@serfab/cadre-host 1.13.0 → 1.15.0

package/dist/orchestrator/host-process-orchestrator.js

@@ -47,6 +47,18 @@ function scrubbedParentEnv() {
     }
     return env;
 }
+/**
+ * The env carrying how the child gets into its cadre, and nowhere else (see
+ * `HostedSpawnRequest`): `CADRE_CLAIM_SECRET` makes `cadre-cli start` wait to be
+ * claimed, `CADRE_INVITATION` makes it redeem the invitation once it is up.
+ */
+function joinEnv(request) {
+    if (request.claimSecret)
+        return { CADRE_CLAIM_SECRET: request.claimSecret };
+    if (request.invitation)
+        return { CADRE_INVITATION: request.invitation };
+    return undefined;
+}
 /**
  * The libp2p listen addresses a managed child binds — its `CADRE_LISTEN_ADDRS`, one
  * entry per element: TCP on the `p2p` port and WebSocket on the `ws` port, both on
@@ -65,22 +77,17 @@ export function childListenAddrs(ports) {
 /**
  * Every TCP port a managed child binds, on the address it binds it to: health and
  * metrics (`cadre-cli`'s `HealthServer`) and the libp2p TCP and WebSocket listeners
- * ({@link childListenAddrs}) on every interface, plus the loopback admin channel —
- * for the owner node only, the one child started with `--admin-port`. A key the
- * set lacks (a handle persisted by an older build) is skipped.
+ * ({@link childListenAddrs}), all on every interface. A key the set lacks (a handle
+ * persisted by an older build) is skipped.
  */
-function childPortBindings(ports, owner) {
+function childPortBindings(ports) {
     const bindings = [];
     for (const port of [ports.health, ports.metrics, ports.p2p, ports.ws]) {
         if (port !== undefined)
             bindings.push({ port, host: '0.0.0.0' });
     }
-    if (owner && ports.admin !== undefined)
-        bindings.push({ port: ports.admin, host: '127.0.0.1' });
     return bindings;
 }
-/** Fixed friendly id for the admin's owner node. */
-export const OWNER_CONTAINER_ID = 'owner';
 /**
  * Runs cadre nodes as plain Node child processes on the host.
  *
@@ -127,6 +134,7 @@ export class HostProcessOrchestrator {
         this.defaultMemoryLimit = cfg.defaultResources?.memoryLimit;
         this.cliEntrypoint = cfg.spawn?.entrypoint ?? resolveCadreCliBin();
         this.pushResolver = cfg.pushResolver;
+        this.announceAddrs = cfg.announceAddrs;
         log('HostProcessOrchestrator rootDir=%s cli=%s', this.rootDir, this.cliEntrypoint);
     }
     /**
@@ -136,7 +144,6 @@ export class HostProcessOrchestrator {
      */
     async init() {
         const state = this.stateStore.load();
-        this.ownerConfig = state.ownerConfig;
         for (const persisted of state.handles) {
             const handle = {
                 containerId: persisted.containerId,
@@ -148,7 +155,7 @@ export class HostProcessOrchestrator {
                 spawnedAt: persisted.spawnedAt,
                 partyId: persisted.partyId,
                 profile: persisted.profile,
-                ...(persisted.owner ? { owner: true } : {}),
+                announcedAddrs: persisted.announcedAddrs ?? [],
                 alive: false,
             };
             handle.alive = isHandleLive(handle);
@@ -194,25 +201,32 @@ export class HostProcessOrchestrator {
     }
     /**
      * Register a state-change listener. Invoked when a handle's `alive`
-     * transitions (child exit, manual stop). Returns an unsubscribe fn.
+     * transitions (create, child exit, manual stop) and once more, as `stopped`,
+     * when a handle is removed. Returns an unsubscribe fn.
