });
-  }, 60_000);
-
-  afterEach(async () => {
-    try { await host.stop(); } catch { /* ignore */ }
-    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-  });
-
-  it('issues → redeems → lists against the real control DB (listMembers path)', async () => {
-    // Derive a shape-valid peerId from a fresh Ed25519 key — same pattern as
-    // packages/cadre-core/test/seed-bootstrap.spec.ts. The AuthorizedInsert
-    // constraint only checks the signature over digest(PeerId,…); peerId
-    // *liveness* doesn't matter for the host-side CRUD path under test.
-    const phoneKey = await generateKeyPair('Ed25519');
-    const phonePeerId = peerIdFromPrivateKey(phoneKey).toString();
-
-    // Issue
-    const issued = await service.issueInvite({ label: "Mom's phone" });
-    expect(issued.token).toBeTruthy();
-    expect(issued.encodedInvite).toBeTruthy();
-
-    // Redeem — this calls host.acceptPhone() with the sparse reconstructed
-    // invite, which in turn calls authorizePeer and inserts CadrePeer.
-    const redeemed = await service.redeemInvite({
-      token: issued.token,
-      peerId: phonePeerId
-    });
-    expect(redeemed).toEqual({ peerId: phonePeerId, label: "Mom's phone" });
-
-    // Verify directly against the control DB: the row is there.
-    expect(await isInCadrePeer(host, phonePeerId)).toBe(true);
-
-    // List — exercises the CadreNode.listMembers() path. CadrePeer now carries
-    // the host's own self-registered row in addition to the redeemed phone.
-    const snap = await service.list();
-    expect(snap.members).toHaveLength(2);
-    const phoneMember = snap.members.find((m) => m.peerId === phonePeerId);
-    expect(phoneMember).toBeDefined();
-    expect(phoneMember!.label).toBe("Mom's phone");
-    // The host's own peerId is present too (unlabeled → bare peerId as label).
-    expect(snap.members.some((m) => m.peerId === host.peerId!.toString())).toBe(true);
-    expect(snap.pending).toHaveLength(0);
-  }, 90_000);
-
-  // The signed `CadrePeer` DELETE previously threw a Quereus deferred-constraint
-  // error ("No row context found for column PeerId") inside cadre-core's
-  // removePeer. That upstream bug is fixed (`quereus-cadrepeer-delete-no-row-context`,
-  // landed), so the full issue → redeem → remove cycle is now exercised here.
-  it('removes a member from CadrePeer', async () => {
-    const phoneKey = await generateKeyPair('Ed25519');
-    const phonePeerId = peerIdFromPrivateKey(phoneKey).toString();
-
-    const issued = await service.issueInvite({ label: "Mom's phone" });
-    await service.redeemInvite({ token: issued.token, peerId: phonePeerId });
-    expect(await isInCadrePeer(host, phonePeerId)).toBe(true);
-
-    await service.removeMember(phonePeerId);
-
-    expect(await isInCadrePeer(host, phonePeerId)).toBe(false);
-    expect(store.getMember(phonePeerId)).toBeUndefined();
-    const afterRemove = await service.list();
-    // The phone is gone; the host's own self-registered row remains.
-    expect(afterRemove.members.map((m) => m.peerId)).not.toContain(phonePeerId);
-    expect(afterRemove.members).toHaveLength(1);
-    expect(afterRemove.members[0]!.peerId).toBe(host.peerId!.toString());
-  }, 90_000);
-});
-
-async function isInCadrePeer(node: CadreNode, peerId: string): Promise<boolean> {
-  const db = node.getControlDatabase();
-  if (!db) return false;
-  const inner = db.getDatabase();
-  for await (const row of inner.eval(
-    'select PeerId from CadreControl.CadrePeer where PeerId = ?',
-    [peerId]
-  )) {
-    if (row.PeerId === peerId) return true;
-  }
-  return false;
-}
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { generateKeyPair } from '@libp2p/crypto/keys';
+import { peerIdFromPrivateKey } from '@libp2p/peer-id';
+import { CadreNode, ed25519KeyPairFromLibp2p } from '@serfab/cadre-core';
+
+import { ensureSelfLabel } from '../self-label.js';
+import { TrustCircleService } from '../trust-circle.js';
+import { TrustCircleStore } from '../trust-circle-store.js';
+
+/**
+ * End-to-end integration test: stand up a real host CadreNode with a real
+ * Quereus control DB and exercise the full TrustCircleService issue → redeem
+ * → list → remove cycle. The "phone" peerId is derived from a fresh Ed25519
+ * key (no second libp2p node) since the test only validates host-side state.
+ *
+ * This replaces the mock CadreNodeLike in trust-circle.test.ts with the real
+ * CadreNode to validate that:
+ *  - `acceptPhone` (called from redeemInvite with a sparse reconstructed
+ *    invite) actually inserts a CadrePeer row;
+ *  - `list()` picks up the new peer via the canonical CadrePeer query;
+ *  - `removeMember` deletes the row from CadrePeer via the
+ *    DELETE-with-context syntax that cadre-core trusts from
+ *    `quereus/docs/sql.md`.
+ */
+describe('TrustCircleService — real CadreNode integration', () => {
+  let tmpRoot: string;
+  let host: CadreNode;
+  let store: TrustCircleStore;
+  let service: TrustCircleService;
+  let hostOwnerPrivateKey: string;
+  let hostOwnerPublicKey: string;
+
+  beforeEach(async () => {
+    tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-tc-int-'));