      */
     onStateChange(listener) {
         this.stateListeners.add(listener);
         return () => { this.stateListeners.delete(listener); };
     }
     /**
-     * Spawn a generic managed node — the donated-node path (the requester's cadre,
-     * pinned to the *requester's* owner key). The node is given its own protobuf
-     * identity key inside its workdir (`ensureNodeIdentity`, reused across
+     * Spawn a managed node — a hosted node for some cadre, started waiting to be
+     * claimed when the request carries a `claimSecret`, or redeeming the cadre
+     * invitation it carries as `invitation`. The node is given its own
+     * protobuf identity key inside its workdir (`ensureNodeIdentity`, reused across
      * re-spawns of the same containerId), which is what makes its peer id stable
      * across restarts AND what makes its node-local stores durable: `cadre-cli
      * start` opens the file-backed bootstrap-peer, trusted-owner and strand
      * network-state stores in the node's state directory, which defaults to the
      * directory holding the `cadre.json` written here — the same workdir.
-     * Terminating the loan (`removeContainer`) deletes the workdir, so the key and
+     * Removing the node (`removeContainer`) deletes the workdir, so the key and
      * every store go with it.
      */
     async createContainer(request) {
+        // Before anything is allocated: `cadre-cli start` refuses the pair anyway, and a child
+        // that exits at once would only surface as a crash loop.
+        if (request.claimSecret && request.invitation) {
+            throw new Error(`container ${request.containerId}: a spawn carries a claim secret or an invitation, not both`);
+        }
         const workdir = this.workdirFor(request.containerId);
         // Sampled BEFORE `ensureNodeIdentity`, which brings the directory into
         // existence as a side effect of writing the key. Only a spawn that found
@@ -233,25 +247,14 @@ export class HostProcessOrchestrator {
             // node's worth of ports from a bounded range on every failed provision attempt.
             const identity = await ensureNodeIdentity(workdir);
             log('container %s identity peerId=%s', request.containerId, identity.peerId);
-            // A node started with pinned owner keys belongs to a FOREIGN cadre (the
-            // node-donation flow: it trusts the requester's owner key, not the host's).
-            // The host's FCM/APNs credentials are minted for the host owner's own app
-            // and are meaningless to a foreign cadre — so donated nodes get NO push
-            // block. (Per-grantee push creds would be a future ticket; none in v1.)
-            const foreignParty = (request.pinnedOwnerKeys?.length ?? 0) > 0;
             // Only storage-profile nodes participate in strands and thus fan out push
             // wakes — a transaction-only node need not carry credentials. Resolved
             // BEFORE the drop below, which keeps the drop → launch window synchronous
             // (see restoreDroppedHandles).
-            const push = request.profile === 'storage' && !foreignParty ? await this.resolvePush() : undefined;
-            // Pinned owner key(s) reach the child via CADRE_OWNER_KEYS (comma-separated);
-            // `cadre-cli start` unions it into its cold-start pinnedKeyTrustPolicy so the
-            // node will accept the foreign-authority-signed seed presented via POST /seed.
-            const extraEnv = request.pinnedOwnerKeys?.length
-                ? { CADRE_OWNER_KEYS: request.pinnedOwnerKeys.join(',') }
-                : undefined;
+            const push = request.profile === 'storage' ? await this.resolvePush() : undefined;
+            const extraEnv = joinEnv(request);
             // The last `await` on this path: checked as close to the drop as it can be.
-            await this.refuseRespawnOverLiveChild(request.containerId, {}, false);
+            await this.refuseRespawnOverLiveChild(request.containerId);
             // Nothing from here to the launch is `await`ed — which is what keeps
             // `restoreDroppedHandles`'s documented precondition true even though the
             // `try` now opens further up. Do not add an `await` past this line.
@@ -266,7 +269,6 @@ export class HostProcessOrchestrator {
                 partyId: request.partyId,
                 profile: request.profile,
                 ports,
-                owner: false,
                 buildConfig: () => this.buildChildConfig(request, workdir, push),
                 extraArgs: ['--identity-file', identity.path],
                 ...(extraEnv ? { extraEnv } : {}),
@@ -294,7 +296,7 @@ export class HostProcessOrchestrator {
     }
     /**
      * Remove the working directory a spawn created for `containerId` when no
-     * handle owns it — the cleanup of last resort for a donation record that
+     * handle owns it — the cleanup of last resort for a hosted-node record that
      * never got a `dockerId` (the host died between `ensureNodeIdentity` and the
      * handle write, so `createContainer`'s own unwind never ran). Returns whether
      * anything was removed.
@@ -303,17 +305,12 @@ export class HostProcessOrchestrator {
      * to await.
      */
     reclaimWorkdir(containerId) {
-        // The admin's own node is never reclaimed by this route: its workdir is a
-        // single fixed path reused by every restart and it holds the host's own
-        // control-DB storage.
-        if (containerId === OWNER_CONTAINER_ID)
-            return false;
         // A live handle owns that directory, and `removeContainer` — which stops
         // the child first — is the only thing allowed to delete it.
         if (this.resolveDockerId(containerId))
             return false;
         const workdir = this.workdirFor(containerId);
-        // Defence, not a live case: donation ids are `grn_<base64url>` and so can
+        // Defence, not a live case: hosted-node ids are `hn_<base64url>` and so can
         // hold neither a path separator nor a dot. A caller that ever passes
         // something else must not be able to walk out of `rootDir`.
         if (!workdir.startsWith(this.rootDir + sep)) {
@@ -376,120 +373,27 @@ export class HostProcessOrchestrator {
         }
     }
     /**
-     * Ensure the admin's owner node is running, spawning it if absent or
-     * dead. Idempotent: a second call with the node already alive returns the
-     * existing handle without launching a second child. The spawn parameters
-     * are persisted so a later `/api/nodes/:id/{start,restart}` (or an
-     * orchestrator restart) can re-spawn it without re-supplying them.
-     *
-     * The owner node is spawned as `cadre-cli start --owner
-     * --admin-port <p> --identity-file <identityPath>` so it carries the
-     * host's libp2p identity, founds/joins the control network, and exposes the
-     * loopback admin channel the manager delegates to.
+     * The public addresses the node about to spawn announces. A hook that throws costs
+     * the node its public addresses, never its start: it still binds and is reachable
+     * on its LAN addresses, and `NatService` restarts it once the addresses it should
+     * announce differ from these.
      */
-    async ensureOwnerNode(cfg) {
-        const config = cfg ?? this.ownerConfig;
-        if (!config) {
-            throw new Error('ensureOwnerNode: no owner config supplied and none persisted');
-        }
-        this.ownerConfig = config;
-        const existing = this.findOwnerHandle();
-        if (existing && isHandleLive(existing)) {
-            this.persist();
-            return toNodeInfo(existing);
-        }
-        const profile = config.profile ?? 'storage';
-        // Re-resolve push credentials from the secret store on every (re-)spawn so a
-        // restart picks up rotated keys and nothing raw is replayed from state.json.
-        // Resolved BEFORE the drop below so the drop → launch window stays
-        // synchronous (see restoreDroppedHandles).
-        const push = await this.resolvePush();
-        // The last `await` before the drop — same guard as in createContainer.
-        await this.refuseRespawnOverLiveChild(OWNER_CONTAINER_ID, { p2p: config.libp2pPort }, true);
-        // NOTE: the short-circuit above matches via `findOwnerHandle` (owner flag OR
-        // containerId), this drop only by containerId. Equivalent today — every
-        // owner handle is launched with OWNER_CONTAINER_ID. If an owner spawn ever
-        // takes a different containerId, the two would disagree and the handle the
-        // short-circuit found would survive here, leaking it and its ports.
-        const dropped = this.dropStaleHandle(OWNER_CONTAINER_ID);
-        let ports;
+    announceAddrsFor(containerId, ports) {
+        if (!this.announceAddrs)
+            return [];
         try {
-            // The owner node must listen on the configured libp2p port so the NAT
-            // mapping (external → internal) lands on it — hence the p2p override, which
-            // wins over the dropped handle's. Every other port comes back as it was, for
-            // the same reason as in createContainer.
-            ports = allocateNodePorts(this.portAllocator, { ...reusedNodePorts(dropped), p2p: config.libp2pPort });
-            const result = this.launchChild({
-                containerId: OWNER_CONTAINER_ID,
-                partyId: config.partyId,
-                profile,
-                ports,
-                owner: true,
-                buildConfig: (workdir) => this.buildOwnerChildConfig(config, profile, workdir, push),
-                extraArgs: ['--owner', '--admin-port', String(ports.admin), '--identity-file', config.identityPath],
-            });
-            const handle = this.handles.get(result.dockerId);
-            return toNodeInfo(handle);
+            return this.announceAddrs(containerId, ports);
         }
         catch (err) {
-            // Release before restoring — see the same note in createContainer.