+
+    // Own-owner host: the node's libp2p identity key IS its owner key
+    // (the cadre-cli `--owner` shape), so registerSelf can owner-sign the
+    // INSERT of its own CadrePeer row.
+    const hostKey = await generateKeyPair('Ed25519');
+    const owner = ed25519KeyPairFromLibp2p(hostKey);
+    hostOwnerPrivateKey = owner.privateKeyB64;
+    hostOwnerPublicKey = owner.publicKeyB64;
+
+    const baseId = Math.random().toString(36).slice(2);
+
+    host = new CadreNode({
+      controlNetwork: { partyId: `host-${baseId}`, bootstrapNodes: [] },
+      privateKey: hostKey,
+      profile: 'transaction'
+    });
+
+    await host.start();
+
+    const db = host.getControlDatabase();
+    expect(db).not.toBeNull();
+    await db!.insertOwnerKey(hostOwnerPublicKey);
+
+    host.initializeSeedBootstrap(hostOwnerPrivateKey);
+
+    // The owner writes its own CadrePeer row up-front (the implement ticket's
+    // CLI change). After this the host's own peerId is a member, so it shows up
+    // alongside any redeemed peers in the trust-circle listing.
+    await host.registerSelf();
+
+    store = new TrustCircleStore(tmpRoot);
+    // Same self-labelling call bin/host.ts makes at startup, wired to the real
+    // node's peer ID instead of an OwnerNodeClient (this test constructs
+    // TrustCircleService directly against a CadreNode, so no client is in play).
+    await ensureSelfLabel({ store, getPeerId: async () => host.peerId!.toString() });
+    service = new TrustCircleService({ cadreNode: host, store });
+  }, 60_000);
+
+  afterEach(async () => {
+    try { await host.stop(); } catch { /* ignore */ }
+    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+  });
+
+  it('issues → redeems → lists against the real control DB (listMembers path)', async () => {
+    // Derive a shape-valid peerId from a fresh Ed25519 key — same pattern as
+    // packages/cadre-core/test/seed-bootstrap.spec.ts. The AuthorizedInsert
+    // constraint only checks the signature over digest(PeerId,…); peerId
+    // *liveness* doesn't matter for the host-side CRUD path under test.
+    const phoneKey = await generateKeyPair('Ed25519');
+    const phonePeerId = peerIdFromPrivateKey(phoneKey).toString();
+
+    // Issue
+    const issued = await service.issueInvite({ label: "Mom's phone" });
+    expect(issued.token).toBeTruthy();
+    expect(issued.encodedInvite).toBeTruthy();
+
+    // Redeem — this calls host.acceptPhone() with the sparse reconstructed
+    // invite, which in turn calls authorizePeer and inserts CadrePeer.
+    const redeemed = await service.redeemInvite({
+      token: issued.token,
+      peerId: phonePeerId
+    });
+    expect(redeemed).toEqual({ peerId: phonePeerId, label: "Mom's phone" });
+
+    // Verify directly against the control DB: the row is there.
+    expect(await isInCadrePeer(host, phonePeerId)).toBe(true);
+
+    // List — exercises the CadreNode.listMembers() path. CadrePeer now carries
+    // the host's own self-registered row in addition to the redeemed phone.
+    const snap = await service.list();
+    expect(snap.members).toHaveLength(2);
+    const phoneMember = snap.members.find((m) => m.peerId === phonePeerId);
+    expect(phoneMember).toBeDefined();
+    expect(phoneMember!.label).toBe("Mom's phone");
+    // The host's own peerId is present too (unlabeled → bare peerId as label).
+    expect(snap.members.some((m) => m.peerId === host.peerId!.toString())).toBe(true);
+    expect(snap.pending).toHaveLength(0);
+  }, 90_000);
+
+  // The signed `CadrePeer` DELETE previously threw a Quereus deferred-constraint
+  // error ("No row context found for column PeerId") inside cadre-core's
+  // removePeer. That upstream bug is fixed (`quereus-cadrepeer-delete-no-row-context`,
+  // landed), so the full issue → redeem → remove cycle is now exercised here.
+  it('removes a member from CadrePeer', async () => {
+    const phoneKey = await generateKeyPair('Ed25519');
+    const phonePeerId = peerIdFromPrivateKey(phoneKey).toString();
+
+    const issued = await service.issueInvite({ label: "Mom's phone" });
+    await service.redeemInvite({ token: issued.token, peerId: phonePeerId });
+    expect(await isInCadrePeer(host, phonePeerId)).toBe(true);
+
+    await service.removeMember(phonePeerId);
+
+    expect(await isInCadrePeer(host, phonePeerId)).toBe(false);
+    expect(store.getMember(phonePeerId)).toBeUndefined();
+    const afterRemove = await service.list();
+    // The phone is gone; the host's own self-registered row remains.
+    expect(afterRemove.members.map((m) => m.peerId)).not.toContain(phonePeerId);
+    expect(afterRemove.members).toHaveLength(1);
+    expect(afterRemove.members[0]!.peerId).toBe(host.peerId!.toString());
+  }, 90_000);
+});
+
+async function isInCadrePeer(node: CadreNode, peerId: string): Promise<boolean> {
+  const db = node.getControlDatabase();
+  if (!db) return false;
+  const inner = db.getDatabase();
+  for await (const row of inner.eval(
+    'select PeerId from CadreControl.CadrePeer where PeerId = ?',
+    [peerId]
+  )) {
+    if (row.PeerId === peerId) return true;
+  }
+  return false;
+}