-            if (ports)
-                this.releasePorts(ports);
-            this.restoreDroppedHandles(dropped);
-            // Deliberately NOT `discardWorkdir` — the asymmetry with createContainer
-            // is the point. `<rootDir>/owner` is a single fixed path reused by every
-            // restart and holds the host's own control-DB storage, so it neither
-            // grows without bound nor is safe to delete on a failed spawn.
-            throw err;
-        }
-    }
-    /** Endpoint + bearer for the owner node's admin channel, if spawned. */
-    getOwnerAdminEndpoint() {
-        const handle = this.findOwnerHandle();
-        if (!handle)
-            return undefined;
-        return {
-            baseUrl: `http://127.0.0.1:${handle.ports.admin}`,
-            token: handle.startupToken,
-        };
-    }
-    /** Whether spawn parameters for the owner node are known (persisted). */
-    hasOwnerConfig() {
-        return this.ownerConfig !== undefined;
-    }
-    /** Whether the given friendly/docker id refers to the owner node. */
-    isOwnerNode(idOrDockerId) {
-        if (idOrDockerId === OWNER_CONTAINER_ID)
-            return true;
-        const direct = this.handles.get(idOrDockerId);
-        if (direct?.owner)
-            return true;
-        for (const h of this.handles.values()) {
-            if (h.owner && h.containerId === idOrDockerId)
-                return true;
+            log('announce hook failed for %s; it starts with no public addresses: %s', containerId, err.message);
+            return [];
         }
-        return false;
-    }
-    /** Stop the owner node (if running). Used on graceful shutdown. */
-    async stopOwnerNode() {
-        const handle = this.findOwnerHandle();
-        if (handle && isPidAlive(handle.pid)) {
-            await this.stopContainer(handle.dockerId);
-        }
-    }
-    /** Stop the owner node (if running), then re-spawn it from saved config. */
-    async restartOwnerNode() {
-        const handle = this.findOwnerHandle();
-        if (handle && isPidAlive(handle.pid)) {
-            await this.stopContainer(handle.dockerId);
-        }
-        return this.ensureOwnerNode();
     }
     /**
-     * Core spawn mechanics shared by `createContainer` and `ensureOwnerNode`.
+     * Core spawn mechanics behind `createContainer`.
      *
      * The caller has already allocated `ports` and **owns their lifetime**: this
-     * method never releases them, so every caller must release on any throw out
+     * method never releases them, so the caller must release on any throw out
      * of here (it has to unwind its handle drop on the same path anyway — see
      * `restoreDroppedHandles`).
      *
@@ -506,12 +410,6 @@ export class HostProcessOrchestrator {
         mkdirSync(workdir, { recursive: true });
         mkdirSync(join(workdir, 'storage'), { recursive: true });
         const token = randomBytes(16).toString('hex');
-        // Per-container secret gating the node's `POST /seed` route. The node
-        // refuses seed delivery unless the caller presents this as a bearer token
-        // (and unregisters the route entirely when the env var is empty), so we
-        // mint a fresh high-entropy value per child and hand it back on the result
-        // for `ContainerService.applySeed` to send.
-        const seedToken = randomBytes(32).toString('base64url');
         const tokenPath = join(workdir, STARTUP_TOKEN_FILE);
         // Ensure stale token from a previous container with the same id is cleared.
         if (existsSync(tokenPath)) {
@@ -525,32 +423,29 @@ export class HostProcessOrchestrator {
         const memoryLimit = opts.memoryLimit ?? this.defaultMemoryLimit;
         const heapBytes = parseMemoryLimit(memoryLimit);
         const heapMB = heapBytes !== undefined ? Math.max(64, Math.floor(heapBytes / (1024 * 1024))) : undefined;
+        const announcedAddrs = this.announceAddrsFor(containerId, ports);
         const env = {
             // Scrubbed, not raw process.env: every CADRE_* config-override key is
             // stripped so a var set on the manager can't silently reconfigure every
             // child (see scrubbedParentEnv). Caller-supplied extras come next — the
             // fixed per-child vars below always win so extraEnv can never clobber
-            // the seed/startup tokens or port wiring.
+            // the startup token or port wiring.
             ...scrubbedParentEnv(),
             ...opts.extraEnv,
             CADRE_STARTUP_TOKEN: token,
             CADRE_HEALTH_PORT: String(ports.health),
             CADRE_METRICS_PORT: String(ports.metrics),
             CADRE_LISTEN_ADDRS: childListenAddrs(ports).join(','),
-            // NOTE: the scrub above drops every CADRE_* var and `extraEnv` is built only from
-            // pinnedOwnerKeys, so a managed child advertises only the ports assigned to it here
-            // — `CADRE_ANNOUNCE_ADDRS`/`CADRE_APPEND_ANNOUNCE_ADDRS` cannot reach it. Fine while
-            // children are reached at those ports; if a host is ever fronted by a proxy or DNS
-            // name, plumb an announce var through from host config. The TCP
-            // and WebSocket ports are the CHILD'S CONTROL NODE's alone: each strand node the
-            // child runs binds the same two entries with OS-assigned ports instead, since one
-            // port cannot be held twice (`cadre-core/src/strand-network-config.ts`). A NAT
-            // forward (the owner node's, via `NatService`) covers the TCP port only, so it
-            // reaches the control node over TCP alone; a phone outside the LAN, which needs the
-            // WebSocket port, and every strand node are reached through observed addresses only,
-            // since no `CADRE_RELAY_ADDRS` is set here and a child therefore holds no relay
-            // reservation.
-            CADRE_SEED_TOKEN: seedToken,
+            // The append form, not `CADRE_ANNOUNCE_ADDRS`: that one replaces the advertised
+            // set and would drop the LAN addresses a phone at home dials. Every entry must be
+            // a valid multiaddr: cadre-core refuses to start on one that is not.
+            // The TCP and WebSocket ports are the CHILD'S CONTROL NODE's alone: each strand
+            // node the child runs binds the same two entries with OS-assigned ports instead,
+            // since one port cannot be held twice, and inherits neither announce field
+            // (`cadre-core/src/strand-network-config.ts`). Those ports are not mapped, and
+            // strand nodes are reached through observed addresses only, since no
+            // `CADRE_RELAY_ADDRS` is set here and a child therefore holds no relay reservation.
+            ...(announcedAddrs.length > 0 ? { CADRE_APPEND_ANNOUNCE_ADDRS: announcedAddrs.join(',') } : {}),
             // Pin each child's node-local state (trusted-owner anchor, retained
             // cold-start dial targets) to its OWN workdir. This is the same value the
             // cli would derive by default (the config file lives here too), but stated
@@ -612,7 +507,7 @@ export class HostProcessOrchestrator {
             spawnedAt: new Date().toISOString(),
             partyId: opts.partyId,
             profile: opts.profile,
-            ...(opts.owner ? { owner: true } : {}),
+            announcedAddrs,
             child,
             alive: true,
         };
@@ -644,23 +539,20 @@ export class HostProcessOrchestrator {
             dockerId,
             healthEndpoint: `http://localhost:${ports.health}/health`,
             metricsEndpoint: `http://localhost:${ports.metrics}/metrics`,
-            // The node's seed API (`POST /seed`) is bound to the same server/port as `/health`.
-            seedEndpoint: `http://localhost:${ports.health}/seed`,
-            seedToken,
             p2pPort: ports.p2p,
         };
     }
     /**
      * Refuse to re-spawn `containerId` while a previous child of it may still be
-     * running. Both spawn paths call this as their last `await` before the handle
+     * running. `createContainer` calls this as its last `await` before the handle
      * drop, so a refusal happens while nothing has been released, no token rotated
      * and no child launched — the caller sees an ordinary failed spawn.
      *
      * Why it exists: the drop hands the old handle's ports back and the launch takes
      * those same ports (`reusedNodePorts`), so a child started over a live one dies
-     * on a port clash — but only after `launchChild` has returned success with a
-     * fresh seed token. The caller then records a dead child, and the live one
-     * refuses the new token.
+     * on a port clash — but only after `launchChild` has returned success. The
+     * caller then records a dead child, and the live one keeps running with no
+     * handle naming it.
      *
      * - A handle this process spawned is checked exactly ({@link isHandleLive}); a
      *   live one refuses outright.
@@ -670,9 +562,6 @@ export class HostProcessOrchestrator {
      *   is already bound, refuse. The pid is never killed on that evidence — it may
      *   not be ours.