package/src/auth/__tests__/trust-circle.test.ts

@@ -9,29 +9,37 @@ import { TrustCircleService, createTrustCircleHandlers } from '../trust-circle.j
 import { TrustCircleStore } from '../trust-circle-store.js';
 import { TrustCircleError } from '../types.js';
 import type { CadreNodeLike } from '../trust-circle.js';
-import { AuthorityNodeUnavailableError } from '../../authority/authority-node-client.js';
+import { OwnerNodeUnavailableError } from '../../owner/owner-node-client.js';
 
 /**
- * Minimal in-memory mock of the authority-node channel adapter. Records calls
+ * Minimal in-memory mock of the owner-node channel adapter. Records calls
  * so assertions can verify the auth + redemption flow without standing up a
  * real libp2p control network or admin channel.
  */
 class MockCadreNode implements CadreNodeLike {
+  /** CadrePeer rows — the real (authorized) membership test. */
   readonly authorizedPeers = new Set<string>();
+  /**
+   * Addressable-only rows — peers that published an address record without
+   * ever being vouched for. Models the "stranger writes its own row" bug:
+   * present in `listMembers`/`isMember` (addressable), absent from
+   * `listAuthorizedMembers`/`isAuthorizedMember` (authorized).
+   */
+  readonly unauthorizedAddressablePeers = new Set<string>();
   readonly issuedInvites: Array<{ token?: string; expiresIn?: number }> = [];
   readonly accepted: Array<{ phonePeerId: string; token?: string }> = [];
   readonly removed: string[] = [];
 
   /** Toggle to make acceptPhone reject. */
   acceptShouldThrow: Error | null = null;
-  /** When false, membership calls throw AuthorityNodeUnavailableError. */
+  /** When false, membership calls throw OwnerNodeUnavailableError. */
   nodeAvailable = true;
 
   async createInvite(token?: string, expiresIn?: number) {
     this.issuedInvites.push({ token, expiresIn });
     const invite: CadreInvite = {
       partyId: 'party-test',
-      authorityAddrs: ['/ip4/127.0.0.1/tcp/4001'],
+      ownerAddrs: ['/ip4/127.0.0.1/tcp/4001'],
       token,
       createdAt: Date.now(),
       ...(expiresIn ? { expiresAt: Date.now() + expiresIn } : {}),
@@ -48,6 +56,7 @@ class MockCadreNode implements CadreNodeLike {
   async removePeer(peerId: string) {
     this.removed.push(peerId);
     this.authorizedPeers.delete(peerId);
+    this.unauthorizedAddressablePeers.delete(peerId);
   }
 