      *
-     * `overrides` are the ports the caller will override on top of the reused ones
-     * (the owner node's configured p2p port); `owner` adds the admin channel.
-     *
      * NOTE: the probe cannot see a re-attached child still loading its modules —
      * `cadre-cli start` writes its token and only then binds, so a child in that
      * window shows neither, and a re-spawn launched then races it for the ports.
@@ -687,14 +576,14 @@ export class HostProcessOrchestrator {
      * child is ever seen dying on its own port right after a host restart, probe by
      * connecting instead of binding.
      */
-    async refuseRespawnOverLiveChild(containerId, overrides, owner) {
+    async refuseRespawnOverLiveChild(containerId) {
         const previous = this.handlesFor(containerId);
         if (previous.some(isHandleLive)) {
             throw new Error(`container ${containerId} is still running`);
         }
         if (!previous.some((h) => isPidAlive(h.pid)))
             return;
-        const bindings = childPortBindings({ ...reusedNodePorts(previous), ...overrides }, owner);
+        const bindings = childPortBindings(reusedNodePorts(previous));
         try {
             await Promise.all(bindings.map(assertPortFree));
         }
@@ -709,9 +598,9 @@ export class HostProcessOrchestrator {
     /**
      * Drop any handle left over from a previous spawn of the same `containerId`
      * and release its ports. Handles are keyed by the per-spawn `dockerId`, so
-     * without this a re-spawn (donated-node respawn) would strand the prior
+     * without this a re-spawn (a hosted node's respawn) would strand the prior
      * handle in the map forever, leaking its ports from a bounded range each
-     * time. Mirrors the same cleanup in `ensureOwnerNode`.
+     * time.
      *
      * DO NOT delete the workdir: the identity key and node-local stores
      * (trusted-owner anchor, retained cold-start dial targets) live there and are
@@ -721,16 +610,16 @@ export class HostProcessOrchestrator {
      * Releasing the ports hands them straight back to the allocator, and the
      * re-spawn then takes those same ports as overrides (`reusedNodePorts`), so a
      * re-spawn while the *previous* child is still listening would bind-clash.
-     * Callers must therefore never drop a live child, and both do so only after
+     * The caller must therefore never drop a live child, and does so only after
      * {@link refuseRespawnOverLiveChild} has passed. A caller that needs to replace
      * a live child must stop it first.
      *
      * **The drop is reversible.** It happens before the launch can fail, so the
-     * dropped handles are returned and every caller restores them via
+     * dropped handles are returned and the caller restores them via
      * {@link restoreDroppedHandles} when the launch throws — otherwise the caller
      * would be left holding a dockerId this orchestrator no longer knows, and the
      * node's workdir could never be reclaimed. On a *successful* spawn the drop
-     * stands: `DonationService.abandonRespawn` depends on the old handle being
+     * stands: `HostedNodeService.abandonRespawn` depends on the old handle being
      * gone by then.
      */
     dropStaleHandle(containerId) {
@@ -749,10 +638,10 @@ export class HostProcessOrchestrator {
      *
      * **Precondition: the drop → launch window is synchronous.** Restoring is
      * sound only because nothing can have taken those ports or run cleanup
-     * against the handle in between — `launchChild` contains no `await` and both
-     * callers resolve push credentials *before* their drop. `launchChild`'s half
+     * against the handle in between — `launchChild` contains no `await` and the
+     * caller resolves push credentials *before* its drop. `launchChild`'s half
      * is enforced: its declared return type is not a Promise, so adding an
-     * `await` there is a compile error. The callers' half is not — an `await`
+     * `await` there is a compile error. The caller's half is not — an `await`
      * slipped between a drop and its launch silently breaks this.