   encodeInvite(invite: CadreInvite): string {
@@ -55,12 +64,23 @@ class MockCadreNode implements CadreNodeLike {
   }
 
   async listMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
-    if (!this.nodeAvailable) throw new AuthorityNodeUnavailableError('node down');
-    return [...this.authorizedPeers].map((peerId) => ({ peerId, multiaddr: null }));
+    if (!this.nodeAvailable) throw new OwnerNodeUnavailableError('node down');
+    return [...this.authorizedPeers, ...this.unauthorizedAddressablePeers]
+      .map((peerId) => ({ peerId, multiaddr: null }));
   }
 
   async isMember(peerId: string): Promise<boolean> {
-    if (!this.nodeAvailable) throw new AuthorityNodeUnavailableError('node down');
+    if (!this.nodeAvailable) throw new OwnerNodeUnavailableError('node down');
+    return this.authorizedPeers.has(peerId) || this.unauthorizedAddressablePeers.has(peerId);
+  }
+
+  async listAuthorizedMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
+    if (!this.nodeAvailable) throw new OwnerNodeUnavailableError('node down');
+    return [...this.authorizedPeers].map((peerId) => ({ peerId, multiaddr: null }));
+  }
+
+  async isAuthorizedMember(peerId: string): Promise<boolean> {
+    if (!this.nodeAvailable) throw new OwnerNodeUnavailableError('node down');
     return this.authorizedPeers.has(peerId);
   }
 }
@@ -201,7 +221,7 @@ describe('TrustCircleService.redeemInvite', () => {
 
   it('preserves the pending token when acceptPhone fails with node_unavailable', async () => {
     const { token } = await service.issueInvite({ label: 'Transient' });
-    cadreNode.acceptShouldThrow = new AuthorityNodeUnavailableError('node down');
+    cadreNode.acceptShouldThrow = new OwnerNodeUnavailableError('node down');
 
     await expect(service.redeemInvite({ token, peerId: 'pTrans' }))
       .rejects.toMatchObject({ code: 'node_unavailable' });
@@ -225,7 +245,7 @@ describe('TrustCircleService.redeemInvite', () => {
     // first redeem hits node_unavailable. The second redeem should still
     // bounce synchronously while the gate is held.
     let release!: () => void;
-    const gate = new Promise<void>((_, reject) => { release = () => reject(new AuthorityNodeUnavailableError('node down')); });
+    const gate = new Promise<void>((_, reject) => { release = () => reject(new OwnerNodeUnavailableError('node down')); });
     cadreNode.acceptPhone = async () => {
       await gate;
     };
@@ -349,7 +369,7 @@ describe('TrustCircleService.list', () => {
     expect(store.getMember('orphan')).toBeUndefined();
   });
 
-  it('falls back to local labels when the authority node is unavailable', async () => {
+  it('falls back to local labels when the owner node is unavailable', async () => {
     store.addMember({ peerId: 'pZ', label: 'Zoe', addedAt: 't' });
     cadreNode.nodeAvailable = false;
 
@@ -361,7 +381,7 @@ describe('TrustCircleService.list', () => {
 
   it('issueInvite surfaces node_unavailable when the channel is down', async () => {
     const downNode = new MockCadreNode();
-    downNode.createInvite = async () => { throw new AuthorityNodeUnavailableError('refused'); };
+    downNode.createInvite = async () => { throw new OwnerNodeUnavailableError('refused'); };
     const svc = new TrustCircleService({ cadreNode: downNode, store });
     await expect(svc.issueInvite({ label: 'Nina' }))
       .rejects.toMatchObject({ code: 'node_unavailable' });
@@ -373,6 +393,30 @@ describe('TrustCircleService.list', () => {
     const entry = snap.members.find(m => m.peerId === 'unlabeled-peer');
     expect(entry?.label).toBe('unlabeled-peer');
   });
+
+  it('excludes addressable-only peers nobody authorized', async () => {
+    cadreNode.authorizedPeers.add('invited-peer');
+    cadreNode.unauthorizedAddressablePeers.add('stranger-peer');
+
+    const snap = await service.list();
+
+    expect(snap.members.map(m => m.peerId)).toContain('invited-peer');
+    expect(snap.members.map(m => m.peerId)).not.toContain('stranger-peer');
+  });
+
+  it('keeps the self row even though the authorized set excludes self', async () => {
+    store.addMember({ peerId: 'self-peer', label: 'This device', addedAt: 't', self: true });
+    // Self is addressable (would show under listMembers) but never authorized.
+
+    const snap = await service.list();
+
+    const self = snap.members.find(m => m.peerId === 'self-peer');
+    expect(self).toBeDefined();
+    expect(self?.self).toBe(true);
+    expect(self?.label).toBe('This device');
+    // Not pruned as an orphan label despite being absent from the authorized set.
+    expect(store.getMember('self-peer')).toBeDefined();
+  });
 });
 