      *
      * No `persist()` here: `state.json` is rewritten only by `launchChild` and
@@ -778,14 +667,6 @@ export class HostProcessOrchestrator {
     workdirFor(containerId) {
         return join(this.rootDir, containerId);
     }
-    /** Locate the owner node's handle, if one has been spawned. */
-    findOwnerHandle() {
-        for (const h of this.handles.values()) {
-            if (h.owner || h.containerId === OWNER_CONTAINER_ID)
-                return h;
-        }
-        return undefined;
-    }
     /**
      * Inverse of {@link releasePorts} — hold a handle's whole port set against
      * the allocator. Used both to rehydrate on `init` and to undo a drop whose
@@ -861,6 +742,11 @@ export class HostProcessOrchestrator {
         this.discardWorkdir(handle.workdir, { maxRetries: 20, retryDelay: 200 });
         this.handles.delete(dockerId);
         this.persist();
+        // Removal is a state change too: `NatService` releases the node's port
+        // mappings on it at once rather than at its next timer pass. A stopped
+        // event for a node no longer in `listNodes()` is how listeners tell a
+        // removal from a stop.
+        this.emitStateChange(handle);
     }
     /**
      * Whether the child `dockerId` names is running — see {@link isHandleLive}. An
@@ -912,7 +798,8 @@ export class HostProcessOrchestrator {
         const cfg = {
             controlNetwork: {
                 partyId: req.partyId,
-                bootstrapNodes: req.bootstrapNodes,
+                // A hosted node is dialed (a claim) or dials the members its invitation names.
+                bootstrapNodes: [],
             },
             profile: req.profile,
             // The request carries the filter as text (the provider hands the same text to
@@ -939,46 +826,10 @@ export class HostProcessOrchestrator {
             cfg.push = push;
         return cfg;
     }
-    /**
-     * Child config for the **host's own personal cadre** owner node — the opt-in
-     * "founder" persona spawned only when `ownCadre.enabled` (see
-     * docs/cadre-host.md § Two roles: donor and founder). It founds/joins the
-     * control network for the host's own `partyId` (no bootstrap peers — it is the
-     * founding node of the host's *own* cadre) and carries the host identity via
-     * `--identity-file` (passed as a spawn arg).
-     *
-     * This is NOT the node cadre-host donates to a requester. Donated nodes are
-     * generic (`createContainer` / `buildChildConfig`): they join the
-     * **requester's** cadre via bootstrap peers and pin the *requester's* owner
-     * key — they never run a host genesis.
-     */
-    buildOwnerChildConfig(cfg, profile, workdir, push) {
-        const config = {
-            controlNetwork: {
-                partyId: cfg.partyId,
-                bootstrapNodes: [],
-            },
-            profile,
-            strandFilter: 'all',
-        };
-        if (profile === 'storage') {
-            config.storage = { type: 'file', path: join(workdir, 'storage') };
-        }
-        // The host-own-cadre owner/storage node participates in strands, so it owns
-        // the push-wake fan-out when credentials are configured. (Donated nodes
-        // belong to foreign cadres and get NO host push block — see the donor path.)
-        // Written into cadre.json (same host trust boundary as the workdir's
-        // control-DB); keys are never logged — only the redacted presence line in
-        // resolvePush.
-        if (push)
-            config.push = push;
-        return config;
-    }
     persist() {
         const state = {
             version: 1,
             handles: [...this.handles.values()].map((h) => this.toPersisted(h)),
-            ...(this.ownerConfig ? { ownerConfig: this.ownerConfig } : {}),
         };
         this.stateStore.save(state);
     }
@@ -1006,7 +857,7 @@ export class HostProcessOrchestrator {
             spawnedAt: h.spawnedAt,
             partyId: h.partyId,
             profile: h.profile,
-            ...(h.owner ? { owner: true } : {}),
+            announcedAddrs: h.announcedAddrs,
         };
     }
 }
@@ -1020,7 +871,7 @@ function toNodeInfo(h) {
         spawnedAt: h.spawnedAt,
         workdir: h.workdir,
         ports: { ...h.ports },
-        ...(h.owner ? { owner: true } : {}),
+        announcedAddrs: [...h.announcedAddrs],
     };
 }
 /**
@@ -1040,8 +891,8 @@ function resolveCadreCliBin() {
 }
 /**
  * Whether the process a handle names is still the child it was launched as — the
- * one liveness rule behind `init`, `isRunning`, `ensureOwnerNode`'s short-circuit
- * and the pre-spawn guard, so they cannot drift apart.
+ * one liveness rule behind `init`, `isRunning` and the pre-spawn guard, so they
+ * cannot drift apart.
  *
  * A handle this process spawned carries its `ChildProcess`, and that answer is
  * exact from the moment of spawn: no exit seen, and the pid still answering. (The