 describe('createTrustCircleHandlers', () => {

package/src/auth/index.ts

@@ -5,6 +5,8 @@
 export { TrustCircleService, createTrustCircleHandlers, DEFAULT_INVITE_TTL_MS } from './trust-circle.js';
 export type { TrustCircleServiceOptions, CadreNodeLike } from './trust-circle.js';
 export { TrustCircleStore } from './trust-circle-store.js';
+export { ensureSelfLabel, SELF_LABEL } from './self-label.js';
+export type { EnsureSelfLabelOptions } from './self-label.js';
 export { parseDuration } from './duration.js';
 export {
   TrustCircleError,

package/src/auth/self-label.ts

@@ -0,0 +1,74 @@
+/**
+ * Self-labelling for the trust-circle listing.
+ *
+ * `TrustCircleService.list()` shows the cadre's *authorized* membership, which
+ * deliberately excludes the node's own self-published row — a node's own
+ * address record isn't something an owner key vouched for. To keep the owner's
+ * own device visible in the listing, cadre-host records a local
+ * `self: true` label for it and `list()` splices that row back in.
+ *
+ * Writing that label is this module's job. Kept out of `bin/host.ts` so it is
+ * unit-testable without standing up the CLI.
+ */
+
+import debug from 'debug';
+
+import type { TrustCircleStore } from './trust-circle-store.js';
+
+const log = debug('cadre:host:trust-circle-self');
+
+/** Label written for the owner's own device when none exists yet. */
+export const SELF_LABEL = 'This device';
+
+export interface EnsureSelfLabelOptions {
+  /** Local labels store to write into. */
+  store: TrustCircleStore;
+  /** Resolves the owner node's peer ID; '' when the node isn't ready yet. */
+  getPeerId: () => Promise<string>;
+  /** Clock override for tests. */
+  now?: () => Date;
+}
+
+/**
+ * Record the owner node's own peer ID as a `self: true` local label.
+ *
+ * Idempotent: an existing row for that peer ID is left alone, so an admin's
+ * rename survives restarts. Stale `self` rows (a different peer ID — the node
+ * identity was replaced) are dropped, since `list()` splices every `self` row
+ * in unconditionally and would otherwise show a device that no longer exists.
+ *
+ * Returns the peer ID that is now labelled, or `undefined` when the node
+ * wasn't ready. Throws whatever `getPeerId` throws — callers treat a failure
+ * as best-effort (the next start heals it).
+ */
+export async function ensureSelfLabel(opts: EnsureSelfLabelOptions): Promise<string | undefined> {
+  const { store, getPeerId } = opts;
+  const now = opts.now ?? (() => new Date());
+
+  const peerId = await getPeerId();
+  if (!peerId) {
+    log('owner node not ready — no self label written');
+    return undefined;
+  }
+
+  for (const member of store.listMembers()) {
+    if (member.self && member.peerId !== peerId) {
+      log('dropping stale self label for %s (current identity is %s)', member.peerId, peerId);
+      store.removeMember(member.peerId);
+    }
+  }
+
+  const existing = store.getMember(peerId);
+  if (!existing) {
+    store.addMember({ peerId, label: SELF_LABEL, addedAt: now().toISOString(), self: true });
+    log('labelled own device %s as "%s"', peerId, SELF_LABEL);
+  } else if (!existing.self) {
+    // Row predates self-labelling (or was written by a redemption). Stamp the
+    // flag, keeping the label: without it `list()` prunes the row, since the
+    // authorized set never contains self.
+    store.addMember({ ...existing, self: true });
+    log('stamped existing label for own device %s as self', peerId);
+  }
+
+  return peerId;
+}